AI and HSE Management: The Good, the Bad and the Accountable — Part 4 of 8
Summary
AI is already part of everyday HSE work, much of it through tools nobody approved.
HSE teams handle some of the most sensitive information an organisation holds: incident investigations, witness statements and health records
The likeliest data breach is not a cyber attack. It is a well-meaning employee or adviser pasting an incident report into a public chatbot to save an hour.
Your exposure extends to every employee, consultant and contractor who runs your data through their own AI tools or cloud-based services.
The first three posts in this series were about thinking: what AI does to individual judgement, and to the independence of the checks we rely on. This post is about something more concrete. The information we put into these tools, where it goes, and who else is putting our information into them.
AI is already in your HSE function
Whatever your organisation’s official position on AI, it is almost certainly already in use in your HSE work.
It drafts procedures and toolbox talks. It translates safety briefings for multilingual workforces. It summarises regulations and helps build legal registers. It turns investigation notes into reports and suggests root causes. It writes the first version of the monthly HSE report.
Much of this happens through general-purpose AI tools, often on personal accounts and personal phones, adopted by individuals trying to get through a heavy workload. Nobody approved it. Nobody prohibited it either. In most organisations, nobody knows the extent of it.
This is what is now called shadow AI: AI use that the organisation cannot see. In itself it is a sign that people are looking for better ways to work. The problem is what goes into the tools.
Why HSE information is unusually sensitive
Consider what passes through an HSE function in an ordinary month:
incident investigation reports, which may later be examined by regulators, insurers or courts;
witness statements, given in confidence by named individuals;
occupational health records, injury details and fitness-for-work assessments;
exposure monitoring results linked to named workers;
environmental incident records: spills, leaks, unpermitted releases and exceedances of discharge or emission limits, often with regulatory notification duties and potential enforcement attached;
environmental monitoring data, such as stack emissions, effluent quality and groundwater contamination results, which can carry significant legal and reputational consequences if disclosed out of context;
site layouts, process information and emergency arrangements, some of it relating to critical infrastructure;
client and contractor information covered by confidentiality agreements.
Health information is treated as sensitive personal data under both the UAE and Saudi personal data protection laws, and attracts stricter conditions on how it may be processed and transferred. Environmental incident and monitoring information carries its own risk: a draft spill report or an unreviewed exceedance result, circulating outside the organisation before the facts are established and the regulator has been notified, can do serious legal and reputational damage. Much of the rest is commercially confidential or security-sensitive. Very little of it should be leaving the organisation’s control.
The leak that looks like work
Picture a hypothetical but entirely plausible scene. It is late in the evening. An HSE adviser has to finish an investigation report for tomorrow’s management meeting. They paste the witness statements, the injured worker’s details and the draft findings into a free AI chatbot and ask it to tidy up the report and suggest root causes.
Nothing about this feels like a data breach. There is no hacker and no malicious intent. The adviser is trying to do a good job. But depending on the tool and its settings, that information may now be stored on servers in another country, retained for an unknown period, reviewed by the provider, or used to improve future models. Consumer versions of AI tools and enterprise versions often have very different terms on exactly these points, and few users read either.
The organisation does not know it happened. It cannot retrieve the data. And if the information concerned personal health data, it may have transferred that data outside the jurisdiction in a way its data protection obligations do not allow.
This is not a hypothetical risk for large organisations. In 2023, Samsung restricted staff use of generative AI tools after engineers entered confidential source code and internal meeting notes into a public chatbot. If it can happen in one of the world’s most sophisticated technology companies, it can happen in an HSE department.
It is not only the HSE team
The adviser in that example is not unusual, and HSE staff are not the only route out. Sensitive HSE information travels across the whole organisation, and almost anyone can leak it without meaning to:
The site engineer who photographs an incident scene and asks an AI app to describe what went wrong, uploading the photograph, its location data and the faces in it.
The environmental coordinator who pastes a hydrocarbon spill report, with volumes, locations and the draft cause, into a chatbot to help word the notification to the regulator.
The plant engineer who uploads a month of stack monitoring data, including an unreported exceedance, to an online tool to produce a trend chart.
The HR officer who pastes a sickness-absence record into a chatbot to draft a return-to-work letter.
The project manager who lets an AI note-taker join the incident review meeting, so that every word, including names and admissions, is transcribed and stored by a third-party service.
The supervisor who uses a free translation app to turn a witness statement into English.
The manager who uploads the full incident register to a spreadsheet assistant to produce a chart for the board.
Increasingly, AI is also built into the tools people already use: email, document editors, messaging apps, even phone keyboards. Some of it is switched on by default. An employee may be sending information to an AI service without consciously deciding to use AI at all.
The same applies in the other direction. AI assistants connected to company files can surface information to people who should not see it. A question about lost-time injuries can return a colleague’s medical details simply because the file permissions were never tight enough, and nobody noticed until a machine went looking.
AI tools are only the most visible part of a wider issue. Almost every AI service is cloud-based, and so are many of the everyday tools that sit alongside them: free file-sharing sites, online PDF converters, transcription services, survey and form builders, personal cloud storage. Each one can move HSE information onto servers outside the organisation’s control, and often outside the country, without anyone thinking of it as a data transfer.
None of these people is acting maliciously. Most would be surprised to hear they had caused a data incident. That is precisely the problem: a risk that nobody recognises is a risk that nobody manages.
Even the question can be sensitive
There is a subtler form of leak that few people consider: the compliance question itself.
When an engineer asks an AI tool, “Our wastewater discharge exceeded the permit limit three times last month. Do we have to report it, and what penalties apply?“, they have not just searched a regulation. They have described a possible breach, in their own words, to a third-party service, along with details that may identify the site and the company.
