AI Contractor Prequalification: How It Works and What It Reviews

My team built the prequalification agents in ComplyFlow, which is why the hardest version of the AI question lands here rather than anywhere else. A prequalification decides whether a company may send its workers onto your site.

The shape of the answer is narrower than the marketing around it, and it does not change. An agent is pointed at something specific. It returns findings against criteria somebody wrote down. A person makes the decision. Everything below is what our Help Centre documents, because a capability nobody has written down is not one I am willing to describe.

What an AI Prequalification Agent Is Pointed At.

Three things, and nothing else.

A form question. An agent is attached to one form type, such as a work permit or a SWMS, and then to particular questions on that form. Only compatible question types appear in the picker: text inputs, text areas, and file uploads. One agent can cover several questions, and several agents can target the same question.¹

A document. A file upload is a question type, so a safety management system, a certificate, or a method statement is read the same way a typed answer is.

Review criteria you define. Since the AI Tools V2 release of 29 June 2026 you build the agent yourself through a guided wizard: choose the document type, define the review criteria, configure the agent. The wizard can suggest criteria for the document type you picked, which you keep, edit, weight, or add your own to. You can also nominate specific form questions and entity fields whose answers are sent to the agent as context, and every one of those is recorded in the AI Log.²

That third point is the one procurement teams underrate. The agent is not applying an industry standard it picked up somewhere. It is applying your list. A thin list produces a thin review, and it produces it very confidently.

What the Agent Returns, and What It Does Not.

It returns feedback against those criteria, on that answer or that document, with the criteria visible to both sides. A Display Criteria link on an AI question lets contacts and reviewers see exactly what the AI will assess a response against before a review is run, and the review panel says how many reviews remain on that question.²

What it does not return is a decision. There is no approval inside it, no suitability rating, and nothing that closes a file. The article covering the standard prequalification form in our Help Centre puts the boundary in seven words: once submitted, a human reviews all responses.³

What the Standard Prequalification Form Reviews.

The standard prequalification form combines ordinary compliance data collection with AI review of uploaded documents and written responses. It covers four areas, and they are not all treated the same way.³

Safety Management, Against 24 Criteria.

The contractor picks one of two paths. They upload a safety management system for a single comprehensive review, or they type answers into individual form fields that are each reviewed separately. Both paths are assessed against the same 24 criteria across six areas. Every contractor also uploads a WHS policy, reviewed against four criteria of its own, whichever path they took.³

The six areas are risk management procedure, communication and consultation, contractor management, incidents and corrective actions, worker training and competency, and psychosocial management.³ Psychosocial management sitting in the main six rather than bolted on at the end is the part I would point a safety manager at first.

Contractors get the same list before they submit. The supplier-side guidance sets out what a submission has to demonstrate in each of the six areas, down to naming the hierarchy of control and asking how often risks are reviewed.⁴ Publishing the marking scheme is not generosity. It is what makes a failed criterion mean something, because a contractor who misses a criterion they could read in advance has told you something real.

High Risk Work and the SWMS.

If a contractor declares high-risk activity, they select from 18 categories, from confined space and work at height to disturbance of asbestos and energised electrical installations, and upload a safe work method statement. The agent reviews that statement against the activities they selected.³

That is a narrower job than it sounds, and it is the right size for a machine. The question is whether the document addresses the declared work, not whether the work will be done safely on the day.

Insurances and Certifications, Which Do Not Stop at Approval.

Each insurance question a contractor answers creates a compliance requirement on their profile: the level of public liability cover they hold, workers compensation by state, personal accident, and professional indemnity. They must maintain what they declared and keep current evidence against it, and where a policy expires or evidence is not provided, their compliance status reflects it. ISO 14001 and ISO 9001 declarations work the same way, with the certificate as the evidence.³

Behind that sits the requirement set, which is a named bundle of documents, forms, and training applied to an audience. The screen describes itself as bundling those once, after which ComplyFlow handles the invitations, reminders, and renewals. Add an item to a set and everybody it covers is re-checked and shows as outstanding until they provide it.⁵ That is the mechanism that turns a point-in-time questionnaire into a record that stays current.

Modern Slavery, Which the AI Does Not Review.

