AI can read your whole survey. Or surveil your people.
Most engagement surveys collect more than ratings. They collect comments, the free-text boxes where people actually say what they think. And for years those comments have been the part nobody had time to read properly. A few hundred responses across a dozen questions is thousands of paragraphs. HR teams skim, pull a handful of quotes for the board pack, and the rest sits unread. AI changes that overnight. A general-purpose model can read every comment, group them into themes, and tell you what is rising and falling, in minutes.
That is a genuine gain. It is also where the trouble starts. The same capability that themes a thousand comments can just as easily profile the people who wrote them, infer the mental state of a named individual, or quietly become a monitoring system that workers never agreed to. The difference between those two outcomes is not the tool. It is how you set it up. This piece is about staying on the useful side of that line.
What is actually happening
Two things are colliding right now, and HR is standing where they meet.
The first is capability. Large language models are good at exactly the task open-text feedback needs: reading messy, unstructured human writing and organising it. Tools built into HR platforms now offer comment theming and sentiment summaries as a feature, and a People and Culture lead can do the same thing directly with a general assistant like ChatGPT or Claude. The bottleneck that kept survey comments unread is gone.
The second is a vacuum. The free, government-backed People at Work survey, long the default psychosocial risk-assessment tool for Australian workplaces, is being decommissioned through 2026. SafeWork SA and Comcare have confirmed the timeline: new organisations could register until 1 June 2026, new surveys can be launched until 1 July 2026, and the platform and its reports stay accessible only until 2 October 2026. The stated reason is that changes in legislation and research revealed gaps in the tool. As organisations look for what comes next, commercial AI-powered survey and sentiment products are moving into the space, often promising exactly the individual-level insight that should give a careful HR team pause.
So the timing is sharp. AI can read feedback at scale at the same moment the trusted free tool is leaving and the psychosocial duty on employers is tightening. The instinct to reach for an AI tool is right. The question is what you point it at.
It helps to remember why the comments matter in the first place. Ratings tell you the temperature; the open text tells you why. It is where people raise the thing nobody put on the survey, where an emerging workload or safety problem shows up before it reaches a grievance, and where the early signal of a psychosocial hazard often appears in plain language. Leaving that unread is not a small loss. The reason most teams left it unread was never that it lacked value; it was that reading thousands of comments fairly was more work than anyone had. That is exactly the constraint AI removes, which is what makes the capability worth getting right rather than avoiding.
The practitioner play
Here is a workflow you can run on your next pulse survey that gets the analytical value while holding the privacy and psychosocial line. Take a worked example: you are the People and Culture lead at a 400-person organisation, you have just closed a pulse survey, and you have around 1,200 free-text comments across the open questions.
1. De-identify before anything goes near a model. Strip names, the names of managers and colleagues, team identifiers small enough to single someone out, and any detail that points to one person. If a comment says "since [EMPLOYEENAME] took over [TEAM] it has been impossible," it becomes "since a new leader took over a small team it has been impossible." This is the step most tools skip and the one that matters most.
2. Theme at the aggregate level only. Ask the model to cluster the de-identified comments into themes and tell you how common each is, with a representative paraphrase rather than verbatim quotes that could be traced. A prompt as plain as "Group these comments into the main themes, tell me roughly how many comments sit under each, and write a one-line neutral summary of each theme. Do not attribute anything to an individual" does the job. The output you want is "workload and after-hours contact came up in roughly a quarter of comments," not a list of who is unhappy.
3. Set a minimum group size. Decide a floor, commonly five or ten responses, below which you do not report a result for any team or segment. If only three people in a team answered a question, their feedback rolls up to the next level. This single rule prevents the most common re-identification accident: a "team" result that is really one person's words.
4. Keep a human reading the themes. AI surfaces patterns; it does not understand your organisation. A theme the model labels "negative sentiment about change" might, to someone who knows the context, be a specific and legitimate safety concern. Read the themes, sense-check them against what you already know, and decide what they mean. That judgement is yours.
5. Close the loop, do not score people. Use the themes to drive action and to tell employees what you heard and what you will do. Resist the temptation to turn the analysis back onto individuals or teams as a performance or "engagement score" that follows them around.
