Is an AI Risk Assessment Suitable and Sufficient?

An AI risk assessment can be suitable and sufficient: you can use AI to draft it, as long as the result fits your job. In Great Britain the law sets the standard the assessment must meet, not how it is written, and the duty to make sure it meets that standard stays with you, not with the tool.

If you came here for an HSE ruling on AI, there isn't one. This page covers what the standard means, what HSE has actually said about AI, and how to check your draft: HSE's five steps, then six checks aimed at AI drafts.

What "suitable and sufficient" means

The phrase comes from regulation 3 of the Management of Health and Safety at Work Regulations 1999 (MHSWR), not from the Health and Safety at Work Act. Every employer must make a suitable and sufficient assessment of the risks to their employees and to anyone else affected by their work. Self-employed people the law covers have the same duty, and HSE says that includes anyone whose work could put others at risk and anyone working in construction.

The regulations do not define the phrase, but they do say what the assessment is for: identifying the measures you need to take to comply with the law. Our plain-English reading is that a suitable and sufficient assessment fits this job, these people and this place, and goes far enough to decide the controls. HSE does not expect you to remove every risk, only to do what is reasonably practicable.

Regulation 3 also says you must review the assessment if there is reason to think it is no longer valid or the work has changed significantly, and record the significant findings if you have five or more employees. An employer must not employ a young person, meaning anyone under 18, without first assessing the risks to them.

HSE also warns against relying purely on paperwork: the priority is controlling the risks in practice. It publishes its own template, but says copying an example and putting your company name on it would not satisfy the law. An unchecked AI draft is the same problem in a smarter-looking document. (If you use templates, see how to adapt a risk assessment template.)

If a client has asked you for RAMS, the risk assessment is the part the law requires; a method statement usually is not required by law by that name (see do I need a method statement for a small job?).

What HSE has said about AI

HSE's policy statement on its regulatory approach to AI, published on 12 June 2026, says most health and safety law sets objectives without prescribing how to meet them, so it applies regardless of the technology being used. The statement is about how HSE regulates the use of AI at work, and it says the law requires a risk assessment for uses of AI that affect workplace health and safety. That is a different question from drafting your own risk assessment with AI, which the statement does not deal with as such. It also lists new guidance on how the law applies to AI as work for 2026/27. Nothing in it, or in regulation 3, makes an exception for a risk assessment drafted with AI.

HSE's 2025 research summary on how AI is used in the industries it regulates includes generative AI creating risk assessments and identifying controls. One risk respondents named was AI producing inaccurate safety assessments, so that the right controls are not put in place. They listed checking generative AI's content as a challenge, and human review and approval of high-risk or safety decisions as a control. The industry survey answers were self-reported, and the research did not evaluate whether the AI technologies it cites were appropriate, but its findings point the same way as the law: check the draft.

Who is responsible for an AI-drafted risk assessment

Regulation 3 puts the duty on the employer or self-employed person. It says nothing about who, or what, types the words. HSE makes the same point about outside help: you can do the assessment yourself, and if you bring in a consultant, managing health and safety is still your legal duty as the employer. Software cannot take on more of that duty than a consultant can.

An AI tool also has a limit a consultant need not have: it cannot visit your site. It works from what you tell it, and where you said nothing, it can only guess at what usually applies. Its drafts read just as smoothly when they are wrong, so a missing hazard is easy to skim past.

If something goes wrong, "the AI wrote it" explains how the document was made. It does not explain why the controls were not there.

Check the draft against HSE's five steps

HSE sets out five steps for managing risk. They make a good first pass over any draft, however it was made.

1. Identify hazards. Does it cover the whole job, including setting up, clearing away and anything non-routine, and health hazards such as manual handling, chemicals and stress?
2. Assess the risks. Does it say who might be harmed and how, including other contractors, visitors and the public? Do the likelihood and severity match your own judgement?
3. Control the risks. Could a hazard be removed altogether? For each remaining risk, is there a practical control, and does it say who does it and by when?
4. Record your findings. Is it written down and dated, and does it say who made it? A record of the significant findings is required with five or more employees, and still sensible with fewer.
5. Review the controls. Does it say when it will be looked at again? Review it when the staff, process, substances or equipment change, after an accident or near miss, or when a control is not working.

Six checks for an AI-drafted risk assessment

HSE's steps apply to any assessment. These target the ways an AI draft in particular can go wrong.

