The section 26A readiness briefing

Psychosocial compliance in New South Wales after 1 July 2026: what changed, the duty stack the change sits in, what the evidence looks like when a regulator asks, and a checklist an organisation can self-assess against today.

Executive summary

On 1 July 2026, a new section 26A of the Work Health and Safety Act 2011 (NSW) came into force. Inserted by the Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025, it requires every person conducting a business or undertaking (PCBU) in NSW to comply with approved codes of practice, or to manage the same hazards and risks in a different way that provides a standard of health and safety equivalent to or higher than the code. SafeWork NSW's Code of Practice on managing psychosocial hazards at work is an approved code, so the way an organisation manages psychosocial risk, including exposure to traumatic events, is now measured against a statutory standard rather than persuasive guidance.

The duty reaches further than many organisations expect. The Act's definition of worker includes volunteers, so emergency services and other volunteer-based organisations owe it to their whole membership, and officers (directors and senior executives) carry a parallel personal duty of due diligence to verify that the organisation complies.

Since 1 July 2026, a PCBU should be able to answer three questions:

1. Which approved codes of practice apply to the hazards in our work, including the psychosocial code?
2. For each, are we complying with the code, or managing the risk another way that we can show meets an equivalent or higher standard?
3. Could we produce the records that prove either answer, today, to a regulator, a court or a coroner?

Most of this briefing is product-neutral and stands on its own; a short final section describes how CaseNote maps to the measurement and record-keeping obligations discussed. This briefing is general information, not legal advice.

What section 26A actually does

Before 1 July 2026, an approved code of practice in NSW worked the way it still works under the model WHS laws in force elsewhere in Australia: it was admissible as evidence of what is known about a hazard and of what a reasonably practicable standard looks like, but a duty-holder was not obliged to follow it. Section 26A is a NSW divergence from that model position. In plain terms, the provision says that where the Minister has approved a code of practice, a PCBU must either:

(a) comply with the code, or

(b) manage the hazards and risks in a different way that provides a standard of health and safety equivalent to or higher than the standard required under the code.

Paraphrased for readability. Read the provision in full at legislation.nsw.gov.au (Work Health and Safety Act 2011 No 10, s 26A).

Two points of precision matter here. First, the code itself has not become legislation. What section 26A does is make compliance with an approved code, or a demonstrably equivalent or better alternative, a statutory duty. The distinction matters: the alternative-standard limb preserves flexibility, but it puts the burden on the organisation to show the equivalence with evidence, rather than assert that its own approach is reasonable.

Second, section 26A sits among the Act's health and safety duties. That means a failure is enforceable through the machinery the Act already has: improvement notices, prohibition notices, and the Act's offence provisions. An organisation does not need a workplace injury to occur before the duty can be tested; an inspector can ask for the evidence of compliance at any time.

The duty stack section 26A sits in

Section 26A did not arrive in a vacuum. It is the newest layer in a stack of duties that has been building for more than a decade, and it is best understood as the layer that makes the others auditable against a published standard.

Read together, the stack asks four questions. Did the organisation protect psychological health at all? Did it run a structured identify-assess-control-review process for psychosocial hazards? Does that process meet the standard the approved code describes, or something demonstrably better? And did the people at the top personally verify all of the above, rather than assume it?

What the psychosocial code expects in practice

SafeWork NSW's Code of Practice, Managing psychosocial hazards at work, was published in May 2021 and describes a management cycle rather than a paperwork exercise: identify the psychosocial hazards present in the work, assess the risks they create, control them so far as is reasonably practicable using the hierarchy of controls, and review whether the controls are working. SafeWork NSW's hazard list includes exposure to traumatic events, alongside hazards such as high job demands and low role clarity. For emergency services, frontline health, social work and similar fields, traumatic exposure is not an edge case; it is the defining psychosocial hazard of the work.

The scale of that hazard in the emergency services sector is documented. Beyond Blue's Answering the Call (2018), the national mental health and wellbeing study of Australia's police and emergency services, surveyed 21,014 current and former personnel. One in three employees reported high or very high psychological distress, and among former employees about one in four showed probable post-traumatic stress disorder.

In practical terms, the code's expectations reduce to four things:

• Hazard identification that reflects the actual work. A generic risk register that never mentions traumatic exposure, in an organisation whose people attend traumatic scenes, is itself evidence of a gap.
• Controls that go beyond policy documents. Policies and training alone do not discharge the duty. Controls must reach how work is designed, rostered, resourced and supported: who is exposed, how often, what happens after exposure, and who is watching the accumulation.
• Review of control effectiveness. The cycle does not end when a control is implemented. The organisation must be able to say whether the control is working, which requires measuring something before and after.
• Records. Each of the steps above needs to be documented as it happens. Undocumented compliance is indistinguishable, after the fact, from non-compliance.

