How to Choose WHS Compliance Software in Australia

Most of the WHS software comparison pages a buyer finds were written for somewhere else. They will tell you to look for dashboards, mobile access, and good reporting, and they are not wrong. They will not tell you that the same event is notifiable under one Act in Victoria and a different one everywhere else, or that the white card in a worker’s wallet was issued by a different body depending on which state they sat the course in.

Those are the things that decide whether a system survives an Australian rollout. I sit in these buying conversations most weeks, and the local specifics are almost never on the buyer’s list until somebody’s implementation walks into one. Below is what to ask about, roughly in the order it will cost you.

One Set of Model Laws, and a Different Regulator in Every State.

Australia has harmonised WHS law in the sense that most of the country works from one template. Safe Work Australia wrote the model WHS Act, the model WHS Regulations, and the model Codes of Practice in 2011, and is explicit that it neither regulates nor enforces any of it: to become legally binding, the Commonwealth, states, and territories each have to implement the model laws as their own.¹ The same page records that the model laws have been implemented in all jurisdictions except Victoria, and that some jurisdictions which did adopt them made variations.¹

So the single national rulebook a vendor’s marketing implies does not exist. What exists is a shared template, a set of local variations, and a separate regulator holding the enforcement pen in each state and territory, with Comcare covering the Commonwealth scheme.² It runs deeper than one regulator per jurisdiction: SafeWork NSW regulates everything other than mines and petroleum sites, which sit with the NSW Resources Regulator, and Queensland splits general industry from mining, quarrying, petroleum, gas, and explosives the same way.²

The buying consequence is testable in a demo. Ask the vendor to add a requirement that applies to one state’s sites and not another’s, using your own administrator login rather than a support ticket. In ComplyFlow, workforce compliance requirements attach to the site, so a Victorian site carries what a Queensland site does not.

Victoria Is Not a Variation. It Is a Different Act.

Victoria never adopted the model laws at all.¹ It runs the Occupational Health and Safety Act 2004, and the gap shows up fastest in incident notification, the process most likely to be running inside your software.

Under the Victorian Act, an employer or self-employed person must notify WorkSafe immediately on becoming aware that an incident has occurred at a workplace under their management and control, preserve the incident site, and provide written notification within 48 hours.³ The categories are Victoria’s own: incidents involving death or a person requiring medical treatment, and incidents that expose a person to a serious risk to their health or safety, which is where a near miss lands.³ WorkSafe also requires the completed incident notification form to be kept for at least five years.³

None of that maps cleanly onto the model law’s categories or timings. A single form with a single workflow is therefore wrong in Victoria, or wrong everywhere else, and you find out which at the worst moment available. Ask whether incident management can carry more than one notification path, and what decides which path a site uses.

Notification Is About to Diverge Further, Not Less.

A comparison page written two years ago cannot tell you this part. In December 2025 Safe Work Australia published amendments to the model WHS Act with updated guidance, extending notification duties to dangerous incidents involving mobile plant and falls, violent incidents including sexual assault, work-related suicide and attempted suicide, and extended worker absences of 15 or more calendar days.⁴

The critical sentence is the next one. Safe Work Australia says the changes take legal effect only once they are adopted into local WHS laws, that each jurisdiction will determine its own implementation timeline, and that employers must check with their local regulator before changing notification systems or reporting practices.⁴

Read that as a software requirement rather than a legal update. For some stretch of the next few years the same event will be notifiable in one state and not in the next, changing on a different date in each. A system with its notification logic hard-coded to one national definition will be quietly wrong in several jurisdictions at once, and nobody will notice until a regulator asks. Ask who changes that logic, how quickly, and what it costs.

Labour Hire Licensing Is a Separate Licence, in Four Places.

There is no national labour hire licensing scheme. Four jurisdictions run their own, under four separate Acts, administered by four separate bodies, and each puts a duty on the business using the labour as well as the one supplying it.

