Wage Theft Is a Crime: The Payroll AI Fix

Underpayment Is No Longer Just a Civil Problem

On 1 January 2025, intentionally underpaying an employee's wages or entitlements became a criminal offence under the Fair Work Act 2009 (Cth). The change arrived through the Fair Work Legislation Amendment (Closing Loopholes) Act 2023 and it applies to underpayments occurring on or after that date. This is a genuine shift in exposure. For most of the last two decades, an award breach was a civil matter: back-pay, a penalty, an enforceable undertaking, some reputational damage. Now, where the conduct is intentional, the same facts can put a director or a payroll manager in front of a criminal court.

The Fair Work Ombudsman sets out the penalties plainly. For an individual, the maximum is up to 10 years imprisonment, a fine, or both. For a company, the maximum fine is the greater of three times the underpayment amount or 25,000 penalty units. For an individual, the fine is the greater of three times the underpayment or 5,000 penalty units. Translated into dollars at the current penalty unit value, that is a cap running into the millions for a company and over a million for an individual. These are not numbers a midsize business can absorb quietly.

There is one important qualifier, and it matters for how you should respond. The offence targets intentional conduct. Honest mistakes, genuine errors in award interpretation, and inadvertent miscalculations are not criminalised. As the Fair Work Ombudsman states, accidental or unintentional underpayment based on a genuine mistake does not attract criminal liability. But that qualifier is doing a lot of work, and the practical question for any employer is uncomfortable: how do you demonstrate, after the fact, that a systematic underpayment was a mistake rather than a decision? That is where your systems, your records, and your ability to show a consistent good-faith process become the whole game.

This guide is written for the person who runs payroll, people, or finance at a midsize Australian business (roughly 50 to 500 employees). It explains where the new law bites hardest for organisations of your size, and where AI-assisted award interpretation, reconciliation and monitoring genuinely reduce risk, versus where they cannot and a human still has to own the call.

The four things that decide your exposure

• Whether an underpayment happened at all (the underlying debt never goes away, even where no offence is made out).
• Whether the conduct was intentional or a genuine mistake.
• Whether you can evidence a consistent, good-faith compliance process.
• Whether you fall inside or outside the Voluntary Small Business Wage Compliance Code.

Why Midsize Employers Are More Exposed Than They Think

There is a comfortable assumption in a lot of midsize businesses that wage theft prosecutions are for the deliberate bad actors: the sham-contracting operator, the cash-in-hand restaurant, the franchise skimming migrant workers. Those cases are real, and the enforcement record reflects them. But the structural exposure for a mid-market employer comes from something far more mundane: award complexity meeting manual processes at scale.

Australia's modern award system is genuinely intricate. Overtime thresholds, casual loadings, split-shift allowances, weekend and public holiday penalty rates, annualised salary reconciliation obligations, allowances that turn on the specific task performed, and classification structures that change what an employee is owed based on duties rather than title. A business with 15 staff on a single award can hold most of that in a bookkeeper's head. A business with 250 staff across three awards, multiple states and a mix of full-time, part-time and casual arrangements cannot. The interpretation load has outgrown the manual method, and manual interpretation is precisely where systematic errors are seeded.

Now layer on the single most important structural fact for your size band. The Voluntary Small Business Wage Compliance Code, which commenced alongside the offence on 1 January 2025, offers a real safe harbour: if a small business employer satisfies the Code, the Fair Work Ombudsman cannot refer the conduct for possible criminal prosecution. But a "small business" for the purposes of the Code is an employer with fewer than 15 employees. A 200-person business does not get that protection. You carry the full weight of the offence without the codified pathway out of it that the smallest employers can rely on.

The enforcement data tells you where the regulator is actually looking. In its 2024-25 Annual Report, the Fair Work Ombudsman reported recovering $358 million for more than 249,000 underpaid workers, with about 60 per cent of that (almost $213 million) coming from large corporate sector employers, back-paid to nearly 118,000 employees. The regulator also issued 1,220 Compliance Notices and secured its highest ever single-action penalty, with operators of the Sushi Bay outlets ordered to pay $15.3 million. The pattern is clear: this is not a small-employer enforcement story. Larger and more complex payrolls are squarely in view, and the mid-market sits inside that trend line without the small business Code to fall back on.

