NSW Codes of Practice Are Now Enforceable: What the 1 July 2026 Duty Means for You

On 1 July 2026 a quiet but significant change took effect in New South Wales. Codes of practice, which for years sat in the background as “guidance”, became something much closer to law. If you run a business in NSW, the practical question has shifted from “have we had an incident?” to “can we show we are following the code, or doing something demonstrably better?”

I have audited safety systems for a long time, and this is the sort of change that catches good businesses out. Not because they are unsafe, but because they have never had to prove the thing they have always done informally.

What changed

The Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025 inserted a new section 26A into the NSW Work Health and Safety Act 2011. From 1 July 2026, a duty holder must:

• comply with an approved code of practice that applies to a risk in their business; or
• manage that risk in a way that provides an equivalent or higher standard of work health and safety than the code.

Three things about that are worth sitting with.

• It applies to every approved code: around 30 of them. The psychosocial code has had the most attention, and it is the one that will bite hardest, but this is not a psychosocial-only change. Manual handling, hazardous chemicals, confined spaces, plant, silica, noise. All of it.
• You no longer need an incident. Previously the code was largely evidentiary, something a court weighed up after something went wrong. Now, failing to follow an applicable code, without a demonstrably equivalent alternative, can be a breach in its own right. Nobody has to be hurt.
• Inspectors can act on it directly. A SafeWork inspector can reference the code when issuing an improvement or prohibition notice, and a failure can be prosecuted as a failure to comply with a health and safety duty under the Act.

One technical point that gets muddled in the commentary: you still cannot be charged under a code of practice. The code is not an offence provision. What has changed is that complying with the code has become the duty, and breaching that duty is prosecuted through the same offence provisions as any other safety breach.

The trap is in the second limb

Most of the attention has gone to “you must follow the code”. The genuinely interesting part is the alternative: you may instead manage the risk to an equivalent or higher standard.

That sounds like flexibility. In practice it is a documentation burden, and it is where I expect most businesses to come unstuck. Because if you are not following the code, the burden falls on you to show that what you do instead is at least as safe. “We’ve always done it this way and nobody’s been hurt” is not a demonstration of equivalence. It is an absence of evidence.

To rely on the second limb, you realistically need: a risk assessment that identifies the hazard the code addresses; a documented reason why your control differs; an argued case that your control achieves an equivalent or better outcome; and records showing the control is actually operating. That is not a memo. That is a management system.

Why this makes a real safety system far more valuable

Here is the part that ought to interest anyone weighing up whether a formal OH&S system is worth the effort. Everything section 26A now demands of you (identify applicable obligations, assess the risk, select and justify controls, keep evidence that they operate, review them) is precisely the machinery of an ISO 45001 occupational health and safety management system.

A business running ISO 45001 properly already has a register of compliance obligations, a hazard and risk register, documented controls, worker consultation records and an internal audit cycle. Which means it can answer an inspector’s “show me” in minutes rather than weeks, and can actually mount the equivalent-or-better argument if it chooses to deviate from a code. A business without one is relying on memory, and memory does not hold up in front of a regulator.

You do not need to be certified to comply with the law. But the system that gets you certified is the same system that lets you prove compliance, and that is a far better reason to build one than a logo for a tender.

What to do in the next month

1. List the codes that actually apply to you. Not all 30, just the ones relevant to your hazards. Start from the official codes by jurisdiction and work down to your operations.
2. Gap-assess against each one. Where do you already comply, where do you partially comply, and where do you knowingly do something different? Be honest. An independent gap analysis is more useful here than a self-assessment, for obvious reasons.
3. Take the psychosocial code seriously. It is the one most businesses have the least evidence for, and the one regulators are most focused on. Consultation records, a psychosocial hazard risk assessment and actual controls, not a wellbeing poster.
4. Document your equivalence arguments now, not after the notice arrives. Anywhere you depart from a code, write down why, and why your approach is at least as safe. Do it while you can think clearly.
5. Build the evidence trail. Controls that exist only in a document are worth nothing. Records of training, consultation, inspections and corrective actions are what prove the control is real.

A note for businesses outside NSW

This is a NSW amendment. But if you operate across borders, you now have a jurisdiction where codes are enforceable and others where they remain evidentiary, and running two standards of safety across one business is a poor idea in practice and an indefensible one in front of a regulator. Most multi-state operators will find it simpler, and safer, to lift everything to the NSW bar. It also would not surprise me to see other jurisdictions look closely at this over the next few years.

How Streamline can help

We help Australian businesses turn codes of practice into a working safety system, and prove it. That might be an independent gap analysis against the codes that apply to you, an independent internal audit of your existing system, a full ISO 45001 certification project, or ISO mentoring if your team wants to build it themselves with expert guidance. You work directly with an experienced ISO Lead Auditor.

Speak with an experienced ISO auditor

Not sure which codes apply to you, or whether you could prove equivalence if asked? Email hello@streamline.business or call Brisbane 07 3667 8280, Sydney 02 8315 7780 or Melbourne 03 9034 3990.

This article is general information, not legal advice. For advice on how section 26A applies to your specific circumstances, speak with a WHS lawyer.