Resources / Compliance
Blog, codes of practice, 2026The codes
stopped being advice
On 1 July 2026 New South Wales turned its codes of practice into a standard you either meet or beat. Here is what that means for a crew working outdoors, and the part that catches people out.
The short version
- Section 26A of the Work Health and Safety Act 2011 (NSW) commenced on 1 July 2026. A person conducting a business or undertaking, which the legislation shortens to PCBU and most people read as “the business”, must now comply with an approved code of practice or manage the risk to an equivalent or higher standard.
- Codes were already admissible evidence of what was reasonably practicable. They still are. What changed is that they are now also a duty, so a gap against a code is a breach in itself.
- The change was signposted 12 months out, but there is no phase-in and no grace period. It applied in full from the first day.
- The regulator does not have to prove an incident or an injury occurred. A gap against a code can be the breach.
- Four codes reach essentially every outdoor crew regardless of trade: how to manage work health and safety risks, managing the work environment and facilities, managing the risk of fatigue at work, and managing psychosocial hazards at work.
- The fatigue code, remade in February 2026, asks for records of working hours, breaks and travel, and for trends to be read across them. That is a records problem before it is a policy problem.
- New South Wales is not the only state doing this. Queensland has had the same provision, word for word, since 2017.
- A separate Act passed in February will extend the duty to digital work systems. It is not in force yet. When it starts, the software you buy to prove compliance becomes something you have to do due diligence on.
Where this piece comes from #
The last piece in this series walked through the first 24 hours after a serious incident, and the 5 places response goes wrong. This one is about the months before that. It came out of re-reading the SafeWork New South Wales code list after the July change and realising that a fair few of the codes that now bite hardest on outdoor work were remade in the first half of 2026, which means the version most businesses have on file is not the version that applies.
None of this is legal advice. It is the reading of a founder who builds software for outdoor crews and had to work out what the change meant for the product. Sources are at the bottom. Where I could quote the Act or the Regulation itself I have, because the whole argument of this piece is that the exact wording now matters.
What actually changed #
Before 1 July, a code of practice was evidence and nothing more. If you ended up in front of a court, the code was admissible as proof of what was known about a hazard and what was reasonably practicable to do about it. You could depart from it and argue your way. The code sat on the guidance side of the line.
Section 26A moved it. Here is the whole section:
26A Duty of persons conducting business or undertaking, code of practice
A person conducting a business or undertaking must, if the Minister approves a code of practice for the purposes of this Act,
(a) comply with the code, or
(b) manage hazards and risks arising from the work carried out as part of the conduct of the business or undertaking in a way that is different to the code but provides a standard of health and safety that is equivalent to or higher than the standard required under the code.
Two routes. Follow the code. Or do something else that is demonstrably as good or better.
What the section does not do is repeal the old position. Section 275 is still there, and an approved code is still admissible as evidence of whether a duty has been complied with. Codes did not stop being evidence. They became a duty as well, which is the harder of the two to argue with.
Section 26A was inserted by the Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025, which was assented to on 3 July 2025 and split into 3 staged commencements by proclamation in September 2025:
| Date | What commenced |
|---|---|
| 13 October 2025 | Most of the Act, including expanded entry permit powers to take measurements, conduct tests and take photos and video relevant to a suspected contravention |
| 1 March 2026 | Prosecutions and civil penalty proceedings brought by registered organisations, and a new obligation on SafeWork New South Wales to report to the Minister twice a year on psychosocial complaints and notices |
| 1 July 2026 | The section 26A duty to comply with approved codes |
So the change was visible 12 months ahead. What there was not, and is not, is a phase-in or a grace period. Section 26A applied in full on day one, to arrangements that were already running.
Inside a code, the verbs carry the weight. SafeWork New South Wales sets out the test plainly: “must” is a requirement that is typically a duty by law, “should” identifies the standard required by a code and is where the equivalent-or-higher question lives, and “may” indicates an optional course of action. A code stuffed with “should” statements is not a code full of suggestions any more. Each “should” is now a standard you either meet or consciously beat another way.