What a regulator, a court or a coroner asks for afterwards

When something goes wrong, the questions asked of an organisation follow a consistent pattern: what did you know, when did you know it, what did you do, and how did you verify the follow-through? Goodwill, capable people and pockets of good practice do not answer those questions. Contemporaneous records do. Two Australian matters, from different areas of law, show how the pattern plays out.

Kozarov v Victoria [2022] HCA 12 is a common-law negligence decision, not a WHS prosecution, and the distinction matters. A solicitor prosecuting child sexual offence cases developed post-traumatic stress disorder from the work. The High Court held that where work carries an inherent and obvious risk of psychiatric injury that the employer knows about, the duty to take proactive protective steps arises from the outset and applies to everyone in the role; the employer cannot wait for an individual to complain or show visible warning signs. The decision concerns roles in which trauma exposure is intrinsic to the work, and it should not be read as imposing that proactive standard on every workplace. But for organisations whose people attend traumatic events as a matter of course, it describes the standard a court will apply: a proactive system, run before harm appears.

The Court Services Victoria prosecution shows the regulatory side. Following a workplace suicide and findings of trauma exposure, role conflict and excessive workloads at the Coroners Court, WorkSafe Victoria prosecuted Court Services Victoria under section 21 of Victoria's Occupational Health and Safety Act 2004. It was convicted and, at sentencing in October 2023, fined $379,157, the maximum available, plus costs. This was a Victorian prosecution under Victorian law, not a NSW matter and not a section 26A case, but it is a landmark Australian prosecution for psychological harm. And a general warning belongs beside it: measurement that is collected and not acted on does not protect an organisation; it becomes evidence of what the organisation knew.

The financial backdrop makes the trend hard to dismiss. Safe Work Australia's Key Work Health and Safety Statistics Australia 2025 reports 17,600 serious workers compensation claims for mental health conditions in 2023-24 (preliminary data), an increase of 161 per cent over ten years. On the most recent finalised figures (2022-23), the median mental health claim involved $67,400 in compensation and 35.7 working weeks away from work.

The lesson that survives both cases and the claims data is the same one section 26A now writes into statute: the decisive question is whether the organisation ran a real, proactive, documented system, or whether it waited.

The measurement problem

The quietest requirement in the duty stack is also the hardest: reviewing control effectiveness. An organisation cannot demonstrate that its psychosocial controls work without measuring something, and most organisations have never measured psychological hazards with anything like the rigour they apply to physical ones. ISO 45003, the international standard for psychological health and safety at work, is the reference point most organisations reach for when they build that measurement capability.

Two kinds of measurement do different jobs, and conflating them causes trouble:

• Workforce-level hazard measurement asks how the work itself is affecting people in aggregate: job demands, role clarity, exposure to traumatic events and the other hazard categories. To get honest answers it must be anonymous by design, and reporting must suppress small groups (for example, cells below five respondents) so nobody can be identified by arithmetic. This is the measurement that shows whether controls are moving the hazard profile over time.
• Individual-level screening uses validated instruments such as the K10, PHQ-9, GAD-7, DASS-21, PCL-5, C-SSRS, WHO-5, ProQOL-5 and the Copenhagen Burnout Inventory to check on individual wellbeing and route people to support. One boundary is non-negotiable: these are screening and assessment tools. They indicate that someone may need clinical follow-up; they do not diagnose any condition, and they do not predict outcomes. Screening programs need clinical governance around instrument selection, thresholds and response protocols, and results belong inside a confidential support relationship, not in a management report.

Organisations that measure at both levels, keep the two strictly separate, and act on what they find can show the hazard profile, the controls applied, and the trend. Organisations that do not can only assert.

A readiness checklist

The following items can be self-assessed today, with no product involved. Each is phrased as the question a regulator, a court or a coroner would eventually ask; an honest “no” is a finding, not a failure. It tells you where to direct effort now, before an incident.

