Psychosocial Safety
Psychosocial safety at work: the AU/NZ duty, explained
A practical guide to the psychosocial safety duty across Australia and New Zealand, and how to turn everyday people data into audit-ready evidence.
By the Whyser Team · 23 July 2026 · 10 min read
Key takeaways
- Psychosocial safety means managing risks to mental health at work the same way you'd manage a trip hazard on the factory floor. It's not a wellbeing nice-to-have. It's WHS law.
- Every Australian jurisdiction now has an in-force psychosocial duty and a code of practice. Victoria was last, commencing 1 December 2025.
- The duty is positive: eliminate psychosocial risk so far as reasonably practicable, and where you can't eliminate it, minimise it. That's an active obligation, not a wait-and-see one.
- The legal process is four steps: identify the hazards, assess the risk, control it at the source, and review and record what you did.
- The data you're probably already collecting, pulse surveys, exit interviews, engagement scores, can double as the evidence a regulator wants to see, if you treat it that way from the start.
- New Zealand's duty is implicit under existing health and safety law, with non-binding guidance rather than a mandatory code. It's a step behind Australia, not exempt from it.
A director we spoke with recently told us his safety team had "psychosocial risk covered" because they'd run an engagement survey the year before. We asked him what the survey had actually changed. He went quiet.
That's the gap we want to close in this guide. Psychosocial safety is a legal duty now, not a values statement, and it comes with a process that has to produce evidence, not just good intentions.
What psychosocial safety actually means
Psychosocial safety is about managing the aspects of work that can harm someone's mental health. Not their mood on a bad Tuesday. Their actual psychological health, the same category of harm WHS law has always covered for physical injury.
Think about what creates that risk. Constant excessive workload. A manager nobody can approach. Vague accountabilities that leave someone guessing what "good" looks like. Isolation. Exposure to aggression or trauma. These aren't soft issues. They're hazards, in the same technical sense as a wet floor or an unguarded machine, and WHS law now treats them that way.
The shift in the last few years is that this stopped being a "nice culture" conversation and became a compliance one. If you run a business with people in it, you now have an obligation to manage this risk, in writing, and to be able to show your working if asked.
Why this is now a legal duty, not a values statement
Australia runs on model WHS law. Safe Work Australia writes a model Act, Regulations and Code of Practice, and each state, territory and the Commonwealth enacts its own version. That's why the detail varies a little by jurisdiction, but the core obligation doesn't.
Under that model law, a PCBU (a person conducting a business or undertaking, which in practice means most employers) has a positive duty to eliminate psychosocial risk so far as reasonably practicable. Where you can't eliminate it entirely, you have to minimise it as far as reasonably practicable. That's the legal standard: not "we did a survey once," but an ongoing, demonstrable effort to reduce the risk.
The Model Code of Practice: Managing psychosocial hazards at work (August 2022) sets out around 14 common psychosocial hazards and how to manage them. It's not just guidance you can politely ignore. It's admissible in court as evidence of what was reasonably practicable at the time, which means it's effectively the yardstick a regulator or a court will hold your business against.
Here's where each jurisdiction landed:
| Jurisdiction | Regulation commencement | Code |
|---|---|---|
| NSW | 1 Oct 2022; consolidated into WHS Regulation 2025 (22 Aug 2025) | SafeWork NSW Code |
| Queensland | 1 April 2023 | QLD's own Code (2022) |
| WA | 24 Dec 2022 | Psychosocial hazards in the workplace (2022) |
| Tasmania | Regs 30 Nov 2022; Code 4 Jan 2023 | model Code |
| NT | 1 July 2023 | NT Code (2023) |
| ACT | 27 Nov 2023 | Code 27 Nov 2023 |
| SA | 25 Dec 2023 | model-based Code |
| Commonwealth (Comcare) | core duty 1 April 2023 | Cth Code of Practice 2024 |
| Victoria (separate OHS regime) | 1 Dec 2025, no transition period | Compliance Code alongside |
As of mid-2026, every Australian jurisdiction has an in-force psychosocial duty and a code sitting behind it. Victoria came last, and it runs a separate OHS regime rather than adopting the model law wholesale, with a few of its own features, including that training alone can't be your only control, and a requirement for prospective written prevention plans.
New Zealand sits a step behind. Under the Health and Safety at Work Act 2015, "health" already includes mental health, so the duty exists implicitly, it was never carved out as a separate psychosocial requirement. There's no mandatory code. WorkSafe NZ published non-binding good-practice guidance in 2024, broadly following the NSW model. If you operate across the Tasman, don't read "no mandatory code" as "no duty." The duty is there. The compliance scaffolding around it is just less prescriptive for now.
Papua New Guinea, by contrast, is genuinely a different starting point. Its safety statutes date to the 1960s and 1970s and were written for physical safety. There's essentially no psychosocial content in the law yet. If PNG is part of your footprint, this is an education conversation, not a compliance one.
Want the full picture jurisdiction by jurisdiction? See psychosocial hazards in Victoria, Queensland and New South Wales.
What the duty actually requires: four steps
Strip away the legal language and the process is genuinely simple to describe, even if it takes discipline to do well. It's a cycle, not a one-off project.
