Psychosocial hazards — the aspects of work that cause psychological harm — have been part of Australia's work health and safety framework for years. What has changed in 2026 is the enforcement posture. In New South Wales, the Managing Psychosocial Hazards at Work Code of Practice became a legally enforceable benchmark from 1 July 2026, meaning regulators no longer need to wait for harm to occur before taking action. Victoria's dedicated psychological health regulations have been in force since December 2025. Across every Australian jurisdiction, the message from regulators is consistent: psychosocial risk management is a compliance obligation, not a wellbeing initiative, and the standard of evidence required to demonstrate compliance has materially increased. This article covers what psychosocial hazards are, where the obligations now sit, what employers are required to do, and what HR and WHS teams should have documented.

What are psychosocial hazards? Definition and Safe Work Australia examples

Under Australian workplace health and safety frameworks — including the model Work Health and Safety laws and Victoria's Occupational Health and Safety Act 2004 — psychosocial hazards are broadly defined as aspects of work — including how work is designed and managed, the working environment, workplace interactions and behaviours, and other matters — that may cause psychological harm, physical harm, or both. The definition is broad by design. It covers not just dramatic events such as workplace violence, but the everyday conditions that shape how workers experience their roles.

The model Code of Practice: Managing Psychosocial Hazards at Work, published by Safe Work Australia, identifies the following as common psychosocial hazards:

• High job demands, including excessive workloads and unrealistic deadlines

• Low job control — limited autonomy over how and when work is performed

• Poor role clarity, role conflict, or role overload

• Low support from managers or colleagues

• Poor workplace relationships, including workplace bullying, harassment, aggression and violence

• Inadequate reward and recognition relative to work performed

• Poor organisational change management

• Remote work and isolation

• Exposure to traumatic events or distressing material

Psychosocial hazards can operate individually or in combination. Safe Work Australia notes that they may interact or compound to create risks that are greater than any single hazard in isolation. The potential outcomes include psychological conditions such as anxiety, depression and post-traumatic stress disorder, as well as physical conditions including musculoskeletal injuries and fatigue-related harm.

The distinction from physical hazards is one of visibility, not severity. A faulty machine is observable and easy to document. An unsustainable workload, a dysfunctional reporting relationship, or a culture that tolerates bullying may be equally harmful but harder to detect and measure — which is precisely why the regulatory framework now requires proactive identification and management rather than relying on incident reports as the primary signal.

The regulatory landscape — how obligations stand in 2026

Psychosocial risk management is now a legal obligation in every Australian jurisdiction. The shift has taken place over several years, with each state and territory adopting and building on the model Work Health and Safety framework developed by Safe Work Australia. In 2026, the regulatory environment has materially tightened — particularly in New South Wales and Victoria.

The national framework

Safe Work Australia's model Work Health and Safety (WHS) Regulations, first published in 2022, introduced express requirements for how persons conducting a business or undertaking (PCBUs) must identify and manage psychosocial hazards. These regulations — and the accompanying Model Code of Practice: Managing Psychosocial Hazards at Work — provide the national baseline. Each jurisdiction is responsible for adopting and enforcing the framework within its own WHS legislation.

New South Wales — Code of Practice now enforceable

New South Wales represents the most significant recent development in psychosocial risk regulation. The state introduced psychosocial hazard regulations in 2022. From 1 July 2026, section 26A of the Work Health and Safety Act 2011 (NSW) — introduced by the Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025 — changed the legal status of all approved Codes of Practice, including the Managing Psychosocial Hazards at Work Code.

Before 1 July 2026, the Code operated as guidance material that courts and regulators could refer to as evidence of what a reasonable PCBU should have done. However, compliance with the Code was not a mandatory statutory benchmark in its own right — failure to follow it did not itself constitute a breach.

