AI governance in Australian mining and resources.

Every operator is a person conducting a business or undertaking and must ensure, so far as reasonably practicable, the health and safety of workers and others. Deploying autonomous haulage, AI proximity detection or remote-operated plant does not shift the duty: the operator must eliminate or minimise risks the technology creates, provide safe plant, and supervise, monitor and train workers around it.

Under the Work Health and Safety (Mines and Petroleum Sites) regime the NSW Resources Regulator expects autonomous mobile mining plant to be managed as a mechanical engineering control plan hazard, using the September 2020 autonomous mobile plant guideline and MDG 15. Operators must risk-assess the autonomous system, define critical controls to prevent a material unwanted event, and evidence them under the sites principal control plans.

In Western Australia the Work Health and Safety (Mines) Regulations 2022, made under the WHS Act 2020, require operators to identify principal mining hazards, including roads and areas where mobile plant operate, and to prepare a principal mining hazard management plan. Automated and externally controlled plant must be assessed within that plan, with control measures documented and kept current for the regulator.

Queensland coal operators must maintain a safety and health management system and principal hazard management plans under the Coal Mining Safety and Health Act 1999. Amendments made by the 2024 legislation clarify that the system must address risks from remote operating centres and remote operation of plant and equipment, with the additional principal hazard management plans required to be in place from 1 September 2025.

AI fatigue cameras, in-cab monitoring and GPS tracking of haul trucks are workplace surveillance. In NSW the Workplace Surveillance Act 2005 requires at least 14 days written notice before surveillance of an employee starts, and makes covert surveillance an offence unless authorised. Operators must notify workers, define permitted use of the data, and align with the Surveillance Devices Act where cameras are used.

Where a mining or resources operator holds a critical infrastructure asset, such as a critical gas or liquid fuel asset, the Security of Critical Infrastructure Act 2018 requires a written critical infrastructure risk management program covering cyber, personnel, supply chain and physical hazards. AI systems that control or monitor operational technology must be brought inside that program, with cyber security incidents reported to the Australian Signals Directorate, within 12 hours where the impact is significant (s 30BC) and 72 hours where the impact is relevant (s 30BD).

Operators handling worker biometrics, fatigue data, camera footage and contractor records must comply with the 13 Australian Privacy Principles under the Privacy Act 1988. That means collecting only what is necessary, being open about handling in a privacy policy, securing the data, and limiting use and disclosure. AI models trained on personal information remain bound by these principles, enforced by the OAIC.

From 10 December 2026 a new APP 1 obligation, introduced by the Privacy and Other Legislation Amendment Act 2024, requires entities to describe in their privacy policy any computer program that uses personal information to make decisions that could reasonably be expected to significantly affect a person. Automated rostering, access or workforce screening tools in mining should be inventoried now so the policy is ready.

The Guidance for AI Adoption, published 21 October 2025 by the National AI Centre, sets six essential practices: decide who is accountable, understand impacts, measure and manage risk, share essential information, test and monitor, and maintain human control. Though voluntary, it is the benchmark regulators cite for reasonable AI governance and should frame how resources operators oversee autonomous and predictive systems.

Build a register of every AI and autonomous system across the operation, from haulage and drills to fatigue detection and predictive maintenance, and name an accountable owner for each.

Fold autonomous and remote-operated plant into the relevant principal hazard or mechanical engineering control plan, with documented critical controls for each material unwanted event.

Map remote operating centre and remote plant risks into the safety and health management system, meeting the Queensland requirements in place from 1 September 2025.

Issue workplace surveillance notices at least 14 days before deploying in-cab cameras, GPS or fatigue monitoring, and set clear limits on how the data may be used.

Inventory automated decisions affecting workers, such as rostering, access and screening, ahead of the 10 December 2026 privacy policy transparency duty.

Confirm whether any asset is a critical infrastructure asset and, if so, bring operational-technology AI inside the critical infrastructure risk management program.

Adopt the six essential practices from the Guidance for AI Adoption as the internal governance baseline, keeping humans in control of safety-critical automation.