The NSW Psychosocial Code Is Becoming Law. It May Already Be Out of Date.

Introduction

From 1 July 2026, section 26A of the Work Health and Safety Act 2011 (NSW) turns approved Codes of Practice from persuasive guidance into enforceable compliance benchmarks. Most of the commentary on this change has focused on the headline shift: a person conducting a business or undertaking (PCBU) must now either follow an applicable Code or prove, with evidence, that its own approach meets an equivalent or higher standard. Less attention has gone to a narrower problem sitting inside the psychosocial hazards space specifically. The Code that becomes NSW's legal benchmark for psychosocial risk was written in 2021, and the regulatory framework underneath it has moved since then. SafeWork NSW's own published guidance acknowledges the gap. This article sets out what that gap is, why it matters for how organisations evidence compliance from 1 July, and what closing it looks like in practice.

The Legal Landscape

Section 26A was inserted into the WHS Act by the Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025, which passed the NSW Parliament in late June 2025 and received assent shortly after. It commences on 1 July 2026 and applies to every approved Code of Practice in the state simultaneously, covering hazards from falls and confined spaces through to psychosocial risk. Under the new provision, a PCBU must either comply with an applicable Code, or implement alternative risk control measures that achieve a standard of health and safety equivalent to or higher than the Code sets out. The second limb is not self-certifying: a PCBU that departs from the Code carries the onus of demonstrating, with evidence, that its alternative approach actually meets that bar.

The relevant Code for psychosocial risk is the Managing Psychosocial Hazards at Work Code of Practice, approved by SafeWork NSW under section 274 of the WHS Act and issued in May 2021 - the first Code of its kind in Australia. It sets out a four-step risk management process covering hazard identification, risk assessment, control implementation and review, and gives specific guidance to officers on meeting their due diligence obligations under section 27. For a broader look at what section 26A changes across all approved Codes, see our earlier analysis of the NSW Codes of Practice change.

The Gap the Code Itself Admits To

Here is the detail most compliance checklists are missing. The 2021 Code predates a significant strengthening of the underlying WHS Regulation. The Work Health and Safety Regulation 2025 introduced sections 55C and 55D, which explicitly require PCBUs to apply the hierarchy of controls set out in section 36 when managing psychosocial risk, and to give specific consideration to a defined set of relevant matters. Before this change, psychosocial risk management in practice leaned heavily on administrative controls - policies, training, employee assistance programs. The 2025 Regulation makes clear that administrative controls sit low in the hierarchy, and that PCBUs must first turn their mind to eliminating or minimising risk through higher-order measures such as work redesign, before falling back on procedural or support-based responses as the primary control.

SafeWork NSW's own resource page for the Code acknowledges this directly, noting that the regulatory framework has continued to evolve since May 2021 and that the Work Health and Safety Regulation 2025 has since strengthened requirements for managing psychosocial risk, including the mandatory application of the hierarchy of control measures. In other words, the document about to become the legal floor for psychosocial compliance in NSW was written under an earlier, less demanding reading of the law it now supports.

This matters because of how section 26A is structured. From 1 July, an organisation that can show it followed the Code has a strong compliance position - but only if following the Code also satisfies the Regulation's current hierarchy-of-controls requirement. An organisation that treats the Code as a checklist of administrative measures, and stops there, may be able to point to Code compliance on paper while still falling short of what sections 55C and 55D actually require. The safer reading is that the Code sets a floor, not a ceiling, and that the "equivalent or higher standard" test in section 26A has to be assessed against the Regulation as it stands today, not just the 2021 Code text in isolation.

Why This Raises the Stakes for Officers

The shift also changes what due diligence looks like under section 27. Officer due diligence has always included taking reasonable steps to maintain up-to-date knowledge of WHS matters, and to verify that compliance processes are actually operating on the ground, not just documented on paper. Once Code compliance becomes a duty in its own right, an officer who signs off on a psychosocial risk program built solely around the 2021 Code's administrative-control examples - without confirming it also satisfies the Regulation's hierarchy-of-controls requirement - is exposed on two fronts at once: a possible section 26A breach at the PCBU level, and a due diligence question at the officer level.

Enforcement does not require an incident to have occurred. A documented gap between an organisation's controls and what the Regulation requires can, on its own, be sufficient grounds for regulatory action, from an improvement notice through to prosecution under the Act's existing health and safety duty offence provisions. This is not a theoretical risk: SafeWork NSW has flagged psychosocial hazards as an ongoing enforcement priority, and a regulator with an enforceable benchmark to measure against is a materially different enforcement environment to the one most psychosocial risk programs were originally designed for.

What Closing the Gap Looks Like in Practice

For WHS managers and HR directors preparing for 1 July, the practical task is narrower than a full risk assessment rebuild. It is a mapping exercise: for each control currently in place against a psychosocial hazard, identify where it sits in the hierarchy of controls, and confirm that higher-order options - changes to job design, workload, rostering, or reporting lines - were genuinely considered and documented before administrative or support-based controls were relied on as the primary response. Where elimination or higher-order minimisation is not reasonably practicable, that reasoning itself needs to be recorded, not just the control that was ultimately chosen.

This is also where the evidentiary side of section 26A becomes concrete rather than conceptual. A PCBU relying on the "equivalent or higher standard" pathway needs a governance trail: who assessed the hazard, what hierarchy-of-controls analysis was applied, who was consulted under section 47, and when. Genuine consultation before a decision is made - not notification after the fact - remains the threshold regulators and courts apply, and it applies with more force now that inspectors can act on a documented gap alone, without needing to point to an injury. Organisations that have already reviewed their psychosocial approach against the broader section 26A change should treat this hierarchy-of-controls question as the next layer of that review, not a separate project.

PsychProof's hazard and control library maps directly to the Safe Work Australia and NSW psychosocial hazard taxonomy, including control classification against the hierarchy of controls, and produces a timestamped consultation and control record for each hazard as it is assessed. For organisations working through what "equivalent or higher standard" actually requires, having that mapping and audit trail in place before 1 July - rather than reconstructed after an inspector asks for it - is the difference between a defensible position and a documentation exercise done under pressure.

Conclusion

Section 26A's headline effect - Codes of Practice becoming enforceable - is well covered elsewhere. The detail that matters for psychosocial risk specifically is narrower and easy to miss: the Code about to become NSW's legal benchmark was written for an earlier version of the Regulation it sits under, and SafeWork NSW says so on its own website. Organisations that treat literal Code compliance as sufficient, without checking it against the 2025 Regulation's hierarchy-of-controls requirement, may find their compliance position is weaker than they assumed the moment the Code becomes enforceable rather than advisory. The fix is not a new risk framework. It is confirming that the framework already in place actually satisfies the law as it stands today, and can show its working if asked.