Every business in Australia that has people doing work for it owes them a duty of care. That duty has two layers. At common law, an employer must take reasonable care for the safety of its employees. Under work health and safety (WHS) law, the person conducting the business or undertaking must ensure, so far as is reasonably practicable, the health and safety of its workers.
Getting it wrong can be expensive in ways that compound. An injured worker may claim damages for negligence, the WHS regulator may investigate and prosecute, and a serious incident can cripple a small business financially and reputationally. This guide sets out who owes the duty, the standard the law applies, the specific things you must do day to day, what happens if you fall short, and the practical steps that put your business in a defensible position.
Who owes the duty, and to whom
WHS law in Australia is set by each state and territory, and by the Commonwealth for its own workplaces, under laws based on the model WHS Act. The central duty holder is the person conducting a business or undertaking, known as a PCBU. In practice that is any business, from a sole trader to a large company. There is no turnover, headcount or industry threshold and no small-business exemption: if you carry on a business or undertaking and engage people to carry out work, the duty applies to you.
The people the duty protects are broader than many owners assume. Under s 7 of the Work Health and Safety Act 2011 (Cth), a worker includes an employee, a contractor or subcontractor, an employee of a contractor, a labour hire worker, an apprentice or trainee, a student on work experience, an outworker and a volunteer. If someone does work for your business in any of those roles, they are within the scope of your WHS duty, and at common law your duty of care extends to your employees wherever the work takes them.
Officers carry personal obligations as well. Directors and senior managers must exercise due diligence to ensure the business complies with its WHS duties, so they cannot delegate safety to a manager or consultant and walk away. If an officer is personally involved in a failure, they can be prosecuted in their own right.
The employer's common law duty is also non-delegable: you cannot avoid it by handing the work to a contractor or blaming a third party. In Atkinson v Gameco (NSW) Pty Ltd [2005] NSWCA 338, the NSW Court of Appeal considered an injury to an employee working on premises controlled by another party and confirmed that the employer's duty of care did not disappear simply because the work was performed elsewhere. The obligation to take reasonable care for your people follows the work.
The standard: what "reasonably practicable" means
The core statutory duty is set out in s 19 of the Work Health and Safety Act 2011 (Cth): a PCBU must ensure, so far as is reasonably practicable, the health and safety of its workers and of other people who might be put at risk by the work. This includes providing and maintaining a safe work environment, safe plant and structures, safe systems of work, safe handling and storage of substances, adequate facilities, and the information, training, instruction and supervision workers need to work safely.
The duty is not a guarantee that nobody will ever be hurt. It is a duty to do what is reasonably able to be done, weighing the factors listed in s 18 of the Act: the likelihood of the hazard causing harm, the likely severity of that harm, what you know or ought reasonably to know about the hazard and the ways of eliminating or minimising it, the availability and suitability of those ways, and the cost of the controls, including whether that cost is grossly disproportionate to the risk.
Practically, the standard is assessed against what a reasonable business in your position should have known and done at the time, with the resources reasonably available. Ignorance is not a defence, and neither is "that is how we have always done it." If a hazard was foreseeable and a control was reasonably available, the law expects you to have acted.
The specific duties in practice
Identify and assess hazards
Your first obligation is to find the risks. That means documented risk assessments covering physical hazards, such as slips and trips, manual handling, plant and equipment, noise, heat and hazardous substances, and the way work is designed and organised. Assessments must be reviewed when things change: new equipment, new premises, new processes, new products or new and young workers. An assessment that still describes how the business operated years ago is worse than no assessment, because it gives a false impression that the risk has been considered.
Manage psychosocial risks
Psychosocial risks are now an explicit part of the duty, not an afterthought. The model WHS Regulations define a psychosocial hazard as one arising from the design or management of work, the work environment, or workplace interactions or behaviours, that may cause psychological harm (r 55A of the Work Health and Safety Regulations 2011 (Cth)), and require PCBUs to manage psychosocial risks in the same systematic way as physical ones (r 55C). In plain terms, workload, role clarity, fatigue, bullying, harassment and poor responses to complaints are safety issues, not just HR issues. The states and territories have been progressively adopting equivalent provisions into their own regulations, so check the position where you operate.
Maintain safe systems, plant and training
Safe systems of work are the everyday procedures that stop people being hurt: how tasks are done, what equipment is used, who is allowed to do what, and what supervision applies. Keep plant guarded, maintained and regularly inspected, make sure PPE is provided and used, and train people before they start a task rather than after an incident. New starters, young workers and workers moving to new tasks are consistently over-represented in workplace injuries, so induction and role-specific training deserve particular attention.
