Incident reporting: the AI drafts, a person notifies

The notification rules, by jurisdiction

What counts as notifiable has its own definitions, and Australian states and territories have their own regulators and adoption of the model laws. Read your regulator's guidance; this page does not replace it.

Incidents also create records. In the US, employers with more than 10 employees keep OSHA Forms 300, 300A and 301, with some industries exempt. In Australian construction, Safe Work Australia says the relevant risk assessment, WHS plan and safe work method statements (SWMS) are kept "for two years after the incident".

A data breach is a different kind of incident. In Australia, the Notifiable Data Breaches scheme requires organisations covered by it to notify affected individuals and the OAIC when a breach is likely to result in serious harm. The same rule applies: a person assesses and notifies.

The first hour: keep the AI out of the critical path

"Immediately" and "by the fastest possible means" mean a phone call or the regulator's own channel, made by a person, as soon as they are aware. Nobody should wait for an AI draft before notifying. A sensible setup:

• Your incident procedure names who notifies and how, and that procedure does not depend on any software being available.
• The AI can help someone find the procedure and the regulator's contact details quickly when asked in Teams or by text.
• While the person notifies, others can give the AI the facts as they come in: what happened, when, where, who, what was done. It keeps a time-stamped note of what it was told.
• If the regulator asks for written follow-up, the AI drafts it from those notes for the responsible person to check.

After the notification: reports, registers and actions

Most incident admin happens in the days and weeks after. This is where an AI worker in Microsoft 365 earns its keep:

• Incident report draft. Built from the notes, photos and statements you give it, in your own template in Word.
• Register entry. A proposed entry in your incident register (Excel or a SharePoint List) for you to approve.
• Record preservation. A reminder to keep the documents tied to the incident, such as the SWMS, risk assessment and WHS plan for a construction job, filed together and not overwritten.
• Investigation follow-up. Requests to witnesses and supervisors for statements, with reminders until they arrive.
• Corrective actions. A list with owners and due dates, reminders as dates approach, and a note to the risk and hazard registers where controls change.
• Annual logs. For US employers who keep OSHA logs, the year's entries feed the summary and the electronic submission on your reporting calendar.

The Everything asks before anything important goes out, so nothing is sent to a regulator, insurer or family member without a person approving it.

What stays with a person

• First aid, emergency response and making the site safe. Always first.
• Deciding whether it is notifiable. The AI can show the definitions you have stored; the decision is yours.
• Making the notification. By phone or the regulator's channel, by the person your procedure names.
• What the report says. The draft is a starting point. The responsible person confirms the facts and signs.
• Talking to the injured worker and their family. That is never a job for an AI.

Before you start

The Everything runs inside your Microsoft 365 tenant with tightly scoped permissions, but your data does leave the tenant for AI processing. Its privacy policy names Microsoft (Azure OpenAI) and OpenAI as AI providers and says providers may process information outside your country. The public site does not claim any certification such as SOC 2 or ISO 27001, and it does not name a hosting country.

Incident records often contain health information and details of injured people, which is among the most sensitive data a business holds. Check your privacy, workers' compensation and record-keeping obligations before you give any AI tool access to them, and limit access to the folders and lists it needs.

Questions people ask