
Safe Work Australia has published the final report of its Best Practice Review of the model work health and safety laws. It is the first full review of the model laws since the 2018 Boland review, and it makes 21 recommendations to WHS ministers, along with a list of actions Safe Work Australia will take itself.
Nothing in it is law yet. Ministers have to agree to each recommendation, and every jurisdiction then has to legislate. That will take time, and some recommendations may not survive the process. But the report shows clearly where the model laws are heading, and for organisations running a safety management system it raises a useful question: which of these changes would write into law what a well-run ISO 45001 system already does, and which ones genuinely raise the stakes?
Short answer
The recommendations that matter most for day-to-day safety management are:
- Risk management for all work (recommendation 6). The risk-management process in Part 3.1 of the model WHS Regulations would move into the Act and apply to all work and workplaces. In the short term, the regulations would be amended so the hierarchy of control measures clearly applies to psychosocial risks.
- Harmful workplace behaviours in the primary duty (recommendation 4). Section 19 would be clarified to include managing the risks arising from harmful workplace behaviours.
- Following a code counts as compliance (recommendation 15). A person who complies with a code of practice would be taken to have met the relevant duty, for the matters the code covers.
- No insurance for prosecution legal costs (recommendation 11). Insurance or an indemnity could no longer cover the legal fees of a person being prosecuted under the WHS laws.
- Anyone could prosecute (recommendation 10). Any person or organisation would have standing to bring a WHS prosecution, drawing on the NSW and New Zealand approaches, with a review three years after commencement.
- No time limit for the most serious offences. The report recommends removing the limitation period for industrial manslaughter and Category 1 offences, while keeping the two-year limit for other offences (with the regulator able to start proceedings later with the written authorisation of the Director of Public Prosecutions).
What the 21 recommendations cover
The report groups the recommendations into seven areas.
| Area | Recommendations | In brief |
|---|---|---|
| Harmonisation | 1 to 3 | Ministers recommit to nationally consistent laws; a new National Compliance and Enforcement Policy |
| The duties framework | 4 to 7 | Harmful behaviours in section 19; risk management elevated into the Act; a WHS Information Statement for workers, and one for small business owners |
| Consultation and representation | 8 | Best-practice variations on health and safety representatives, committees, consultation, the right to cease unsafe work and union right of entry |
| Compliance and enforcement | 9 to 14 | Longer internal review periods; general standing to prosecute; no insurance for prosecution legal fees; limits on non-disclosure agreements; a national approach to infringement notices; regulator and inspector powers |
| Codes of practice | 15 to 17 | Compliance with a code taken as compliance with the duty; new industry codes for retail, education and training, agriculture and construction, with small business toolkits; codes that apply nationally once ministers agree |
| The model regulations | 18 | A project to modernise the regulations for modern work and emerging hazards |
| Emerging issues | 19 to 21 | National strategies on artificial intelligence and digital technology, climate change (including new regulations on extreme heat, air quality and vector-borne diseases) and harmful behaviours (including regulations on access to facilities and on work-related violence and harassment) |
What a good ISO 45001 system already covers
Much of the direction in this report will look familiar to anyone running a certified safety management system. Several recommendations would turn good practice into a clear legal expectation.
| Recommendation | Where ISO 45001 already deals with it |
|---|---|
| Risk management applies to all work (6a) | Clause 6.1.2, hazard identification and assessment of risks, applies across all activities, not just the hazards with their own regulations |
| Hierarchy of controls for psychosocial risks (6b) | Clause 8.1.2 requires the hierarchy of controls for all hazards. ISO 45003 gives guidance on applying it to psychosocial risk |
| Harmful workplace behaviours in the primary duty (4) | Clause 6.1.2.1 already lists social factors, including workload, work hours, harassment and bullying, as hazards to identify |
| Consultation and representation (8) | Clause 5.4, consultation and participation of workers, including non-managerial workers |
| A WHS Information Statement for workers (7) | Clause 7.3, awareness, and 7.4, communication |
| Codes of practice as the benchmark (15 to 17) | Clause 6.1.3, legal and other requirements, and 9.1.2, evaluation of compliance |
In other words, an organisation whose ISO 45001 system genuinely works, rather than one that exists mainly for the certificate, is unlikely to be caught out by recommendations 4, 6 or 8. The gap usually shows up in psychosocial risk. Many systems still treat it as a policy and a training module rather than a hazard to be assessed and controlled like any other. Our guide to psychosocial hazards explains where ISO 45001 stops short of what Australian law expects.
