Why are regulators looking at this now?
- Vår Energi, automated drilling. Havtil audited the company from 10 to 12 December 2025, sent a notification of order on 21 January 2026 and issued the order on 5 February 2026. It found three non-conformities, on qualification of technology, analyses and non-conformity handling, which “individually and collectively constitute serious breaches of the regulations”. The order requires criteria for the development, testing and use of automated drilling technologies, and a binding plan within two weeks (Havtil, published 6 February 2026). More detail is on after a regulator letter or order on AI.
- Aker BP, Yggdrasil. Havtil audited risk management and qualification of new technology such as AI from 17 to 22 June 2026. It also checked that its 2025 guidance letter on AI had been “made known and evaluated”. It found two non-conformities: technology qualification, and risk management and risk understanding linked to the planned use of robots (Havtil, published 22 October 2026).
- United Kingdom. HSE stated on 12 June 2026 that health and safety law already requires a risk assessment for uses of AI that affect workplace health and safety (HSE).
- Seveso and COMAH sites. The duty to manage change already applies. Seveso III, Annex III and COMAH 2015, Schedule 2 require a safety management system that covers modifications, and an AI change to the process is one. See AI management of change.
What does HTO mean?
HTO stands for human, technology and organisation. The Norwegian term is MTO (menneske, teknologi, organisasjon). Havtil says it focuses on how companies assess risk “from a holistic perspective that includes humans, technology and organisation (HTO)” (Havtil).
In plain terms, a new technology is safe only if the people who use it and the organisation around it change with it. Havtil links a lack of coherence between technology, work processes, situational awareness and human factors to a loss of confidence in the technology and a higher risk of failure in critical operations.
The same idea has other names in English: human and organisational factors, a sociotechnical view, or “people, plant and process” in process safety. In French it is close to FOH, facteurs organisationnels et humains.
Readiness checklist: what should a site be able to show?
Each item is drawn from what the 2026 Havtil audits and its 2025 letter on AI ask for.
- Criteria for development, testing and use. Written before the technology is used, and representative of the real conditions of use, as Havtil requires.
- Technology qualification. Evidence that the AI or automation meets the requirements that apply, including where it is adapted to solutions already accepted on the site.
- Risk assessed as a whole. Analyses that look at human, technology and organisation together, individually and collectively, before the decision to introduce the technology, with the major accident risk stated. See AI and HAZOP.
- Work processes and procedures. Changed in step with the technology, not after it.
- Roles and responsibilities. Redefined where automation moves tasks between people and systems, with an organisational management of change where needed.
- Operator competence and confidence. Training and drills for the people who use the technology, as Havtil’s 2025 letter expects, and the ability to run without it. See operator competence when AI runs the plant.
- Non-conformity handling. Deviations found in testing or use are recorded, assessed and closed.
- A management of change record for each AI change. Deployment, retraining, new input data and vendor updates. See AI management of change.
- Regulator guidance known and evaluated. Havtil’s 2025 letter on AI, HSE’s 2026 statement, and the guidance of your own regulator, read and assessed against your activities.
How can I help before the regulator comes?
I carry out an independent readiness review of your automation and AI changes against this checklist and the regulations that apply to your site. I lead and conduct each review myself, drawing on about 30 years running and auditing oil, gas and chemical operations, including more than 50 management system audits in over 20 countries. You receive the gaps ranked, with owners and actions, before an inspector asks the same questions.
To scope a review, get in touch, or start with an autonomous operations briefing.
What you can expect from XO Autonomous Operations
- An independent review of your automation and AI changes against the readiness checklist and the regulations that apply to your site.
- The gaps ranked, with owners and actions, before an inspector asks the same questions.
- The review led and conducted by Carl Goodwin.
Sources
- Havtil, Order to Vår Energi: risk assessment and qualification of automated drilling operations, published 6 February 2026.
- Havtil, Aker BP, Yggdrasil: risk management and qualification of new technology such as artificial intelligence, published 22 October 2026.
- Havtil, Follow-up of artificial intelligence and safety, 2 June 2025.
- HSE, HSE’s regulatory approach to artificial intelligence, 12 June 2026.
Questions
What is HTO in safety?
HTO stands for human, technology and organisation (MTO in Norwegian). It means assessing risk from all three together, so that a change in technology is matched by changes in work processes, roles, competence and the organisation. In English it is also described as human and organisational factors, a sociotechnical view, or people, plant and process; in French it is close to FOH, facteurs organisationnels et humains.
What will a regulator ask about AI and automation changes?
Recent Havtil audits looked at criteria for development, testing and use, technology qualification, analyses and risk assessments made before the decision to introduce the technology, non-conformity handling, and whether the operator had made its 2025 guidance letter on AI known and evaluated it.