Here's what every Australian business needs to know from 1 July.
Let's be honest: 'psychological safety' has been floating around corporate Australia for years, mostly living on posters in break rooms and slide decks that nobody opens twice. But as of 1 July 2026, it's moved out of the aspirational column and squarely into the legal one. This isn't a vibe shift. It's a law change.
So what's actually happening, why now, and what do you need to do about it? Let's get into it.
First: what's actually changing on 1 July 2026?
The headline change is in NSW, and it has real teeth. Section 26A of the Work Health and Safety Act 2011 (NSW) commences on 1 July 2026, transforming the Managing Psychosocial Hazards at Work Code of Practice from advisory guidance into a legally enforceable compliance benchmark.
In plain language: until now, the Code was strong evidence of what a responsible business should do. From 1 July, if you're not following it – or demonstrating you're doing something better – you may be in breach. Full stop.
This isn't the only change, but it's the one NSW businesses in particular should be paying very close attention to. A few other things worth knowing:
• Unions can now bring civil penalty proceedings. Since 1 March 2026, registered organisations – including unions – can initiate enforcement action for WHS breaches in NSW. SafeWork NSW is no longer the only party watching.
• SafeWork NSW added 20 dedicated psychosocial enforcement inspectors in March 2026. These aren't generalists. They're coming specifically for this.
• Penalties are serious. Category 2 breaches can result in fines up to approximately $447,000 for officers personally, and Category 1 offences can reach $2.3 million plus imprisonment.
• The rest of Australia is already there. Every state and territory now has enforceable obligations to actively identify, assess, and control psychosocial hazards. Victoria's regulations came in December 2025. NSW's July change means the final major piece is now in place nationally.
There’s one more wrinkle worth knowing about, and it’s the one most organisations will miss. The Code of Practice itself is partially out of date. The Managing Psychosocial Hazards at Work Code was written in 2021 and still references the WHS Regulation 2017. But the WHS Regulation 2025, which commenced in August 2025, introduced new requirements – specifically sections 55C and 55D – that explicitly require PCBUs to manage psychosocial risks using the hierarchy of control measures. The 2021 Code leans heavily on administrative controls like policies and training. An organisation that follows the Code to the letter but ignores those newer regulatory requirements won’t pass the “equivalent or better” test under Section 26A. In other words: the Code is the floor, not the ceiling, and the floor has been raised since the Code was written.
Why is this happening now?
The short answer: we've been building to this for a while, and COVID turbocharged it.
The 2018 Boland Report recommended treating psychosocial risks with the same legal weight as physical risks. ISO 45003:2021 (the international standard on psychological health and safety at work) followed. Then came a cascade of state-level regulations, codes of practice, and test cases through the courts – including a landmark conviction of the Commonwealth Department of Defence following the suicide of a worker at RAAF Base Williamtown.
The data tells a sobering story too. Mental health conditions now account for 10.5% of all serious workers’ compensation claims in Australia – a 97% increase from 2012–13. The median compensation paid per serious mental health claim is more than three times higher than for physical injuries. In NSW alone, one in five workplace complaints is now psychosocial.
Regulators, courts, and legislators have looked at that data and concluded: 'guidance isn't cutting it.' Hence: law.
What do businesses actually need to do?
The short version: you can't just tick a box and call it done. The law requires a genuine, documented system – not a policy gathering dust on a shared drive.
Here's what compliance looks like in practice:
1. Know your 17 hazards
Safe Work Australia identifies 17 psychosocial hazards in the national Model Code, which covers everything from high job demands, poor workplace relationships, and inadequate support, to traumatic events, job insecurity, and remote/isolated work. Sexual and gender-based harassment is explicitly included. If your hazard identification doesn't cover all 17, it's not complete.
2. Apply the hierarchy of controls – properly
This is the shift most organisations will stumble on. Training programs, mental health days, and EAPs are still valuable — but they are not controls under the law. The hierarchy starts with work design – eliminating or redesigning the conditions that create the risk in the first place. If the only thing between a psychosocial hazard and your workers is an awareness session, you're not compliant.
3. Consult workers – genuinely
Consultation with workers and Health & Safety Representatives isn't optional. Inspectors will ask for evidence that workers were involved in identifying hazards and designing controls – not just informed after the fact.
4. Document everything
After 1 July, the question isn't whether you manage psychosocial risk. It's whether you can prove it. Risk assessments, control measures, review cycles – all of it needs to be documented and current. A regulator or union now carries the expectation that you'll have this on hand.
5. Review and keep reviewing
Controls need to be checked regularly and after trigger events – restructures, incidents, significant change. A risk register written in 2023 and never touched again won't be enough.
What to prioritise
If you're reading this and wondering whether you're up to code, here's a practical triage:
• Audit your current approach against the Code of Practice – section by section. Not a self-reported 'we do this', but actual evidence of documented controls against each hazard category.
• Check your hazard identification covers all 17 hazard types. Gaps here are exactly what inspectors will look for.
• Make sure your controls go beyond training. If your psychosocial risk management plan is primarily made up of awareness campaigns and EAP reminders, that's a red flag.
• Review anything involving surveillance or monitoring. NSW's new Digital Work Systems Act 2026 means AI tools, productivity trackers, and performance monitoring software now need to be assessed as potential psychosocial hazards.
• Start building the paper trail now. Even if your controls are solid, if they're not documented, they don't exist in the eyes of a regulator.
Note: this blog provides general information only and doesn't constitute legal advice. Talk to a qualified WHS professional about your specific situation.
Where does training fit into all of this?
Leaders need to understand what psychosocial hazards actually are – and recognise them in the context of their own teams. Workers need to know what a psychologically safe workplace looks like, and what their rights are. HSRs and managers need confidence to have early conversations before small issues become formal complaints – or worse, injuries.
This is where targeted, context-specific microlearning earns its place – as the capability layer that helps learning managers identify early warning signs, or upskilling teams on healthy communication in high-pressure environments - and as the compliance piece needed to provide auditors. Building a shared understanding of what psychosocial hazards look like in your specific industry – whether that's a contact centre, a construction site, or a corporate headquarters – can help to create a psychologically safe workplace.
The bottom line
Psychological safety was already the right thing to prioritise. Now it's also the legally required thing. The businesses that are putting the code into practice aren’t just protecting themselves from enforcement action – they're building the kind of workplaces people actually want to work in.
Want help with the training piece?
Documenting your hazard register and redesigning work processes is the legal and operational core of compliance. But none of it sticks if your managers and teams don't actually understand and recognise psychosocial hazards day to day. That's where Yarno comes in: targeted, context-specific microlearning that builds real capability and compliance across your organisation – and gives you the engagement and tick-box data to prove it.
Get in touch today to talk through how microlearning can support your teams to understand psychological safety and be compliant.
.png)
