AI and Chain of Responsibility

Chain of Responsibility is the part of Australian transport law that most people outside the industry misunderstand. It is not a rule about drivers. Under the Heavy Vehicle National Law, Chain of Responsibility (CoR) extends legal accountability for the safety of a heavy vehicle, its driver and its load to every party whose actions, inactions or demands influence the journey. That includes the operator, the prime contractor, the scheduler, the consignor and consignee, the loader and the packer. If your decisions shape how a truck moves, the law treats you as responsible for the safety consequences.

The centrepiece is the primary duty. Each party in the chain must ensure, so far as is reasonably practicable, the safety of its transport activities. Sitting above that, the HVNL imposes a distinct executive due diligence duty on the people who run the business. The most serious breaches are Category 1 offences, carrying maximum penalties that reach $300,000 for an individual and $3,000,000 for a corporation, with the prospect of imprisonment in the gravest cases, and the National Heavy Vehicle Regulator indexes these penalty units over time.

For a midsize transport operator, distributor or large consignor, the operational question is uncomfortable. How do you demonstrate, after an incident, that you took all reasonably practicable steps across fatigue, speed, mass, loading and maintenance, when the evidence is spread across telematics units, spreadsheets, paper run sheets and people's memories? This is where AI, applied with discipline, strengthens your evidence base, and where, just as importantly, it does not absolve anyone of the duty itself.

The primary duty and why it is hard to evidence

The primary duty is deliberately broad. It does not hand you a checklist that, once ticked, guarantees compliance. Instead it asks whether you eliminated or minimised the risks of your transport activities so far as was reasonably practicable. That is a court-tested standard, weighing the likelihood and severity of harm against the cost and difficulty of controlling it.

The practical difficulty is evidential. Reasonably practicable is judged on what you knew or ought to have known and what you did about it. After a fatigue-related crash, an investigator will ask whether your schedule allowed the driver lawful rest, whether you had visibility of accumulated work hours, whether speed and route data showed pressure to cut corners, and whether someone acted when the warning signs appeared. If that information lived in disconnected systems that no one was reading together, the gap between your written policy and your operating reality becomes the case against you.

The shift the law rewards is from periodic, fragmented record-keeping to connected, continuously monitored evidence. That is a data and workflow problem before it is an AI problem, but it is exactly the kind of problem where machine learning adds leverage once the data is joined up.

The executive due diligence duty

Above the operational primary duty sits a personal one. Under the HVNL, an executive of a business that is a party in the chain has a duty to exercise due diligence to ensure the business complies with its primary duty. This is not vicarious liability. It is a direct, personal obligation on directors and senior managers, and the NHVR sets out the kind of steps it expects an executive to take.

In substance, executive due diligence means a senior person must understand the nature of the business's transport activities and their hazards and risks, ensure the business has and uses the resources and processes needed to control those risks, and ensure that information about hazards, risks and incidents is received, considered and acted on promptly. That last element, acting on information, is precisely where good systems matter. An executive who can show a live risk dashboard, documented escalation, and timely action on alerts is demonstrating due diligence. One relying on assurances they never tested is not.

Where AI does real work in CoR

AI does not discharge the primary duty. People and processes do. What AI does is widen the field of view and shorten the time between a risk emerging and a human acting on it. Three areas stand out.

The first is fatigue and work-hours monitoring. Fatigue is among the most heavily regulated risks in heavy vehicle transport, with prescribed work and rest limits and record-keeping obligations. AI helps by reconciling electronic work diary data, telematics and rostering to flag where a planned schedule would push a driver toward a breach, before the trip is dispatched rather than after. The intervention is preventive: the scheduler sees the conflict and changes the plan.

The second is exception detection across speed, route and behaviour. Telematics generates more data than any compliance officer can read. Models that learn normal patterns and surface only meaningful exceptions, such as sustained speeding on a particular corridor or a route that implies an unrealistic timetable, turn a data lake into a manageable stream of human decisions. This is the same predictive, exception-based discipline we describe in our guide to asset-health AI for Australian transport fleets, pointed at safety rather than maintenance.

The third is documentation and audit readiness. Much of CoR compliance is the ability to produce, on demand, a coherent record of what you knew and what you did. AI assists by extracting and structuring information from run sheets, defect reports, induction records and incident notes into a single, queryable trail. The same principle underpins our guide to automated compliance reporting for Australian businesses: the goal is a standing record, not a fortnightly scramble.

What AI cannot do here

It is worth being blunt about the limits, because overselling them is its own compliance risk. AI cannot make a scheduling decision that breaches rest limits acceptable. It cannot substitute for the judgement of a manager weighing a genuine commercial pressure against a safety risk. It cannot stand in the witness box and explain a decision; a person does that. And a model that produces alerts no one reviews is worse than no model, because it manufactures evidence that you were warned and did nothing.

