NSW Psychosocial Hazards at Work: New WHS Rules Employers Must Follow (2026)
NSW employers must now identify and control psychosocial hazards at work under the updated Code of Practice. Learn the 14 hazard categories, employer obligations, the hierarchy of controls for psychosocial risks, penalties for non-compliance, and how other states are following.
What are psychosocial hazards and why do they matter now?
Psychosocial hazards are aspects of work and work environments that have the potential to cause psychological or physical harm. They have always existed in workplaces, but until recently they received far less regulatory attention than physical hazards like machinery or chemicals. That changed with Safe Work Australia's model Code of Practice for Managing Psychosocial Hazards at Work, published in 2022 and adopted by NSW through its own Code of Practice in 2024, with active enforcement commencing in 2025. This is not new law — the obligation to manage risks to psychological health has always existed under the general duty in s19 of the WHS Act. What the Code of Practice does is give employers specific, practical guidance on how to meet that obligation for psychosocial hazards. Under s275 of the WHS Act, while a Code of Practice is not legally binding in itself, a court or tribunal can use it as evidence of what is known about a hazard and what is reasonably practicable to do about it. In practice, this means employers who fail to follow the Code will struggle to argue they have met their duties. SafeWork NSW has signalled that psychosocial hazard management is a compliance priority for 2025-26.
The 14 psychosocial hazard categories employers must address
The Code of Practice identifies 14 categories of psychosocial hazard that employers must systematically identify and assess. These are: (1) job demands — workload, time pressure, and emotional demands that exceed a worker's capacity; (2) low job control — workers having little say over how, when, or where they do their work; (3) poor support — inadequate training, resources, or supervisory support; (4) lack of role clarity — unclear job expectations, responsibilities, or authority; (5) poor organisational change management — restructures, mergers, or system changes handled without consultation; (6) inadequate reward and recognition — effort not matched by pay, promotion, or acknowledgment; (7) poor organisational justice — decisions perceived as unfair, inconsistent, or biased; (8) traumatic events or material — exposure to distressing incidents, content, or situations; (9) remote or isolated work — working alone or in locations far from assistance; (10) poor physical environment — noise, temperature extremes, or cramped conditions; (11) violence and aggression — from customers, clients, patients, or colleagues; (12) bullying; (13) harassment including sexual harassment; and (14) conflict or poor workplace relationships. Each hazard must be considered in the context of the specific workplace.
Employer obligations: identify, assess, control, review
The Code of Practice requires employers to follow a systematic risk management process for psychosocial hazards, mirroring the approach already used for physical hazards. Step one is identification: employers must proactively identify psychosocial hazards through methods such as worker surveys, reviewing incident reports, analysing absenteeism and turnover data, conducting workplace inspections, consulting with HSRs and workers, and reviewing the design of work itself. Step two is risk assessment: once a hazard is identified, the employer must assess the level of risk by considering the severity of potential harm, the duration and frequency of exposure, and the number of workers affected. Step three is control: the employer must implement controls to eliminate the risk or, if that is not reasonably practicable, minimise it so far as is reasonably practicable. Step four is review: controls must be monitored and reviewed regularly, especially after incidents, changes in work design, or when new information becomes available. Consultation with workers at each stage is mandatory under s47-49 of the WHS Act. Employers who simply adopt a generic wellbeing program without undertaking this systematic process are not meeting the Code's requirements.
The hierarchy of controls applied to psychosocial risks
The traditional hierarchy of controls — eliminate, substitute, isolate, engineer, administer, PPE — must be adapted for psychosocial risks. Elimination might mean removing a hazard entirely: for example, eliminating customer aggression by implementing a zero-tolerance policy with real consequences, or eliminating excessive workload by hiring additional staff or reducing output expectations. Substitution might mean replacing high-demand work practices with lower-demand alternatives — for example, rotating workers through emotionally demanding roles rather than assigning the same person permanently. Isolation and engineering controls translate to designing work systems that reduce exposure: providing quiet spaces for recovery, installing safety barriers for customer-facing workers, or implementing technology that reduces monotonous tasks. Administrative controls include policies, procedures, training, rostering practices, and supervision — these are the most commonly used controls for psychosocial hazards but are also the least effective when used alone. The Code emphasises that 'wellness' initiatives like mindfulness apps, yoga classes, or resilience training are individual-level responses that do not constitute adequate control measures. They may be a useful supplement, but they do not address the root cause of the hazard and cannot substitute for systemic changes to work design, leadership, and organisational culture.
Penalties for non-compliance
Failure to manage psychosocial hazards exposes employers to the same penalty framework as any other WHS breach. Under the WHS Act, a Category 1 offence — reckless conduct that exposes a person to a risk of death or serious injury or illness (which includes serious psychological injury) — carries a maximum penalty of $3 million for an individual and $15 million for a body corporate. A Category 2 offence — failure to comply with a health and safety duty that exposes a person to a risk of death, serious injury, or illness — carries up to $1.5 million for an individual and $3 million for a body corporate. A Category 3 offence — failure to comply with a health and safety duty — carries up to $500,000 for an individual and $2.5 million for a body corporate. Beyond criminal penalties, employers face civil claims for negligence, workers compensation premium increases, and productivity losses from absenteeism and turnover. SafeWork NSW has conducted over 1,000 psychosocial hazard-focused inspections since 2024, issuing improvement notices to employers who lack systematic processes for identifying and managing psychosocial risks. The regulator has indicated it is moving from an education phase to an enforcement phase in 2026.
How other states are following NSW's lead
NSW is not alone in strengthening psychosocial hazard regulation. Queensland adopted the model Code of Practice in 2023 and has been actively enforcing it through Workplace Health and Safety Queensland. Victoria updated its OHS regulations in 2022 to explicitly include psychosocial hazards and published a compliance code on workplace bullying and prevention of psychosocial hazards. Western Australia adopted the model Code of Practice when it transitioned to the harmonised WHS framework in 2022. South Australia, Tasmania, the ACT, and the Northern Territory have all adopted or are in the process of adopting the model Code. At the federal level, the Respect@Work reforms introduced a positive duty on employers to prevent sexual harassment, sex discrimination, and related behaviour — effectively codifying a psychosocial hazard management obligation in federal anti-discrimination law. Comcare, the Commonwealth regulator, has also updated its guidance for federal public sector employers. The direction is clear: psychosocial hazard management is now a core compliance obligation for every Australian employer, not a nice-to-have. Employers who invest in proper systems now will be ahead of the curve; those who delay face increasing regulatory scrutiny and liability.
Try these free tools
Official resources
General information and estimates only — not legal, financial, or tax advice. Always verify with the Fair Work Ombudsman (13 13 94) or a qualified professional.
Related articles
Step-by-step guide if your employer isn't paying super. How to check via myGov, report to the ATO, and what enforcement powers exist for unpaid super.
Can My Employer Change My Roster Without Notice? (Know Your Rights)Your employer must give 7 days' notice for roster changes under most awards. Here's when you can say NO — plus what to do if they change your hours without asking.
12 Things That MUST Be on Your Payslip — or Your Employer Is Breaking the LawAustralian employers face fines up to $19,800 per payslip violation. Check the 12 mandatory items your payslip must include — free 30-second compliance checker inside.