WorkSafe explains HSWA changes

New WorkSafe guidance outlines how changes to the Health and Safety at Work Act will affect businesses from 1 April 2027, including different risk management duties for small and large businesses

WorkSafe has released four guides explaining business size, critical risks and how those risks must be managed under the amended Health and Safety at Work Act (HSWA).

The guidance is intended to help businesses prepare before the changes take effect. Business size will determine the scope of their risk management duties.

Small businesses’ main HSWA duties will be limited to managing critical risks, although they may choose to manage other risks. Large businesses will remain responsible for managing all risks, while giving priority to critical risks.

How business size is determined

The guidance uses the term PCBU – a person conducting a business or undertaking. This can include a company, sole trader or other organisation.

A small PCBU generally has fewer than 20 workers, while a large PCBU has 20 or more. Workers include contractors, subcontractors, labour hire workers, apprentices and trainees, as well as employees.

For businesses with fluctuating worker numbers, classification depends on reasonably expected numbers over the financial year. A business expecting fewer than 20 workers for at least nine months can qualify as small.

The guidance includes an example of a construction company with 35 workers, including subcontractors such as electricians and plumbers, which is classified as large.

For businesses making lasting workforce changes, their classification changes when the increase or reduction takes effect. Moving from 19 to 20 workers therefore changes the applicable duties from that day.

What counts as a critical risk?

A critical risk is one likely to result in death, a notifiable injury, illness or incident, or a specified occupational disease. Risks managed by regulations identified under HSWA are also critical.

WorkSafe’s examples include risks associated with asbestos, hazardous substances, certain machinery and working at height.

For hazards not covered by regulations, the guidance directs businesses to consider what could happen without controls and whether the resulting harm would meet the critical risk criteria.

“Focus on the worst, but realistically possible, outcomes, not just what usually happens,” it said.

The assessment includes everyday work, maintenance and emergencies. Businesses must also seek workers’ views, consider previous incidents and near misses, and account for known industry risks. Occupational diseases include respiratory disease caused by dust or fumes and some cancers linked to workplace exposure.

What changes for small businesses?

For small PCBUs, the duties limited to critical risks include the primary duty of care and duties associated with workplaces, plant, training, supervision and personal protective equipment.

Critical risks must be managed so far as is reasonably practicable. Businesses must assess them using what they know, and ought reasonably to know, about their work, then monitor, review and revise controls.

Worker welfare requirements continue to apply regardless of risk levels. These include adequate toilets, drinking water, hand washing facilities, first aid and emergency planning.

Officers of small PCBUs must exercise due diligence to ensure the business meets its duties to identify and manage critical risks. Small businesses can also choose to manage other risks voluntarily or through contractual arrangements.

What changes for large businesses?

Large PCBUs must continue managing all risks, with critical risks receiving priority.

WorkSafe describes this as addressing critical risks first, reviewing their controls more frequently and allocating a greater share of risk management resources to them.

Its construction example places falls from height ahead of minor office slips and trips. Controls include engineered edge protection, exclusion zones, frequent inspections of fall protection systems and dedicated supervisors for high-risk work. Once the critical risk is managed, the company should address other risks.

Brief guidance summaries

Am I a small or large PCBU?
Explains who counts as a worker, the 20-worker threshold, fluctuating workforce numbers and new businesses. A checklist and examples show how classification affects duties and when it changes.

What is a critical risk?
Defines critical risks and provides a process for identifying them. It distinguishes regulated hazards from those requiring an assessment of potential harm and explains differences between small and large businesses.

Managing critical risks for small PCBUs
Identifies the duties limited to critical risks, explains assessment and control requirements, and confirms continuing worker welfare obligations. It also covers officer duties and working with other businesses.

Prioritising critical risks for large PCBUs
Explains how to prioritise critical risks through the order of work, more frequent control reviews and resource allocation. Construction and manufacturing examples illustrate how other risks remain part of businesses’ duties.