It’s 1865 in Britain, the roads are still dominated by horses and carts, and a new kind of machine starts appearing on the streets, noisy, unfamiliar and unpredictable enough to make people nervous. Parliament responds in the way Parliament often responds when it can’t quite decide whether something is progress or a threat, by writing a rule that feels safe on paper and faintly absurd in practice. If you’re going to take one of these powered vehicles onto a public road, you don’t just drive it, you send a person out in front, sixty yards ahead, walking carrying a red flag.
The intention is obvious. People and horses could be hurt. Roads are narrow. The public didn’t consent to this new risk.
But if you’ve ever watched a society try to regulate a new technology before it has fully understood it, you’ll recognise the second-order effect too: when the compliance response becomes heavy, uncertain, or performative, innovation doesn’t stop, it just slows, fragments, or shifts elsewhere. As the downside risks fade away so do the benefits. Sadly as much as many people can parrot the mantra that risk is about both harm and opportunity we stay tragically pinned to the downside.
That’s the frame I keep coming back to when I look at New South Wales putting “digital work systems” squarely on the WHS map.
Because the NSW Bill is, in one sense, completely unremarkable: it simply takes a reality we all already live with, and makes it explicit in law. Algorithms allocate work. Platforms set pace. Dashboards score performance. Monitoring is continuous. Sometimes the system decides who gets the next job, who gets penalised, who gets pushed to the bottom of the queue, and who gets quietly nudged out. Those aren’t “IT features”. They are work design choices, and work design is where WHS either succeeds or fails.
And yet, as soon as you say that out loud, you also have to be honest about what happens next, because regulation has a habit of producing two outcomes at once: it can sharpen accountability, and it can also create a new hazard, the hazard of organisations becoming cautious in the wrong places, freezing in the face of ambiguity, and defaulting to defensive compliance rather than better design. Regulation rarely has no unintended consequences.
So I’d like us to reflect on the pros and cons of this move and it’s worth starting with the objections, not because they’re all pure or well-motivated, but because they are the pressures that will shape how this lands in the real world.
The first objection is structural, and it matters if you run a business across borders: our WHS system is supposed to be principles-based and harmonised, and the moment one jurisdiction starts adding bespoke, tech-specific duties, you can feel the harmonisation story fray a little at the edges. Multi-state employers don’t respond by designing a bespoke system for each state, they respond by designing to the strictest regime, building one big compliance wrapper, and then hoping it doesn’t accidentally smother the practical work of improving safety.
The second objection is more operational, the definition is broad enough to catch the mundane. “Algorithm, AI, automation or online platform” is a phrase that can describe sophisticated workforce optimisation and algorithmic management, but it can also describe a scheduling app, a rostering tool, a performance report, a basic workflow system, the kind of digital plumbing that almost every organisation now relies on. When the net is cast wide, the worst organisational instincts wake up: people start treating everything as high risk, everyone reaches for legal review, and the system slowly drifts toward “tick and flick” because if everything is critical, nothing is.
Then there’s the area where the temperature rises fastest: access, inspection, and right of entry. The Bill expands powers so WHS entry permit holders can require reasonable assistance to access and inspect a digital work system relevant to a suspected WHS contravention, subject to notice and regulator guidelines. If you work in WHS, you can see the safety logic immediately: if the hazard is embedded in a digital rule set, in metrics, in allocation logic, you can’t always “see it” by walking the floor. But if you sit in operations, IT, or governance, you can also see the genuine risks, these systems often contain personal information, commercially sensitive data, vendor intellectual property, cyber controls that can’t be casually bypassed, and third-party platforms with access constraints you don’t control. If “reasonable assistance” isn’t operationalised with tight boundaries, you can accidentally create a new suite of harms while trying to prevent the original ones.
Hovering over all of this is the fraught reality of industrial relations. In a good relationship, this becomes a mechanism for transparency and problem solving. In a strained relationship, it becomes a lever, a contest, a proxy fight. If the regulator guidance is vague, slow, or unevenly applied, you can almost script the disputes in advance: what counts as “relevant”, what counts as “proportionate”, what happens when the system is offshore-hosted SaaS, what happens when the organisation says, quite reasonably, “we can’t expose this dataset without violating privacy”, and what happens when the other side says, equally reasonably, “then how do we verify the risk mechanism is real?”
Add one more layer and you get a basic fairness issue: large organisations can absorb audits, assurance reviews, and specialist capability. Smaller operators often can’t. They rely on vendor defaults, and they don’t have the leverage to demand transparency or redesign. So the compliance burden lands unevenly, and perversely the places with the least capability may be the most exposed.
That’s the case against, and none of it should be dismissed as mere politics.
The reform exists for a reason, and that reason is not hard to understand.
Because digital systems now do what managers and supervisors used to do in plain view. They set the pace of work, they shape workload and they create incentives. They measure and rank, they monitor relentlessly, and they make decisions that feel objective because they are numerical, even when they are anything but. The WHS risks created by those choices are not hypothetical. You can see them in fatigue. You can see them in stress. You can see them in reduced autonomy and constant surveillance. You can see them in job insecurity created by systems that make people feel they are always one metric away from being replaced. These risks are hidden inside a scoring model that was never designed to be fair, only efficient.
