Federal agencies and self-insured licensees operating under the Comcare jurisdiction are subject to the Work Health and Safety Regulations 2011 (Cth), specifically Regulations 55A to 55D on psychosocial hazards, and the Managing Psychosocial Hazards at Work Code of Practice 2024 registered on 1 November 2024.

Together, these instruments create a psychosocial compliance framework that applies across the Commonwealth public sector, national employers, and any organisation operating under Comcare's regulatory umbrella. For organisations that operate across multiple state and territory jurisdictions, the Commonwealth framework sets the baseline that state regulations build upon.

What the regulations require

Regulations 55A to 55D, which commenced on 1 April 2023, define psychosocial hazards and psychosocial risks and require PCBUs to manage those risks using the standard Part 3.1 risk management process. PCBUs must identify psychosocial hazards, eliminate the associated risks so far as is reasonably practicable, and where elimination is not reasonably practicable, minimise them. The regulations require PCBUs to have regard to all relevant matters when determining control measures, including the duration, frequency, and severity of exposure, how hazards may interact or combine, the design of work, systems of work, and the workplace environment.

The Code of Practice provides the practical guidance on how to meet these obligations. Compliance with the Code is not mandatory, but a PCBU that follows it is taken to have complied with the relevant regulation. A PCBU that takes a different approach must demonstrate that it meets an equivalent or higher standard.

What the Code adds beyond the model

The Commonwealth Code builds on the Safe Work Australia model code with several additions relevant to modern federal workplaces.

The Code identifies three additional psychosocial hazards not included in the model code: fatigue, intrusive surveillance, and job insecurity. It describes intrusive surveillance as including keyboard activity trackers, GPS monitoring of movements, and technology that allows remote access to workers' screens for performance monitoring purposes, as distinct from safety-related monitoring.

The Code also includes a new section on responding to reports, complaints, and incidents, setting out ten principles to guide the process: act promptly, ensure immediate safety, treat all matters seriously, use a trauma-informed approach, maintain confidentiality, be neutral, support all parties, do not victimise, communicate process and outcomes, and keep records.

The Code requires the use of the hierarchy of controls when managing psychosocial risks, making explicit that information, instruction, and training should not be the primary response when higher-order controls are reasonably practicable.

A systematic, data-driven approach

The Commonwealth Code promotes integrating psychosocial risk management into existing WHS management systems rather than treating it as a separate programme. The expectation is that organisations use the same risk management infrastructure they already apply to physical hazards: hazard registers, risk assessments, control implementation, worker consultation, and regular review.

This approach is systematic and data-driven. It encourages early reporting of psychosocial hazards, worker participation in hazard identification, and transparent review processes. For federal agencies already operating mature WHS management systems, the practical task is integration, not invention.

ISO 45003 alignment for multi-jurisdiction employers

For organisations operating under Comcare that also have workers in state and territory jurisdictions, the Commonwealth framework intersects with multiple regulatory regimes. Each jurisdiction has adopted the model WHS psychosocial provisions with local variations.

ISO 45003:2021 provides a structured framework for managing psychosocial risks within an occupational health and safety management system based on ISO 45001. For multi-jurisdiction employers, aligning with ISO 45003 principles offers a practical mechanism for demonstrating best practice across all the jurisdictions in which they operate, while meeting the specific requirements of each.

ISO 45003 broadly aligns with and supports Australian WHS legislation. An organisation that integrates psychosocial risk management into an ISO 45001-aligned system, following ISO 45003 guidance, is well positioned to demonstrate the systematic approach that Australian regulators now expect.

The practical significance

The Commonwealth framework matters beyond the federal public sector. Comcare's regulatory umbrella covers a significant portion of Australia's national employers. The Code of Practice sets a practical benchmark for what a systematic approach to psychosocial risk management looks like, and state regulators are increasingly aligning with it.

Comcare has established a Psychosocial Inspection Program to support enforcement. The combination of a detailed Code, specific regulations, and active inspection capability means the Commonwealth framework is operational, not aspirational.

Disclaimer: This article provides general information on psychosocial compliance in Australian workplaces. It does not constitute legal advice. Organisations should consult qualified professionals for advice specific to their circumstances. Information cited is sourced from Comcare, the Federal Register of Legislation, Safe Work Australia, and relevant legal analyses as of the date of publication.