What the NSW Psychosocial Hazard Regulations Mean for Your 2026 WHS Review

In 2026, a NSW WHS review cannot stop at a policy signed in 2022: it must show how the PCBU identified and controlled psychosocial hazards in current work.

That is the practical significance of the updated guidance and sharper regulatory attention to psychosocial hazards. NSW has not created a separate compliance universe for 2026. The applicable framework remains the Work Health and Safety Act 2011, the Work Health and Safety Regulation 2017 as amended, and the psychosocial hazard duties aligned with the national model framework. Safe Work Australia guidance provides the practical background, while SafeWork NSW is the regulator that will assess how those duties operate in NSW workplaces.

For HR and WHS teams, the question is therefore not whether the organisation has a psychosocial hazard policy. It is whether the organisation can demonstrate a current, reasoned process for identifying hazards, assessing risks where required, consulting workers, implementing controls, and checking whether those controls work.

What the NSW duty requires

A PCBU has the primary duty of care to ensure, so far as is reasonably practicable, the health and safety of workers and other people who may be affected by the work. Health includes psychological health. The obligation is not limited to responding after a worker reports stress, bullying or an injury.

The organisation must consider psychosocial hazards that arise from work, the way work is designed or managed, the working environment, and interactions or behaviours at work. The relevant question is whether a hazard could create a risk to psychological health and safety, not whether the organisation has already received a formal complaint.

Safe Work Australia's guidance identifies 13 psychosocial hazard categories:

• job demands
• low job control
• poor support
• lack of role clarity
• poor organisational change management
• inadequate reward and recognition
• poor organisational justice
• traumatic events or material
• remote or isolated work
• poor physical environment
• violence and aggression
• bullying
• harassment, including sexual harassment

These categories are not 13 boxes to tick once. They are a structured way to examine how work is actually performed. A review that records bullying and harassment but says nothing about workload, decision-making authority, change management or role clarity is incomplete, even if the organisation has a well-written conduct policy.

The duty to manage risk is also broader than an employee assistance programme, wellbeing webinar or resilience training. Those measures may have a place, but they do not remove the need to examine the source of the risk. If excessive workload is foreseeable, the organisation needs to consider work allocation, staffing, deadlines, priorities and escalation arrangements. If poor support is the issue, it may need to examine supervision, access to advice and how concerns are handled.

What your 2026 review should be able to show

A defensible annual review should produce evidence, not just assurances. At a minimum, I would expect an HR or WHS team to be able to locate the following items.

1. A current hazard inventory. The inventory should address all 13 categories and explain which are relevant to the organisation, which work groups may be exposed, and why. A category should not be marked "not applicable" without a short reason.
2. Worker consultation records. The organisation should be able to show how workers and, where relevant, health and safety representatives were asked about work design, behaviours, incidents and emerging risks. Consultation should include groups whose experience may differ, such as remote workers, new starters, contractors, people managers and workers exposed to traumatic material.
3. A risk assessment method. The records should explain how the organisation considered the likelihood and consequences of exposure, including frequency, duration, intensity, affected groups and existing controls. Psychosocial risks can interact. For example, a major organisational change may increase job demands, reduce role clarity and weaken support at the same time.
4. A control plan. Each material risk should have controls, an accountable owner, a due date, a status and a method for checking effectiveness. Controls should address the source of the risk where reasonably practicable, rather than relying only on individual coping measures.
5. Review and incident evidence. The review should connect the risk register with complaints, reported incidents, exit feedback, absenteeism trends where lawfully available, investigations, return-to-work information and change projects. These sources should inform the risk assessment, while protecting confidentiality and avoiding unsupported conclusions about individual workers.

This does not mean that an employer must keep every worker's sensitive information in a central risk register. It means the organisation needs enough information to understand patterns and control risks. Personal information should be handled carefully, with access limited to people who need it for a legitimate work purpose.

What a psychosocial risk register needs to contain

A risk register is useful only if a person outside the original review can understand what was considered and what happened next. A practical entry should contain:

• the hazard category and a plain-English description of the work situation
• the work group, location or activity affected
• the possible pathways to psychological harm
• evidence considered, such as consultation, incident reports, surveys, complaints or operational changes
• existing controls and their limitations
• the assessed risk and the reasoning behind it
• additional controls required, prioritised by the hierarchy of control
• the control owner, implementation date and review date
• the effectiveness measure, including what would indicate that the control is not working
• links to relevant procedures, training, consultation records and investigations

Risk ratings should not become a substitute for reasoning. A green rating with no explanation is weak evidence. So is an entry that says "manager training" without identifying the work-related hazard, the manager behaviour or system problem being addressed, and how the organisation will know whether the training changed the risk.