The correct mental model is augmentation. AI expands what your team can see and how quickly they can see it. The duty, the decision and the accountability stay with people. This is the same human-accountability principle that runs through our AI governance framework for Australian midsize business: the system informs, the human decides, and the decision is recorded.

The 2026 Master Code and the direction of travel

In January 2026 the NHVR released the 2026 Master Code, a registered industry code of practice that updates the original 2018 version after two years of consultation across the supply chain. Two features matter for technology planning.

First, the 2026 Master Code shifts from a role-based structure to an activity-based one, recognising that safety risks arise from what people do, not their job title. That reframing rewards operators who can map risk to specific transport activities and evidence the controls around each, which is precisely the kind of structured, activity-linked record that good data systems produce.

Second, and importantly, the NHVR is explicit that the 2026 Master Code does not create new legal obligations or replace existing requirements under the HVNL. It is a guidance and assurance tool that helps parties meet the primary duty they already hold. So the Master Code is not a new compliance deadline to panic about. It is a clearer benchmark for what reasonably practicable looks like, and a useful structure to align your monitoring and evidence against.

A sequencing plan for midsize operators

The build is incremental. You do not need a full AI safety platform on day one, and trying to buy one before your data is in order wastes money. The order below front-loads the work that makes everything else possible.

Phase 1 is the one operators skip and regret. Without a clear map of roles and data, any tool you buy sits on top of fragmentation and inherits its blind spots. Connecting the data in Phase 2 is unglamorous integration work, but it is what turns isolated systems into the joined-up evidence the law expects. Only then does AI exception detection in Phase 3 have clean inputs to reason over.

Fatigue: the risk where AI earns its keep

Of all the CoR risk areas, fatigue is the one where joined-up data and AI monitoring deliver the clearest return, because the failure mode is both common and catastrophic. Fatigue regulation under the HVNL is prescriptive, with defined work and rest limits and a requirement to keep accurate records of work and rest time. The compliance challenge is not understanding the rules. It is maintaining a live, accurate picture of where every driver sits against those limits across a working week, when the inputs arrive from multiple vehicles, depots and shifts.

A scheduler working from a static roster cannot see, at the moment of assigning a job, that a particular driver is approaching a rest-break threshold or has accumulated hours that make the planned run unlawful. By the time a paper diary is reconciled, the trip has already happened. AI changes the timing of the knowledge. By reconciling electronic work diary data, telematics and the proposed schedule, a system can flag the conflict before dispatch, when it can still be fixed by reassigning the work or adjusting the timetable.

The legal significance is direct. The primary duty asks what was reasonably practicable, and the executive duty asks whether information about risks was received, considered and acted on promptly. A system that surfaces a fatigue conflict before dispatch, and a documented decision to reschedule, is close to a textbook demonstration of both. The same workforce data also touches award and rostering obligations, which is why fatigue planning sits alongside the broader Fair Work compliance automation picture rather than apart from it.

What AI does not do is decide that a marginal schedule is acceptable because the freight is urgent. That judgement, and the accountability for it, stays with the scheduler and, ultimately, the executive. The model makes the risk visible in time to act. A person still has to act.

How this connects to the rest of your operation

CoR rarely sits alone. The scheduling decisions that drive fatigue risk are the same decisions that drive service performance, and the dispatch logic that keeps a fleet safe overlaps heavily with the dispatch logic that keeps it efficient. Operators investing in AI dispatch automation for delivery and courier work should design safety constraints into the same system rather than bolting compliance on afterward. Likewise, the broader resilience benefits of AI for supply chain visibility and disruption prediction and the workforce considerations in Fair Work compliance automation intersect with CoR at the roster. The safest operators treat these as one connected system, not five disconnected projects.

The bottom line

Chain of Responsibility makes safety everyone's legal problem, and it judges you on what you can prove you knew and did. AI does not discharge that duty, and any vendor who implies it does is selling you a risk. What AI genuinely offers is reach and speed: continuous monitoring of fatigue, speed and mass exceptions, surfaced as a ranked queue of human decisions, and logged to a standing evidence trail that a director can stand behind. The 2026 Master Code sharpens the benchmark without moving the legal goalposts. The operators who come out ahead will be the ones who connect their data first, let AI widen the field of view second, and keep the duty, the decision and the accountability firmly with people.

Related Reading

• Asset-Health AI for Australian Transport Fleets
• AI Dispatch Automation for Courier Services
• AI Governance Framework for Australian Midsize Business
• Automated Compliance Reporting for Australian Businesses
• AI for Supply Chain Visibility and Disruption Prediction
• Fair Work Compliance Automation with AI