The modern slavery section runs ten questions, and the documentation says plainly that the contractor’s responses are not reviewed. They are there to give you visibility into labour practices, risk awareness, and potential areas of concern across your contractor base. Some answers force an explanation: a yes on prior bribery, corruption, or labour and human rights breaches; a yes on workers paying recruitment or placement fees; a no on written contracts before work starts.³

I would keep it that way. Those answers are a declaration a supplier makes about their own labour practices, and a model reading a declaration can tell you it is complete. It cannot tell you it is true. If supplier risk beyond safety is your question, AI in supply chain compliance covers modern slavery reporting, sanctions screening, and document review at supplier scale.

How to Test an Agent Before It Goes Live.

Before you save an agent you can run it against a real sample document and see the actual review result, and you can preview an agent’s criteria from the configuration panel. Each test allows up to two free previews, recorded in your AI Tokens history without consuming any tokens.²

Use them properly. Pick three documents where you already know the answer: one you approved, one you sent back, and the borderline one you argued about internally. Run all three. If the agent passes the one you rejected, the criteria are too loose, and you have found that out on a sample instead of on a live supplier three weeks before a project start.

What a Person Still Decides.

Everything about whether a contractor may be on your site.

That is not a product position. It is where the duty sits. Section 19 of the model Work Health and Safety Act puts a primary duty on a person conducting a business or undertaking to ensure, so far as is reasonably practicable, the health and safety of workers engaged, or caused to be engaged, by the person, and of workers whose activities in carrying out work are influenced or directed by the person.⁶ The second limb is the contractor limb, and it is why prequalification exists at all.

Section 46 adds that where more than one person has a duty in relation to the same matter, each of them must, so far as is reasonably practicable, consult, co-operate and co-ordinate activities with all the others.⁶ Neither duty is discharged by a grade on a screen.

Safe Work Australia has also put the tool itself inside the duty. A person conducting a business or undertaking must manage health and safety risks from AI and digital technologies as much as they reasonably can, just as they would any other hazard, and must consult workers and their health and safety representatives before introducing digital technology that may affect health and safety.⁷ If you are adding an AI reviewer to prequalification, that consultation happens before it goes live, not in the retrospective.

Where the Agent Falls Over.

Three places. I would rather say them than wait for you to find them.

Jurisdiction-specific nuance. Australia has nine work health and safety jurisdictions, and Victoria runs occupational health and safety law rather than the harmonised model. A criterion written with one jurisdiction in mind is applied as written everywhere you use it, without noticing that the wrong Act is being assumed. Write the criteria with the jurisdiction in them, or accept that the review is generic.

Anything that needed a person to have stood in the room. A safety management system describes a consultation process. It cannot tell you the toolbox talk is three minutes of a supervisor reading a form aloud. Documents describe controls. People verify them, which is what site documents and inductions exist to support after prequalification is finished.

The reviewer’s own confidence in the output. This is the failure that is ours rather than the model’s, and it is documented rather than a hunch. Automation bias, the tendency to over-rely on automation, does not spare people who are good at the job: reviewing 74 studies of it in 2012, the Journal of the American Medical Informatics Association found that decision aids lift overall performance while their users stop recognising the errors the aid itself introduces.⁸

Parasuraman and Manzey, reviewing the same ground in Human Factors in June 2010, found the effect in experts as readily as in novices, unpreventable by training or instruction, and present in teams as well as in individuals.⁹ An experienced reviewer is not protected by being experienced. The 2012 review does name something that helps, which is emphasising user accountability: a named person, on the record, for that decision.⁸ That is a process change, not a training day.

What Changes for the Reviewer.

The queue, not the judgement.

What arrives at a procurement reviewer today is a stack of submissions in unknown condition, and most of the week goes on finding out which ones are complete. What arrives afterwards is a stack where the obvious gaps are already marked against criteria you wrote and the contractor could read, and where the incomplete ones went back before they reached you. The decisions left are the ones worth your attention: the borderline method statement, the contractor whose consultation process reads like a template, the subcontractor chain nobody has asked about.

That is a smaller job, and a harder one. For the wider version of this argument across safety work, AI for workplace safety sets out what AI is reliable for and what it should never be handed, and the five AI skills every WHS manager should be building covers the habits that make somebody good at supervising it.