In principle, psychosocial hazards have always been within WHS. In practice, they are too often treated as culture problems, resilience problems, or HR problems, rather than as what they usually are: work design problems.
The best part of this Bill, conceptually at least, is that it removes the “the system made me do it” excuse. It says, plainly, that work allocation is still work allocation, and the duty to ensure health and safety so far as reasonably practicable does not evaporate because the tool is automated. That matters inside organisations because it gives WHS and HR permission to have the conversation that too often gets deferred. Procurement, operations, and IT are not separate worlds and in many businesses these functions have disconnected from the risks they introduce.. If the system changes how work is done, it changes risk, and risk governance has to follow.
It also helps that the Bill hard-wires four prompts that are, in practice, the most common failure modes of algorithmic management:
- excessive workloads,
- excessive performance metrics,
- excessive monitoring and surveillance,
- unlawful discriminatory practices and decision-making.
They make it harder for a PCBU to claim ignorance when the system is obviously driving pace, constant ranking, intrusive monitoring, or unfair allocation outcomes.
And then there’s the controversial part again, but with the safety logic stated plainly: verification. If the hazard is embedded in digital rules and metrics, you can never identify it by looking at a procedure or doing a walk-around. The mechanism of harm might be in a threshold, a target, a nudging rule, a penalty, a scoring weight. If we want WHS to be evidence-based rather than narrative-based, we have to be willing to inspect the places where the evidence lives, and increasingly, the evidence lives inside systems.
So what does the Bill actually do, in practical terms, once you strip away the noise?
It defines “digital work system” broadly as an algorithm, AI, automation or online platform. It adds an express limb to the primary duty of care so PCBUs must ensure workers’ health and safety is not put at risk from the use of digital work systems. It creates a specific duty focused on allocation of work by digital work systems, with those four risk prompts baked in. And it expands entry permit holder powers so they can require reasonable assistance to access and inspect a digital work system relevant to a suspected WHS contravention, with constraints including notice, regulator guidelines developed with consultation, phased application until guidelines exist for classes of workplaces, and review clauses.
Now, here’s the part that matters most, and it’s where I think this lives or dies.
This Bill will help if it drives better work design and better controls. It will fail if it becomes a proxy war about access.
Because the uncomfortable truth is that risks arising from a “digital work system” are unlikely to be fixed by a Union Delegate requesting that one or two parameters in an algorithm be tuned up or down. The fix requires design governance, by setting a raft of safe operating parameters, and by verifying the output of the system than trusting its intent.
If we want this to work in practice, we need to build guardrails around the system, and then we need to treat those rails as critical controls, which means they are designed, enacted, verified, and monitored.
The guard rails look like workload limits that are explicit and enforceable including pace, volumes, time windows, fatigue triggers, minimum breaks, shift density constraints and escalation rules when demand spikes. They look like metric governance that is mature enough to admit that what we measure becomes what people chase, and what people chase becomes what they trade off. We must define caps, no-go incentives, and rules that prevent proxy punishments for basic human needs. We should design surveillance minimisation, which sounds soft until you treat it as a control and collect only what is necessary. Surveillance must be transparent, have limits on who can access it, limit retention and be absolutely proportionate to the risk we are trying to manage. We need appeals pathways so a worker can challenge outcomes driven by a system that is, inevitably fallible and while a marvel of technology not cognisant of the fully messy reality of the human experience. Finally these guard rails include human override that is real, not symbolic: a clear escalation path when the system drives unsafe outcomes, and managers who are empowered to intervene without fear of missing a target.
If we build those rails well the right-of-entry provisions become less scary because we know what is under the hood. We can evidence what we’ve done. We can show your boundaries. We can say, “Here’s how the system works, here are the controls, here is what we verify, here is how we manage privacy, here is how we manage cyber security,” and suddenly the conversation shifts away from suspicion and toward assurance.
So if you’re a PCBU looking at this and wondering what to do, my advice is start with capability.
Inventory the digital systems that allocate, pace, rank or monitor work, including vendor tools and the shadow platforms teams adopt. Run a WHS risk assessment focused on work allocation impacts, not abstract “AI ethics”. Set guard rails with clear limits and escalation triggers. Document the decision chain in a way directors would recognise as due diligence: designed, enacted, verified, monitored. Prepare for access and inspection in a controlled way, which means an inspection mode that protects privacy and cyber security: screen share or sandbox, redaction protocols, nominated technical and WHS contacts, and a data handling approach aligned to regulator guidance as it emerges. And then train leaders for governance because if frontline managers can’t explain how the system sets pace and measures performance, you don’t have a training gap, you have a governance gap.
If we get that right, we land in a better place than the red flag era, because we don’t slow the future down out of fear, and we don’t let the future run ahead of us unchecked either. We build work design capability that keeps pace with the systems shaping work. In the end we have great technology that delivers the productivity, service and quality benefits with fewer reports of excessive pace, fatigue, and intrusive monitoring; fewer psychosocial incidents and claims linked to workload intensification.
In WHS the only thing that really counts is whether harm is prevented in the real world, and increasingly, the real world of work is being organised by code.
