AI and HSE Management: The Good, the Bad and the Accountable — Part 5 of 8
Summary
Using AI to prepare compliance work does not, by itself, remove an organisation’s existing legal and professional responsibilities.
Across the GCC, employers’ HSE duties already apply to AI-assisted decisions. No new AI law is needed for that.
Several parties can be exposed at once: the employer, the consultant, the contractor and the vendor. Their responsibilities coexist; one does not replace another.
A documented, competent review, checked against primary sources and actual site conditions, is important evidence of reasonable care. It is not a guarantee of immunity.
The first four posts in this series looked at what AI can do to an organisation’s judgement, its checks and its data. The remaining posts turn to the question boards should be asking: when AI-assisted compliance work goes wrong, who answers for it?
The short answer is that the people who were responsible before AI arrived are still responsible. Courts, tribunals and clients outside the region have started to test that principle, and the developments so far increasingly reinforce it.
The tool is not a separate entity
In 2024, the British Columbia Civil Resolution Tribunal in Canada decided a small consumer claim that has become one of the most cited examples in AI liability. In Moffatt v Air Canada, a customer relied on the airline’s website chatbot, which gave him wrong information about a bereavement fare. When he claimed the refund the chatbot had described, the airline argued, in effect, that the chatbot was responsible for its own statements.
The tribunal rejected that argument. The chatbot was part of the airline’s website, and the airline was responsible for the information on it.
The decision is not binding on any GCC court, and it concerned a consumer fare, not a safety decision. But it illustrates a principle that is hard to argue against anywhere: an organisation cannot distance itself from what its own AI tools say.
Reliance is not diligence
In 2023, in Mata v Avianca, lawyers in New York filed a brief citing cases that did not exist. An AI tool had invented them. The court sanctioned the lawyers, not simply because the citations were fabricated, but because of how they responded when the problem was pointed out: they continued to stand behind the fictitious cases rather than promptly acknowledging the error.
In 2025, Deloitte agreed to refund part of its fee to the Australian government after a report worth roughly A$440,000 was found to contain fabricated references and a fabricated quotation from a court judgment. A revised version disclosed that generative AI had been used. Deloitte stated that the corrections did not affect the report’s substantive findings or recommendations, which makes the case more instructive, not less: even where the conclusions survived, the failure to verify the sources had a cost.
Neither case involved HSE. Both point to the question an HSE regulator, a court or a client is likely to ask after a compliance failure. Not “did you use AI?” but “what did you do to check it?”
The GCC test: the duty already exists
AI-specific rules are developing at different speeds across the GCC, and the next post looks at them in detail. But employers do not need a new AI law to have HSE responsibilities. Those duties already exist.
Every GCC country’s labour law places the same basic duty on employers: protect workers from the hazards of their work. The wording differs; the principle does not. In every GCC state, the duty to identify and control workplace risks sits with the employer.
None of these instruments mentions AI, and none needs to. Consider an AI-generated risk assessment that fails to identify a critical hazard. Whether the assessment was prepared by hand, copied from an earlier project or generated by software, the question is the same: did the responsible organisation adequately identify, assess and control the risk?
The region’s civil codes point the same way. The UAE Civil Transactions Law takes a broad, harm-based approach to liability, and includes specific liability for those in charge of dangerous things and mechanical equipment, a provision legal scholars have argued could extend to AI systems. Saudi Arabia’s Civil Transactions Law, in force since December 2023, makes a person whose fault causes damage liable to compensate it. No GCC court has yet ruled on an AI-related error, but commentators expect courts in the region to treat AI as a tool, not a legal actor, with liability resting on those who design, deploy and control it.
This matters particularly in the GCC, where principal contractors, subcontractors, consultants and clients share responsibilities across complex projects. AI-generated documentation can pass through several organisations before anyone checks whether its assumptions reflect actual site conditions.
Responsibility is shared, not transferred
It is tempting to ask whether the employer or the vendor is liable. Often the honest answer is: potentially both, in different ways.
- The employer retains its statutory HSE duties and is the first party a regulator will look to.
The individuals who approve AI-assisted documents carry professional and, in some cases, personal accountability for their sign-off.
The consultant who supplies AI-assisted advice may face professional and contractual exposure if that advice is wrong.
The contractor has its own obligations for the work it plans and performs, including the risk assessments it submits.
The AI vendor may carry contractual liability, and in some jurisdictions product liability, for defects in its tool.
These responsibilities coexist. None of them disappears because another party is involved.
The vendor will carry more, but not what you think
Many leaders assume that if an AI tool gets it wrong, the vendor will be liable. That assumption deserves a closer look.
Most AI tool contracts limit or exclude the vendor’s liability for how their output is used. Contractual warranties, limitations of liability and regulatory responsibilities are three different things: a vendor’s contract can limit what you can recover from the vendor, but it cannot transfer your regulatory duties to them.
Europe is moving the line. The EU’s revised Product Liability Directive, which applies to products placed on the EU market from 9 December 2026 once implemented in national law, treats software, including AI, as a product. Where a defective AI product causes harm the Directive covers, that can bring strict, no-fault liability for its producer, subject to the rules on defect and proof, and that liability cannot be excluded by contract against injured people.
But the Directive is about defective products causing death, personal injury, or damage to private property and data. It does not mean that every inaccurate AI interpretation of HSE legislation creates product liability. And it does not cover the regulatory fine, the stop-work order, the lost contract or the reputational damage that follows a compliance failure. Those risks remain with the organisation, and claims to recover them fall back on ordinary contract and negligence.
The prosecution nobody wants
Consider a hypothetical lifting operation on a major GCC construction project.