1. Trauma-exposed roles identified. Have you identified the roles in which exposure to traumatic events is an inherent part of the work, rather than treating each exposure as unforeseeable?
2. The code mapped to your operations. Has someone read the psychosocial code of practice against your actual operations and recorded where you comply, where you do something different, and why?
3. Equivalence documented. Where you manage a hazard differently from the code, is the alternative documented in a way that shows the standard achieved, not merely the activity performed?
4. Cumulative exposure visible. Can you produce, for any worker in an identified trauma-exposed role, a contemporaneous record of what the organisation knew about their cumulative exposure and what it did in response?
5. Proactive, not complaint-driven. Does support reach workers on the basis of what the organisation knows about their exposure, or only after they ask for help?
6. Controls beyond documents. Can you point to controls that change how work is designed, rostered, resourced or supervised, rather than policies and training alone?
7. Control effectiveness measured. Do you measure whether your controls are working, and could you show the trend, or would you be asserting effectiveness without data?
8. Workforce-level hazard measurement in place. Do you have an anonymous, repeatable way to measure psychosocial hazards across the workforce, with results workers can trust will not identify them?
9. Screening governed. Where individual screening instruments are used, are they administered under clinical governance and understood by everyone involved as screening, never diagnosis?
10. Records contemporaneous and tamper-evident. Are wellbeing and follow-up records made at the time, timestamped and protected from after-the-fact alteration, or would they be reconstructed from memory and inboxes when asked for?
11. A written use boundary. Is there a written, enforced rule confining wellbeing and exposure data to worker support, and excluding its use for performance management, discipline, attendance management or surveillance?
12. Officer-grade verification. Do your officers receive de-identified reporting sufficient to verify the system operates, such as coverage, response times and follow-up completion, without opening any individual's file?
13. Volunteers included. Does everything above extend to volunteers and to any other people who fall within the Act's definition of worker?
14. Follow-through tracked. After a major incident, is follow-up support scheduled and tracked to completion, or does it depend on individual goodwill and memory?

How CaseNote maps

CaseNote is wellbeing case management for organisations whose people are exposed to traumatic events. It does not discharge anyone's WHS duties; people and governance do that. What it provides is the working system, and the standing evidence, behind several of the checklist items above.

One boundary is built in rather than promised. CaseNote's published Scope Statement confines exposure and wellbeing data to member support: it must never be used for performance management, discipline, attendance management, surveillance, or fitness-for-duty decisions. A tracking system that drifts into surveillance destroys the trust that makes it work, so the boundary is enforced in the platform, not left to policy.

In December 2025, AFAC, Natural Hazards Research Australia and Phoenix Australia jointly published Good practice principles for tracking potentially traumatic event exposure and organisational responses in emergency services (Report No. 49.2025). CaseNote has been reviewed against that standard and maps to all six of its elements. That mapping is a vendor self-assessment; it does not imply endorsement by any of the publishing bodies.

An honest scope note: CaseNote covers the trauma-exposure, screening, measurement and record-keeping ground described in this briefing. Organisational hazards such as change management still need controls of their own; the hazard survey shows you where to direct them, but it does not implement them for you.

Sources and disclaimers

• Work Health and Safety Act 2011 No 10 (NSW), sections 19, 26A and 27; section 26A inserted by the Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025 (NSW), in force 1 July 2026. Available at legislation.nsw.gov.au.
• Work Health and Safety Regulation 2025 (NSW), sections 55A to 55D.
• SafeWork NSW, Code of Practice: Managing psychosocial hazards at work (May 2021, as approved).
• Kozarov v Victoria [2022] HCA 12 (High Court of Australia; common-law negligence).
• WorkSafe Victoria prosecution of Court Services Victoria under section 21 of the Occupational Health and Safety Act 2004 (Vic), sentenced October 2023.
• Safe Work Australia, Key Work Health and Safety Statistics Australia 2025; 2023-24 claims figures are preliminary, and medians cited are 2022-23 finalised figures.
• Beyond Blue, Answering the Call: National Mental Health and Wellbeing Study of Police and Emergency Services (2018).
• ISO 45003, Occupational health and safety management: psychological health and safety at work.
• AFAC, Natural Hazards Research Australia and Phoenix Australia, Good practice principles for tracking potentially traumatic event exposure and organisational responses in emergency services, Report No. 49.2025 (December 2025).

This briefing is general information about work health and safety obligations, not legal advice. Obtain advice on your organisation's specific circumstances from a qualified legal practitioner. Legislative references were checked against the sources above as at July 2026; always read the current provision at legislation.nsw.gov.au.

CaseNote is an independent product of Ideation Labs Australia. It is not affiliated with, or endorsed by, SafeWork NSW, Safe Work Australia, Phoenix Australia, AFAC, Natural Hazards Research Australia, Beyond Blue, or any emergency service organisation. No statement in this briefing should be read as implying that any organisation uses or endorses CaseNote.