AI Governance for Mining and Resources
OT Security, Autonomous Equipment, and Shadow AI

The Australian mining and resources sector is one of the most aggressive adopters of AI in the country. Autonomous haul trucks at BHP and Rio Tinto sites, predictive maintenance on draglines and conveyors, AI-driven ore grade prediction, and machine learning-based safety incident forecasting are no longer experimental, they are production systems handling billions of dollars of assets and, critically, human lives.

This creates a risk surface that is qualitatively different from AI deployment in financial services or healthcare. When a bank's AI model makes a poor credit decision, the consequence is a bad loan. When a mining AI fails, the consequences can include equipment collisions, fatalities, and environmental disasters. The stakes of poor AI governance in mining are uniquely severe.

At the same time, the corporate and enterprise layer of mining companies faces the same shadow AI challenges as every other industry. Workers at BHP, Rio, Fortescue, South32, and Newmont use ChatGPT, Copilot, and dozens of other unsanctioned AI tools to draft reports, analyse data, and summarise documents, often pasting sensitive operational, financial, and personnel data into public AI services without oversight.

Effective AI governance in mining must address both layers: the operational technology (OT) layer where safety-critical AI runs, and the enterprise IT layer where shadow AI proliferates.

Traditional mining IT security was built around a clear air gap between operational technology (OT) systems controlling physical equipment and IT networks running business applications. That air gap no longer exists in most modern mine sites.

Autonomous haul trucks communicate over LTE/5G networks. Predictive maintenance platforms pull real-time sensor data into cloud analytics pipelines. Remote operations centres in Perth and Brisbane control equipment thousands of kilometres away. AI systems trained on corporate data make decisions that directly affect physical processes.

This convergence creates specific AI governance challenges:

Supply chain AI risk. Mining AI is rarely built in-house. It comes from equipment vendors (Caterpillar, Komatsu, Epiroc), specialist OEM software providers, and system integrators. Each introduces AI models into your environment that you did not train, may not fully understand, and may not be able to inspect. AI governance frameworks must extend to third-party and embedded AI, not just internally-built systems.

Model drift in harsh environments. AI models trained on historical operational data will drift as conditions change, ore grades shift, equipment ages, operator behaviour evolves. Without monitoring, a predictive maintenance model that was 95% accurate at deployment may quietly degrade to 70% accuracy, generating missed fault predictions and unexpected equipment failures. Governance requires ongoing performance monitoring, not just deployment sign-off.

Adversarial AI risk in OT. State-sponsored and criminal threat actors have demonstrated the ability to compromise OT systems. AI components in OT environments create new attack vectors: manipulating sensor inputs to cause AI misclassification, poisoning model training data to introduce predictable failure modes, and exploiting AI decision-making systems to cause unsafe equipment behaviour. These are not hypothetical, they are documented attack classes that mining companies must assess.

Safety-critical AI in mining, autonomous vehicles, collision avoidance systems, slope stability monitoring, and gas detection, has a different risk profile from enterprise AI. Failures can result in fatalities, and the obligation to govern these systems is not merely regulatory: it is moral.

Select standards for the system and hazards. Competent engineers should identify the applicable safety standards and validate the controls for the equipment and its operating environment. ISO 17757 covers additional safety hazards of autonomous and semi-autonomous earth-moving and mining machine systems. ISO 13849 addresses safety-related parts of machinery control systems.

Plan intervention and emergency response. Define how operators recognise unsafe conditions, intervene and bring equipment to a safe state. Validate stopping behaviour, emergency controls, communications and operator training against the site’s hazard assessment and engineering requirements. Response times must suit the equipment and operating conditions, not an assumed universal threshold.

Explainability is non-negotiable. When a safety AI makes a decision, stopping a haul truck, triggering an evacuation alarm, flagging a slope instability risk, the operators and safety teams must be able to understand why. Black-box models making safety decisions without audit trails create regulatory exposure and, more importantly, prevent learning from near-misses and incidents.

Incident investigation evidence. Keep records that support investigation of incidents and near misses, including relevant system inputs, outputs, operating conditions and timestamps. Set retention periods against the applicable jurisdiction, record type, safety-management arrangements and investigation needs.

