For most of its history, work health and safety law was about things that crush, cut and electrocute. Startups could be forgiven for treating it as someone else’s problem — no forklifts, no scaffolds, no risk. That assumption is now badly out of date. Since 2022, Australian WHS regulators have been given express tools to regulate psychological harm at work, and in 2026 they have moved from educating employers to enforcing against them. For a startup, that matters more than it might for an established company, because the standard startup operating mode — crushing workloads, ambiguous roles, constant restructuring, remote teams, a culture that prizes intensity — reads uncomfortably like the regulators’ official list of hazards.
The Legal Framework: Psychological Health Was Always In — Now It’s Explicit
The primary duty under section 19 of the model Work Health and Safety Act — enacted in every jurisdiction except Victoria — requires a person conducting a business or undertaking (a PCBU; your company) to ensure, so far as is reasonably practicable, the health and safety of its workers. “Health” has always been defined to include psychological health. What changed in 2022 is that, following the Boland review of the model laws, the model WHS Regulations were amended to spell out how that duty applies to psychosocial risk.
The amendments inserted new regulations 55A to 55D. A psychosocial hazard is a hazard arising from the design or management of work, the working environment, plant, or workplace interactions and behaviours that may cause psychological harm (whether or not it may also cause physical harm). A PCBU must identify reasonably foreseeable psychosocial hazards, eliminate the risks so far as reasonably practicable and, where elimination isn’t practicable, minimise them — choosing control measures against the matters listed in regulation 55D, including the duration, frequency and severity of exposure and how the work is designed, managed and supported.
The harmonised states adopted these amendments between 2022 and 2023 — NSW from 1 October 2022, with Queensland, Tasmania, the Commonwealth and others following. Western Australia adopted equivalent psychosocial provisions in its Work Health and Safety (General) Regulations 2022 from 24 December 2022, supported by its own code of practice. And Victoria, the one non-harmonised state, finally landed its standalone regime: the Occupational Health and Safety (Psychological Health) Regulations 2025 commenced on 1 December 2025, with no transitional period. (The draft’s mandatory prevention plans and six-monthly complaint reporting for large employers were dropped from the final regulations — but the core duty to identify and control psychosocial hazards applies to every Victorian employer from day one.)
Sitting under the regulations is the model Code of Practice: Managing psychosocial hazards at work, which sets out what regulators consider good practice. In NSW, codes now have teeth of their own — more on that below.
The Hazard List Reads Like a Startup Job Ad
The model code identifies around fourteen psychosocial hazards (newer state versions list up to seventeen). Run down the list with a founder’s eye:
- High job demands — sustained high workloads, long hours, time pressure. Crunch before a launch or a raise is the textbook example.
- Low role clarity — undefined responsibilities, conflicting instructions. The “everyone does everything” phase of a startup is low role clarity by design.
- Poor organisational change management — restructures, pivots and layoffs executed without consultation or communication.
- Remote or isolated work — distributed teams without deliberate support structures.
- Inadequate support, low recognition, poor organisational justice — inconsistent performance management, favouritism, opaque decisions.
- Bullying, aggression and harassment, including sexual harassment — which also engages the separate positive duty under the Sex Discrimination Act.
None of this makes intensity illegal. The law doesn’t prohibit hard work, ambitious deadlines or pivots. What it requires is that you treat these features of your workplace as risks to be managed — identified, assessed, controlled and reviewed — rather than as culture.
What Compliance Actually Requires
The duty is a risk-management process, and regulators expect to see evidence of it:
- Identify the hazards — talk to your team (consultation with workers is itself a WHS duty), run a short survey, look at hours, turnover, complaints and exit interviews.
- Control the risks at the source. This is the part employers get wrong. Regulation 55D directs you to work through the design of the job itself: workloads, staffing, deadlines, role definitions, after-hours contact, how change is communicated. A resilience webinar is not a control measure — and Victoria’s regulations say expressly that information and training can’t be your exclusive or predominant control unless nothing else is reasonably practicable.
- Review controls when things change — a funding crunch, a layoff round, a new on-call rota.
- Document it. A startup doesn’t need an enterprise safety management system. A few pages recording the hazards you identified, who you consulted, what you changed and when you’ll review it will put you ahead of most employers — and it’s the first thing an inspector asks for.
Why 2026 Is the Year This Bites
Three developments have converted a sleepy compliance topic into live enforcement risk.
NSW has moved to enforcement. SafeWork NSW now fields a dedicated psychosocial inspectorate, and psychosocial complaints make up roughly a fifth of its requests for service. Under the Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025 (NSW), since 1 July 2026 PCBUs must comply with approved codes of practice — or manage the risk to a standard equivalent to or higher than the code — turning the psychosocial code from guidance into a de facto rulebook. And since 1 March 2026, registered unions can also bring civil penalty proceedings in certain circumstances, adding a second enforcer.
Improvement notices are being upheld. In Secretary, New South Wales Department of Education v SafeWork NSW (No 2) [2026] NSWIRComm 1014, the Industrial Relations Commission largely upheld improvement notices issued over the psychosocial risks of the employer’s own disciplinary investigation processes — and showed that a single worker’s experience can ground a systemic notice reaching across all of an employer’s workplaces, where the risk was reasonably foreseeable. Management systems themselves, not just rogue behaviour, are squarely in scope.
Victoria is finally covered. The December 2025 regulations closed the last gap, so a startup with staff in Melbourne and Sydney now faces express psychosocial duties on both sides of the Murray.
Founders Are Personally on the Hook
Two points startups routinely miss. First, there is no small-business exemption: the duty applies from your first worker, and “worker” includes contractors. Second, under section 27 of the WHS Act, officers — directors and founders who make decisions affecting the whole business — owe a personal, non-delegable duty of due diligence: to understand the hazards, ensure the company has resources and processes to manage them, and verify they’re used. WHS penalties are criminal, they can attach to officers personally, and a growing list of jurisdictions — NSW, Victoria, Western Australia, Queensland and the Commonwealth among them — prohibit insuring against WHS fines. For a founder who sets the workload, the deadlines and the tone, the company’s psychosocial risk profile is substantially their own conduct.
The obligations also interlock with employment law you already have to manage — the right to disconnect, stop-bullying and stop-sexual-harassment orders under the Fair Work Act, and workers compensation for psychological injury, where the median payout — $67,400 on Safe Work Australia’s latest published data — runs at more than four times that of serious claims generally.
A Right-Sized Compliance Plan
For a startup of five to fifty people, proportionate compliance looks like: a short, documented psychosocial risk assessment built on honest consultation; workload and after-hours expectations actually designed rather than defaulted; role descriptions that match reality; a plan for communicating change before you restructure; a credible route for raising concerns that isn’t “tell the founder about the founder”; and a diary note to review it all after the next funding or headcount event. Our employment law team builds these alongside the contracts and policies startups already need, and our startup lawyers in Sydney can tell you quickly whether your current setup would survive an inspector’s visit.
The regulators’ message is simple: burnout is no longer a culture question, it’s a compliance question. The startups that treat it that way now will spend a few days on paperwork. The ones that don’t are betting their founders’ personal liability on nobody ever complaining — and it only takes one.
This article is general information only, not legal advice — what “reasonably practicable” requires depends on your workplace and circumstances. Viridian Lawyers advises Australian startups on employment, safety and governance obligations as they scale. If you’re not sure your team’s workload, structure or policies would stand up to a psychosocial inspection, get in touch.
