Safety, Regulatory and Audit Compliance with AI

I have spent more than two decades close to the parts of an operation that most people never see and never want to: the permit-to-work desk, the incident register, the audit binder, the folder of statutory certificates that must be current or the site cannot legally run. Safety, permits and compliance are my real domain, and they are not glamorous. They are the discipline that keeps people alive and keeps an organisation on the right side of the law. That is exactly why I am cautious, and measured, when someone tells me artificial intelligence is going to revolutionise compliance. AI can help enormously with compliance. It cannot own compliance. The distinction runs through everything that follows, and if you take only one idea away from this guide, make it that one.

The message up front: AI is very good at the parts of compliance that are about volume, consistency and recall, reading documents, cross-checking rules, assembling evidence, watching for drift. It is not, and must never be treated as, the thing that carries legal and moral accountability for a decision. A permit is authorised by a person. A risk is accepted by a person. An audit is signed by a person. AI can make every one of those people faster, better prepared and less likely to miss something. It cannot stand in their place.

1. What compliance really demands

Before you can judge where AI helps, you have to be honest about what compliance actually is. Strip away the software and the acronyms and compliance rests on three demands, and every one of them matters when you decide what to automate.

The first demand is evidence. Compliance is not a feeling that things are being done properly. It is the ability to prove it, with records, on demand, to someone who does not trust you by default. An auditor, a regulator, an insurer, a court after an incident. If you cannot produce the permit that authorised the work, the risk assessment that preceded it, the competency record of the person who did it and the certificate that confirmed the equipment was fit, then in the eyes of a regulator the control did not exist, regardless of what actually happened on the ground. Compliance is an evidence discipline first and a safety discipline second, which sounds cynical until you have watched a well-run site struggle in an audit purely because its records were scattered.

The second demand is consistency. A control that is applied rigorously on Monday and skipped on Friday because the crew was busy is not a control, it is a hope. Regulators and standards bodies care deeply about whether a process is applied the same way every time, by every person, on every shift. Human beings are naturally inconsistent, especially under time pressure and fatigue, and a great deal of real-world non-compliance is not deliberate. It is the same competent people cutting the same small corners when nobody is watching and nothing has gone wrong yet.

The third demand, and the one that changes everything about AI, is accountability. Compliance ultimately answers the question: who is responsible if this goes wrong? Every serious safety and regulatory framework is built around named, competent, accountable people. The permit issuer. The area authority. The responsible engineer. The duty holder. When an incident happens, an investigation traces the chain of decisions back to the humans who made them and asks whether they discharged their duty. That chain must terminate in a person. A machine cannot be a duty holder. It cannot be interviewed, disciplined, retrained or held to account. This is not a technology limitation that will be solved in a later version. It is the point of the whole edifice.

Hold those three demands in mind, evidence, consistency and accountability, because they are the lens for everything else. AI is astonishingly good at the first two. It is structurally incapable of the third, and pretending otherwise is where compliance-by-AI goes badly wrong.

2. Where AI genuinely helps with compliance (and where it must not)

Let me be concrete about the split, because vague enthusiasm helps nobody. There is a clean line between the work AI should do and the work it must never do, and the line falls exactly where accountability begins.

On the helpful side sits everything that is about handling information at scale. Reading a two-hundred-page standard and finding the clauses relevant to a specific task. Comparing a submitted method statement against a checklist of required controls. Cross-referencing a permit request against the certificates, isolations and conflicting works that ought to be checked. Watching a stream of sensor and work-order data for the early signature of a control drifting out of tolerance. Assembling, in minutes, the folder of evidence an auditor will ask for. Drafting the first version of a risk assessment from a library of known hazards for a familiar task. Flagging that a statutory inspection is coming due, or worse, has quietly lapsed. Every one of these is repetitive, high-volume, recall-intensive work where humans are slow, expensive and error-prone through boredom, and AI is fast, consistent and tireless. This is the drudgery, and giving it to a machine is a genuine gift to the people doing safety-critical work.

