A Guide to Australia's New Psychosocial Safety Rules for HR

Here's what most Australian employers are calling a psychosocial safety programme: a fruit bowl. An EAP number somewhere on the intranet. A mindfulness session at the last team day. Maybe a wellbeing survey that nobody read the results of. ❌

As of 1 December 2025, every Australian state and territory has enforceable obligations to actively identify, assess, and control psychosocial hazards at work – not react to them, not offer support after the fact, but prevent them. The same penalties that apply to a broken staircase or an unguarded machine now apply to chronic overwork, or badly handled restructure.

This guide covers what's changed, what you're legally required to do, where the real risks are hiding – and what "good" actually looks like in 2026. ⬇️

First, A Quick Recap: How We Got Here

Australia's regulatory journey on psychosocial safety spans about a decade, but the critical moves happened between 2021 and late 2025.

1. New South Wales led the way, introducing the first dedicated Code of Practice for managing psychosocial hazards back in 2021
2. Safe Work Australia then updated the national model WHS Regulations in 2022, formally requiring employers to identify and control psychosocial hazards across most jurisdictions
3. Western Australia followed in 2022; Tasmania, Queensland and the Commonwealth jurisdiction came in 2023.

The last piece dropped on 1 December 2025 – Victoria, which operates under its own Occupational Health and Safety Act rather than the national model laws, introduced the OHS (Psychological Health) Regulations 2025.

➡️ With that, every Australian state and territory now has explicit, enforceable obligations to manage psychosocial hazards. Specific rules about how risks must be identified, assessed, controlled, and reviewed.

Then there's NSW, which added another layer. From 13 October 2025, new legislation introduced section 26A to the WHS Act 2011 (NSW), taking effect on 1 July 2026. This converts approved Codes of Practice – including the Managing Psychosocial Hazards at Work Code – from advisory guidance into legally enforceable compliance benchmarks.

💬 Regulators no longer need to prove harm occurred. Simply falling short of the Code can constitute a breach.

And from March 2025, a national Code of Practice on Sexual and Gender-Based Harassment came into force – sitting alongside the existing psychosocial framework and adding proactive prevention obligations around harassment both in-person and online.

So What Exactly is A Psychosocial Hazard?

It's worth pausing here, because there's still a lot of confusion about what actually qualifies.

A psychosocial hazard is anything at work that could cause psychological harm – the list is a lot broader than most employers realise. Safe Work Australia identifies 17 common psychosocial hazards in the national Model Code of Practice. They include:

• High job demands – excessive workloads, tight deadlines, cognitive overload
• Low job control – little autonomy over how, when, or where work gets done
• Poor support – inadequate resources, absent or ineffective management
• Low role clarity – unclear responsibilities and conflicting expectations
• Poor organisational change management – restructures and redundancies handled without adequate planning or consultation
• Inadequate reward and recognition – effort that goes routinely unacknowledged
• Poor organisational justice – perceived unfairness in how decisions get made
• Traumatic events or material – exposure to distressing content, people in crisis, or critical incidents
• Remote or isolated work – physical or social isolation from colleagues
• Violence, bullying, and harassment – including sexual harassment, now covered by a separate national Code
• Poor workplace relationships – persistent interpersonal conflict, incivility, discrimination

The Commonwealth jurisdiction's Code adds three more that are worth factoring in regardless of where you're based: 1️⃣ fatigue, 2️⃣ intrusive surveillance, and 3️⃣ job insecurity.

Why hazards combine and compound

One thing regulators are quite clear about is that psychosocial hazards don't operate in isolation.

➡️ A worker dealing with high job demands might manage fine – until they also have low job control, poor support from their manager, and a restructure looming. Those three hazards together create a level of risk far greater than any single factor. ⚠️

This interaction effect matters a lot for how you conduct your risk assessment. You can't just tick off each hazard in isolation and call it done.

The Numbers That Should Get Leadership's Attention

If you're trying to get a boardroom or executive team to take this seriously, lead with the data.

According to Safe Work Australia's Key WHS Statistics Report (October 2025), mental health conditions now account for 12% of all serious workers' compensation claims in Australia, a share that has been growing year on year. Claims for mental health conditions increased by more than 14% in 2023–24 alone.

The median time off work for psychological injury claims is almost five times that recorded for all other injuries and diseases. In dollar terms, mental health-related compensation claims cost Australian employers over $500 million per year.

WorkSafe Victoria's own data shows work-related mental injuries now represent 18% of all new claims in that state. And when the Victorian advisory line is analysed, the top three hazards reported are bullying, poor support, and aggression or violence.

What The Law Now Requires You To Do

Regardless of which state or territory you're in, the core framework is consistent.

As a Person Conducting a Business or Undertaking (PCBU) – which means any employer – you have four core duties.