Scroll sideways to see the whole figure
Which codes reach a crew working outside #
This is not the full list of 50. It is the subset that a business running people outdoors in New South Wales is most likely to be measured against.
| Your work | Codes that now set the minimum |
|---|---|
| Every outdoor crew, whatever the trade | How to manage work health and safety risks; Managing the work environment and facilities; Managing the risk of fatigue at work; Managing psychosocial hazards at work; First aid in the workplace; Hazardous manual tasks; Work health and safety consultation, cooperation and coordination |
| Farms and horticulture | Safe use and storage of agricultural and veterinary chemicals; Safe use and design of bulk storage silos and bins; Managing the risks of plant in the workplace; Managing the risks of biological hazards at work |
| Construction and civil | Construction work; Excavation work; Managing risks of falls at workplaces; Moving plant on construction sites; Overhead protective structures; Working safely when cutting, drilling and grinding concrete and masonry product; Work on roofs, commercial and industrial buildings |
| Landscaping and bush regeneration | Tree works; Managing the risks of plant in the workplace; Hazardous manual tasks |
| Forestry and timber | Safety in forest harvesting; Sawmilling industry; Safe handling of timber preservatives and recently treated timber |
| Transport | Managing the risk of fatigue at work; Managing the risks of plant in the workplace |
| Utilities and councils | Work near overhead and underground electric lines; Excavation work; Managing the work environment and facilities |
| Anyone housing a crew on site | Worker accommodation |
The first row is the one to notice. Whatever else you do, 7 codes apply because you employ people, and 4 of those 7 apply with particular force because your people are spread out, moving between sites and working in weather.
Start with the fatigue code #
If you read 1 code this month, read the February 2026 fatigue code. It is new, it is specific, and almost every statement in it is checkable against a roster and a timesheet.
The shape of what it asks for:
- Where the risk of fatigue is high, consider restricting shifts to no more than 8 hours
- Do not roster more than 3 successive night shifts
- Do not have less than 12 hours between shifts
- At least 1 full day off per week
- A 30 minute break every 5 hours, and more frequent breaks for physically demanding work done outside in the heat
- Work should not start before 6am or end after 10pm, with the high risk windows named as after 10pm, particularly 2am to 6am, and a secondary dip between 2pm and 4pm
- At least 24 hours notice of night work
- Rosters set early enough for people to plan their personal time
- Long commutes accounted for. The code is careful here: the duty may not extend to the drive itself, but if an extended commute means a worker is fatigued once they are at work, that is yours to manage
Then it asks you to know whether any of that is actually happening. The code says you “should consider what records you need in order to assist you to identify fatigue related hazards and risks”, gives “records of working hours, breaks and travel” as the example, tells you to “ensure you are collecting and maintaining records in a form that covers all workers”, and says you “should look for trends across these information sources”.
Read those 4 sentences next to section 26A and the position is clear enough. The standard is not a fatigue policy. The standard is knowing the hours, the breaks and the travel, across all workers, well enough to see a pattern in them.
The section most outdoor businesses have never read #
The Work Health and Safety Regulation 2017 was replaced last year by the Work Health and Safety Regulation 2025, which calls its provisions sections rather than clauses. The 2 that matter most here kept their numbers.
Section 48, remote or isolated work:
(1) A person conducting a business or undertaking must manage risks to the health and safety of a worker associated with remote or isolated work, in accordance with Part 3.1.
(2) In minimising risks to the health and safety of a worker associated with remote or isolated work, a person conducting a business or undertaking must provide a system of work that includes effective communication with the worker.
SafeWork New South Wales’ own guidance spells out what it expects to see: communication devices and procedures that maintain regular contact, and “a ‘check-in’ at the beginning and ‘sign-off’ at the end of the working period”. It also lists periodic supervisor visits, automatic warning devices, personal duress alarms that activate on a lack of worker activity, and satellite tracking, depending on the risk.
Two things follow that people miss.
First, “remote or isolated” is not only the far west of the state. The Regulation defines it as work “isolated from the assistance of other persons because of location, time or the nature of the work”, and defines assistance to include “rescue, medical assistance and the attendance of emergency service workers”. Read that way, the test is not how far you are from a town. It is how long help would take. A 2 person crew on a property well outside ambulance range is the kind of work the definition is aimed at, and so is a solo operator doing tree work in a suburban street with nobody else on site.