On the other side sits everything that is about accepting responsibility for a judgement. Authorising a permit to work on live or hazardous plant. Accepting a residual risk as tolerable. Declaring that an isolation is proven and it is safe to break into a system. Signing an audit finding as closed. Certifying that an installation meets a regulatory standard. Deciding that an incident does not need to be reported. These are not information-handling tasks. They are acts of accountable judgement by a competent, named person who is prepared to answer for them. AI can and should inform every one of these decisions. It must not make any of them, and no serious safety framework will let it.

The caution that matters most: the danger is not that AI gives wrong answers. It is that AI gives fluent, confident, plausible answers that a tired human rubber-stamps because the machine sounded sure. Automation complacency is a documented safety hazard in aviation, medicine and process industries, and compliance is exactly the kind of high-volume, low-drama work where it takes hold. If AI makes the permit approval so smooth that the issuer stops actually reading, you have not improved safety. You have removed the human check while keeping the human signature, which is the worst of both worlds.

The design principle I hold to is simple. Use AI to make sure the accountable human has everything they need, has had their attention drawn to what matters, and cannot easily miss a red flag. Then require that human to actually decide. AI prepares the case. The person still delivers the verdict. Keep that boundary clear and AI is one of the best things to happen to compliance in years. Blur it and you have automated your way into a liability.

3. Permit-to-work validation and checks

Permit-to-work is the sharpest example in the whole field, because it is where compliance and life safety meet directly, and it is the area I know best. A permit to work is a formal, documented authorisation that a specific hazardous task may proceed, under specific controls, for a specific time, in a specific place, after specific hazards have been isolated and verified. Hot work, confined space entry, working at height, breaking containment, electrical work on or near live systems. Get a permit wrong and people die. This is not a domain for casual automation, and I want to be precise about where AI belongs.

AI is genuinely valuable in the validation and checking layer of a permit, the part that asks whether the request is complete, consistent and free of obvious conflicts. A well-built assistant can, the moment a permit request is raised, check that every mandatory field is populated, that the required risk assessment and method statement are attached, that the personnel named hold current competencies for the task, that the equipment isolations listed actually correspond to the system being worked on, and, critically, that there is no conflicting permit already live in the same area. That last check, simultaneous operations conflict, is a classic cause of serious incidents, and it is exactly the kind of cross-referencing across many live records that a human permit issuer can miss under pressure and a machine will never tire of doing.

AI can also flag the patterns that experienced permit officers watch for and busy ones overlook. A permit being raised for confined space entry with no atmospheric testing recorded. A hot work permit in an area with a flammable inventory and no fire watch assigned. A permit whose validity window overlaps a shift change with no re-authorisation. These are rule-based and pattern-based checks, and surfacing them to the issuer before they authorise is unambiguously good.

The line that never moves: AI validates the permit. A competent, authorised person issues it. The physical verification that an isolation is proven, that the atmosphere is safe, that the fire watch is in place, is done by trained people at the worksite, and the authorisation to proceed is a human signature by someone who is accountable if it is wrong. AI can refuse to let an incomplete or conflicting permit reach the issuer. It cannot be the issuer. On a permit desk, that boundary is not a preference, it is the difference between a control and a fatality.

The practical payoff is real all the same. A permit system where AI has already confirmed completeness, competency and conflict-freedom lets the human issuer spend their limited attention on the judgement that actually needs a human: is this task, under these controls, in these conditions, genuinely safe to authorise right now? That is the decision they are trained and paid to make, and freeing them from the clerical checking so they can focus on it makes permits both faster and safer. That is the right use of AI in the highest-stakes compliance process there is.

4. Risk assessment support

Risk assessment is the analytical heart of safety compliance, and it is another place where AI helps a great deal while the accountable judgement stays firmly human. A risk assessment identifies the hazards of a task or an asset, evaluates the likelihood and severity of harm, and specifies the controls that reduce the risk to a level that a competent, accountable person is prepared to accept. The last clause is the one that matters: risk assessment ends in an act of acceptance by a person.