Documentation should also record decisions not to implement a proposed control. There may be a reasonable operational explanation, but it should be stated, reviewed by an appropriate person and revisited if circumstances change. "Not reasonably practicable" is a conclusion that needs a basis, not a label that can be applied to avoid difficult work design questions.

Controls must be more than a policy library

Psychosocial controls often involve several parts of the business. HR may own a bullying procedure, but a business leader may control staffing and deadlines. A WHS team may maintain the register, while line managers influence supervision and day-to-day conduct. The annual review should therefore test whether responsibilities are connected.

Examples of controls may include:

• setting realistic workloads and clear priorities when competing deadlines arise
• clarifying decision rights, reporting lines and role expectations
• building consultation into restructures, technology changes and return-to-office arrangements
• providing supervision and escalation routes for remote or isolated workers
• setting behavioural standards and ensuring complaints are handled promptly and fairly
• designing procedures for violence, aggression and exposure to traumatic material
• monitoring whether workers can take breaks, access support and raise concerns without adverse treatment

Controls should be documented at the level of the hazard. A general wellbeing policy may support a programme, but it does not demonstrate that a particular workload, change process or reporting arrangement has been made safer.

There is an important boundary here. We are not saying that every difficult conversation, busy period or disagreement is automatically a breach of WHS duties. We are saying that foreseeable work-related risks to psychological health need to be considered systematically, and that the organisation must be able to explain why its controls are adequate in the circumstances.

What regulatory attention means for HR teams

SafeWork NSW's role is not to approve an organisation's preferred template. In practical terms, regulatory scrutiny is likely to test whether the PCBU understands its own work and can demonstrate action. That makes the quality and currency of records important, particularly where an organisation has experienced a complaint, a significant change, a serious incident or a pattern of concerns.

HR teams should check whether their records answer these questions:

• When was each work group last considered?
• Who was consulted, and what changed as a result?
• How were hazards identified beyond formal complaints?
• Which controls address the source of each material risk?
• Who is accountable for implementation?
• What evidence shows that controls are operating?
• What happens when a worker raises a concern?
• How are confidentiality, procedural fairness and non-retaliation managed?
• What has changed since the last review?

A 150-person professional services firm in Parramatta provides a useful example. In mid-2026, its review identifies a restructure, sustained client deadlines and a hybrid workforce. The initial register records "workload stress" as one risk. That is too broad to guide action. A better review separates job demands, low job control, poor support and lack of role clarity. It consults project teams and managers, checks how priorities are escalated, records the change-management controls, assigns owners, and schedules a review after the restructure. It also checks whether the complaints pathway is trusted and whether remote workers receive comparable supervision and support.

The counterpoint is that documentation alone does not make work safe. An organisation can have a polished register and still fail workers if managers ignore it, if controls are not funded, or if consultation is treated as a formality. Conversely, not every useful control will fit neatly into a numerical risk score. The review needs professional judgement, worker input and evidence of implementation.

A workable close-of-financial-year process

Before the financial year closes, I suggest running the review in this order:

1. Map work groups, locations, employment arrangements and material changes since the previous review.
2. Test all 13 hazard categories against each relevant work group, rather than completing one organisation-wide checklist.
3. Consult workers and representatives using more than one channel where appropriate, and record the themes without exposing personal information unnecessarily.
4. Update the risk register, including interactions between hazards and gaps in existing controls.
5. Prioritise controls, allocate accountable owners and document implementation dates.
6. Review related policies and procedures, then test whether managers and workers know how to use them.
7. Set effectiveness measures and a review trigger for incidents, restructures, new technology, workload changes or other relevant events.

For a growing organisation, this process can be proportionate. It does not require a large compliance department. It does require a consistent record of decisions, consultation and follow-through. That is the problem ReFresh was built to address: WHS psychosocial compliance without the paperwork spiral. Our small team focuses on Australian requirements, with AI drafting and regulation tracking used to support, not replace, practitioner judgement.

The most useful 2026 review is not the one with the most pages. It is the one that makes the organisation's reasoning visible: what changed, who was exposed, what controls were chosen, who owns them, and what evidence will show whether they worked.