27 August 2026
8 min read
Published by:
The recent introduction of section 26A into the Work Health and Safety Act 2011 (NSW) (WHS Act) has received significant attention from the business community because it elevates the practical significance of approved codes of practice in the management of workplace health and safety risks. Starting from 1 July 2026, PCBUs must either comply with an applicable approved code or be able to demonstrate that an alternative approach achieves an equivalent or higher standard of health and safety protection.
However, section 26A is only part of a broader regulatory story.
Recent developments, including SafeWork NSW's elevation of psychosocial hazards to a key regulatory priority for 2026-27, the expansion of specialist psychosocial regulatory capability, amendments to the Work Health and Safety Regulation 2025 (NSW) and increasing attention on digital work systems, point to a significant shift in regulatory expectations. Together, these developments have established a more comprehensive framework for managing psychosocial risks, with the Managing Psychosocial hazards at work Code of Practice now operating as the mandatory standard following the commencement of section 26A. The Regulator is expected to increasingly scrutinise how businesses manage psychosocial risks in practice, including workload demands, resourcing levels, organisational change, complaint handling processes, workplace culture, and the governance and evidence supporting risk management decisions.
Against that backdrop, section 26A of the WHS Act is best understood as part of a broader regulatory trend towards greater accountability for safety outcomes and a stronger expectation that PCBUs be able to demonstrate, through documented systems, evidence and measurable outcomes, that their controls are effective in eliminating or minimising workplace health and safety risks.
Importantly, this is not simply a compliance issue for WHS teams. The reforms have significant governance implications for boards and senior executives. As psychosocial hazards become an increasingly prominent area of regulatory focus, directors will need to ensure that they are receiving meaningful information about psychosocial risks and that appropriate assurance mechanisms exist to satisfy their due diligence obligations under the WHS Act.
Historically, approved codes of practice in most jurisdictions in Australia provided practical guidance on managing workplace risks and informed assessments (by the regulator) and evidence for the courts as to whether a duty holder had met its WHS obligations.
From 1 July 2026, where an approved Code applies in NSW, a PCBU must either comply with the Code or adopt an alternative approach that delivers an equivalent or higher standard of health and safety.
Importantly, the reform does not eliminate flexibility. Businesses can still develop controls tailored to their operations, workforce and the risk profile of certain tasks or activities.
The practical challenge for duty holders is no longer simply determining how a risk should be managed. It is demonstrating often after an incident has occurred or during a regulatory investigation, why a particular approach was adopted and what evidence supports the conclusion that it provides an equivalent or superior level of protection to which is set out in an applicable code of practice.
Approved codes are therefore likely to operate as the reference point against which alternative approaches are measured.
It should be noted that Queensland has for many years required duty holders to either comply with approved codes of practice or adopt measures that provide an equivalent or higher standard of health and safety. Victoria also operates within a comparatively prescriptive regulatory framework through detailed occupational health and safety regulations and compliance codes addressing a range of workplace hazards.
Viewed in that context, the move to make codes mandatory in NSW is best understood as part of a broader national trend towards greater regulatory scrutiny, more structured risk management systems and increased accountability for organisational decision making. Businesses operating across multiple jurisdictions should expect psychosocial risk management to remain a significant area of regulatory focus.
Officers continue to owe a personal due diligence duty under section 27 of the WHS Act or the equivalent under the Victorian OHS Act where an officer can be guilty of an offence if the breach is attributable to their actions. The duty of due diligence requires an officer to take reasonable steps to ensure that the business complies with its duty. This means an officer must acquire and keep up-to-date knowledge of WHS matters and ensure the PCBU has appropriate processes and resources to eliminate or minimise risks within its operations and that systems are placed to verify that these processes are effective.
The elevation of approved codes of practice means that boards should increasingly view compliance with relevant codes as a governance issue. Where an organisation departs from an applicable code, directors should be satisfied that management can clearly articulate the basis for that decision and provide evidence demonstrating that the alternative approach achieves an equivalent or higher standard of health and safety. This is particularly important given officers may face personal liability where they fail to discharge their due diligence obligations under section 27 of the WHS Act.
From a governance perspective, one of the key risks arising from section 26A is that organisations may be unable to demonstrate why particular risk management decisions were made. The focus is therefore likely to shift from whether an organisation had policies in place to whether it can produce evidence showing that risks were identified, assessed, controlled and reviewed in accordance with contemporary WHS expectations.
For example, it is important to ensure businesses keep contemporaneous evidence demonstrating:
The significance of mandatory codes perhaps is most evident in the context of the Managing Psychosocial hazards at work Code of Practice (Code). The reform elevates the Code from a practical guidance document to the main compliance reference point against which psychosocial risk management is likely to be assessed and tested in a court, and is the benchmark for whether a PCBU can demonstrate an equivalent or higher control.
The Code identifies a range of common psychosocial hazards, including:
Importantly, the Code does not approach these issues as individual conduct or wellbeing concerns. Instead, it adopts the structured WHS risk management framework of identifying hazards, assessing risks, implementing controls and reviewing their effectiveness.
A notable feature of the Code is its systems-based approach. Rather than focusing solely on the worker experiencing stress or psychological injury, the Code encourages organisations to examine whether the design, organisation and management of work are contributing to the risk.
For example, where excessive workload is identified as a psychosocial hazard, the focus should be on whether changes must be made to workload allocation, staffing levels, deadlines, work demands and supervision, rather than administrative controls such as resilience training.
As part of their governance and assurance processes, boards may wish to ask management the following questions:
The move in NSW to make mandatory approved codes of practice reflects a broader regulatory shift across Australia for a more structured and evidence-based approach to risk management, with a corresponding emphasis on the role of an officer to verify that the business is implementing the steps set out in the codes and regulations.
This reform, alongside regulatory priorities and the emerging focus on digital work systems all point in the same direction - businesses are increasingly expected to have systematic processes for identifying, assessing, controlling and reviewing workplace risks and importantly, with respect to an officer’s duty of due diligence, must be able to demonstrate that those processes are effective.
For PCBUs, this also means treating psychosocial hazards like any other serious WHS risk and, where departing from an approved code, being able to clearly justify and document why an alternative approach provides an equivalent or better health and safety outcome.
For directors and officers, the reforms reinforce the importance of active oversight of psychosocial risk management. Questions regarding workload, organisational change, psychological health and workplace culture are increasingly WHS governance questions. Boards that seek meaningful assurance regarding psychosocial risks and the effectiveness of organisational controls will be better placed to satisfy their due diligence obligations and respond to regulatory investigation and scrutiny.
Businesses should expect continued proactive compliance activity by safety regulators in relation to psychosocial hazards, including inspections, targeted campaigns and the use of compliance tools such as improvement notices, prohibition notices and infringement notices where deficiencies are identified. As psychosocial hazards remain a key regulatory priority, organisations should ensure that their governance, reporting and assurance frameworks can demonstrate, through evidence, not only that risks have been identified, but that they are being effectively managed.
If you have any questions, please contact us here.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