Where AI earns its place is in the drafting and completeness of the assessment. For a familiar task, replacing a pump, entering a tank, working on a distribution board, the hazards are largely known and repeat across jobs. An AI assistant drawing on a well-maintained library of hazards, controls and past assessments can produce a strong first draft in seconds, populated with the hazards this task type usually carries and the controls that usually apply. That is a genuine gift to a supervisor who would otherwise start from a blank template or, more honestly, copy last week's assessment and change the date. AI can also check an existing assessment for completeness, comparing it against similar tasks and flagging a hazard that appears to be missing, or a control that is named but has no verification step.

AI can bring consistency to risk scoring too, applying the organisation's risk matrix uniformly rather than leaving likelihood and severity to the mood and experience of whoever happens to fill in the form. It can surface the history a human would not have time to review: has this task caused incidents or near-misses before, and if so, do the current controls address what actually went wrong last time? That connection between the risk assessment and the incident record is one AI makes effortlessly and humans rarely make at all.

But the assessment of whether a residual risk is acceptable is a human judgement that carries accountability, and it must stay that way. Deciding that a control is adequate, that a residual risk is tolerable, that the balance of a specific job on a specific day is safe to proceed, requires context, competence and the willingness to be answerable for the decision. A machine can tell you that the residual risk score is "medium." Only an accountable person can decide that "medium" is acceptable here, now, for these people, given everything the score does not capture. AI drafts and checks the assessment. The competent person owns the acceptance. That division keeps risk assessment both faster and honest.

5. Safety audits and inspections

Audits and inspections are where compliance gets tested, and they are a target-rich environment for AI precisely because so much of the work is systematic, repetitive and evidence-driven. A safety audit checks whether the controls that are supposed to be in place actually are, whether the records that are supposed to exist actually do, and whether the practices on the ground match the practices on paper. Inspections do the same at the level of individual equipment and workplaces.

AI accelerates the preparation and the paperwork around audits enormously. It can assemble the evidence pack for an audit scope in minutes rather than the days a coordinator normally spends chasing documents across systems and inboxes. It can pre-screen a body of records against the audit checklist and flag the obvious gaps before the auditor arrives, a certificate that expired, a training record that is missing, a corrective action from the last audit that was never closed. It can read through inspection reports and free-text findings at volume and cluster them into themes, so that a pattern spread thinly across fifty reports, the same defect recurring on the same equipment type, becomes visible when no single report made it obvious. That thematic analysis of unstructured findings is something AI does well and humans, working one report at a time, structurally cannot.

For inspections in the field, image analysis has real and growing value: photographs of equipment, worksites and installations can be screened for visible defects, missing guarding, corrosion, blocked access, incorrect labelling, giving an inspector a prioritised set of things to verify rather than an undifferentiated pile of images. This is decision support, not decision-making, and used that way it makes an inspector faster and less likely to miss the routine defect while concentrating on the difficult one.

What AI does not do is sign the audit. The auditor's professional judgement, that a control is genuinely effective and not just documented, that a finding is closed in substance and not just on paper, that the site is or is not compliant, is the whole value of the audit and it belongs to a competent, independent, accountable person. An audit whose conclusions were generated by an algorithm and rubber-stamped by a human is worth nothing to a regulator and worse than nothing after an incident, because it created a false record of assurance. AI makes the auditor's job faster and their evidence base wider. The verdict stays theirs. For the outcome measures that turn audit findings into managed performance rather than a filing exercise, the FM KPI framework pillar is a useful companion.

6. ISO and standards compliance

Formal management-system standards are a large part of what compliance means in a mature organisation, and they are well suited to AI support because they are, by design, structured, documented and repetitive. I will talk about them at a general level, because the value of AI here is broad and does not depend on any specific clause number, and I would rather be accurate than impressively specific.