Second, remote or isolated work is also a named psychosocial hazard. The May 2021 psychosocial code lists it among 16, describing it slightly differently, as arising “where there is limited access to other people, reliable communication or technology to get physical and emotional support, if required”. So the same fact pattern is caught twice, once as a physical risk under the Regulation and once as a psychosocial one under the code. Worth knowing alongside that: since 1 March 2026 SafeWork New South Wales has had to report to the Minister every 6 months on psychosocial complaints and notices, by sector, and those reports are tabled in Parliament. That is not a new obligation on you. It is a signal about where the regulator is looking.
Section 40 covers the weather end of it. A business must ensure, so far as is reasonably practicable, that “workers carrying out work in extremes of heat or cold are able to carry out work without risk to health and safety”. The work environment and facilities code’s practical answer is to “provide access to shelter, for example using sheds, caravans, tents, windbreaks or portable shade canopies”, and to reorganise outdoor work so people work in shade or on other tasks when the sun is most intense.
Scroll sideways to see the whole figure
Equivalent or higher is a documentation job #
The second route is real. You are allowed to run the work differently from the code. Plenty of outdoor businesses already control a risk better than the code describes, because the code is written for the general case and you know your ground.
What you are not allowed to do is run it differently and be unable to show the comparison. Lockton’s reading of the change is blunt on the point: the emphasis is “not just on having controls in place, but on being able to clearly evidence that those controls meet or exceed the standard”, and “SafeWork NSW, as the Regulator, is not required to prove that an incident or injury has occurred.” A failure to meet the standard in a code can be the breach on its own.
The old shape of a work health and safety problem was: something happened, then someone asked what you had in place. The new shape does not need the first half.
The mechanism is worth understanding rather than taking on trust. Section 26A sits in Part 2, Division 3. Section 30 defines a “health and safety duty” as a duty imposed under Division 2, 3 or 4 of that Part, and sections 31 to 33 attach the offence categories to any health and safety duty. So the moment section 26A commenced, the existing penalty structure picked it up automatically.
A plain gap against a code, with no exposure to serious harm, is a Category 3 offence under section 33, which has no risk element at all: the offence is having a duty and failing to comply with it. The maximums are 6,070 penalty units for a body corporate, 1,214 for an individual who is a PCBU or an officer, and 607 for any other individual. Section 242B sets the penalty unit at $128.36 for 2026-27, indexed annually, and section 242C rounds down to the nearest dollar:
| Who | Category 3 maximum, 2026-27 |
|---|---|
| Body corporate | $779,145 |
| Officer, or an individual running the business | $155,829 |
| Any other individual, including a worker | $77,914 |
If the failure exposes someone to a risk of death or serious injury or illness, it is a Category 2 offence under section 32 instead, and the body corporate maximum is $2,326,910 on the same unit. For the hazards this piece is about, falls, heat, fatigue, plant and overhead lines, Category 2 is not a theoretical branch.
Check the figures against the current year before you quote them anywhere. The unit moves every 1 July.
It also runs into officer due diligence, which the earlier piece in this series covered. Section 27 was not amended and did not need to be: section 27(5)(e) already makes due diligence include taking reasonable steps “to ensure that the person conducting the business or undertaking has, and implements, processes for complying with any duty or obligation” under the Act. Section 26A is now one of those duties. So an officer’s due diligence now reaches whether the business has a working process for identifying which codes apply and whether it meets them, and whether that process is actually running rather than sitting in a folder.
So the practical job is a gap analysis: list the codes that apply, work through the “should” statements, record where you follow the code and where you do something equivalent or better, and keep the evidence in a form somebody else can read.
The twist: your software is next #
The Work Health and Safety Amendment (Digital Work Systems) Act 2026 was assented to on 18 February 2026, and it is the most interesting thing to happen to this area of law in a while. It is not in force yet, which is worth being precise about, because a fair amount of commentary written this year reads as though it is.
What commenced on assent was the machinery: the notice conditions on the new entry power, the regulator’s power to issue guidelines, and a transitional provision. The substance did not. The definition of a digital work system, the extension of the primary duty in section 19, and the new section 21A are all recorded on the register as not in force, awaiting proclamation. SafeWork New South Wales is at stage 1 of a 3 stage consultation on the guidelines, so nothing is imminent. But the drafting is done and the direction is set.
The definition is very broad. A digital work system is “an algorithm, artificial intelligence, automation or online platform”, with no qualifier about what it is used for. Rostering software, a scheduling algorithm, a tracking app, a platform that hands out jobs: all of it.