1. Identify the hazards. Work out what's actually creating psychosocial risk in your organisation. That means looking at things like workload, role clarity, support from managers, exposure to difficult customers or traumatic material, and how change is managed. We've written a full breakdown in psychosocial hazards at work.
2. Assess the risk. For each hazard you find, work out how likely it is to cause harm and how severe that harm could be. This isn't guesswork. It should draw on real data: incident reports, absenteeism, exit interviews, survey results, and what people actually tell you when you ask properly. We go through this in detail in how to run a psychosocial risk assessment.
3. Control the risk at the source. Fix the thing causing the harm, not just the symptom. If a team is drowning in workload, an EAP referral doesn't touch the cause. Redistributing the work, changing a deadline, or hiring might. Controls sit in a hierarchy, and the code of practice expects you to prefer controls that address the source over ones that just help people cope.
4. Review and record. Check whether your controls actually worked, and keep a record that shows you did. This is the step most businesses skip, and it's the one a regulator will ask about first. "We fixed it" without a record is, for legal purposes, close to "we didn't do anything."
| Step | What it means | What "done well" looks like |
|---|---|---|
| Identify | Find the hazards in your actual workplace | A hazard list grounded in real data, not a generic checklist |
| Assess | Rate likelihood and severity | Assessment tied to evidence, reviewed by people who know the work |
| Control | Fix the cause, not just the symptom | Controls at the source first, coping supports second |
| Review & record | Check it worked, and keep the paper trail | A dated record you could hand a regulator without panicking |
That last column is where most organisations fall down. Not because the intent is missing, but because the record-keeping was never built into how the work happens day to day.
Enforcement has teeth now
This isn't theoretical risk. SafeWork NSW runs psychosocial WHS checks at workplaces with 200 or more employees, and a late-2025 compliance campaign issued more than 500 non-compliance notices. Improvement notices have been upheld on appeal. Regulators in other jurisdictions are running their own versions of the same scrutiny.
If your instinct is "we're too small to be on anyone's radar," that's a reasonable read of the enforcement pattern today. It's a much riskier read of where enforcement is heading, and it does nothing for the actual people at risk in your organisation right now.
Where free tools fit, and where they stop
You don't have to build this from nothing. The People at Work assessment survey, backed by Comcare and Safe Work Australia, is a free government-endorsed starting point. There are also validated instruments like APHIRM and COPSOQ III that measure psychosocial risk against established, peer-reviewed benchmarks. ISO 45003:2021 offers a guidance framework, not a certification, that maps closely to the Australian model code and is widely cited by vendors in this space.
These are a genuine floor. They're not built to run continuously, and none of them are designed to sit inside your everyday people processes so the evidence accumulates as a by-product of doing the work, rather than as a separate project every twelve months.
This is general guidance, not legal advice. Where the detail of your obligations matters, get your own legal and WHS advice for your jurisdiction and your workforce.
The bridge: turning everyday people data into audit-ready evidence
Here's the thing we keep coming back to with our clients. Most organisations already collect data that's relevant to psychosocial risk. Pulse survey results. Exit interview themes. Onboarding feedback. Performance conversation notes. It's usually scattered, unstructured, and never looked at as evidence of anything.
That data is a bridge. Structured properly, and captured continuously instead of once a year, it becomes the record that supports your identify, assess, control, review cycle, rather than a duplicate project sitting alongside it. This is the core idea behind how we've built Whyser Work: the everyday people processes you'd run anyway (culture measurement, career conversations, onboarding, performance check-ins) double as the audit trail your duty of care requires.
To be clear: a platform or a record supports your duty of care. It doesn't replace your own legal and WHS advice, and it doesn't replace the judgement of people who know your workplace.
If you want a hands-on starting point, our psychosocial readiness checklist is a free, practical self-assessment you can run this week to see where your organisation actually stands against the four steps above.
Frequently asked questions
Is psychosocial safety the same thing as wellbeing?
Not quite. Wellbeing programs are usually about supporting people to cope, things like an EAP, mindfulness sessions, or flexible leave. Psychosocial safety is about managing the hazards that create harm in the first place. A good wellbeing program can sit alongside psychosocial risk management, but it doesn't replace the legal duty to identify, assess and control hazards at the source.
Does the psychosocial duty apply to small businesses?
Yes. The positive duty to eliminate or minimise psychosocial risk applies to any PCBU, regardless of size. Larger workplaces face more active regulator attention right now (SafeWork NSW's checks target workplaces with 200 or more employees), but the legal obligation itself doesn't have a size threshold.
What happens if we don't do anything?
You're carrying real legal exposure, and improvement notices have already been upheld on appeal in at least one jurisdiction's enforcement campaign. But the bigger cost, in our experience, is what happens inside the business before any regulator gets involved: disengagement, avoidable turnover and preventable harm to people who are relying on you to have this covered.
How do we know if what we're already doing is enough?
Ask whether you could hand a regulator a dated record showing you identified a hazard, assessed it, controlled it, and reviewed whether the control worked. If the honest answer is "we have a survey from last year," that's your starting point, not your finish line.
Want to see where the connected system for all of this lives day to day? Have a look at Whyser Work's culture module, or book a demo if you'd rather talk it through.
If you had to hand your psychosocial risk file to a regulator tomorrow, what would be in it, and would it be enough?
See it in your organisation
Whyser Work turns everyday people data into the culture and compliance picture leaders can act on.