Mining has spent years identifying fatal risks and documenting critical controls. In 2026, the test is changing: leaders increasingly need to show that those controls are specific, owned, verified in the field and acted on when performance degrades.
Three developments make the shift hard to ignore.
Queensland coal mines reached the end of the transition period for new critical-control requirements on 1 June 2026. ICMM released an updated Critical Control Management guide with a stronger emphasis on performance, accountability, verification and action. And a July 2026 inspection campaign in New South Wales resulted in 321 compliance notices across 85 of the 123 mine sites attended.
The message is not that the industry lacks procedures. It is that a documented control is not the same as a control that will work when demanded.
From “identify and document” to “verify and act”
ICMM’s updated guide describes the next stage plainly: move from identifying and documenting controls to verifying and acting.
That distinction matters because critical-control programs can look mature on paper while remaining weak at the operating interface. Bowties may be complete, but the controls are vague. Verification schedules may be full, but checks test attendance or paperwork rather than control health. Dashboards may report completion rates without showing what failed, what is deteriorating, or whether action was effective.
The updated guide defines critical-control performance requirements as the standards or criteria a control must meet to achieve its objective. It says those requirements should be specific, measurable and realistic. Verification then checks whether those requirements are being met in practice, usually including physical confirmation that the control is implemented.
This is a more demanding standard than “procedure available” or “worker trained.” It asks whether the barrier itself is healthy.
For a vehicle–person interaction risk, for example, the useful question is not simply whether a traffic management plan exists. It is whether separation, visibility, communications, exclusion zones or proximity controls are present, functioning and understood under actual operating conditions.
Regulation is sharpening the expectation
Queensland’s QGN35 guidance was developed to support the integration of critical controls into Principal Hazard Management Plans for coal mines. The guidance records that the legislative provisions commenced on 1 June 2025 with a one-year transition period, making compliance required by 1 June 2026.
The intent extends beyond inserting a new section into a PHMP. QGN35 is directed at the development, implementation and maintenance of critical controls, including review of their effectiveness.
That implementation challenge is visible elsewhere. In July 2026, the NSW Resources Regulator attended 123 mine sites across coal, metalliferous, extractives and small-mine sectors. It issued 321 compliance notices at 85 sites. The leading topics included unintended interaction with rotating or moving equipment, exposure to airborne contaminants and vehicle or mobile-plant collisions.
The notice total is not, by itself, a measure of critical-control maturity, and not every notice related directly to a critical control. It is nevertheless a clear warning: written systems and field conditions can diverge at scale.
A separate NSW assessment of vehicle–person interaction in shot-firing zones examined whether relevant risk assessments and traffic plans addressed the hazard, personnel were trained, and mines could explain how controls were verified as present and performing as designed. Its recommendations included planned task observations and critical-control verification, alongside practical measures addressing blind spots, reversing, separation and communications.
The regulatory direction is consistent. Leaders should expect scrutiny of both the design of controls and the evidence that they work.
Five tests for an assurance-ready control
Mining executives do not need another layer of generic reporting. They need a sharper test of whether each critical control is governable in practice.
1. Is the control genuinely critical?
A long list weakens focus. A critical control should materially prevent a fatal or catastrophic event, or materially reduce its consequence. Training, procedures and inspections may support a control without being the control itself.
Separating controls from supporting and verification activities is essential. Otherwise, assurance effort can be concentrated on the wrong things.
2. Is expected performance unambiguous?
Statements such as “maintain effective separation” or “comply with procedure” are difficult to verify. A usable performance standard defines the control’s objective, owner, measure, tolerance and required evidence.
If two supervisors can interpret the standard differently, it is not yet strong enough.
3. Does verification test control health?
Counting completed checks measures activity. It does not necessarily measure assurance.
Verification should be designed around how the control can erode or fail. It may require field observation, testing, document review, worker engagement or technical inspection. The method and frequency should reflect the control’s nature: a permanent engineered barrier demands a different assurance approach from a human-dependent control used every shift.
4. Are failures connected to decisions?
A failed verification is a decision point, not a dashboard colour.
The escalation path should define who is notified, what interim protection is required, who can accept continued operation, how corrective action is tracked, and what evidence is needed before the control is considered restored.
Leaders should be especially alert to recurring weak signals: repeated tolerances, overdue actions, inconsistent site interpretations and verification records that show high completion but little adverse finding.
5. Can the organisation reconstruct the story?
When a regulator, board or internal reviewer asks how a control was selected, approved, changed and verified, the evidence should be coherent.
That means preserving the link between the hazard, unwanted event, bowtie, control objective, performance standard, erosion factors, verification activity, result, action and approval. Fragmented spreadsheets and uncontrolled document versions make that chain difficult to defend.
What leaders should ask for now
The executive view of critical-control assurance should be concise but substantive.
For each material unwanted event, leaders should be able to see:
- the small set of controls that matter most
- the current approved performance standard for each control
- named risk, control and verification owners
- verification quality and findings, not only completion
- controls outside tolerance and the operational response
- repeat failures, overdue actions and emerging erosion patterns
- the source evidence behind the reported status
- material changes to controls, operating context or assumptions
This is not a request for more data. It is a request for a clearer chain from risk to evidence to action.
Where AI can help, and where it must stop
Critical-control management involves substantial structured work: reviewing standards and procedures, defining bowties, rationalising large control sets, writing measurable performance requirements, designing verification activities and maintaining consistency across documents and sites.
AI can reduce the administrative burden and expose gaps, but it should not approve a critical control or replace competent judgement.
MineGuard AI’s Critical Risk AI is designed around that boundary. It uses site standards, procedures and risk registers to assist teams in developing bowties, critical controls, performance standards and verification programs. Its published workflow supports defining owner, intent, measure, tolerance and evidence requirements; setting verification frequency, method and pass/fail criteria; checking for vague or inconsistent material; and exporting controlled assurance packs.
The system is AI-assisted and human-approved. Site leaders and competent risk owners remain responsible for approval and implementation. MineGuard’s broader trust model adds evidence traceability, named human approval and audit logging so the technology supports accountability rather than obscuring it.
The practical opportunity is not automated safety. It is a more consistent way to turn fragmented safety documents into reviewable control logic, then keep human attention on whether the control is credible in the field.
The leadership shift
The next phase of critical-control maturity will not be won by adding more bowties or increasing checklist volume.
It will be won by making fewer controls more explicit, testing the conditions that determine whether they work, responding decisively to weak signals, and preserving evidence that connects field reality to leadership decisions.
In the proof era, the question is no longer “Do we have a critical-control program?”
It is: Can we demonstrate that the controls protecting people today are the right controls, performing to standard, with accountable action when they are not?
Book a MineGuard AI walkthrough to see how Critical Risk AI can help structure bowties, performance standards and verification programs while keeping control approval with your people.