Take ISO 45001, the international standard for occupational health and safety management systems, and ISO 55000, the family of standards for asset management. Both, like the wider family of management-system standards, are built on a common logic: define your context and obligations, establish policy and objectives, plan and implement controls, check performance, and act to improve. Both require extensive documented information, records that prove the system is not just designed but operating. That documentation burden, keeping procedures current, evidencing that controls were applied, showing that corrective actions closed the loop, tracing objectives through to measured results, is precisely the kind of high-volume, consistency-demanding work where AI is strong.

In practice AI helps with standards compliance in several concrete ways. It can map an organisation's existing procedures and records against the requirements of a standard and highlight where documented information appears to be missing or stale, which is most of the pain in preparing for a certification audit. It can keep a live view of whether the evidence a standard expects, competency records, management review minutes, internal audit results, corrective action closure, is actually present and current, rather than discovering the gaps the week before the certification body visits. It can help maintain the consistency between documents that standards auditors probe for, checking that a procedure, a work instruction and a training record actually agree with one another rather than drifting apart over years of piecemeal edits.

What AI does not do is make the organisation compliant with the standard. Conformance to ISO 45001 or ISO 55000 is a judgement made by accredited, competent auditors and, before them, by the organisation's own accountable managers who own the management system. The standard is about real controls operating in a real organisation, applied and owned by real people, and its whole purpose is to establish that named leadership takes responsibility for safety and for assets. AI can carry a great deal of the documentation and gap-checking load, and it should, because that load is exactly the drudgery that keeps competent people from the higher-value work. It cannot be the management system, and it cannot be the accountable leadership the standard exists to hold to account. For the governance frame that keeps AI itself inside the boundaries these standards imply, see the AI governance for enterprise operators pillar.

7. Government and regulatory reporting

Regulatory reporting is one of the least loved and most unavoidable duties in any operation, and it is a strong candidate for AI assistance because it is high-volume, deadline-driven, format-strict and repetitive. Depending on the sector and jurisdiction, an operation may owe regular returns to environmental regulators, safety authorities, utilities regulators, civil defence bodies and municipal or federal agencies, each with its own template, its own data requirements, its own cadence and its own penalties for late or inaccurate submission. In the region where I work, as in most, the volume and precision of required reporting has only grown over the years.

AI helps here in ways that are practical and low-drama. It can pull the required data from the systems where it already lives, maintenance records, monitoring data, incident logs, into the shape a specific regulatory return demands, saving the coordinator the tedious and error-prone job of manual re-keying across formats. It can check a draft submission for internal consistency and for obvious anomalies, a figure that jumped tenfold from last period, a mandatory field left blank, a total that does not reconcile with its components, before it goes out rather than after the regulator queries it. It can track the calendar of what is due to whom and when, and raise the alarm early, so that a deadline is never missed through simple oversight, which is a surprisingly common cause of regulatory trouble.

It can also keep an organised, retrievable record of what was reported, when, and on what basis, which matters more than it sounds. When a regulator comes back six months later with a question about a past submission, being able to reconstruct exactly what was sent and where every number came from is the difference between a five-minute answer and a week of anxious archaeology.

The boundary is the same as everywhere else, and in regulatory reporting it has teeth. A regulatory submission is a formal declaration made by the organisation, and usually by a named responsible person, that the information is true and complete. That declaration carries legal weight and, in many jurisdictions, personal liability. AI can assemble the return, check it and flag the anomalies, but a competent, accountable person must review it, understand it and take responsibility for its accuracy before it is submitted. Submitting a regulatory return that an algorithm generated and nobody genuinely checked is not efficiency, it is a false declaration waiting to be discovered. AI prepares the report. A person owns the submission.

8. Audit preparation and evidence assembly

If there is one place where AI feels almost purpose-built for compliance work, it is audit preparation, because so much of that work is the pure logistics of evidence: knowing what will be asked for, finding it, checking it is current and complete, and presenting it coherently. Anyone who has run an audit response knows that the substance of compliance is often fine and it is the assembly of proof that consumes the days, the frantic search across shared drives, email threads, filing systems and people's memories for the certificate, the record, the sign-off that proves a control was in place.

