AI and HSE Management: The Good, the Bad and the Accountable — Part 8 of 8
Summary
The approaches examined here treat AI as a controlled process, not just a productivity tool.
Published frameworks and practices point to a common pattern: an AI inventory, review before deployment, risk-based oversight, and independent assurance.
Companies in the region are already certifying their AI management systems to ISO/IEC 42001. This is not just a Big Tech exercise.
Published evidence of AI governance inside HSE functions is still scarce. That is an opportunity, not a reason to wait.
The organisations that gain most from AI may be those that deliberately preserve the human expertise it appears to make unnecessary.
This series began with a positive case: a competent HSE professional using AI well can outperform the same professional without it. It then looked at what can go wrong, and at who answers when it does.
This final post returns to the positive. Some organisations have published concrete accounts of how they govern AI. These examples do not establish superior HSE performance, but they show what structured governance can look like, and what HSE and compliance leaders can learn from it.
The common pattern
Look across published AI governance frameworks, international standards and selected organisational examples, and certain elements recur. Not every organisation documents every one of them, and the details vary with size and sector, but the building blocks are remarkably similar:
An AI inventory. They know which AI systems are in use, for what purpose, on what data, and at what level of risk.
Review before deployment. New AI uses are assessed by a cross-functional group, typically including legal, compliance, risk, information security and the business, before they go live.
Oversight in proportion to risk. Low-risk uses, such as drafting internal communications, get a light touch. High-consequence uses get named owners, formal review and human approval.
Independent assurance. Mature governance frameworks provide for review independent of those developing or operating the AI systems. Depending on the organisation and the consequences of the AI application, this may involve compliance and risk functions, internal audit or external assessment.
Vendor scrutiny. Suppliers of AI tools are asked how their systems are governed, what data they use and where it is processed.
- A recognised framework. Increasingly, that framework is ISO/IEC 42001.
The principles are familiar, but implementation is not necessarily simple. Establishing meaningful oversight, validating AI systems and maintaining independent assurance can require considerable technical and organisational effort. What distinguishes the approaches examined here is that these controls are built into how AI is selected, deployed and monitored, rather than added after an incident or a regulatory intervention.
What some organisations have published
A few examples show how this looks in practice. It is worth being clear about the kind of evidence behind each one, because what an organisation states about its AI governance and what it has had independently verified are not the same thing.
Unilever has described an AI assurance process in which potential new AI projects are assessed by a cross-functional team of experts, working with an external partner, before deployment, and monitored afterwards. In 2024 the company reported more than 500 AI systems in operation worldwide and, separately, 150 projects taken through its assurance process. These are company-reported figures; the cited publication does not provide independent verification. But they describe a process in unusual detail. The lesson is that assurance works best as a gate at the start, not an inspection at the end.
Microsoft has brought specified AI services, including several of its Copilot services, within the scope of ISO/IEC 42001 certification, subject to independent third-party audit, under a published Responsible AI Standard. The lesson for buyers is that it is now reasonable to ask AI vendors for evidence of how their own systems are governed, and to expect more than a policy statement in return.
Closer to home, companies in the region are moving too. NADEC, the Saudi food and agriculture company, announced in 2026 that its Digital & Technology Division had achieved ISO/IEC 42001 certification. Its published scope includes infrastructure and operations, applications, strategy and governance, information security, and digitalisation services. Unifonic, the Saudi communications technology company, achieved the same certification in 2025, independently audited by SGS, for the AI systems it develops for customer care, marketing automation and personalisation.
NADEC is a particularly relevant example for HSE professionals. Agriculture and food production involve operational safety, environmental management, equipment risks and extensive regulatory obligations. The published certification does not establish how AI is governed within NADEC’s HSE functions, or whether those functions fall within the certified scope. But it does show that formal AI governance is already being adopted inside a major Saudi operating business, not only by technology providers.
One caution applies to all of them. Certification shows that an organisation’s AI management system has been audited against the standard within its certified scope. It does not, by itself, show that every AI use within that scope is safe or effective. That still depends on the controls described in Part 7 actually working.
What is still missing
One gap remains particularly noticeable. Compared with applications in finance, customer service and human resources, there is relatively little publicly documented evidence of how organisations govern AI-assisted decisions specifically within HSE and environmental compliance functions.