• Victoria. The Labour Hire Authority licenses providers and states plainly that hosts must only work with licensed providers, with serious penalties for engaging an unlicensed one.⁵
• Queensland. The Labour Hire Licensing Act 2017 (Qld), with a public register of licensed providers and a compliance unit that prosecutes unlicensed ones.⁶
• South Australia. The Labour Hire Licensing Act 2017 (SA), in the version that took effect on 29 January 2026. Section 11 makes providing labour hire services without a licence an offence; section 12 separately makes it an offence to enter into an arrangement for labour hire services unless the provider holds one. Both carry a maximum penalty of AU$140,000 for a natural person and AU$400,000 for a body corporate.⁷
• The Australian Capital Territory. The Labour Hire Licensing Act 2020 (ACT), in force,⁸ administered by WorkSafe ACT, which publishes a register so businesses and workers can verify a licence and sets the application fee at AU$3,461.00 for 2026-27.⁹

Check which of these reaches you before you write the requirement, because the schemes are not identical and they move. The software question is the smaller one: can you hold a labour hire licence against a supplier, in some states and not others, with an expiry date and a named person who checks it against the issuing register. If prequalification collects a licence number nobody ever verifies, what you bought is a filing cabinet with a login.

The White Card Has One Course Code and a Different Issuer in Every State.

The general construction induction card, the white card, is the document most often sitting in the wrong shape in a compliance system, because it looks national and is not.

The training unit is the same everywhere: CPCWHS1001 or CPCCWHS1001, Prepare to Work Safely in the Construction Industry, delivered by a Registered Training Organisation.¹⁰ Issuance is not. In Victoria the card is issued by WorkSafe Victoria itself, on application from the training organisation, courses delivered online only are not accepted, and the card can take up to 60 days to arrive.¹⁰ In New South Wales it is issued by SafeWork NSW, again through the training organisation, and cards issued in other states and territories are recognised for construction work in NSW.¹¹

A single field called the white card number is therefore not enough. The record has to know which body issued it, because that decides which register a person checks it against, and it has to cope with a worker holding a card from a state you do not operate in. Ask how training and induction records handle that, and who is expected to verify the card rather than accept a photograph of one.

Ask Where the Data Sits, Because Procurement Will.

This question arrives late in almost every enterprise purchase and surprises buyers who have not been through one. A WHS compliance system holds a great deal of personal information: licences, medicals, police checks, training histories, next of kin. That puts it inside the Privacy Act 1988, whose framework is the 13 Australian Privacy Principles.¹²

Two of the 13 decide the procurement conversation. Australian Privacy Principle 8 requires an entity, before disclosing personal information to an overseas recipient, to take such steps as are reasonable in the circumstances to ensure that recipient does not breach the principles, and section 16C of the Act makes the disclosing entity accountable for acts of the overseas recipient that would breach them.¹³ Sending the data offshore does not send the responsibility with it. Australian Privacy Principle 11 then requires reasonable steps to protect the information, and to destroy it or de-identify it once it is no longer needed for any purpose it may be used or disclosed for, unless a law or a court order requires it kept.¹⁴

That is why a procurement reviewer asks where the data is held, and why the cloud is not an answer. Ask for the hosting location in writing, the certification and the year it was first held, and the deletion practice. ComplyFlow’s answer is that all data is hosted within Australia, with ISO 27001 certification since 2019 and AWS Qualified Software status since 2023, set out in the ComplyFlow Help Centre.¹⁵ Get the same from whoever you buy from, and give it to procurement before contract rather than after.

What This Adds Up to in a Demo.

Four requests, all of which a vendor can meet in front of you if the product was built for this market.

1. Add a requirement that applies to your Victorian sites and not your New South Wales ones, using your own administrator login, and show what happens to the people already assigned there.
2. Show the incident notification path a Victorian site follows and the one a model-law state follows, and name who maintains the difference when a definition changes.
3. Open one worker’s record and show the white card, the body that issued it, and who verified it and when.
4. Put the hosting location, the certification and its date, and the deletion practice in writing before contract.

A vendor who manages all four without raising a ticket has built for Australia. One who cannot manage the first has not, and every complication above ends up in a spreadsheet beside the system, which is the outcome you were buying software to avoid.

The Australian Part Is the Part That Breaks.

WHS software is bought on a feature list and lived with on the exceptions. Here those are a state line, a second regulator for mines, a licence that exists in four jurisdictions, a card that different bodies issue, and a privacy duty that follows the data overseas. None of it appears in a demo unless you put it there.

Three other posts carry the rest of it. Contractor management software: 10 questions and 10 bad answers is the vendor conversation itself, question by question, with the reply that should slow you down attached to each. The three things WHS software has to get right is the short version, for a shortlist already down to two. And when a manual safety management system stops working is the one to read first if you are not yet convinced you need to buy anything. When you want to test all of this against a real system, book a demo and bring your hardest state.