A good themed output looks like a short, honest brief: five or six themes, each with a rough share of comments, a neutral one-line summary, and a sense of whether it is rising or settled. From the worked example, you might land on workload and after-hours contact, clarity of role after a restructure, recognition, and confidence in senior leadership, each grounded in the de-identified text rather than your assumptions. That is a board-ready picture you could not have produced by hand in the time available, and it points to action without pointing at people.
The same workflow travels well beyond the annual engagement survey. Exit interviews, onboarding pulses and team retrospectives all generate the kind of open-text feedback that usually goes unread, and all carry the same risk if analysed carelessly. De-identify, theme in aggregate, hold the minimum group size, keep a human reading, and the method holds up across every one of them.
Run that way, AI does the reading you never had time for, and the output is a clearer picture of the workforce, not a dossier on it.
The governance line
Three Australian frameworks bear on this, and together they draw the boundary clearly.
Privacy is the first. Free-text survey comments, and certainly any inference a model draws from them, are personal information when they can be linked to a person. The Australian Privacy Principles still apply: collect only what you need, tell people how their responses will be used, use the information only for that purpose, and keep it secure. The OAIC's guidance on commercially available AI products is blunt on the transparency point: "Businesses should update their privacy policies and notifications with clear and transparent information about their use of AI." It also stresses accuracy, that organisations must take reasonable steps to ensure personal information is accurate, which matters because an AI summary that misreads sentiment and then drives a decision is an accuracy problem, not just a quality one. The employee-records exemption is narrower than people assume: it covers records about current and former employees, not the broader privacy and safety duties around how you analyse feedback, and it does not cover job applicants at all.
Psychosocial safety is the second, and it is the one most likely to be missed. The Commonwealth Code of Practice for managing psychosocial hazards at work names intrusive surveillance as a recognised hazard in its own right, alongside fatigue and job insecurity. Its examples include tracking how and how much people work and technology that monitors employees closely. An AI sentiment system that infers the mood or mental state of identifiable individuals, or that runs continuously in the background, can become exactly that hazard. The control the Code points to is a clear policy on monitoring that is "not excessive or punitive," and genuine consultation with workers about it. In other words, the thing you deploy to understand wellbeing must not itself harm it.
There is a practical thread running through all three: consultation. The Code's control for monitoring is to consult workers about it, and the broader move in Australian workplace law, including the way states are writing digital and automated systems into work health and safety duties, is toward involving people in how technology is used on them rather than informing them after the fact. Telling your workforce that survey feedback may be analysed with AI, and agreeing the limits together, is not a compliance nicety. It is what turns the analysis into something people trust enough to keep being honest in.
Fairness is the third. Whatever the survey reveals, the response that affects a person, a conversation, a change to a role, a support referral, is a human decision that must be made on a fair basis and explained. AI can tell you a theme exists. It cannot fairly decide what happens to the people inside it.
What never to automate
A short list of bright lines keeps the whole thing safe.
Never let AI score, rank or rate named individuals from their survey text. The moment the analysis attaches to a person, it stops being engagement measurement and becomes covert assessment.
Never re-identify. If a result would point to one person, it does not get reported. No exceptions for "but it would be useful to know."
Never feed raw, identifiable comments into a public consumer AI tool with no data protection. Use a tool your organisation has approved, with data handling you can stand behind, and de-identify first regardless.
Never let AI infer the health or psychological state of a named worker and treat that as fact. A model guessing that someone is "burnt out" from a comment is not a clinical judgement, and acting on it as one is both unfair and unsafe.
And never run it silently. People should know their feedback may be analysed with AI, how, and what it will and will not be used for. Consent and transparency are not optional extras here. They are the difference between a survey and surveillance.
The promise of AI in this corner of HR is real and worth taking. It lets a stretched team finally use the feedback people took the time to give, instead of letting it pile up unread. The discipline is to keep AI pointed at the room and never at the person, to de-identify first and decide last, and to remember that the tool you bring in to understand your people is also a tool that can quietly watch them. Set it up so it does the first job and can never do the second.
TheAICommand. Intelligence, At Your Command.