There will be two duties. Section 19(c1) extends the primary duty of care so that workers are not put at risk from the use of digital work systems. Section 21A goes narrower and harder, at the allocation of work specifically, and lists 4 things a business will have to consider:
- excessive or unreasonable workloads
- excessive or unreasonable performance metrics
- excessive or unreasonable monitoring or surveillance
- unlawful discriminatory practices or decision making
The Act never uses the word psychosocial, but that list is a psychosocial list in everything but name, and it will sit alongside a psychosocial code that section 26A has already turned into a standard.
For a business buying software, due diligence on the vendor is about to become part of the safety duty rather than a procurement preference. Identify the systems you use for allocation, monitoring or tracking. Assess the risk. Refresh it when a new system comes in. Starting now is cheaper than starting the month it commences.
There is also a new right of entry. Once it commences, an entry permit holder will be able to require reasonable assistance to access and inspect a digital work system where a contravention is suspected, on at least 48 hours and not more than 14 days notice. That power is doubly gated: it cannot commence until a month after the guidelines are published, and a transitional provision stops it being exercised until they exist.
The uncomfortable implication is the honest one: a tool bought to prove you comply with the fatigue and remote work codes can, if it is designed badly, create the psychosocial hazard the digital work systems duty is aimed at. Monitoring that ranks people against each other, scores them, or reports on what an individual was doing minute by minute is exactly the shape of thing the Act names.
Five things to take away #
- Codes are the floor now, not just the argument. Since 1 July 2026 you either meet the code or beat it, and you have to be able to show which. They are still evidence too.
- Your copies are probably out of date. 18 of the 50 codes carry a 2026 date. Re-download the ones that apply.
- Fatigue is the sharpest one for outdoor work. It is new, specific and measured against hours, breaks and travel that either exist in your records or do not.
- Remote or isolated work is broader than it sounds, and section 48 wants a check-in at the start and a sign-off at the end, not a policy about it. The test is how long help would take, not how far you are from town.
- No incident is needed. A gap against a code can be the breach, which moves the whole exercise from “after something happens” to “this quarter”.
Common questions #
Does this apply outside New South Wales? #
Not only New South Wales, but not everywhere either. Queensland has had a section 26A in identical terms since 2017, so none of this is new there. Everywhere else in the harmonised scheme, codes remain evidence of what was reasonably practicable rather than a duty in themselves, and Victoria sits outside the scheme with its own compliance code system. If you work across a border, check which model applies on each side, and be careful with regulator websites, which sometimes say “must comply” loosely in a state where the Act does not.
We are a small business. Does it still apply? #
Yes. The duty attaches to the business, not to its size. What changes with size is what is reasonably practicable, not whether the code applies.
What if 2 codes cover the same hazard differently? #
Work to the higher standard and write down why. That is the equivalent-or-higher route working in your favour.
Do we have to follow every “should” in a code? #
You have to meet the standard each “should” describes, by that route or another one that is as good or better. The verb test matters: “must” is typically a duty carried through from the Act or Regulation, “should” sets the standard required by the code, “may” is optional.
How far back do our records need to go? #
The codes do not set a single retention period, and different obligations carry different ones. The practical answer is that if a gap analysis is the job, records need to cover enough time to show a pattern rather than a good week.
Is a spreadsheet of hours enough? #
It can be, if it is accurate and contemporaneous. The problem with spreadsheets is not the format, it is that they are filled in later from memory, and the fatigue code asks you to look for trends across the records. A trend built from reconstructed numbers is a trend in somebody’s recollection.
What this changed for us #
We build workforce software for outdoor and field work, so I read the July change twice: once as a business that has to comply with it, and once as a product decision.
The honest mapping, feature by feature, is narrower than a marketing page would like:
- Clock on and clock off, with geofencing, is a check-in at the start of the working period and a sign-off at the end, which is the thing section 48 asks for by name. It exists as a record whether or not anyone remembers to make it.
- Timesheets hold hours and breaks as they happened rather than as they are recalled at the end of the fortnight, which is the raw material the fatigue code wants you to read trends across. They come out ready to approve.
- Rostering is where the fatigue code’s numbers live: 12 hours between shifts, 3 successive nights, 1 day off a week, notice before a night shift. A roster is the only place you can see those before they happen instead of after.