From 1 July 2026, the position is reversed. A PCBU must either comply with an applicable approved Code of Practice, or manage the relevant hazard to a standard that is equal to or higher than the Code — and must be able to demonstrate this. In an inspection or investigation, a SafeWork NSW inspector can now assess compliance directly against the Code, rather than having to first establish that harm occurred. Falling short of the Code may itself constitute a breach.

SafeWork NSW increased its psychosocial inspection capacity in March 2026, adding 20 inspectors dedicated specifically to psychosocial risk, with unannounced workplace visits already in use.

Victoria — new psychological health regulations in force

Victoria operates under its own occupational health and safety legislation rather than the harmonised WHS model, but the direction of travel is consistent. The Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic) took effect on 1 December 2025, introducing explicit obligations for employers to identify and manage psychosocial hazards under the Occupational Health and Safety Act 2004 (Vic). The regulations also expressly provide that information, instruction or training cannot be used as the exclusive or predominant control measure for psychosocial risks where higher-order controls — such as redesigning work or modifying systems — are reasonably practicable.

Other jurisdictions

The Commonwealth, Queensland, South Australia, the Australian Capital Territory, Western Australia, Tasmania, and the Northern Territory have each adopted and implemented the model WHS Regulations and Code of Practice within their own frameworks. Queensland was among the first to give its Code of Practice statutory force under section 26A of the WHS Act — requiring PCBUs to comply with the Code or demonstrate an equivalent or higher standard — a model that New South Wales has since adopted from 1 July 2026. At the federal level, for Commonwealth employers regulated by Comcare, an updated Code of Practice took effect in 2024.

The shift in enforcement posture

Across jurisdictions, the regulatory posture has moved from reactive to proactive. Unannounced workplace visits and psychosocial-specific inspections are not new, but the threshold for demonstrating compliance during an inspection has risen significantly — particularly where Codes of Practice now carry the status of mandatory benchmarks rather than guidance material. PCBUs and their officers — who carry personal due diligence obligations — are expected to be able to demonstrate that psychosocial risks have been systematically identified, assessed and controlled.

What employers are required to do — the risk management duty and who is accountable

The core obligation under the model WHS Regulations is for PCBUs to manage psychosocial risks so far as is reasonably practicable. That phrase — reasonably practicable — does not mean eliminating every possible risk at any cost. It means taking measures that a reasonable person in the same position would consider appropriate given the likelihood of harm, the severity of potential consequences, and what is known about ways to address the hazard.

The Model Code of Practice sets out a four-step risk management process that reflects how this duty is expected to be discharged in practice.

1. Identify hazards

2. Assess risks

3. Control risks

4. Review control measures

The steps are sequential: each builds on the one before it.

Officers and personal liability

PCBUs bear the primary WHS duty. Officers of a PCBU — including directors, senior executives, and others who make or participate in decisions affecting the whole or a substantial part of the business — carry a personal due diligence obligation. This requires officers to acquire and keep up-to-date knowledge of WHS matters, understand the nature of the operations and the hazards involved, and ensure the PCBU has appropriate resources and processes in place to meet its WHS duties. Personal liability for officers exists independently of any liability imposed on the PCBU.

Sexual harassment as a psychosocial hazard

Most jurisdictions now expressly require PCBUs to identify and manage psychosocial risks arising from sexual and gender-based harassment at work, and to prepare and implement a plan to do so. This obligation sits alongside — and in some respects overlaps with — the positive duty under the Sex Discrimination Act 1984 and equivalent state legislation to take reasonable and proportionate measures to eliminate sexual harassment. HR and WHS teams should ensure that their psychosocial risk management framework addresses this category of hazard explicitly.

What HR and WHS teams should have in place

While the Model Code of Practice sets out a standard four-step risk management process (identify, assess, control, review), translating this duty into practice requires five essential compliance elements for HR and WHS teams. What follows is the specific processes, records, and systems that constitute a defensible psychosocial risk management program.

1. Conduct and document a psychosocial risk assessment

A risk assessment is the foundation of the compliance framework. It should identify the psychosocial hazards present in the workplace, assess the risks they create, and inform the selection of control measures. The assessment should be specific to the organisation — generic templates that have not been adapted to the actual work, roles, and environment will not meet the standard regulators expect.