A mobile crane is to be positioned on ground that was previously excavated and backfilled. The lifting contractor submits a risk assessment and method statement largely prepared with generative AI. The documents are professional and comprehensive-looking. They address lifting accessories, exclusion zones, communications and operator competence. They do not adequately assess ground-bearing capacity, outrigger loading or the suitability of the proposed crane position.
The lift supervisor signs the documents. The HSE adviser checks that the required sections are complete. The main contractor accepts the submission. Nobody verifies ground stability or the adequacy of outrigger support on the day.
During the lift, an outrigger loses support and the crane overturns.
The investigation does not turn on which AI system drafted the documents. It asks whether the lift was properly planned, whether the ground conditions were assessed, whether competent people verified the controls, and whether each organisation involved discharged its responsibilities. The AI-generated assessment will be part of the evidence. So will every signature that approved it.
The failure was not simply that AI omitted a hazard. It was that the verification process failed to detect the omission before the operation went ahead. A polished document supported by several signatures does not establish that a critical hazard was identified or controlled.
When the error is in the legal register
AI errors can create exposure long before anyone is hurt.
Consider a multinational with facilities in both Dubai and Abu Dhabi. An AI tool is asked to identify the occupational safety requirements that apply. It produces a convincing summary, but fails to distinguish federal obligations from additional requirements that apply to particular activities and emirates.
The resulting legal register is reviewed for completeness, approved and loaded into the company’s compliance management system. Months later, an audit finds that a material requirement was never included. Compliance had been reported as satisfactory, because the missing obligation was never assessed.
The failure was not merely an incorrect AI answer. It was the absence of a reliable process for identifying applicable legislation, checking primary sources, translating requirements into obligations and verifying implementation. The register looked complete. The assurance was not.
What a defensible decision rests on
After an incident or an audit finding, the organisations in the strongest position will not be those that avoided AI. They will be those that can show what they did with it. Three controls work together:
Control | What it demonstrates |
Source verification | The requirement or technical guidance was checked against an authoritative, applicable and current source. |
Competent review | A person with the right expertise examined the substance of the output, including omissions and assumptions, not just its completeness. |
Field verification | The assumptions and controls were checked against the actual worksite and operating conditions. |
They are complementary. An assessment can accurately reflect a published standard and still be wrong for a particular site.
Two further safeguards make the record stronger: keeping the version of the AI output that was actually approved, and requiring a fresh assessment when conditions, equipment or legal requirements change.
There is also a trap to avoid. Asking a second AI tool to verify the first is not necessarily an independent check. Both may repeat the same incorrect assumption, miss the same hazard or rely on similarly incomplete sources, as discussed in Part 3 of this series. For high-consequence HSE decisions, independent verification means checking against authoritative requirements, engineering evidence and actual operating conditions, with competent human judgement applied to the result.
A documented, competent review of this kind may provide important evidence that the organisation exercised reasonable care. It does not guarantee immunity from liability. Whether it amounts to a defence will depend on the applicable law, the duty in question, the adequacy of the controls and the circumstances of the incident. But without it, there is very little to rely on at all.
Five questions before you rely on AI-assisted compliance work
The adviser in that example is not unusual, and HSE staff are not the only route out. Sensitive HSE information travels across the whole organisation, and almost anyone can leak it without meaning to:
- Your software vendors. What do they warrant about the currency and sources of their content, and how quickly must they tell you when it is wrong?
- Your consultants. Do they disclose their AI use on your work, and does their professional indemnity insurance cover AI-assisted advice?
- Your contractors. Are their risk assessments and method statements produced with AI, and who on their side is competent to verify them on site?
- Your data. Where is your information processed, is it used for training, and can you have it returned or deleted?
- Your evidence. Could you show, for any AI-assisted compliance decision, what was checked, by whom, against which source, and on what site conditions?
The next question
If the duty already exists, the next question is how regulators expect organisations to govern AI in discharging it. In the GCC there is no single AI law, but the rulebook is being written, one regulator at a time. That is the subject of the next post.
Why Redlog Is Building for This Future
At Redlog, we are building compliance intelligence tools on the principles set out in my previous series: curated and expert-validated regulatory content, jurisdiction-specific coverage, source traceability, applicability-aware outputs, and an expert-in-the-loop model that keeps professional accountability where it belongs.
This series adds a further principle. AI should strengthen the professional’s judgement, not stand in for it. Tools that show their sources and flag their uncertainty prompt the professional to check, challenge and decide. That keeps them in the left-hand column.
We are publishing this series because the conversation about AI and accountability in HSE should happen inside the profession. It should be shaped by people who understand regulatory compliance, duty of care, operational risk and the consequences of getting this work wrong.
AI will change HSE practice. That is no longer the question. The question is whether the profession will shape that change with judgement, governance and accountability, or allow it to be shaped elsewhere.
If that is how you think AI should work in HSE compliance, it is the conversation we want to have, starting with our webinar.
This is Part 5 of AI and HSE Management: The Good, the Bad and the Accountable. The previous series, AI and the HSSE Profession: What’s Actually Changing, and all of our prior blog posts are available at www.redlogenv.com/blog.
Webinar – Join us on November 16, 10:00 AM CET/ 11:00 AM UTC+3
Webinar: AI, Accountability and HSE Compliance in MENA — What Every Business Leader Needs to Know
Join us for a discussion with our experts to learn more about where liability sits when AI-assisted compliance work goes wrong, what regulators are starting to expect, and what good governance looks like in practice, and more. Register here
- The Signature Is Still Yours - October 26, 2026
- The Leak Nobody Noticed - October 19, 2026
- When Four Lines of Defence Become One - October 15, 2026