Workplace risk assessments drafted with AI: documents, specialist review and the server

AI for workplace risk assessments: what the draft covers

A local AI can draft a workplace risk assessment: it reads the machine manuals, safety data sheets, incident and near-miss reports and earlier assessments for a workplace, and proposes the hazards, the workers exposed and the measures, each with the source document named. The safety specialist checks the draft at the workplace, corrects it, sets the priorities and signs. The employer remains responsible for the assessment, whoever or whatever wrote the first version.

This guide is for safety officers, HSE managers, plant managers and managing directors of small and mid-sized manufacturers, where one safety specialist, often external and part-time, looks after many workplaces. It explains what EU law asks of the employer, where an AI saves time in the four steps of a risk assessment, which documents it needs, and which server runs it. Legal points are general information on EU directives as of October 2026. Member States transpose the directives into national law, and the national rules, your safety specialist and your legal counsel decide what applies in each plant.

A machine builder's risk assessment is a different document. Under the Machinery Regulation, the builder assesses the machine before placing it on the market and writes the instructions, as our guide to machine manuals with AI explains. The user's workplace assessment takes those instructions as an input and adds what the builder cannot know: where the machine stands, who works at it, which substances are used and what has already happened there.

What EU law asks of the employer

Council Directive 89/391/EEC of 12 June 1989, the framework directive on safety and health at work, sets the duty. Article 5(1) gives the employer "a duty to ensure the safety and health of workers in every aspect related to the work", and Article 5(2) adds that enlisting external services "shall not discharge him from his responsibilities in this area". Article 6(3)(a) requires the employer to "evaluate the risks to the safety and health of workers", including in the choice of work equipment, chemical substances and the fitting-out of workplaces. Article 9(1) requires the employer to "be in possession of an assessment of the risks to safety and health at work", to decide on the protective measures and the protective equipment to be used, and to "keep a list of occupational accidents resulting in a worker being unfit for work for more than three working days".

Article 7 has the employer designate workers for protection and prevention, and enlist "competent external services or persons" where the company lacks competent staff. Article 11 gives workers and their representatives a right to be consulted on measures that may substantially affect safety and health. None of these articles mentions software, and none moves the responsibility away from the employer.

For hazardous chemicals, Council Directive 98/24/EC of 7 April 1998 adds detail. Under Article 4(1) the employer first determines whether hazardous chemical agents are present and assesses the risk taking into account, among other things, their hazardous properties, the information from the supplier such as the "safety data sheet", the level, type and duration of exposure and the occupational exposure limit values. Article 4(2) requires the assessment to be documented and kept up to date, notably after significant changes. Article 4(4) asks for the combined risk where several agents are present, and Article 4(5) states that new work with hazardous chemical agents "shall only commence after an assessment of the risk of that activity has been made and any preventive measures identified have been implemented".

The four steps of a risk assessment, and where the AI fits

EU-OSHA, the EU's agency for safety and health at work, describes risk assessment in four steps on its OiRA site and notes that there is "no single 'right' way" to do it: identifying hazards and those at risk, evaluating and prioritising risks, deciding on preventive action and implementing it, and monitoring and reviewing. It recommends a record with the assessor's name and function, the hazards and risks identified, the workers at risk, the protection measures, the person responsible with dates, and the monitoring and review arrangements.

Steps and record contents from EU-OSHA's OiRA page "How to carry out a risk assessment" (read 25 October 2026); the AI and specialist columns are our summary.

The saving lies in the first and the last rows. Collecting hazards from a 200-page manual, a dozen safety data sheets and three years of incident reports is long reading, and the AI does that reading and returns each hazard with its page reference. Rating and deciding stay human: a model has never stood at the machine, and it does not know that the guard is removed twice a shift for cleaning unless someone wrote that down.

EU-OSHA provides OiRA, its Online interactive Risk Assessment platform, "free of charge to sectoral partners at EU and national levels", who build sector tools from it; the site describes these tools as "enabling micro and small companies to carry out risk assessments". Where an OiRA tool or another sector template exists for your sector, keep it as the structure, and let the AI fill it from your own documents.

The documents the AI reads

Four kinds of document carry most of what the AI needs.

• Machine and equipment manuals. The safety chapter, warnings, residual risks named by the builder, maintenance and cleaning instructions, noise and vibration values where given.
• Safety data sheets. Hazards, handling and storage, exposure controls and personal protection, the sections our guide to safety data sheets with local AI describes. The AI collects the substances used at each workplace and their hazard statements.
• Incident, near-miss and first-aid reports. What has happened, where, with which machine or substance. The AI sorts them by workplace and type, so that the assessment reflects the plant's own history.
• Earlier assessments, inspection notes and photos. Last year's assessment, the safety walk notes, photos of the workplace; a vision-language model reads photos and scanned forms.

The documents go into a search index that the AI queries for each workplace, so every hazard in the draft carries the document and page it came from. The safety specialist can then check the source in seconds. Our guide to preparing company documents for an AI assistant explains how to sort and clean the sources first.

We supply AI servers built to order and set up the models and the document search under our Private AI/ML service; send us the template you use and a list of your document sources, and our team proposes a configuration.

