What Good Safety and Compliance Management Looks Like Now

The question I get asked most by a safety manager who has just taken on a bigger patch is some version of this: what does good look like now. Not what the law said when they did their training. What it asks this year, and what an inspector would expect them to be able to put on the table. I have been answering that question since 2009.

Four things have moved in Australian work health and safety practice, and each one changes what a competent team does week to week. None of them adds a form. All of them change what you have to be able to show.

Psychosocial Risk Is a Regulated Duty, Not a Wellbeing Program.

This is the change that has caught the most organisations on the back foot, because for years the subject sat with human resources and arrived as an assistance line on a poster.

The model WHS Regulations now carry a division on psychosocial risks. Regulation 55A defines a psychosocial hazard as a hazard arising from or relating to the design or management of work, a work environment, plant at a workplace, or workplace interactions or behaviours, that may cause psychological harm.¹ Regulation 55D requires a business to implement control measures to eliminate psychosocial risks so far as is reasonably practicable and, where that is not practicable, to minimise them.¹

That is the same sentence shape as the duty for a physical hazard, and it is meant to be. Regulation 55D also sets out what you must have regard to in choosing controls: the duration, frequency and severity of exposure, how the hazards interact or combine, the design of work including job demands, the systems of work, the layout and conditions of the workplace, the plant and substances at it, workplace interactions or behaviours, and the information, training, instruction and supervision provided.¹

Safe Work Australia’s code of practice, published in July 2022, names the hazards to look for. Job demands, low job control, poor support, lack of role clarity, poor organisational change management, inadequate reward and recognition, poor organisational justice, traumatic events or material, remote or isolated work, poor physical environment, violence and aggression, and bullying.² Read that list against a night shift on a remote site and the point makes itself.

The duty has commenced. In New South Wales the psychosocial provisions started on 1 October 2022.³ Victoria sits outside the model laws and made its own rules: the Occupational Health and Safety (Psychological Health) Regulations 2025 commenced on 1 December 2025, and require Victorian employers to identify psychosocial hazards, control the risks and review the controls.⁴

In practice this means a psychosocial hazard belongs on the same risk register as a fall from height, with an owner, a control, a residual score and a review date. Not in a parallel wellbeing document nobody opens.

AI Is Now a Hazard You Have to Manage.

On 23 July 2026 Safe Work Australia published guidance on AI and digital technologies and put it in its hazards library, alongside chemicals and working at heights.⁵

The position is plain. If you are a person conducting a business or undertaking, you must manage health and safety risks from AI and digital technologies as much as you reasonably can, just as you would with any other hazard or risk.⁶ The guidance is explicit that this covers psychological risk as well as physical, which ties the first two changes together.⁶

Two obligations in it are the ones teams miss. First, you must consult workers and their health and safety representatives before introducing digital technology that may affect health or safety, to help identify the risks and decide how to manage them.⁶ Consultation after the rollout is not consultation. Second, you must provide the information, training, instruction and supervision needed to protect people, including genuine opportunities to ask questions or raise concerns.⁶

None of that says do not use AI. We build AI into ComplyFlow, and I think it is the best thing to happen to compliance admin in a decade. It says put the tool through the risk process you would put a new piece of plant through, and write down what you decided. For the skills a safety manager needs to do that well, my colleague John McCann has written The 5 AI Skills Every WHS Manager Should Be Building Right Now, which covers the governance side properly.

Industrial Manslaughter Reached Every Jurisdiction.

The offence that used to be a Queensland peculiarity is now general. One warning before the figures. The penalty tables circulating on compliance blogs disagree with each other, several are years out of date, and at least one figure in wide circulation is plainly wrong. The numbers below are read out of Safe Work Australia’s own jurisdictional comparison table for 2026-27,¹⁵ and the sections out of each Act.^379101112

These are maximums for a body corporate, current at 1 August 2026:

• New South Wales, AU$20,000,000, offence commenced 16 September 2024.
• Victoria, AU$20,910,000, being 100,000 penalty units at AU$209.10 for the year from 1 July 2026. This is the one to watch. Victorian penalty units are indexed every year, and WorkSafe’s own page still carries AU$16.5 million with “as at 1 July 2020” beside it. That figure is six years stale and is the number most often quoted.⁸
• Commonwealth, South Australia, Tasmania, and the Australian Capital Territory, AU$18,000,000 each.
• Northern Territory, AU$12,610,000, being 65,000 penalty units at AU$194.
• Queensland and Western Australia, AU$10,000,000 each.

For an individual, only Western Australia sets a monetary maximum, at AU$5,000,000.¹⁵ Everywhere else the individual penalty is imprisonment with no monetary ceiling: 25 years in New South Wales, Victoria, and the Commonwealth; 21 years in Tasmania; and 20 years in Queensland, Western Australia, and the Australian Capital Territory.

Queensland’s offence and the Commonwealth’s both reach a senior officer personally as well as the business.⁷¹² Tasmania’s applies to a person conducting a business or undertaking and to an officer of one.¹⁰ That is the bridge to the fourth change. Why risk assessments are required sets the same table beside the enforcement ladder that leads to it.

The Duty Reaches the Boardroom Through Section 27.

Officers’ due diligence is not new. What is new is the criminal offence sitting behind it, and the fact that boards have noticed.

Section 27 of the model WHS Act requires an officer to exercise due diligence to ensure the business complies with its duties, then defines due diligence as six reasonable steps: acquire and keep up to date knowledge of work health and safety matters; understand the operations and the hazards and risks in them; ensure the business has available and uses appropriate resources and processes to eliminate or minimise risk; ensure it has processes for receiving and considering information about incidents, hazards and risks, and responding in a timely way; ensure it has and implements processes for complying with its duties; and verify the provision and use of those resources and processes.¹³

The sixth step is the one that should change what a chief executive asks for. Verification is not a slide saying the induction rate is 94%. It is being able to see that the process ran, who it ran on, what it found, and what happened next. A percentage tells an officer nothing they could stand behind.

The Three Moves, and the Order to Make Them In.

Three moves, in the order I would make them.

Put psychosocial hazards on the risk register you already keep, rather than in a document beside it. Same matrix, same owners, same review cycle. A scheduled review is what stops a risk being accepted by default: in ComplyFlow, each risk owner receives an action for the risks they own and updates the controls and the residual score, and the review’s overall status tracks how many of those actions are done.¹⁴

Run every new AI or digital tool through that same process before it goes live, and consult the people whose work it will change while the decision is still open.⁶ Record the consultation, because the duty is to consult, not to have meant to.

Then look at what your officers actually receive. If the board pack is percentages, it evidences nothing under section 27. Swap one number for one exception list: the contractors working today whose evidence is not current, named, with the date each was last checked. That is verification, and it takes up about the same space on the page.

None of this is an argument for more paperwork. All four changes ask the same question in different accents: can you show what you did, for this hazard, on this site, on this date. If the answer lives in somebody’s inbox, the answer is no.