The examples above show real progress in enterprise AI governance. They do not show how those same controls operate within safety-critical or environmental compliance workflows.
Public disclosures are more visible in areas such as customer service, financial decisions and recruitment. That does not establish that HSE governance is absent; it makes its implementation harder to assess from published evidence.
But for the reasons set out across this series, HSE deserves a prominent place in AI governance. HSE is where AI-generated documents carry safety consequences, where the independence of review is a matter of life and death, and where some of an organisation’s most sensitive information is handled. The organisations that extend their AI governance into HSE early will be setting the standard others follow.
Lessons for HSE and compliance leaders
Drawing the threads together, five lessons stand out:
- Start with visibility. You cannot govern AI you cannot see. The inventory comes first, and it should include the tools nobody approved.
- Govern people as well as tools. HSE governance must address the people as well as the technology: competence can fade, and reviews can lose their independence. Those risks need managing as deliberately as the software, alongside unreliable sources, unsuitable tools, data exposure and supplier risk.
- Scale oversight to consequence. Not every AI use needs the same control. Editing the wording of an approved toolbox talk requires different safeguards from generating its technical instructions or preparing a lifting plan.
- Ask your suppliers. If global technology companies can evidence their AI governance, your compliance software vendors, consultants and contractors can be asked to evidence theirs.
- Do not wait for the regulator. The governance principles are already visible, and in the GCC, financial-sector requirements and guidance offer principles that can be adapted to HSE.
The series in one sentence
AI can make HSE professionals markedly better or quietly worse, depending on how it is used. It does not remove the organisation’s existing duties or the need for competent professional judgement.
Across these eight posts, that has meant:
The good: used as a sparring partner rather than a substitute, AI can sharpen professional judgement, not replace it.
The bad: it can also hide weak analysis behind fluent documents, collapse the independence of our checks, and move sensitive information beyond our control.
- The accountable: the signature remains the organisation’s, regulators in several sectors are increasingly formalising AI governance expectations, and good governance can be assessed through three questions: is it accountable, traceable and auditable?
One last thought
Across this series, the central argument has remained the same: AI should make competent HSE professionals more capable, not make their competence less necessary.
The organisations that get this right will not simply be those that adopt AI fastest. They will be those that can demonstrate that their people, decisions and assurance processes remain reliable as the technology becomes more powerful.
In the end, the organisations that benefit most from AI may be those that deliberately preserve the very human expertise that AI appears to make unnecessary.
Why Redlog Is Building for This Future
At Redlog, we are building compliance intelligence tools on the principles set out in my previous series: curated and expert-validated regulatory content, jurisdiction-specific coverage, source traceability, applicability-aware outputs, and an expert-in-the-loop model that keeps professional accountability where it belongs.
This series adds a further principle. AI should strengthen the professional’s judgement, not stand in for it. Tools that show their sources and flag their uncertainty prompt the professional to check, challenge and decide. That keeps them in the left-hand column.
We are publishing this series because the conversation about AI and accountability in HSE should happen inside the profession. It should be shaped by people who understand regulatory compliance, duty of care, operational risk and the consequences of getting this work wrong.
AI will change HSE practice. That is no longer the question. The question is whether the profession will shape that change with judgement, governance and accountability, or allow it to be shaped elsewhere.
If that is how you think AI should work in HSE compliance, it is the conversation we want to have, starting with our webinar.
This is Part 8 of AI and HSE Management: The Good, the Bad and the Accountable. The previous series, AI and the HSSE Profession: What’s Actually Changing, and all of our prior blog posts are available at www.redlogenv.com/blog.
Webinar – Join us on November 16, 10:00 AM CET/ 11:00 AM UTC+3
Webinar: AI, Accountability and HSE Compliance in MENA — What Every Business Leader Needs to Know
Join us for a discussion with our experts to learn more about where liability sits when AI-assisted compliance work goes wrong, what regulators are starting to expect, and what good governance looks like in practice, and more. Register here
- How the Leaders Are Doing It - November 10, 2026
- Accountable, Traceable, Auditable - November 5, 2026
- The GCC Is Writing the Rulebook, One Regulator at a Time - November 3, 2026