Measures in the order the directive sets

Article 6(2) of the framework directive lists the general principles of prevention: "avoiding risks"; "evaluating the risks which cannot be avoided"; "combating the risks at source"; adapting the work to the individual; adapting to technical progress; replacing the dangerous by the non-dangerous or the less dangerous; developing a coherent overall prevention policy; "giving collective protective measures priority over individual protective measures"; and "giving appropriate instructions to the workers".

That order is useful for checking drafts, by people and by the AI. A draft whose only measure against solvent vapour is a respirator gets a flag: is there a substitute product, can the vapour be extracted at the source, can the task be enclosed. A draft that lists "train the workers" as the only measure for an unguarded nip point gets the same flag. The AI asks the questions; the specialist and the employer decide what is technically and economically possible.

Keeping assessments current

Assessments age with the plant. A new machine, a changed process, a substitute substance or an accident all call for a review, and Directive 98/24/EC requires the chemical assessment to be kept up to date. EU-OSHA's page recommends reviews at regular intervals and a revision when circumstances change.

Here the AI does work that is hard to do by hand. When a supplier sends a revised safety data sheet, the AI compares it with the previous version, lists the changes in hazards and exposure controls, and names every assessment that uses the substance. When an incident is reported, it finds the assessment for that workplace and shows whether the hazard was in it. When a new machine arrives, it drafts the additions from the manual before commissioning.

Safety briefings with AI, and the workers' side

The assessment leads to instructions and training. Article 10 of the framework directive requires that workers receive information on the risks and the measures for their workplace and job, and Article 12 requires adequate safety and health training, notably on recruitment, on a change of job and when new equipment or technology is introduced. Drafting briefings in the languages spoken on the floor is a task of its own, covered in our guide to multilingual shop-floor training with local AI.

Workers and their representatives take part too: Article 11 gives them consultation rights on measures that may substantially affect safety and health, and EU-OSHA recommends drawing up the records with them. An AI assistant used in this work is a topic to raise with them early, as our guide on the works council and an internal AI assistant explains.

Why incident data stays on your own server

Incident and first-aid reports name the injured worker and describe the injury. That is personal data, and data concerning health is a special category under Article 9(1) of the GDPR, whose processing is prohibited unless an exception applies, as our guide to hybrid AI with confidential data kept local sets out. Safety data sheets of your own mixtures reveal compositions, and machine layouts are often confidential. On an own server, these documents stay in your building and the query log is under your retention setting. Your data protection officer confirms the legal basis and whether names can be removed before indexing; for most hazard analysis, the workplace and the type of event are enough.

The server for risk assessment drafts

Drafting risk assessments needs little computing power. One safety specialist works through a few workplaces a day, and the large reading jobs, such as a new manual or a batch of revised safety data sheets, can run overnight. The sensible plan is the company AI server that also carries the assistants for quality, engineering and the office.

Users-per-card rule (0.9 × driver-visible memory, less 3 GiB per card and less the weights): Qwen3.8-27B FP8 weights 30,866,866,928 bytes = 28.75 GiB (Hugging Face file list, read 25 October 2026) with FP8 cache, 1.14 GiB per 32K conversation; gpt-oss-120b about 65 GB = 60.8 GiB (Hugging Face file list, re-read 25 October 2026) with 16-bit cache, 0.5625 GiB per 16K conversation; power by our estimate (cards, processors and 15 per cent for the rest), confirmed by a measurement on the delivered system.

A conversation is one request being answered at the same moment, and a token is a piece of a word; 32K tokens hold a long manual chapter plus the question and the answer. Qwen3.8-27B is described on its model card as a vision-language model that understands images and documents, under the Apache 2.0 licence, which is why it takes the manuals, data sheets and photos. gpt-oss-120b, also Apache 2.0, serves the rest of the company.

The entry server has two NVIDIA RTX PRO 6000 Blackwell Server Edition cards, two AMD EPYC processors, 384 GB of DDR5 ECC memory and two NVMe drives, and runs from one ordinary 230 V 16 A feed in a server room. Without a server room, our Private AI/ML service runs the platform on dedicated hardware in a Tier-3 data centre in Lithuania, inside the EU. Other first tasks for the same server are listed in our guide to first AI use cases in a manufacturing SME, and a company without IT staff finds who does what in an AI server without an IT department.

Notes for the IT team

• Index by workplace. Tag every document with the workplaces, machines and substances it concerns, so that the search for one workplace returns its manual pages, data sheets and incidents together.
• Template output. Let the model fill your assessment template as structured fields (hazard, source, workers, rating proposal, measure, responsible, date) and write them into the document or the HSE software; vLLM supports output constrained to a JSON schema.
• Change triggers. Watch the folders for new safety data sheet versions, manuals and incident reports, and queue a comparison against the affected assessments.
• Access. Incident reports and health data are readable only by the safety specialist and the people your data protection officer names; filter the search by roles from the company directory.
• Logs. Keep the query log under an agreed retention period; it shows which sources a draft was built from.

What we supply

You can buy this system from us: our team sizes the configuration to your workload and budget and replies within one business day. We build AI servers to order with two, four or eight cards, assembled and tested before delivery, delivered anywhere in the EU on one EU contract and invoice, with manufacturer warranty on every component handled through us; quantities and lead time are confirmed in writing with the quote. Our Private AI/ML service, delivered with our engineering partner Vixen.UNO, sets up the models, the document search, access control and the query log. Describe the workplaces and documents you start with, and we propose how to set up the drafting on one server.

FAQ