1. Identify psychosocial hazards proactively

You can't wait for someone to raise a formal complaint or go on stress leave before acknowledging a hazard exists. Identification has to be active, and it needs to draw on multiple data sources – not just a survey in isolation. Good identification combines:

• Staff surveys and consultation (not as a one-off, but ongoing)
• Analysis of existing workplace data – incident reports, absenteeism patterns, workers' comp claims, exit interview themes, grievances and EAP usage trends
• Observations of how work is actually done, not just how it's meant to work
• Input from Health and Safety Representatives (HSRs) where they exist

BlueSafe guidance makes this point clearly: a survey is one input, not the whole assessment. If you're relying on a single data source, the assessment is too weak to satisfy regulators.

2. Assess the risk properly

Once you've identified hazards, you need to assess the likelihood and severity of harm. Regulators expect you to consider 1️⃣duration (how long workers are exposed), 2️⃣ frequency (how often), and 3️⃣severity (how intense). You also need to consider which workers are most vulnerable – and how hazards might interact with each other to elevate risk.

Higher-risk groups often include new starters, workers going through performance management, workers in high-demand or customer-facing roles, and remote or isolated workers.

3. Implement controls using the hierarchy

This is where many employers are still going wrong, and it's where regulators are increasingly focusing.

Controls must follow the hierarchy of controls. That means starting with elimination – can you redesign the role, adjust the workload, change the system to remove the hazard entirely?

If elimination isn't reasonably practicable, you move to controls that alter the management of work, systems, work design, or the workplace environment. Training and EAP programmes come last, and critically, they cannot be the primary or dominant control measure.

Victoria's regulations are particularly explicit about this. Training and instruction can only be used as the exclusive control if there is genuinely no other reasonably practicable option. And where used in combination with other measures, training must not be the predominant one.

In practice: offering a mindfulness course in response to chronically excessive workloads is not a control. It's a comfort blanket, and one regulators won't accept.

4. Review and monitor, not just after something goes wrong

Controls must be reviewed regularly, particularly when something changes — new information, a workplace incident, changes to work design, or a request from an HSR. The expectation is a live, ongoing cycle. Not a once-a-year tick.

5. Consult throughout – genuinely, not performatively

Consultation has to be early, genuine, and ongoing. That means involving workers before controls are decided, not just informing them afterwards. Consultation must also be considered in light of any obligations under awards or enterprise agreements.

The Risk Assessment Tool You've Been Using is Being Retired

Here's something that directly affects a lot of HR teams: the People at Work (PAW) survey – Australia's most widely used, government-funded psychosocial risk assessment tool, which has helped around 5,000 businesses assess risks and seen more than 160,000 workers participate – is being decommissioned.

⚠️ The platform will begin winding down from 1 June 2026, with the final access date of 2 October 2026.

Why? Because changes in legislation have outpaced the tool. PAW was developed in 2007 and doesn't fully address additional hazards now identified in the Model Code of Practice – particularly sexual harassment, isolated or remote work, and job insecurity. Response rates have also declined.

The critical point: removing the tool doesn't remove your legal obligation. If PAW has been your primary method of psychosocial risk assessment, you need to find an alternative that reflects the current regulatory landscape and the full 17-hazard framework. A number of commercial tools and state-specific resources are available ⬇️

1. Queensland's Psychosocial Risk Assessment Tool
2. SA's Healthy Workplace Toolkit
3. NSW's Workplace Wellbeing Assessment tool are all worth exploring.

The Case Law Every HR Manager Needs to Know About

Regulatory enforcement is one thing. The case law landing right now is something else entirely, and it's reshaping what "psychosocial risk" means for everyday HR processes.

Elisha v Vision Australia: $1.44 million for a botched disciplinary process

In December 2024, the High Court of Australia handed down a landmark decision that overturned over 100 years of precedent. In Elisha v Vision Australia Ltd [2024] HCA 50, the court upheld a $1.44 million damages award to a former employee who suffered serious psychiatric injury (including major depressive disorder) as a direct result of Vision Australia's flawed disciplinary process.

➡️ Vision Australia's disciplinary procedures were incorporated into Elisha's employment contract. By not following those procedures (specifically, raising allegations he was never given the opportunity to address), Vision Australia breached the contract. The breach caused psychiatric injury. That injury was held to be a foreseeable consequence of the breach. The primary judge described the disciplinary process as "nothing short of a sham and a disgrace."

What does this mean in practice? Every time your disciplinary procedures are referenced in an employment contract or enterprise agreement, you're creating a legal obligation to follow them properly. Cutting corners in a performance management or termination process is potential liability for psychiatric injury, outside the workers' comp system, with no cap.

Court Services Victoria: $379,157 fine for a "toxic culture"

In October 2023, Court Services Victoria was prosecuted, pleaded guilty, and fined $379,157 for failing to identify and assess psychosocial risks – specifically, a toxic culture at the Coroners Court that contributed to serious psychological harm among employees.

This case pre-dates Victoria's new regulations. That $380,000 fine was under the general duty provisions of the OHS Act. The bar is now higher.

NSW Department of Education: a single complaint, a system-wide notice

In March 2026, the NSW Industrial Relations Commission upheld two SafeWork NSW improvement notices issued to the Department of Education following a complaint from a single employee.

The Commissioner made a particularly pointed observation: the fact that only one employee had complained didn't reduce the employer's duty to address the hazard. SafeWork was also justified in issuing a notice covering all the Department's workplaces – not just the one where the complaint originated – because the hazard arose from a systemic issue.

