Psychosocial Safety Is Now Law in Australia. Here’s What HR Teams Need to Do.

Psychosocial Safety Is Now Law in Australia. Here’s What HR Teams Need to Do.

Workplace psychological health used to be treated as a wellbeing initiative. Something HR led, supported by an Employee Assistance Programme, measured occasionally with an annual engagement survey, and presented to the executive team as a culture metric.

That framing is no longer legally sufficient.

From 1 December 2025, psychosocial hazards became enforceable under Work Health and Safety law across every Australian state and territory. The same obligations that apply to a broken staircase or an unguarded machine now apply to chronic overwork, poorly managed organisational change, and role ambiguity. Boards and officers must demonstrate active due diligence not good intentions.

For HR and P&C teams, this is a significant shift in obligations. Here is what changed, what you are now required to do, and what demonstrable compliance actually looks like in practice.

What changed in December 2025?

Australia’s regulatory journey on psychosocial safety spans more than a decade, but the critical changes arrived in late 2025. Victoria’s Occupational Health and Safety (Psychological Health) Regulations 2025 commenced on 1 December 2025, completing a national alignment. Every Australian jurisdiction now has enforceable obligations to actively identify, assess, and control psychosocial hazards not to react to them after harm occurs, but to prevent them.

The national model WHS Regulations define psychosocial hazards broadly. They cover work design, work environment, workplace interactions and behaviours, and any other factors that may cause psychological or physical harm. This includes job demands, low job control, poor workplace relationships, low role clarity, remote or hybrid work, bullying and harassment, and poorly managed organisational change.

Critically, the regulatory expectation is not a policy on paper. It is a live, ongoing risk management system, following the same approach applied to physical hazards: identify, assess, control, review, repeat.

The NSW update: Codes of Practice become legally binding from 1 July 2026

New South Wales has added an additional layer that HR teams need to understand. From 13 October 2025, legislation introduced section 26A to the WHS Act 2011 (NSW), with that provision taking effect on 1 July 2026. This converts approved Codes of Practice , including the Managing Psychosocial Hazards at Work Code, from advisory guidance into legally enforceable compliance benchmarks.

Under the new provision, a organisation must either comply with the approved Code of Practice or demonstrate an equivalent or higher standard of health and safety management. A regulator no longer needs to prove that harm occurred. Falling short of the Code may itself constitute a breach of the WHS Act.

For NSW employers, 1 July 2026 is the date the Code becomes an enforceable compliance benchmark. This does not introduce new WHS duties. The obligation to manage psychosocial risks already existed. What changes is how compliance is assessed: the Code becomes the default legal reference point, making psychosocial risk management visible, auditable, and enforceable.

For employers in other jurisdictions, the national framework already requires the same standard. The NSW change simply makes the enforcement mechanism more explicit.

The obligations break down into four interconnected duties that must be treated as an ongoing cycle rather than a one-time exercise.

Identify reasonably foreseeable psychosocial hazards

This means actively mapping the psychosocial risks present in your workplace. This means not waiting for a complaint or incident to surface them. Common identification methods include workplace surveys, focus groups, analysis of absenteeism and turnover data, and review of incident and complaint records. The identification process must be documented and must involve genuine worker consultation.

Assess the risk

Once hazards are identified, you must assess the likelihood and severity of harm. Factors to consider include the frequency and duration of exposure, the number of workers affected, the vulnerability of the workforce, and whether control measures are currently in place. Risk assessments must be recorded.

Implement controls

Controls must follow the hierarchy of controls: elimination or minimisation, not just support and awareness training. An EAP is not a control. It is a support mechanism after harm has occurred. Regulators expect structural interventions: job redesign, workload management, improved management capability, clear role expectations, and systems that reduce the causes of harm rather than treating its symptoms.

Monitor, review, and consult

Compliance is not a one-off exercise but a live monitoring cycle. Controls must be reviewed regularly, particularly when something changes: new information, a workplace incident, changes to work design, or a request from a health and safety representative. Consultation with workers must be early, genuine, and ongoing.

Regulators expect objective evidence of structural interventions: job redesign, workload management, clear role expectations. The obligation is to prevent harm, not to support people after it has occurred.

Why annual engagement surveys are no longer sufficient

Most Australian organisations have an annual engagement survey. Some have a more formal wellbeing survey attached to a biennial cycle. Under the new psychosocial safety framework, these instruments are valuable as they are, but do not on their own constitute an adequate monitoring programme.

The regulatory expectation is ongoing monitoring, with controls reviewed in response to what that monitoring surfaces. A survey conducted once a year cannot detect the early signals of a psychosocial risk escalating between cycles. By the time the annual survey is fielded, the harm may already have occurred.

This is the practical case for more frequent employee feedback mechanisms, specifically pulse surveys, as a monitoring tool, not just an engagement metric.

How pulse surveys and engagement surveys support compliance

Pulse surveys, run at regular intervals (monthly or quarterly) create an auditable record of ongoing psychological health monitoring. They allow HR teams to detect early signals: a team whose workload scores have deteriorated over three consecutive survey cycles, a business unit where role clarity ratings are declining, a manager whose direct reports are consistently scoring lower on support than the organisational average.

This is not just useful people data. It is the kind of documented, time-stamped, ongoing monitoring that regulators consider evidence of an active risk management system.

Xref Pulse is designed for exactly this purpose: short, regular, structured surveys that track sentiment trends over time and surface the signals that require action before they become incidents. Combined with Xref Engage, which allows for deeper, targeted surveys designed by workplace psychologists, organisations can build a layered monitoring programme that meets both the regulatory standard and the practical needs of the business.

Building a practical compliance framework

For HR and P&C teams working through what this means in practice, a functional psychosocial safety framework involves the following components working together.

• A risk identification process that is documented, involves worker consultation, and is reviewed at least annually and after significant workplace changes. The identification process should draw on multiple sources of survey data, absenteeism records, incident reports, and direct consultation.
• A risk register that records identified hazards, current control measures, and the outcome of risk assessments. This will need to be comprehensive, but it must also be maintained.
• An ongoing monitoring mechanism. Pulse surveys are are the most practical tool for most organisations that creates a regular, documented record of psychological health indicators across the workforce.
• A clear process for responding to monitoring data: who reviews the results, what threshold triggers a response, who is responsible for implementing changes, and how the effectiveness of those changes is assessed.
• Director-level reporting on psychosocial risks. Regulators expect boards and officers to have visibility of these risks as part of their WHS governance obligations, not just HR.

If this feels like a significant uplift from where your organisation currently sits, you are not alone. The regulatory shift has been gradual, but the enforcement expectations as of 2026 are material. The organisations that will navigate it most effectively are those that treat psychosocial safety as an operational discipline not a wellbeing programme.

Xref Engage and Xref Pulse are designed to support ongoing psychosocial risk monitoring with surveys built by workplace psychologists and real-time dashboards that track what matters.

Talk to our team about building a monitoring framework for your organisation.