Since 1 July 2026, approved WHS Codes of Practice in NSW are no longer treated as optional background reading. A person conducting a business or undertaking (PCBU) must now either follow the relevant approved Code or be able to show its own approach manages the same risk to an equal or higher standard. In practice, that shifts the burden of proof: regulators and courts can point to the Code as the benchmark, and a business that has departed from it needs a documented reason on file, not an explanation invented on the day an inspector asks.
What actually changed on 1 July 2026?
Before this change, approved Codes of Practice functioned as authoritative guidance: businesses were expected to have regard to them, and courts could refer to them, but a business had more room to argue its own approach was reasonable without pointing back to the Code itself. From 1 July 2026, that changed in one specific way - a PCBU must now follow an approved Code that applies to its work, or demonstrate that its alternative approach manages the relevant hazard to an equal or higher standard. The practical effect is that "we do it our way" is still allowed, but it now needs to be shown, not just asserted.
What is a Code of Practice, and why did it used to carry less weight?
A Code of Practice sits between the general legal duty in the WHS Act (manage risk, so far as reasonably practicable) and a business's own site procedures. It translates a broad duty into specific, workable guidance for a hazard or activity - psychosocial risk, for example, or a category of plant or substance. Codes are approved through a formal process, which is exactly why regulators can now lean on them more heavily as the reference point for "what good looks like", rather than one input among several.
What do businesses need to do differently now? (before and after)
| Before 1 July 2026 | From 1 July 2026 | |
|---|---|---|
| Status of an approved Code | Authoritative guidance - businesses expected to have regard to it | The benchmark - follow it, or show an equal-or-higher alternative |
| Departing from the Code | Could be argued as reasonable in general terms | Needs a documented, defensible reason on file |
| Regulator's use of the Code | One reference point among several during an inspection or investigation | A direct benchmark for what compliance should look like |
| What a PCBU should hold on file | General procedures aligned to the standard's intent | Procedures mapped explicitly against the relevant Code, with departures explained |
What happens if a business does not follow an approved Code and cannot show an equivalent?
The exposure is not a new offence - the underlying legal duty to manage risk has not changed. What has changed is how easily a regulator or a court can now point to the relevant Code and ask a business to explain the gap. Where a business has no documented alternative, no mapping of its own procedures against the Code, and no record of a deliberate, reasoned decision to depart from it, that gap becomes far harder to argue away after the fact than it would have been before 1 July 2026.
How does this fit into a business that already runs a management system?
For a contractor already running a genuine WHS management system, this is more of an evidence exercise than a rebuild. The practical steps are:
- Map current procedures against the relevant approved Codes for the hazards that actually apply to the business - not every Code applies to every industry.
- Record the reasoning wherever the business's approach differs from a Code, in enough detail that it stands up months later, not just in the moment.
- Fold the mapping into the next internal audit cycle, so Code alignment gets checked routinely rather than only when someone asks.
ISO 45001 certification does not automatically satisfy this on its own, but a business already running structured risk management, consultation and review under 45001 typically has most of the scaffolding this needs. The gap is usually the explicit mapping to the Code itself, not the underlying practice.
Does this matter for tender and principal contractor assurance, not just regulator visits?
It does, and often sooner than a regulator visit would. Principal contractors and government agencies running prequalification and tender assurance checks increasingly ask contractors to demonstrate exactly this kind of alignment - not just "do you have a WHS system", but "can you show how your system maps to the current regulatory benchmark". A contractor that can produce a clear Code-mapping document, with departures explained and dated, answers that question in one attachment. A contractor relying on "we have always done it this way" answers it in a meeting that goes worse than it needs to. For businesses chasing mid-tier and major civil, infrastructure or government-adjacent work, this is one more piece of evidence that either speeds up a tender assurance review or slows it down.
So what should a contractor actually check first?
Pull the list of approved Codes of Practice relevant to your work, and check honestly whether your current procedures are mapped against them or simply "in the same spirit". If the honest answer is the latter, that mapping - and the documented reasoning for anywhere you deliberately differ - is the single most useful thing to close out before it becomes a question in an audit or an incident investigation.
If you want a second set of eyes on where your management system stands against this, Hillview's Audit Readiness Check is a free starting point at hbass.com.au. [LINK]
Jemma Kennedy - Lead Auditor, 15+ years in civil, mining and infrastructure.
FAQ
What is a WHS Code of Practice? A Code of Practice is a practical guide, approved under the WHS Regulation, that sets out how to manage a specific hazard or duty - for example psychosocial hazards or a category of plant. Codes have always sat between the general legal duty and a business's own procedures, translating "manage the risk" into concrete, workable steps.
Does this change apply Australia-wide or just in NSW? The 1 July 2026 change described here is specific to how NSW treats approved Codes of Practice. Other states and territories run their own WHS legislation and may treat Codes differently, so a multi-state contractor should check the position in each jurisdiction it operates in rather than assume NSW's position travels automatically.
My business already has a management system. Does this change anything? It raises the bar on evidence, not on effort, for most businesses that already run a genuine system. If your procedures already line up with the relevant Codes, the practical change is making sure you can show that alignment, and documenting the reasoning wherever you deliberately do something different.
Can a business still depart from an approved Code of Practice? Yes, but the burden shifts. A business can still manage a hazard its own way if it can demonstrate that approach meets or exceeds what the Code sets out. What changes is that "we do it differently" now needs a documented, defensible reason on file, not just a verbal explanation if a regulator asks.
Does this affect ISO 45001 certification requirements? Not directly - ISO 45001 and WHS Codes of Practice are separate frameworks. In practice, though, a business already certified to ISO 45001 usually has most of the structure (documented risk management, consultation, review) needed to demonstrate Code alignment. It is worth confirming the crossover rather than assuming it, one lane rarely substitutes fully for the other.
Founder, Hillview Business Services. 15+ years inside civil construction, mining and infrastructure businesses.