1. Details you never gave it. Read every name, number, date, qualification and piece of equipment. If you did not supply it, find out where it came from: a draft can include a first aider you do not have or a measurement nobody took. Correct it or delete it.
2. Facts it assumed. Look for statements you never made: that two people will be on site, that the area will be fenced off, that someone else will isolate the power. Each one becomes your promise. If it is not true, change the document or change the job.
3. Controls you will not actually use. A draft can cheerfully tell someone who works alone to have a colleague foot the ladder. A control that will not happen is not a control, and leaving it in hides the gap. Write down what you will really do, and if that is not enough, change how the work is done.
4. Hazards only you can see. Your description gives the tool the general version of the job. The specific version is on site: the pavement that stays open below the scaffold, the occupied flat underneath, the fragile roof light, the client's dog that will not stay in the kitchen. Add what is missing. That includes the products you will use: one whose label warns of a health hazard needs its own COSHH assessment, not a passing mention.
5. People the law treats specially. A draft cannot account for people it does not know about. For a young person (under 18), an employer must take particular account of their inexperience, lack of awareness of risks and immaturity. So a 17-year-old apprentice needs that; a 19-year-old is not a young person in law, though any new starter's inexperience still belongs in the assessment. HSE also names migrant workers, new or expectant mothers and people with disabilities as having particular requirements. Add anyone on the job who is in one of these groups, and what you will do differently for them.
6. Stop-work items written as routine lines. Some findings should stop the job, not sit in a table. Asbestos is the clearest case: HSE says it may be in any building built or refurbished before 2000. If you suspect it, stop, do not drill or cut, and get it checked before work goes on. A line such as "asbestos: wear a dust mask" should be deleted and the asbestos question settled first.

Where AI RAMS fits

AI RAMS is our own tool, so weigh this section with that in mind. It drafts risk assessments, method statements and COSHH assessments, each in its own chat: you describe the job, answer its follow-up questions, generate the draft, read a watermarked preview and edit anything that does not match your site. Creating, previewing and editing are free, with no card needed. Downloading is paid: you pay once per document, which unlocks its downloads, including after later edits, or take Pro for unlimited downloads.

It has the same limits as any AI tool: it knows only what you tell it and cannot see your site, so the checks above still apply. If you also need a method statement, it is a separate document from its own chat. That chat can start from a risk assessment you have already made, but once both exist, nothing checks the two against each other, so read them side by side. AI RAMS does not make construction phase plans. If you want to try it, you can start a draft here.

For a walkthrough, see drafting a method statement in AI RAMS, step by step. Still deciding how to produce your risk assessment? See how to choose between a template, an AI tool and a consultant.

Before anyone works to it

Whatever drafted it, the risk assessment is yours. Read it against the real job, run HSE's five steps and the six checks above, and fix what does not match. If the work is high risk or new to you and you cannot tell whether the draft is right, get help before anyone works to it: HSE's guidance on appointing a competent person says that if you do not have the competence in-house, "you can get help from a consultant or adviser". Once it is right, make sure the people doing the work know the controls, and review it when the job changes.

Frequently asked questions

Are AI-generated risk assessments legal in the UK?

Yes, you can use AI to draft one. In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient risk assessment and says nothing about who, or what, types the words. The duty to make sure the result meets that test stays with the employer or self-employed person, not with the tool.

What does suitable and sufficient mean for an AI risk assessment?

The phrase comes from regulation 3 of the Management of Health and Safety at Work Regulations 1999. The regulations do not define it, but they say the assessment is for identifying the measures needed to comply with the law. Our plain-English reading is that a suitable and sufficient assessment fits this job, these people and this place, and goes far enough to decide the controls. The same test applies however the assessment was written.

Has HSE made a ruling on AI risk assessments?

No. HSE has issued no ruling on risk assessments drafted with AI. Its policy statement of 12 June 2026 says most health and safety law sets objectives without prescribing how to meet them, so it applies regardless of the technology being used. The statement also lists new guidance on how the law applies to AI as work for 2026/27, and nothing in it makes an exception for an AI-drafted risk assessment.

How do I check an AI-generated risk assessment?

Read it against the real job and run HSE's five steps over it: identify hazards, assess the risks, control the risks, record your findings and review the controls. Then look for details you never gave the tool, facts it assumed, controls you will not actually use, hazards only you can see, people the law treats specially, and stop-work items such as suspected asbestos written as routine lines.

What if I cannot tell whether an AI-drafted risk assessment is right?

Get help before anyone works to it, especially if the work is high risk or new to you. HSE's guidance on appointing a competent person says that if you do not have the competence in-house, you can get help from a consultant or adviser. Bringing one in does not move the legal duty from you, just as using software to draft the assessment does not.

---

By Filip Perkon, Director, AI RAMS. Legal points last checked on 5 October 2026 against HSE guidance and legislation.gov.uk. This is general information, not legal advice.