That record may be stored, retained and, depending on the tool, reviewed by the provider. Unlike a conversation with your own lawyer, it is unlikely to be protected by legal privilege. And it was created at the most sensitive moment of all: before the facts were established, before anyone had decided what the obligation actually was, and before the regulator had been notified.
Researching the law is a normal and necessary part of compliance work. But the way people describe their own situation when asking about it can turn routine research into something close to an admission. Compliance questions about real incidents belong in controlled tools and controlled conversations, not in a public chatbot.
Banning it rarely works
The instinctive response is to prohibit AI tools. It is understandable, and usually ineffective. People who have found a tool that saves them hours each week tend to keep using it, quietly, on their own devices. A ban often converts visible AI use into invisible AI use.
The more effective approach is to give people a better option: approved tools with proper data terms, clear rules on what can and cannot go into them, and an explanation of why it matters.
Your data, someone else’s AI
There is a further layer that most organisations have not yet considered.
Your HSE function does not work alone. Consultants prepare your legal registers and audits. Contractors write their own risk assessments and method statements using your site information. Specialists investigate your incidents.
Every one of them may be running your information through their own AI tools and cloud services, under their own settings, in their own jurisdictions. Your data protection obligations and your confidentiality agreements do not stop at your own staff. But your visibility usually does.
Consultancies, including ours, should be able to answer a simple set of questions from their clients: Which AI tools do you use on our work? What data goes into them? Where is it processed? Is it used to train anyone’s models? Who reviews the output before it reaches us?
At Redlog, we hold ourselves to the same standard. Our AI Acceptable Use Policy applies to every employee, contractor and sub-consultant working on Redlog projects. In summary:
We use AI for client work only through business-grade tools listed on our Approved AI Tools Register, which is reviewed quarterly. Free and personal accounts are not permitted.
Client names, personal names, project identifiers, financial figures and confidential information are anonymised before they go into any AI tool, including approved ones.
Client data is never used to train or fine-tune AI models, and we require the same commitment from our tool providers.
Every AI-assisted output is reviewed by a consultant with expertise in the subject before it reaches a client, and every reference is checked against the primary source.
Sub-consultants are bound by the same rules. If client data is ever entered into a non-approved tool, it must be reported within 24 hours, and the client notified where appropriate.
The policy is designed to align with the principles of ISO/IEC 42001 and ISO/IEC 27001, and a copy is available to clients on request.
What using AI safely looks like
None of this is an argument against AI in HSE. It is an argument for using it deliberately.
Approve the tools. Provide enterprise AI tools whose terms exclude training on your data and set out where it is processed.
Classify the information. Decide which categories of HSE information may go into which tools. Health records and witness statements are not the same as a toolbox talk.
Remove what is not needed. Names, identification numbers and site-identifying details can often be removed before AI is used, without losing the value of the analysis.
Ask the general question, not the specific one. When researching a possible compliance issue, ask about the requirement, not about your incident, and take the specific question to your legal or compliance advisers.
Write it into contracts. Require consultants and contractors to disclose their AI use on your work and to meet the same data standards as your own staff.
Check what is already switched on. Review the AI features built into your email, office, messaging and meeting tools, the access rights of any AI assistant connected to company files, and which cloud services hold your HSE information and where.
Train everyone, not just HSE. Engineers, HR, supervisors and managers handle HSE information too. Short, practical guidance on what not to paste, upload or record goes a long way.
Explain the why. People make better decisions about data when they understand what is at stake, not just what the rule says.
The question for leaders
Do you know which AI tools your consultants and contractors are using on your data?
For most organisations, the honest answer is no. That is one of the practical questions we will address in the webinar.
From the bad to the accountable
This post concludes the second part of the series. We have looked at three ways AI can quietly make HSE management worse: by eroding judgement (Post 2), by collapsing the independence of our checks (Post 3), and by moving sensitive information beyond our control (this post).
The remaining posts turn to accountability. The next one asks the question every board should be asking: when AI-assisted compliance work goes wrong, who answers for it?
Why Redlog Is Building for This Future
At Redlog, we are building compliance intelligence tools on the principles set out in my previous series: curated and expert-validated regulatory content, jurisdiction-specific coverage, source traceability, applicability-aware outputs, and an expert-in-the-loop model that keeps professional accountability where it belongs.
This series adds a further principle. AI should strengthen the professional’s judgement, not stand in for it. Tools that show their sources and flag their uncertainty prompt the professional to check, challenge and decide. That keeps them in the left-hand column.
We are publishing this series because the conversation about AI and accountability in HSE should happen inside the profession. It should be shaped by people who understand regulatory compliance, duty of care, operational risk and the consequences of getting this work wrong.
AI will change HSE practice. That is no longer the question. The question is whether the profession will shape that change with judgement, governance and accountability, or allow it to be shaped elsewhere.
If that is how you think AI should work in HSE compliance, it is the conversation we want to have, starting with our webinar.
This is Part 4 of AI and HSE Management: The Good, the Bad and the Accountable. The previous series, AI and the HSSE Profession: What’s Actually Changing, and all of our prior blog posts are available at www.redlogenv.com/blog.
Webinar – Join us on 10 November 2026
Webinar: AI, Accountability and HSE Compliance in MENA — What Every Business Leader Needs to Know
Join us for a discussion with our experts to learn more about where liability sits when AI-assisted compliance work goes wrong, what regulators are starting to expect, and what good governance looks like in practice, and more. Register here
- The Leak Nobody Noticed - October 19, 2026
- When Four Lines of Defence Become One - October 15, 2026
- The Fluency Trap - October 15, 2026