Easy summary: Start with an AI register. Give every use an accountable owner, approved purpose, data limits, human review point, incident route and review date. Higher-impact uses need stronger evidence and oversight.
A minimum viable governance cycle
| Stage | Evidence to keep | Decision |
|---|---|---|
| Discover | AI register including embedded and unapproved tools | Is the use visible and owned? |
| Assess | Purpose, affected people, data, impact and legal-context assessment | Is the use appropriate and proportionate? |
| Consult | Applicable award/agreement clauses, WHS/OHS process and feedback record | Who must be heard before implementation? |
| Control | Access limits, testing, human review, fallback and supplier commitments | What prevents or reduces foreseeable harm? |
| Deploy | Approval, training, notices, operating instructions and baseline measures | Are people ready and informed? |
| Monitor | Performance, incidents, complaints, subgroup outcomes and change log | Should the system continue, change, pause or retire? |
Consultation decision check
Which instrument applies? Identify any award, enterprise agreement, contract, policy and dispute-resolution clause. Do not assume the same process applies to every worker.
Is there a major technology or organisational change? If a definite decision is likely to have significant effects, an applicable award or agreement may require notice, written information, discussion and genuine consideration of views.
Are rosters or ordinary hours changing? Check the specific consultation and consent rules before using AI-generated scheduling.
Can health or safety change? Consult under the WHS/OHS framework that applies. Consider workload, pace, surveillance, role clarity, deskilling, fatigue and psychosocial risks, not only physical hazards.
No specific clause found? Consultation can still be sound governance. Explain the purpose, evidence and limits; give affected people a real opportunity to identify risks and improve controls.
Consultation does not always require consent, but some instruments contain separate consent or process requirements. Check the actual instrument and obtain advice for consequential change.
Deployment gate
- The intended benefit and non-AI alternative are documented.
- The accountable business owner and technical/supplier contacts are named internally.
- Data collection, notice, use, disclosure, retention, access and deletion are understood.
- Accuracy and harmful failure modes have been tested using realistic cases.
- Subgroup and accessibility impacts have been considered.
- A reviewer can obtain context, challenge the output and reverse or pause the process.
- Workers know the rules and can report concerns without unnecessary friction.
- A fallback exists if the AI or supplier becomes unavailable or unsafe.
Review after launch
First 30 days
Watch for unapproved workarounds, confusing instructions, privacy leakage, false confidence and support needs.
By 90 days
Compare benefits, errors, complaints, workload and subgroup outcomes with the approved baseline.
After material change
Reassess when the model, purpose, data, integration, supplier terms or affected population changes.
Sources and currency
Jurisdiction: Australia. Currency: Sources checked 27 October 2026. Legislation and workplace instruments are binding only where they apply. Regulator and government material is guidance unless stated otherwise. Standards and recommended governance practices are not legislation. Victoria uses its OHS framework; other jurisdictions have adopted versions of the model WHS laws with local variations.