Where the stakes go up
Some recommendations change the consequences rather than the system.
Prosecution legal costs. Insurance against WHS fines is already prohibited. Recommendation 11 would extend that to legal fees, so a person facing a WHS prosecution could not rely on an insurance policy or indemnity to fund their defence. For officers, that makes due diligence a personal matter in a very practical sense.
Who can prosecute. Under recommendation 10, a prosecution would no longer depend only on the regulator deciding to act. Unions, families and other organisations could bring one too. A safety system that can show, with records, what was assessed, what was decided and what was checked becomes more important when more people can test it in court.
No time limit for the most serious offences. Removing the limitation period for industrial manslaughter and Category 1 offences means records of risk assessments, control verification and decisions about serious hazards could matter many years after the event. Our article on workplace fatalities in 2025 looks at how serious incidents most often happen and what verification looks like in practice.
Codes of practice cut both ways. Recommendation 15 would give a clear benefit to following a code: if you comply with it, you are taken to have met the duty for the matters it covers. NSW has already gone the other way with its section 26A, under which you follow the applicable code or show you manage the risk to an equivalent or higher standard. Our article on enforceable codes of practice in NSW covers that change. Either way, the codes relevant to your work are becoming the benchmark your system is measured against.
What happens next
The report goes to WHS ministers. They will decide which recommendations to accept, and Safe Work Australia would then draft the changes to the model Act, regulations and codes. Each jurisdiction then decides whether, and when, to adopt them. Victoria is the only jurisdiction that has not adopted the model laws, so changes there would depend on its own parliament.
Some recommendations are short-term fixes, such as clarifying the hierarchy of controls for psychosocial risks. Others, like the regulations modernisation project and the strategies on AI and climate change, will take years.
In the meantime, nothing changes for your legal obligations today. The duty of a PCBU is the same as it was last week.
Practical steps now
- Check your psychosocial risk management. Are psychosocial hazards in your risk register, assessed and controlled using the hierarchy of controls, with someone checking the controls work?
- Check your risk method covers everything. Your risk process should apply to all your work, not only the hazards that have their own regulations or codes.
- Know which codes apply to you. List the codes of practice relevant to your activities in your legal register, and record how your controls compare to them.
- Brief your officers. The recommendations on legal costs and standing to prosecute are worth putting in front of directors and senior managers now, as part of their due diligence.
- Watch for ministers’ response. We will update this article when ministers announce which recommendations they accept.
Model WHS laws review: FAQs
Is the review now law?
No. It is a set of recommendations to WHS ministers. Nothing changes until ministers agree and each jurisdiction passes the changes.
How many recommendations are there?
21, grouped into harmonisation, the duties framework, consultation and representation, compliance and enforcement, codes of practice, the model regulations and emerging issues. The report also lists actions Safe Work Australia will take itself.
Does this affect businesses in Victoria?
Victoria has its own OHS laws and has not adopted the model laws. Several recommendations draw on Victorian approaches, and businesses working across borders will still feel the effect.
Does ISO 45001 certification mean we comply?
Not on its own. ISO 45001 gives you the structure to manage risk, consult workers and evaluate compliance, but legal compliance depends on what your system actually does in practice. A well-run system puts you in a strong position for most of what the review recommends.
How Streamline can help
Streamline helps Australian organisations build and improve ISO 45001 safety management systems that work in practice, including psychosocial risk management and legal registers that keep up with changes like these. Our gap analysis shows where your system stands, and ISO mentoring supports your own team to make the improvements. If you would like to talk through what the review means for your organisation, get in touch.
Source: Safe Work Australia, Best Practice Review of the model WHS laws: Final Report, October 2026.
Published 22 October 2026 | Facts checked 22 October 2026 against the final report | Next review when WHS ministers respond to the recommendations | Jurisdiction: Australia (model WHS laws) | Source: Best Practice Review of the model WHS laws, Final Report, October 2026
Stay in the Loop
Get an email when we post an article. Your email address will not be used for marketing, and you can unsubscribe at any time.
We handle your details in line with our privacy policy.












