What did Havtil order Vår Energi to do?
Havtil audited Vår Energi’s risk assessment and qualification of automated drilling operations from 10 to 12 December 2025 and issued the order on 5 February 2026 (Havtil). It found three non-conformities, in qualification of technology, analyses and non-conformity handling, and judged that they “constitute serious breaches of the regulations”.
The order has two parts. Vår Energi must prepare criteria for “the development, testing and use of automated drilling technologies” that ensure health, safety and environmental requirements are met, before the systems are taken into use. It must also present a time-limited, binding plan within two weeks of the letter.
The audit report (in Norwegian) records that the company had no internal process for technology qualification. It had used its management of change process instead, and that process was not adapted to setting and using qualification criteria. Havtil saw acceptance criteria written as general objectives, without concrete human, organisational and technical criteria. Major accident risk did not come through clearly in the risk assessments for the new technology.
The order is about automated drilling technology. Neither Havtil’s summary page nor the text-searchable pages of the report mention AI. In my reading, the same findings would apply to any AI system that acts on a hazardous process.
What do regulators already expect on AI?
On 2 June 2025 Havtil published the content of a letter on AI and safety that it had sent to companies (Havtil). It asks for technical documentation of AI systems that can be made available to the authorities. It also asks for the involvement of users and employee representatives, and for the same requirements on AI used in barrier functions as on any other barrier element. Training and drills are expected for personnel who use AI.
Havtil has since audited another operator on the same subject. Its audit of Aker BP’s Yggdrasil development, carried out from 17 to 22 June 2026 on risk management and qualification of new technology such as AI, found two non-conformities: technology qualification, and risk management and risk understanding linked to the planned use of robots (Havtil, published 22 October 2026).
In the UK, HSE stated on 12 June 2026 that health and safety legislation requires a risk assessment for uses of AI which impact on workplace health and safety (HSE).
Before any letter arrives, the regulatory audit readiness checklist sets out what these audits look for.
What must a site be able to show within two weeks?
- An AI use inventory. Every system whose output reaches a decision about the hazardous process, including vendor features switched on in existing software and tools staff adopted themselves.
- MOC records. For each system, the change record covering deployment, retraining, new input data and vendor updates. See AI management of change.
- Risk assessments. Studies that treat the AI as a node and state the major accident risk. See AI in HAZOP.
- Competence. Who supervises each system, how they were trained, and how they run the plant when it is wrong or down. See operator competence.
- Barriers. Which barrier elements the AI touches, and whether it stays independent of safety instrumented functions. See AI and safety instrumented systems.
Where these records do not exist, the plan the regulator asks for is the place to say when they will.
How do I help after a regulator’s letter?
I spent seven years as a senior operational risk auditor at bp, with control of work and operating limits among my subject areas. I have also run operations, at an upper-tier Seveso polymer plant and a gas processing joint venture in Algeria. After a letter, I help a site build the inventory and the plan, and test its records against the regulator’s questions before it replies. Start with an autonomous operations briefing or contact me.
Questions
Our regulator asked how we manage AI risk in automated drilling. What should we do?
Show, within about two weeks, what AI is in use, how each system went through the safety management system (technology qualification, risk assessment with the major accident risk stated, management of change), and the criteria it must meet before use. Havtil's February 2026 order to Vår Energi set that pattern: a binding plan within two weeks and criteria before the systems are taken into use.