➡️ One complaint can trigger a system-wide audit. And "only one person raised it" is not a defence.

The Department of Defence conviction

The Commonwealth's Department of Defence was convicted for failing to manage psychosocial risks during a performance management process. The regulator's argument: the psychological risks associated with performance management were serious and foreseeable – and the employer had all the information it needed to identify and address them in advance.

That case is a direct signal to anyone running performance management or formal disciplinary processes: these are now officially psychosocial risk events.

How The Rules Differ by Jurisdiction (And What To Do If You Operate Across States)

While the national framework is broadly consistent, the specifics vary enough that it matters which state you're in – and if you're operating across jurisdictions, you need to know all of them.

For multi-state employers: adopt Victoria's standard as your baseline across the board. It's the most prescriptive, and complying with it means you're covered everywhere.

A Blind Spot From Remote and Hybrid Work Blind Spot

If part of your workforce is operating from home, across regional sites, or in hybrid arrangements, you've got additional psychosocial risk exposure that deserves its own space in your risk register.

➡️ Remote and hybrid work creates hazard conditions that don't surface in a straightforward office-based assessment. Social isolation, blurred boundaries between work and personal time, reduced access to informal peer support, "always on" expectations that eat into recovery time, and a sense of being invisible to management – these are all recognised hazards under the national framework.

The Commonwealth Code explicitly names remote and isolated work as a hazard category. Research from the Black Dog Institute identifies inadequate managerial support as one of the biggest drivers of psychological harm at work – and when a manager sees a team member for thirty minutes a week on video, the early warning signs of psychosocial harm are much harder to catch before they escalate.

Monitoring tools are now a hazard category too

Any productivity monitoring or tracking tools used to manage remote workers – keystroke loggers, activity monitors, automated time tracking, camera checks – must now be assessed as potential psychosocial hazards themselves.

In NSW, the Work Health and Safety Amendment (Digital Work Systems) Act 2026 – enacted in February 2026 – creates Australia's first statutory duty around digital work systems, requiring employers to ensure that monitoring and performance-tracking tools don't generate psychosocial risks such as stress, work intensification, or loss of autonomy.

The Commonwealth Code already explicitly lists intrusive surveillance as a psychosocial hazard. If your monitoring practices were introduced during COVID and have never been reviewed, that review is now overdue – and it belongs on your risk register. 🎯

What Good Psychosocial Safety Practice Looks Like Right Now

Regulators aren't checking whether you have a policy. They're checking whether it translates into documented action, whether workers know about it, and whether the controls are actually working.

Treat it as a technical discipline, not a communications exercise

One of the clearest messages from enforcement trends is that risk management is expected to work like an engineering problem – systematic, documented, evidence-based. That means documented risk assessments showing how hazards were identified, what controls were considered and why, what was implemented, and who owns the review cycle. If it isn't documented, from a regulatory standpoint, it didn't happen.

Apply the hierarchy of controls

Start with work design.

➡️ Can you reduce the workload? Clarify the role? Remove a source of conflict?

These are higher-order controls. Work down from there. Training and EAP support come last, as supplementary measures only. In Victoria, this is explicitly written into the regulations – training cannot be the primary control unless no other option is reasonably practicable.

Manager capability is where prevention actually happens

Employees with a supportive manager have better mental health, lower burnout, and higher productivity. The challenge, as senior research fellow Dr Mark Deady notes, is that managers often don't know where to start (and many assume they need to solve the problem rather than simply respond to it). Basic skills to notice, create space, and connect people with support change behaviour – and the evidence backs it.

Use your HRMS data as an early warning system

Absenteeism trends, turnover spikes, EAP usage patterns, grievance volumes – these are early indicators of emerging psychosocial hazards. If your HR system holds this data but no one is reviewing it through a psychosocial risk lens, that's an easy and important gap to close.

The Bottom Line

1. Every state and territory has enforceable psychosocial safety obligations
2. Codes of Practice are becoming legally binding
3. Inspectors are in post
4. The case law is moving fast, and it's not moving in employers' favour.

There's a temptation to treat psychosocial safety as a documentation exercise: tick the right boxes, update the right register, and move on. Regulators know what that looks like. The NSW Department of Education case shows that a single complaint can trigger a system-wide notice. The Elisha case shows that a flawed process from ten years ago can become a $1.44 million liability today.

The law has put psychological health on the same legal footing as physical safety. Whether organisations match that with genuine operational change – or keep offering yoga vouchers and hoping for the best – is the real question that's playing out right now. 👀

🚀 If reading this has you mentally reviewing your risk register (or realising you don't quite have one) it might be time to look at the systems sitting underneath your HR function.

Subscribe-HR is an HR platform built specifically for Australian organisations, with the tools to help you stay on top of compliance without it taking over your week. Locally hosted, locally focused, and built around the way Australian HR actually works.

[Take a look at Subscribe-HR →]

This post is for general information purposes and does not constitute legal or compliance advice. For guidance specific to your jurisdiction and circumstances, consult a qualified workplace health and safety or employment law professional.