The assessment process should be documented in a way that shows what hazards were identified, how the assessment was conducted, who was involved, what risks were determined, and what controls were selected in response. This documentation is what a WHS inspector will ask to see.

Risk assessments should be reviewed when there is a material change to work arrangements, following an incident or complaint, or at least annually as a matter of good practice.

2. Consult with workers and document the process

Consultation is a continuous legal requirement across every stage of the risk management process — not a single step or a recommended practice. Workers must be given a genuine opportunity to contribute to the identification of hazards, the selection of controls, and the ongoing review of those controls. This means more than distributing a survey — it includes creating channels through which workers can raise concerns safely, ensuring feedback is considered and responded to, and communicating back to workers about what decisions were made and why.

The consultation process should be documented. Records should show when consultation occurred, what methods were used, what workers raised, and how that input influenced decisions. Anonymous survey platforms, team discussions, HSR (Health and Safety Representative) involvement, and one-on-one check-ins can all contribute to a documented consultation record.

3. Update policies and procedures

As noted above, policies and training are necessary but not sufficient as standalone controls. The policy suite should be designed to complement higher-order controls — addressing the specific hazards identified in the risk assessment.

Policies should be current, specific, and accessible. Each should record the date of last review and the authorising signatory. A policy that has not been reviewed for several years, or that exists only as a document on a shared drive with no evidence of communication to staff, provides limited protection in an enforcement or claims context.

4. Train managers and document the training

Line managers are frequently both the source and the first point of contact for psychosocial hazards. A manager's behaviour, workload allocation decisions, communication style, and response to disclosures can each constitute a psychosocial hazard — or a control measure — depending on how they are handled.

Training for managers should cover what psychosocial hazards are, how to identify early warning signs, how to respond to disclosures appropriately, and what escalation pathways exist. Training records should document who attended, when, and what was covered. Training delivered to managers only once, without refreshers, is unlikely to be regarded as sufficient given the pace of regulatory change.

5. Maintain records that can withstand scrutiny

Record keeping is the element of psychosocial risk management most frequently underestimated — and the one that matters most when an incident occurs or a regulator visits. The records that HR and WHS teams should maintain include:

• Risk assessment records, including the date, methodology, participants, findings, and selected controls

• Consultation records, including the methods used, the input received, and the decisions made

• Control implementation records, including what was done, when, and by whom

• Review records, including what triggered the review, what was found, and what changes were made

• Training records, including attendance, content, and dates

• Incident and complaint records, including how each was managed and resolved

Under section 26A in NSW — and the equivalent enforcement frameworks in other jurisdictions — the burden of demonstrating compliance has effectively shifted. An organisation that cannot produce documentation of its psychosocial risk management activities is in a significantly weaker position than one that can, regardless of what controls may actually be in place.

The regulatory shift underway in Australia reflects a broader recognition that psychological harm at work is as real and as preventable as physical harm — and that the legal framework for managing it should be treated accordingly. For HR and WHS teams, the practical implication is clear: a risk assessment that has not been conducted, a consultation process that has not been documented, or a training record that does not exist are no longer merely gaps in good practice. In jurisdictions where codes of practice are now enforceable benchmarks, they can be the breach itself.

The starting point for organisations that have not yet structured their approach is Safe Work Australia's Model Code of Practice: Managing Psychosocial Hazards at Work, available free at safeworkaustralia.gov.au. For advice on how the obligations apply to a specific workplace or industry, consult a WHS specialist or employment lawyer.

Official sources:

• Safe Work Australia — Psychosocial hazards

• Safe Work Australia — Model Code of Practice: Managing psychosocial hazards at work

• Safe Work Australia — Mental health

• SafeWork NSW — Psychosocial hazards

• WorkSafe Victoria — Psychological health

Last updated: September 2026