While the safety-critical AI governance challenge is unique to mining, the shadow AI problem is universal, and mining companies are not immune.

Geologists use AI tools to interpret seismic data and generate exploration reports. Finance teams use AI to model commodity price scenarios. HR teams use AI to draft position descriptions and screen CVs. Communications teams use AI to write announcements and stakeholder updates. In every case, there is a high probability that sensitive data, exploration results, reserves estimates, merger discussions, personnel performance data, is being pasted into public AI services without controls.

The specific mining exposure. Mining companies are subject to ASX continuous disclosure obligations. Unpublished exploration results, reserves estimates, and production data that are material to share price are subject to strict confidentiality requirements. If an employee pastes a preliminary drilling result into ChatGPT to generate a summary, that data may be used to train future model versions, creating a potential market-sensitive disclosure. Workforce AI Security platforms that log and control what data enters public AI tools are not just a security control, they are a regulatory compliance requirement for ASX-listed miners.

Shadow AI inventory for mining companies. In a typical mining company corporate office environment, the shadow AI tools in most common use include: ChatGPT (data analysis, reporting), Microsoft Copilot (emails, documents, Teams), GitHub Copilot (internal software development), Perplexity (research), and various AI-powered geology and mine planning tools with embedded LLM components. Not all of these are sanctioned, and very few are governed.

Australian mining companies operating AI systems face a layered regulatory framework:

Safe Work Australia and State Mining Regulations. Work Health and Safety Act obligations apply to AI systems that affect workplace safety. AI systems controlling autonomous vehicles, blast management, gas detection, and emergency response fall within scope. The duty to identify and manage hazards extends to hazards created by AI system failures.

ASX Continuous Disclosure (Listing Rule 3.1). AI-assisted analysis that generates or processes material non-public information (MNPI), exploration results, reserves estimates, production forecasts, must be governed to prevent inadvertent disclosure through public AI services.

Privacy Act 1988 and Australian Privacy Principles. Employee data, contractor data, and community data processed by AI systems are subject to the Privacy Act. Mining companies using AI for workforce management, safety monitoring (including biometric data from wearables), and community engagement must assess privacy obligations.

ISO/IEC 42001, AI Management System Standard. This voluntary standard can help mining companies structure AI responsibilities, risk assessment and continual improvement. The management-system scope should reflect the organisation’s AI uses. Certification does not replace mining safety obligations or establish the safety of an individual autonomous system.

Emerging obligations. The Australian Government's AI Safety Framework (2024) and the proposed mandatory guardrails for high-risk AI uses will, when enacted, impose additional obligations on mining companies using AI in safety-critical and high-impact contexts. Companies should be building governance infrastructure now rather than scrambling when mandatory requirements take effect.

A practical planning model can group mining AI into three environments: operational technology (OT), mine-site IT and corporate office use. The tiers below are illustrative priorities, not ISO certification categories or a universal legal classification.

**Tier 1, Safety-Critical AI (OT Layer)** Prioritise safety assurance. Applies to: autonomous haul trucks, collision avoidance systems, slope stability AI, gas detection, blast management. Controls to assess: Hazard and functional safety assessment against applicable standards, intervention and emergency-control testing, full audit logging, incident investigation retention, vendor AI transparency requirements, regular model performance validation, change control process for any model update.

**Tier 2, Operational AI (Mine Site IT)** Prioritise operational reliability. Applies to: predictive maintenance, ore grade prediction, drill-and-blast optimisation, fleet management AI. Controls to assess: Performance monitoring and drift detection, explainability requirements for high-consequence decisions, data governance for training datasets, change management process, integration with safety management systems.

**Tier 3, Enterprise AI (Corporate Office)** Prioritise secure employee use. Applies to: employee AI tool usage, AI-assisted reporting, finance and HR applications. Controls to assess: Shadow AI discovery, acceptable use policy, data classification controls preventing MNPI entry into public AI, access controls, usage monitoring and logging.

**Cross-tier governance considerations:** - AI risk register covering all three tiers - Designated AI governance owner (typically CISO or CTO) - Vendor due diligence process for AI components in procured systems - Annual AI governance review with board sign-off - Incident response procedure for AI-related safety and security events