The takeaway is not that midsize businesses are being targeted for punishment. It is that the combination of no Code protection, high award complexity and manual interpretation produces exactly the kind of systematic, hard-to-explain error the offence is designed to catch, whether or not there was any intent to underpay.

Where AI Genuinely Helps, and Where It Cannot

The instinct when a criminal offence appears is to buy software and declare the problem solved. That instinct is wrong, and it is worth being blunt about the limits before the benefits. AI cannot form or negate intent. It cannot give you legal advice. It cannot make a bad award mapping correct, and if you feed it the wrong classification it will confidently and consistently underpay every affected employee, which is arguably worse than a human getting it wrong once. What AI does well is a narrower and genuinely useful thing: it applies rules consistently, reconciles large datasets, flags anomalies, and produces a durable audit trail. In a criminal-liability context where you may one day need to demonstrate a good-faith process, that audit trail is not a nice-to-have. It is the artefact that distinguishes a mistake from a decision.

Think of the payroll compliance problem as a pipeline, and place AI only where consistency and volume are the challenge, keeping human judgement where interpretation and accountability live.

Classification is a human-owned decision informed by tools. AI can suggest the likely award and level from a role description and duties, and it can flag when someone's actual tasks drift away from their recorded classification. But signing off that a person is a Level 4 rather than a Level 3 is a judgement with legal consequences, and it stays with a person who understands the work. This is the single most common root cause of systematic underpayment, and it is not a place to hand the keys to a model.

Capture is where clean data is won or lost. Award interpretation is only as good as the hours, breaks and allowances feeding it. AI-assisted timekeeping can normalise messy inputs, catch missing break records, and reconcile rostered against actual hours, which removes a large class of downstream error. We cover the mechanics of this in our guide to automating timesheets and time tracking.

Interpretation is the strongest case for automation. Applying hundreds of award rules to thousands of shifts, the same way every time, is exactly what software should do and humans should not. The consistency itself is a compliance asset: a documented, versioned rule engine is far easier to defend as a good-faith process than a spreadsheet a payroll officer maintains from memory. This is the same discipline we describe in our broader piece on Fair Work compliance automation.

Reconciliation is where problems surface early enough to fix cheaply. Continuous comparison of what was paid against what the rules say was owed turns an annual, panic-inducing back-pay exercise into a monthly variance report. Small, corrected discrepancies never compound into the multi-year, multi-employee liabilities that make headlines. Our note on automated compliance reporting walks through building this into a routine rather than a fire drill.

Evidence is the quiet payoff. Every classification decision, rule version, calculation and correction, logged and timestamped, becomes the record that supports a "genuine mistake" position if you ever need one. Designing that audit trail deliberately, with the right access controls and human override points, is a governance exercise as much as a technical one, which we set out in our framework for deploying AI agents responsibly.

The Intent Problem, and Why Process Is Your Best Defence

The offence turns on intention, and no software can prove or disprove a state of mind. What it can do is make the innocent explanation credible. Consider a typical 200-person services business that discovers, during a routine review, that a group of employees on an annualised salary arrangement were not properly reconciled against the hours they actually worked, and were collectively underpaid over an 18-month period. The underlying debt is owed regardless, and it must be back-paid in full. The criminal question is whether that underpayment was intentional.

Two versions of that business will fare very differently. The first ran payroll on spreadsheets, had no documented reconciliation process, and cannot show when or how the error entered the system. The second has a versioned rule engine, a monthly reconciliation report that shows the variance was flagged and being actioned, an audit log of every classification decision, and a self-reported disclosure to the regulator the moment the issue was confirmed. Same debt, radically different position on intent. The second business looks exactly like what it is: an employer that made a mistake and had systems designed to catch and correct mistakes. The first looks like an employer that either was not looking or did not want to.

This is the real reason to invest in automation here. It is not primarily about efficiency, though the efficiency is real. It is that a consistent, documented, monitored process is the most persuasive evidence of good faith available to you, and good faith is the line between a civil back-pay bill and a criminal referral.

