The compliance bar just moved from completion to comprehension

For years, compliance training had one job: get people through it. Employers ran the module, logged the completion, and moved on. If a regulator ever came knocking, a completion certificate was the answer.

That's no longer enough.

From 1 July 2026, section 26A of the Work Health and Safety Act 2011 (NSW) came into force. Under this section, NSW's roughly 30 approved codes of practice, including the code for managing psychosocial hazards at work, stop being optional guidance and become the minimum standard a business is expected to meet. A business now has to either follow the code or show it's managing the risk to an equivalent or higher standard. The regulator doesn't need to prove anyone was harmed to establish a breach; falling short of the code can be enough on its own.

At the same time, SafeWork NSW has backed that shift with people. In March 2026 it announced 51 additional inspectors, 20 of them dedicated specifically to psychosocial risk, as part of a $127.7 million, four-year investment.

It's no longer enough to have run the training. Businesses now need to be able to show their people understood it.

What "comprehension" actually means to a regulator

A completion certificate tells you someone opened a course and clicked through to the end. It doesn't tell you what they understood, whether they retained it a month later, or whether they could apply it if it mattered.

An inspector asking about psychosocial risk isn't asking whether your people clicked through the module. They're asking whether your organisation can show, person by person, that people understood their obligations, and when. A completion log doesn't answer that question. A comprehension record does.

This is a genuinely new bar. Under the old approach, a business could point to an LMS dashboard showing 98% completion and consider the job done. Under section 26A, that dashboard shows attendance, not compliance with the code. The two used to be treated as roughly interchangeable. They're not anymore.

The cost of getting this wrong

Because SafeWork NSW's new inspectors aren't required to prove harm occurred before establishing a breach, the usual defence, "nothing bad happened, so we must be fine," no longer holds up on its own. On-the-spot fines are already part of how these inspectors operate, and a standardised psychosocial check can now happen during a visit prompted by something completely unrelated.

That changes the calculation for a compliance or WHS team. It's no longer a question of whether an incident triggers scrutiny. Scrutiny can arrive on an ordinary Tuesday, attached to a routine visit, and the only real preparation is being able to answer the question before it's asked: can you show, for each employee, that they understood this obligation, and when?

It's not just NSW, or just psychosocial risk

NSW is the sharpest current example, but it isn't an isolated one. Victoria's Occupational Health and Safety (Psychological Health) Regulations 2025 commenced on 1 December 2025, giving Victorian employers a specific duty to identify psychosocial hazards and take reasonable steps to eliminate or control the risk, not simply run an awareness session about it. Western Australia moved earlier again, with its own psychosocial regulations taking effect back in December 2022. Three states, three separate pieces of law, all pointing the same direction: regulators want evidence of understanding and active risk management, not a record of attendance.

For any organisation with obligations under WHS, psychosocial, or Respect@Work legislation, and realistically that's most employers, this is worth getting ahead of now, rather than reacting to it after an inspector's visit. It's also worth noting these obligations don't sit only with WHS or risk teams. Positive duty obligations under Respect@Work already require employers to take proactive steps, not just respond after a complaint, and psychosocial risk sits right alongside sexual harassment and bullying as a hazard employers are expected to actively manage. The people who end up accountable for this evidence- a compliance manager, a WHS lead, an HR director- are increasingly being asked to produce the same kind of proof: not that training happened, but that it landed.

What this means for how you train

If your compliance training produces a completion log, it was built for a bar that no longer applies. What's needed now is training that produces a different kind of evidence: a scored, timestamped, named record for each learner, showing what they understood and when, not just that they showed up.

That's a different design problem than "get people through a module." It changes what you measure, how often you check in with learners, and what you can actually hand an inspector when they ask. A single long course, sat once a year, gives you one data point per learner: did they finish it? A series of short, regular check-ins gives you many data points over time, showing whether understanding actually held up, not just on the day of the course, but months later when it matters. That's a stronger record, and it happens to be easier for a busy frontline team to actually complete.

For now, the practical takeaway is simple. If your compliance program can't currently tell you which specific employees understood which specific obligation, and when, that's the gap regulators are now actively checking for. Worth finding out before an inspector does, rather than while one is standing in your reception area asking for records you don't have.