From 1 July 2026, the SafeWork NSW Code of Practice: Managing psychosocial hazards at work is an enforceable benchmark under section 26A of the Work Health and Safety Act 2011 (NSW). AI can help NSW employers detect psychosocial hazards in data they already hold and keep a defensible record of controls. Used to monitor individuals, it adds legal and psychosocial risk.
This guide is for people leaders, WHS managers and operations managers at mid-sized, enterprise and multi-site organisations with NSW workers. It covers what the enforceable code requires, where AI has a legitimate role, and where it makes things worse. Nothing here is legal advice. Psychosocial risk is fact specific, so get advice from a WHS specialist or employment lawyer where a situation is unclear.
Key takeaways
- Under section 26A, a PCBU must follow an approved code of practice or achieve an equivalent or higher standard of health and safety. If you depart from the code, you carry the burden of showing your alternative is as good.
- The duty to manage psychosocial risk is older. What changed in 2026 is that the code is now the measuring stick.
- AI earns its place in detection and documentation: spotting work-design patterns in rostering, leave and survey data, and keeping the risk register and review cycle current.
- AI aimed at individuals (keystrokes, messages, productivity scoring) can itself be a psychosocial hazard and can breach the Workplace Surveillance Act 2005 (NSW) and the Privacy Act 1988.
What changed with the NSW psychosocial hazards code on 1 July 2026?
The Work Health and Safety Act 2011 (NSW) now includes section 26A. From 1 July 2026, a person conducting a business or undertaking (PCBU) must either comply with an approved code of practice or manage the hazard in a way that achieves a standard of health and safety equivalent to or higher than the code.
Before this change, a code of practice was admissible as evidence of what was reasonably practicable, but it was not itself a rule. Now, falling short of an applicable code can help establish a breach, and SafeWork NSW inspectors do not need to wait for an incident or injury to act. The gap between "we meant to get to this" and "we have documented controls" is now the gap between compliant and exposed.
Be precise about what started in 2026. The general duty of care under the WHS Act has always covered psychological health, and explicit psychosocial risk provisions have been in the WHS Regulation 2017 (NSW) since 2022. The 2026 change is about the enforceability of the code that explains how to discharge that duty.
- 2012WHS Act in forceDuty of care covers psychological health from the start
- 2022Regulation updatedExplicit psychosocial risk provisions added to the WHS Regulation 2017 (NSW)
- Pre-2026Code as guidanceSafeWork NSW psychosocial hazards code available as advisory guidance
- 1 July 2026Codes enforceableSection 26A makes approved codes an enforceable benchmark
- OngoingInspection and reviewProactive inspection, unannounced visits, documented controls expected
Which psychosocial hazards does the code name?
Psychosocial risk is easy to underestimate because it sounds abstract. The code makes it concrete. Drawing on the Safe Work Australia model code that NSW follows, recognised psychosocial hazards include:
- High or low job demands, sustained at a level that is overwhelming or harmfully low
- Low job control over how and when work is done
- Poor support from supervisors or colleagues
- Lack of role clarity
- Poor organisational change management
- Inadequate reward and recognition
- Poor organisational justice, including inconsistent application of policies
- Traumatic events or exposure to distressing material
- Remote or isolated work
- Poor physical environment
- Violence and aggression
- Bullying
- Harassment, including sexual harassment
- Conflict or poor workplace relationships
These are conditions of work. The code asks you to look at how work is designed, organised and managed, and to control harmful patterns with the same rigour you apply to a trip hazard or an unguarded machine. For multi-site employers, the same hazard often shows up differently at each branch, which is why consistent identification matters.
What does the code require employers to do?
The enforceable expectation is a systematic risk management process with four repeating steps, plus a consultation duty that runs through all of them.
- IdentifyFind psychosocial hazards in how work is done
- AssessJudge likelihood, severity and who is exposed
- ControlApply the hierarchy of controls, design out where possible
- ReviewCheck controls still work and revise after change
- Identify: actively look for hazards. Sources include worker consultation, incident and hazard reports, workers compensation and absence patterns, exit interviews, and workload and rostering data.
- Assess: understand how serious and how frequent a hazard is, and who is most exposed.
- Control: eliminate the hazard by redesigning work where you can. Training and individual resilience are lower-order controls and no substitute for fixing the work.
- Review: check controls are working and revisit them after significant change, such as a restructure, a new system or a spike in demand.
The duty to consult workers, and health and safety representatives where they exist, runs through every step. This matters for the AI discussion: consultation cannot be automated. A tool can inform the conversation. It cannot replace it.
Officers carry their own exposure. Under the WHS Act due diligence duty, officers must take reasonable steps to understand the organisation's psychosocial risks and ensure resources and processes are in place to manage them. NSW also introduced an industrial manslaughter offence in 2024, and the most serious WHS offences carry penalties in the millions of dollars for a body corporate.
Where does AI genuinely help with psychosocial risk?
