Upstream energy operations generate a dense and continuously expanding portfolio of regulatory deliverables: safety cases, safety and environmental management system (SEMS) documentation, well control and blowout contingency plans, environmental impact assessments, oil spill response plans, quantitative risk assessments, barrier management reports, and decommissioning submissions. Historically these deliverables have been assembled manually through document-centric workflows in which risk information is transcribed, reformatted, and re-argued for each submission. The result is a persistent gap between the live risk state of an asset and the risk picture presented to the regulator.
This paper reviews the decade from 2010 to 2020 and asks what has genuinely advanced in the automation of risk assessment for regulatory purposes, as distinct from what has merely been digitised. A structured review of 148 peer-reviewed and grey-literature sources was conducted, supported by an analysis of five offshore regulatory regimes and a coding framework covering six dimensions of automation maturity. Six clusters of advance are identified: dynamic Bayesian risk updating, digitalised barrier and bow-tie management, machine learning for precursor and anomaly detection, natural language processing for regulatory requirement extraction, digital twin coupling of process simulation with risk models, and automated evidence and audit trail generation.
The review finds that analytical capability has advanced considerably faster than assurance capability. Methods for computing risk from live data matured substantially over the decade, while methods for demonstrating to a regulator that a computed risk figure is credible, traceable, and owned by a competent person advanced very little. This asymmetry, rather than any shortfall in algorithmic sophistication, is identified as the binding constraint on regulatory adoption.
The paper proposes a six-layer reference architecture, designated ARAF-URD (Automated Risk Assessment Framework for Upstream Regulatory Deliverables), that treats the regulatory deliverable as a queryable, versioned view over a governed risk knowledge base rather than as a document to be authored. Central to the architecture is a requirement-to-evidence traceability model in which every assertion in a submission resolves to a dated, attributed, and reproducible evidence object. Four illustrative cases, based on synthetic but operationally representative data, demonstrate the architecture applied to a deepwater drilling permit, a SEMS annual audit cycle, a flaring and venting environmental submission, and a decommissioning comparative assessment. The paper closes with a research agenda organised around validation, explainability, regulator-side capability, and the legal allocation of accountability for machine-generated risk assertions.