AI collapses that assembly problem. Given an audit scope, it can identify the evidence each requirement calls for, locate the corresponding records across the systems where they live, check them for currency and completeness, and flag what is missing while there is still time to fix it rather than during the audit itself. That shift, discovering the gap a week early instead of in front of the auditor, is worth a great deal, because a gap found early is a document to be produced and a gap found live is a finding on the report.

It can also improve the quality of the evidence trail continuously rather than in a panic before each audit. If the discipline of linking each control to its evidence is maintained as work happens, the permit to the risk assessment to the competency record to the closure, then the audit pack is essentially always ready and preparation stops being an event. AI is very good at maintaining those links quietly in the background, catching the work order that closed with no completion evidence, the certificate that will expire before the next audit, the corrective action that has drifted past its due date. This is the same closed-loop, evidence-into-the-system-of-record discipline that separates programs that work from programs that merely generate dashboards, a theme I return to in the predictive maintenance pillar.

The honest limit is worth stating even here, in the friendliest possible use case. AI assembles the evidence, but a competent person still has to look at what was assembled and confirm it genuinely proves what it claims to prove. A certificate that is present but for the wrong asset, a training record that is current but for a different competency, a sign-off that exists but was given by someone without the authority, these are the traps that a fluent, confident assembly can paper over. AI finds the documents. A human still has to read them and vouch that they are the right ones. Get that human check right and audit preparation goes from a recurring ordeal to a routine, which is exactly the kind of drudgery-removal that AI should be doing.

9. Continuous, automatic compliance monitoring

The most transformative shift AI brings to compliance is not to any single task but to the timing of the whole thing. Traditional compliance is periodic. You check at the audit, at the inspection, at the reporting deadline, and between those points you largely hope. Continuous compliance monitoring inverts that: instead of discovering at the annual audit that a control has been slipping for eleven months, you are told the day it starts to drift. This is where AI moves compliance from a backward-looking, evidence-gathering exercise to a forward-looking, early-warning one, and it is genuinely valuable.

In practice, continuous monitoring means AI watching the streams of operational data that already exist and comparing them against the rules compliance requires, all the time, without getting bored. It can watch statutory inspection due-dates across a large asset base and raise the alarm before, not after, a certificate lapses. It can watch permit data for patterns that suggest the permit system is being worked around, a rise in retrospective permits, tasks starting before authorisation, permits routinely extended rather than reissued. It can watch environmental and process data against regulatory limits and flag an approach to a threshold as a leading indicator rather than reporting a breach after the fact. It can watch corrective actions against their due dates and escalate the ones that are quietly aging past resolution. None of this is exotic analytics. It is tireless, consistent rule-checking at a scale and frequency no human team could sustain, and consistency, remember, was one of the three demands compliance makes.

Why this is the real prize: most serious compliance failures are not sudden. They are slow drifts that nobody noticed, a control gradually eroding, a small corner cut that becomes standard practice, a certificate that lapsed and everyone assumed someone else was watching. Continuous monitoring catches the drift while it is still small and cheap to correct, before it becomes the incident and the investigation. Turning compliance from an annual reckoning into a continuous conversation is the single most useful thing AI does in this field.

The caution is that continuous monitoring produces alerts, and alerts without a human system to act on them are just a new form of noise. The failure mode is a wall of compliance dashboards that everyone learns to ignore, the same way over-tuned alarms get acknowledged and dismissed. Monitoring only works if each meaningful alert reaches an accountable person who is expected to act and whose action is tracked to closure. The machine watches and warns. A person decides what the warning means and does something about it. Continuous monitoring makes that person far more effective. It does not replace them, and a monitoring program that assumes it will is one that has confused seeing a problem with solving it.

