For years, many organisations have treated WHS Codes of Practice as useful guidance: important, persuasive and worth considering, but not something that created a standalone duty to comply.

In New South Wales, that position changed on 1 July 2026.

Section 26A of the Work Health and Safety Act 2011 now requires a person conducting a business or undertaking to comply with an approved Code of Practice—or manage the relevant hazards and risks in a different way that provides an equivalent or higher standard of health and safety.[1][2]

The Industrial Relations Commission of NSW says this duty can give rise to an offence under sections 32 or 33 of the Act.[3]

That is a significant shift.

But the most important consequence is not that organisations need another compliance register. It is that they need credible evidence about the standard their controls achieve.

Having a procedure is not the same as meeting the standard

The predictable response will be a document review.

Teams will map Codes against policies, procedures, risk registers and training packages. Gaps will be recorded, actions assigned and dashboards updated.

That work may be necessary. It is not sufficient.

A procedure can reproduce the words of a Code and still fail in practice. Training can be completed while workers remain unable to apply it under real conditions. A control can appear in a risk assessment but be unavailable, routinely bypassed or undermined by workload, maintenance, supervision or competing priorities.

The new duty is framed around the standard of health and safety—not merely the presence of matching documents.[1]

That distinction matters because organisations often audit what is easiest to see:

  • Was the procedure approved?
  • Was the training completed?
  • Was the inspection form submitted?
  • Was the action closed?

Those questions test administrative completion. They do not necessarily test control effectiveness.

The harder questions are operational:

  • Can the control be used when the work becomes difficult?
  • Do workers understand when it is needed?
  • Is the equipment available and maintained?
  • Do supervisors reinforce it when production pressure increases?
  • Are deviations detected and understood?
  • Is the alternative method actually equivalent to or better than the Code’s standard?

These questions move assurance from paperwork to performance.

“We do it differently” now carries an evidence burden

Section 26A does not require every organisation to follow every sentence of a Code in exactly the same way.

The law preserves an important alternative: a PCBU may manage the hazard or risk differently if the different approach provides a standard of health and safety that is equivalent to or higher than the standard required by the Code.[1][2]

That flexibility is valuable. Codes cannot anticipate every technology, workplace or operating context.

But flexibility without evidence is only an assertion.

Consider a hypothetical organisation that does not use the inspection frequency described in a relevant Code. It uses condition monitoring and real-time alerts instead. That may provide an equivalent or higher standard—but only if the organisation can show that the alternative reliably detects deterioration, triggers timely action, remains available in degraded conditions and is understood by the people who depend on it.

“Our system is more advanced” is not verification.

Evidence might include design validation, field observations, maintenance history, test results, worker consultation, failure data, response times, exception reports and independent review. The right evidence will depend on the hazard, the control and the circumstances.

If an inspector, court or officer asked why your alternative is equivalent or better, what evidence would you produce?

Start with applicability, not a generic gap analysis

SafeWork NSW says PCBUs need to identify and apply the Codes relevant to the hazards and risks associated with their work. It also says businesses should review existing practices and controls, consult workers and relevant parties about changes, identify training needs and maintain clear records of assessments, reviews and actions.[1]

The first task is therefore not to download every Code and create one enormous checklist.

Start by establishing which approved Codes are relevant to the organisation’s work, locations, workers, contractors and risk profile.

Then examine each relevant Code through four lenses:

  1. Requirement: What standard does the Code establish for this hazard or risk?
  2. Control: What does the organisation rely on to meet that standard?
  3. Operation: What happens when the control meets real work—variability, time pressure, degraded equipment, contractors, handovers and competing goals?
  4. Evidence: What demonstrates that the control delivers the required standard consistently?

This approach also exposes a common blind spot: the Code may describe a control, while the organisation’s management system assumes that control is effective because it exists.

The gap is not always between the Code and the procedure.

Sometimes the gap is between the procedure and the work.

Consultation becomes part of the evidence

Workers are often the first people to know that a control is difficult to access, creates another hazard or no longer fits the way work is performed.

That makes consultation more than a communication step after the compliance team has completed its review.

It is a source of operational evidence.

SafeWork NSW’s 2026–27 Regulatory Statement identifies worker consultation and employer compliance with the new enforceable Codes as expectations across its regulatory priorities. Those priorities include falls from heights, psychosocial risks, hazardous substances and mobile plant, vehicles and fixed machinery.[4]

Leaders should therefore ask:

  • Which workers and health and safety representatives helped test our conclusion?
  • What did they tell us about workarounds and weak signals?
  • What changed because of their input?
  • How will we know if the control’s performance deteriorates?

If consultation only confirms a decision already made, it is unlikely to reveal how the control behaves in practice.

What officers should ask for

Officers do not need a line-by-line briefing on every approved Code.

They do need a defensible level of assurance that the organisation has identified the relevant Codes, acted on the new duty and verified any claims of equivalent or higher performance.

A useful officer-level view would show:

  • the relevant Codes and accountable owners;
  • material gaps between Code standards and current controls;
  • alternatives being relied upon instead of Code methods;
  • the evidence supporting equivalence or superiority;
  • overdue actions and interim risk controls;
  • worker and HSR consultation;
  • how control performance is monitored after the review; and
  • where uncertainty remains.

The danger is that this reform becomes a short compliance project: documents are updated, actions are closed and the organisation moves on.

The better response is to use the new duty to improve the quality of assurance.

Because the real test is not whether the Code appears in your management system.

It is whether the standard described by the Code can be seen in the way work is actually done.

Can we prove our controls measure up—or are we still relying on the fact that they exist?

This article provides general information, not legal advice. Organisations should obtain advice about the obligations applying to their circumstances and jurisdiction.

References

  1. SafeWork NSW, Codes of practice, updated July 2026; accessed 26 July 2026.
  2. SafeWork NSW, Legislation—Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025, accessed 26 July 2026.
  3. Industrial Relations Commission of NSW, Legal status of codes of practice, updated 1 July 2026; accessed 26 July 2026.
  4. SafeWork NSW, Regulatory Statement 2026–27, July 2026.
  5. NSW Government, Work Health and Safety Act 2011—current version, accessed 26 July 2026.