The strongest case for AI is detection and documentation. Most organisations already hold the relevant data. They lack the capacity to notice patterns in it and to keep a defensible record of what they found and did. AI suits this work, provided it is pointed at work design rather than at individuals.
For example, a 300-staff services group with several regional teams typically has a rostering system, a payroll system, an HR case log and an annual engagement survey. Signals of sustained high job demands are usually already in that data: chronic overtime concentrated in one team, accrued leave never taken, a cluster of resignations from one manager's area, after-hours activity that never lets up. A person reviewing spreadsheets once a quarter will miss most of it. A well-scoped model that surfaces these patterns for a person to investigate turns that data into an early warning.
| Manual, Periodic | AI-Assisted, Continuous | Impact | |
|---|---|---|---|
| Detecting sustained overload | Noticed after burnout or a resignation | Flagged early from rostering and leave patterns | Earlier |
| Survey analysis | Read once, filed, forgotten | Themes surfaced and tracked over time | Continuous |
| Risk register upkeep | Updated when someone remembers | Draft entries and review reminders generated | Consistent |
| Audit readiness | Reconstructed under pressure | Documented as you go | Defensible |
Three uses stand out:
- Pattern detection across operational data. Rostering, timekeeping and leave systems hold the clearest objective evidence of job demands. AI can watch for combinations the code cares about (sustained overtime, unused leave, concentrated absence) and route them to a manager or WHS lead as a hazard to assess. The output prompts human judgement. It is never a verdict.
- Making sense of qualitative feedback. Language models are good at grouping free-text survey, exit interview and hazard report responses into themes, tracking whether a theme is worsening, and separating a one-off complaint from a structural problem. Used on aggregated, de-identified feedback, this strengthens identification without singling anyone out.
- Documentation and cadence. AI can draft risk register entries for a person to review and approve, keep the review cycle on schedule and assemble the evidence trail. Most organisations fail an inspection here because they cannot prove what they did.
- Early detection of overload before it becomes a claimFewer incidents
- Survey and feedback themes surfaced continuouslyBetter identification
- Risk register and review cadence maintainedAudit ready
- Documented, defensible controls in placeLower exposure
We build AI systems where the audit trail is part of the product, and the same discipline applies here: if a control cannot be evidenced, for compliance purposes it may as well not exist. Our work on automated compliance reporting follows the same pattern.
Where does AI add WHS exposure instead of reducing it?
The capabilities that make AI useful make it dangerous when aimed at people rather than at work.
Monitoring becomes a hazard. Surveillance that workers experience as intrusive, opaque or punitive is itself a source of psychological harm. Using AI to watch keystrokes, screen time, message tone or individual productivity in the name of wellbeing can create the low control and low trust conditions the code treats as hazards. If a control makes the psychosocial environment worse, it is not a control.
Privacy and surveillance law. Analysing employee communications and behaviour engages the Privacy Act 1988 where personal information is involved, and the Workplace Surveillance Act 2005 (NSW) imposes notice and other requirements on computer, camera and tracking surveillance of workers. AI that quietly reads messages can breach these obligations regardless of intent. See our guide to AI agent governance, data access and human override.
Automating judgements that must stay human. A model may flag a team or pattern, but decisions about an individual's performance, capability or discipline must be made by a person. Automated decision making about people also carries its own compliance obligations, covered in our piece on Privacy Act automated decisions.
The illusion of compliance. A wellbeing score that nobody acts on adds cost and creates a discoverable record of hazards you did not control. The code rewards action, consultation and review.
What is the AI being pointed at?
- Aggregated work-design signals, reviewed by a humanAppropriate, keep humans in the loop
- De-identified survey and feedback themesAppropriate with privacy safeguards
- Individual keystroke, message or productivity monitoringHigh risk, likely a hazard and a privacy problem
- Automated decisions about a person's performanceNot appropriate, humans must decide
How should a NSW employer start?
Sequence matters more than tooling. The goal is a consultative risk management process that AI supports.
- Weeks 1-3Consult and mapInvolve workers and HSRs, identify hazards from real experience and existing data
- Weeks 4-6Assess and prioritiseRank hazards by severity and exposure, decide what to control first
- Weeks 7-10Control at the sourceRedesign work where possible, use the hierarchy of controls, record decisions
- Weeks 11-13Instrument and reviewAdd AI detection and documentation on top of a working process, set the review cadence
Technology arrives last, deliberately. Consultation and control are the substance of the duty. AI makes identification sharper and documentation defensible once there is a real process to support. An organisation that starts with a monitoring tool and hopes a process will follow usually ends up with neither.
Psychosocial risk overlaps with after-hours contact, change and workload, each with its own legal dimension. Our guides to the right to disconnect, Fair Work compliance automation and AI change management with your people sit alongside this one.
How Solve8 can help
Our consultants and engineers build compliance automation that runs on your infrastructure in Australia, with a person approving every output before it reaches a system of record. If you want help pulling WHS signals from your rostering, payroll and HR systems into a defensible risk register, see our process automation and data and BI services, or talk to us.