10. The accountability line: why a human always signs

Everything in this guide returns to one line, and it is worth stating plainly and defending, because it is the difference between AI as a superb compliance tool and AI as a liability dressed up as progress. Accountability in safety and compliance is, and must remain, human. A human always signs.

There are three reasons this is not negotiable, and none of them is nostalgia. The first is legal. Safety and regulatory frameworks assign duties to persons and organisations, not to software. When something goes wrong, the law looks for a duty holder, a competent person who was responsible and can be held to account. A regulator cannot prosecute a model. An investigation cannot interview an algorithm about why it approved a permit. The entire enforcement structure of safety law assumes a human at the point of decision, and no deployment of AI changes that assumption. If you let AI make the accountable decision, you have not removed the accountability, you have only orphaned it, and it will land on whichever human is nearest when it fails.

The second reason is moral. Safety decisions are decisions about whether it is acceptable to expose people to risk. That is a moral act, and moral accountability requires an agent who understands the stakes, who has something at risk in the decision, and who can be answerable for it afterward. A person authorising a confined-space entry is putting their name to the proposition that they believe it is safe for a colleague to go in. That act of standing behind a decision, with all the weight it carries, is not something a machine can do, because a machine has nothing at stake and cannot bear responsibility. Removing the human from that moment does not just remove a check, it removes the moral seriousness that makes people careful.

The third reason is practical, and it is the one that convinces even the pure pragmatists. AI, for all its strengths, produces confident output that is sometimes wrong in ways that are not obvious. It reflects the data it was built on, which may be incomplete or biased. It does not understand context it was not given. It cannot tell you what it does not know. In high-consequence decisions, you need a competent human specifically to catch the cases where the machine is fluently, plausibly wrong, and to bring the situational judgement the machine lacks. Take that human out and you have removed the one safeguard that exists precisely for the failure modes AI is prone to.

So the operating model is settled, and it is not a compromise, it is the correct design. AI does the reading, the checking, the cross-referencing, the assembling, the watching. It makes the accountable human faster, better informed and much harder to catch out. Then that human, a competent, named, answerable person, makes the decision and signs. The signature is not a formality left over from a paper era. It is the point where accountability attaches, and it must attach to a person. Any compliance system that quietly lets the machine sign has not advanced compliance. It has hollowed it out and hidden the fact. For the deeper treatment of how to keep AI inside these boundaries as it spreads across an operation, the AI governance for enterprise operators pillar goes further, and the practical assistant patterns in the enterprise knowledge assistant pillar and the intelligent maintenance recommendations pillar show what "AI informs, human decides" looks like in day-to-day work.

Final thoughts

Compliance is not paperwork for its own sake, even though it can feel that way from the inside. It is the discipline through which an operation proves it is safe and lawful, to the people who work there, to the regulators who oversee it, and to itself. That discipline rests on evidence, consistency and accountability, and AI transforms the first two while it must never touch the third. Used with that boundary clear, AI takes the crushing volume of reading, checking, assembling and watching off the shoulders of the competent people who run safety, and lets them spend their scarce judgement where judgement actually matters. That is not a small thing. In permits, in risk assessment, in audits, in reporting, the drudgery is real and heavy, and lifting it is a genuine improvement in both efficiency and safety.

But the moment anyone suggests that AI can own the compliance decision, authorise the permit, accept the risk, sign the audit, declare the return, be firm and be clear. It cannot, it should not, and every serious safety framework is built to prevent it. Accountability stays human because the law requires it, morality demands it, and practical safety depends on it. The right question is never whether AI can replace the accountable person. It is how well AI can serve that person, so they are faster, better prepared and less likely to miss the thing that matters. Build it that way and you get the best of both: the tireless consistency of the machine and the accountable judgement of the human, working together on the one job where getting it wrong is measured in more than money.

Related reading: AI governance for enterprise operators, FM KPI framework, Predictive maintenance and failure prediction, AI enterprise knowledge assistant (RAG), AI intelligent maintenance recommendations.