Consult your workers
Under s 47 of the Act, you must consult, so far as is reasonably practicable, with workers who are likely to be directly affected by a health and safety matter. Consultation is not a memo. It means giving workers a genuine opportunity to raise hazards and contribute to decisions about how risks are controlled. Workers are the people who see the risks every day, and the law treats their input as part of the system. Records of toolbox talks and safety meetings are evidence that consultation happened.
Notify the regulator when things go wrong
Section 38 of the Act requires a PCBU to notify the regulator immediately after becoming aware of a notifiable incident. That covers the death of a person, a serious injury or illness, and dangerous incidents such as an uncontrolled explosion, fire, electric shock, a fall of plant from height, or a structural collapse (ss 35 and 37). Notification runs alongside your response to the injured person, not instead of it, and it applies even where you privately consider the incident minor.
What happens if you get it wrong
The consequences of failing the statutory duty are criminal, not just civil. Under the WHS Act as in force for Commonwealth workplaces, a Category 1 offence, exposing a person to a risk of death or serious injury or illness through reckless or negligent conduct, carries up to 15 years' imprisonment for an individual and a maximum fine of $15 million for a body corporate (s 31 and Sch 4 of the Act). A Category 2 offence, failing to comply with a duty where the failure exposes someone to that level of risk, carries maximum fines of $418,000 for an individual and $2.09 million for a body corporate (s 32). A Category 3 offence, simply failing to comply with a duty, carries maximum fines of $140,000 for an individual and $700,000 for a body corporate (s 33). Each state and territory has its own WHS Act with comparable penalties, and several now have industrial manslaughter offences carrying heavier maximums, including 25 years' imprisonment and an $18 million corporate fine in the Commonwealth Act (s 30A).
Separately, an injured worker can sue you for negligence at common law. To succeed they must prove four things: that you owed them a duty of care, that you breached it by failing to meet the standard of a reasonable employer, that the breach caused their injury or loss, and that they suffered actual harm. The workers' compensation schemes that cover most workplace injuries restrict when these common law claims can be brought, and the thresholds differ between states and territories. In NSW, for example, no damages may be awarded unless the injury results in death or a degree of permanent impairment of at least 15% for a physical injury or 25% for a psychological injury (s 151H of the Workers Compensation Act 1987 (NSW)). Proceedings against the employer must be commenced within three years of the injury (s 151D), and damages can be reduced for contributory negligence where the worker's own conduct contributed to the harm (s 151N).
Employers also face exposure for the conduct of their own people. Under the principle of vicarious liability, a business can be held liable for the negligent acts of employees carried out in the course of their work, even where the business itself did nothing wrong. A poorly trained worker who injures a customer, or a supervisor who ignores a reported hazard, can create liability for the business. That makes training, supervision and clear policies part of your legal protection, not just your operational practice.
A practical compliance checklist
Work through this checklist when you set up the business, and again whenever the work changes:
- Risk register: a documented list of hazards, their risk rating and the controls in place, reviewed whenever the work changes.
- Safe work procedures: written instructions for high-risk tasks, including manual handling, working at heights, plant operation and hazardous substances.
- Training and supervision records: who was trained, when, on what, with competency sign-off and refresher dates.
- Incident and near-miss reporting: a simple system staff actually use, with corrective actions closed out and recorded.
- Consultation records: minutes of safety meetings and toolbox talks, and the issues workers raised and how they were addressed.
- Psychosocial controls: workload review, role clarity, fatigue management and a functioning grievance pathway for bullying and harassment complaints.
- Notifiable incident process: a documented procedure for immediate regulator notification, scene preservation and evidence collection.
- Insurance: workers' compensation and public liability policies in place, with prompt notification of incidents to insurers as your policies require.
When a lawyer should be involved
A lawyer is not needed to run your business safely, but there are points where advice is worth the cost. Have a WHS audit done before problems surface, particularly if you are growing, changing premises, taking on contractors or moving into higher-risk work. Engage a lawyer immediately after a serious incident, before you speak to the regulator or correspond with the injured worker's lawyers, so that statements, documents and notifications are handled correctly. If you receive a letter of demand or a pre-litigation notice, notify your insurer and get advice before responding. A lawyer can also review your employment contracts, contractor agreements and policies so that safety responsibilities and insurance arrangements are clear, including for contractors working on your site.
The gap that tends to cost employers most
The failures that recur in employer negligence claims are rarely exotic. They are stale risk assessments after the work changed, known hazards left unaddressed under time pressure, new workers sent onto the job without training, and psychosocial issues such as workload and conflict that were never treated as safety matters. If there is a step to take this week, it is to pull out your risk register and check it against what has actually changed since you wrote it: the new equipment, the new starters, the redesigned process, the complaints that went nowhere. An assessment that no longer describes the real work is the gap a negligence claim walks through. Update it, talk it through with your workers, and record what you did.