Self-reporting matters too. The Fair Work Ombudsman has indicated that where an employer makes a voluntary, frank and complete disclosure of underpayment conduct, it may have the opportunity to enter into a cooperation agreement, under which the regulator agrees not to refer the conduct for criminal prosecution. A system that surfaces problems early is also a system that lets you self-report early, which is itself part of the defensible posture.

A note of caution that follows directly from the intent problem: automating a wrong rule set does not reduce your risk, it industrialises the error. Before any award logic goes live, the mapping has to be validated by someone who genuinely understands the award, ideally with employment law input. AI accelerates a correct process and amplifies an incorrect one. The validation step is not optional, and it is not something to delegate to the tool that will later execute it.

The Systematic Traps That Catch Midsize Employers

Most large underpayment findings do not come from a business deciding to short-change its staff. They come from a handful of recurring structural traps where award complexity and manual process quietly compound the same error across hundreds of pay cycles. Knowing where these traps sit tells you where to point the audit and the automation first, because these are the populations most likely to produce a systematic, hard-to-explain shortfall.

The first is annualised salary reconciliation. Many awards that permit annualised salaries also require the employer to reconcile that salary against what the employee would have earned under the award for the hours actually worked, and to top up any shortfall within a defined period. A salaried employee who consistently works longer hours than the salary assumed can accrue a real underpayment even though their pay never changed. Without a reconciliation process, nobody notices until it is years deep. This is a textbook case for continuous, automated comparison, and it is exactly the kind of quiet accrual that turns into a headline.

The second is casual and part-time treatment: loadings, minimum engagement periods, and the rules around converting casuals to permanent roles. A casual paid a flat rate without the correct loading, or a part-timer whose additional hours should have attracted overtime, are common and easily systematised errors. The third is allowances tied to specific tasks or conditions, tool allowances, travel, first aid, height or dirty-work allowances, which turn on what the person actually did on a given day rather than their job title, and which manual payroll routinely misses because the trigger lives in the timesheet, not the employment contract. The fourth is penalty rates and overtime thresholds across weekends, public holidays and shift patterns, where the interaction of multiple rules is where spreadsheets break down.

None of these traps require bad intent to produce a large liability. That is precisely why they are dangerous under a regime that turns on intent: the underpayment can be substantial and entirely inadvertent, and your ability to show it was inadvertent depends on whether you had a process designed to catch it. Automating the reconciliation and the rule application across these four populations is where a midsize employer gets the most risk reduction for the least effort.

A Realistic 90-Day Compliance Uplift

You do not fix years of payroll practice in a fortnight, and you should be wary of any vendor who says otherwise. A sensible path prioritises the highest-risk awards and classifications first, validates before it automates, and builds the audit trail from day one rather than bolting it on later. The following is a realistic sequence for a midsize employer starting from a mostly manual base.

The ROI conversation for this work is different from most automation business cases, because the largest line item is avoided liability rather than saved hours, and avoided liability is real even when it is hard to put a single number on. The saved-hours case is genuine and worth quantifying for your own environment, but the compliance case is what gets this signed off at board level.

Two closing cautions. First, the technology does not remove the human accountability, and it should not be sold to your team as a way to reduce headcount in payroll. The people who understand your awards become more valuable, not less, because they move from manual calculation to validation, exception handling and judgement. Getting that framing right is a change management task in its own right, which we cover in our guide to AI rollouts in Australian workplaces. Second, none of this is a substitute for legal advice on your specific awards, arrangements and any historical exposure. AI-assisted payroll compliance is a way to run a consistent, evidenced, good-faith process. Whether a particular past underpayment attracts criminal exposure is a legal question for a qualified employment lawyer, not a model.

The wage theft offence has changed the stakes of getting payroll wrong. For midsize employers without the small business Code to fall back on, the most durable protection is not a promise to try harder. It is a consistent, monitored, well-documented process that catches errors before they compound and can prove, if it ever has to, that a mistake was exactly that.

Related Reading

• Fair Work compliance automation for Australian business
• Payday Super 2026: payroll automation
• Automate timesheets with AI time tracking
• Automated compliance reporting for Australian businesses
• Deploying AI agents responsibly: governance and audit trails
• AI rollouts and Australian workplaces: the adoption problem

Solve8 helps Australian midsize businesses design AI-assisted compliance and payroll processes with the audit trails regulators expect. Book a consultation to talk through your award exposure.