- Heat and weather alerts sit against section 40, which is the part of the Regulation that asks whether people working in extremes of heat or cold can do the work without risk, so far as is reasonably practicable.
- The manager dashboard answers who is on site right now, which is the question section 48 is really asking.
- Near miss reporting is in the product.
Payroll export is not built. We will say so until it is.
And the things we have decided not to build are now part of the same story. PocketMode does not rank named individuals against each other and does not score people. The employer view answers questions about the work: who is on site, hours, breaks, conditions, roster changes, incidents. It does not answer questions about the person. We took that position for our own reasons well before the Digital Work Systems Act was drafted. The Act has since given it a second, colder justification: excessive or unreasonable monitoring or surveillance, and excessive or unreasonable performance metrics, are about to be named risks in a safety duty, and software that creates them hands its customer a new hazard to manage.
The claim we will make is narrower than “PocketMode makes you compliant”, and it has to be, because it is not true. A code of practice is a standard for how work is done. No app shortens a shift, moves a crew out of the afternoon sun, or puts 12 hours between two rosters. Those are decisions a business makes.
What software can do is make the record of what actually happened exist without anyone having to remember to create it. After 1 July 2026 that is no longer administration. It is the evidence for the only 2 answers section 26A accepts: we followed the code, or we did something equivalent or better, and here is the proof.
About this write-up #
Not legal advice. The statutory material above is quoted from the New South Wales and Queensland legislation registers, and the code quotes are from the approved codes themselves. Where I am relying on professional commentary rather than a primary source, the text says so. Figures and code versions were checked on 22 September 2026. Codes change, and 18 of them changed this year, so check the version date on anything you act on.
Sources #
Legislation #
- Work Health and Safety Act 2011 (NSW), current version from 1 July 2026. Sections 26A, 27, 30, 31, 32, 33, 242B, 242C, 271DA, 274 and 275. legislation.nsw.gov.au
- Work Health and Safety Act 2011 (NSW), table of amending legislation. Commencement status of the Workplace Protections Act 2025 and the Digital Work Systems Act 2026. legislation.nsw.gov.au
- Work Health and Safety Regulation 2025 (NSW), SL 2025-440. Sections 40 and 48. legislation.nsw.gov.au
- Work Health and Safety Act 2011 (Qld), section 26A, inserted by 2017 No. 38 s 14. legislation.qld.gov.au
- Work Health and Safety Amendment (Digital Work Systems) Bill 2025, as passed by both Houses. parliament.nsw.gov.au
- NSW Parliament, bill history for the Digital Work Systems Bill. Assent 18 February 2026, Act 2026 No 5. parliament.nsw.gov.au
Regulator guidance and approved codes #
- SafeWork New South Wales, Codes of practice. On section 26A and the must, should and may test. safework.nsw.gov.au
- SafeWork New South Wales, list of WHS codes of practice, counted 22 September 2026. safework.nsw.gov.au
- SafeWork New South Wales, Workplace Protections Act 2025 commencement dates. safework.nsw.gov.au
- SafeWork New South Wales, Development of the Digital Work Systems Guidelines, consultation status. safework.nsw.gov.au
- SafeWork New South Wales, Managing the risk of fatigue at work, code of practice, February 2026. safework.nsw.gov.au
- SafeWork New South Wales, Managing the work environment and facilities, code of practice, August 2019. safework.nsw.gov.au
- SafeWork New South Wales, Managing psychosocial hazards at work, code of practice, May 2021. safework.nsw.gov.au
- SafeWork New South Wales, Remote and isolated work. safework.nsw.gov.au
- NSW Government, Codes of Practice become legally binding, 3 July 2026. nsw.gov.au
- Business Queensland, Codes of practice for work health and safety. business.qld.gov.au
Professional commentary #
- King and Wood Mallesons, NSW approved safety codes of practice are now mandatory. mallesons.com
- Lockton, an insurance broker rather than a law firm, Enforceable codes of practice: what expanded WHS obligations mean for NSW organisations, 17 June 2026. Its count of 48 codes was correct in June and is now 50. lockton.com
- PwC Australia, When technology becomes a WHS risk: NSW’s landmark Act spotlights digital work systems. pwc.com.au