Work health and safety (WHS) law is usually understood as a set of duties a business owes its workers. Under Australia's harmonised WHS framework, the protection runs much further. The person conducting a business or undertaking, known as the PCBU, must ensure so far as is reasonably practicable that the health and safety of "other persons" is not put at risk by the work. Customers, clients, visitors and members of the public all sit inside that group.
The question cuts both ways. Customers and visitors also carry legal duties of their own: they must take reasonable care for their own health and safety, and they must comply with reasonable safety instructions a business gives them. This article sets out who owes what, how compliance is measured, the penalties for getting it wrong, and the practical steps a customer-facing business should take.
Who owes WHS duties, and to whom
Australia runs on a nationally harmonised WHS framework built around the model WHS Act. The model laws have been implemented in every jurisdiction except Victoria, which operates under its own Occupational Health and Safety Act 2004 (Vic), enforced by WorkSafe Victoria. Western Australia adopted the model framework in 2022. Section references below are to the Work Health and Safety Act 2011 (Cth), which mirrors the model Act; the adopting states and territories use near-identical provisions, so the same principles apply to a cafe in Sydney, a factory in Brisbane or a salon in Perth.
The central duty holder is the PCBU. Under s 5 of the Work Health and Safety Act 2011 (Cth), a person conducts a business or undertaking whether they act alone or with others, and whether or not the business is run for profit. There is no turnover, headcount or size threshold. To work out whether the duty attaches to you:
- PCBUs: you run a shop, cafe, trades business, salon, gym, office or any other business or undertaking, as a sole trader, partnership, company or other structure, for profit or not.
- Sole traders with no employees: you are still a PCBU, because the duty extends to anyone your work could affect, including your customers.
- Not PCBUs: you act only as a worker or as an officer of a business, or if your group is a volunteer association in which nobody is employed.
Who is protected? Two groups. First, workers: under s 19(1), a PCBU must ensure the health and safety of workers it engages, and workers whose activities in carrying out work are influenced or directed by it, while they are at work. Second, everyone else: under s 19(2), a PCBU must ensure that the health and safety of other persons is not put at risk from work carried out as part of the business or undertaking. It is that second limb that brings customers, visitors, suppliers and passers-by within the scope of your duty.
The primary duty of care
Under s 19 of the Work Health and Safety Act 2011 (Cth), the PCBU has a primary duty to ensure, so far as is reasonably practicable, the health and safety of workers and of other persons affected by the work. The duty is not confined to premises you own. It follows the work, wherever it happens: a shop floor, a client's home, a construction site, a delivery route or a vehicle.
Section 19(3) spells out what the duty concretely involves, and it is worth reading against your own customer-facing areas:
- A safe work environment: providing and maintaining premises, fixtures and fittings without risks to health and safety.
- Safe plant and structures: ensuring the equipment, machinery and buildings customers might encounter are safe.
- Safe systems of work: designing how work is done so that it does not create risks for others.
- Safe use, handling and storage: of plant, structures and substances, including anything a customer could come into contact with.
- Adequate facilities: providing facilities for the welfare of workers, including access to them.
- Information, training and supervision: providing what is necessary to protect all persons, not just workers, from risks arising from the work.
- Monitoring: keeping an eye on worker health and on conditions at the workplace to prevent injury or illness.
The duty cannot be contracted out or delegated. You cannot hand the obligation to a manager, a landlord or a customer by putting up a sign. You can, however, share the practical work: engaging a contractor or consultant to run assessments does not transfer the legal duty, which remains yours.
What "reasonably practicable" means in practice
The standard against which every WHS duty is measured is "reasonably practicable". Under s 18 of the Work Health and Safety Act 2011 (Cth), that means what was reasonably able to be done at the time, weighing up all relevant matters including:
- the likelihood of the hazard or risk occurring;
- the degree of harm that might result;
- what you know, or ought reasonably to know, about the hazard or risk and about ways of eliminating or minimising it;
- the availability and suitability of ways to eliminate or minimise the risk; and
- the cost of those ways, including whether the cost is grossly disproportionate to the risk.
The cost factor is the one most often misread. Cost is weighed only after the risk and the available controls have been assessed, and a control can be avoided on cost grounds only if the cost is grossly disproportionate to the risk. A modest outlay to fix a hazard that could seriously injure a customer is not disproportionate, whatever your profit margin.
Codes of practice help you answer the "reasonably practicable" question. Safe Work Australia publishes model codes, such as the code on managing work health and safety risks, and an approved code applies to anyone with a duty in the circumstances it covers. Following an approved code of practice will, in most cases, mean you have complied with your duty. Codes are not legislation, but they are admissible in court proceedings as evidence of what was reasonably practicable in the circumstances.
Customers' own WHS obligations
Yes, customers have obligations, but they are much lighter than yours. Under s 29 of the Work Health and Safety Act 2011 (Cth), a person at a workplace who is not a worker must:
- take reasonable care for their own health and safety;
- take reasonable care that their acts or omissions do not adversely affect the health and safety of other persons; and
- comply, so far as they are reasonably able, with any reasonable instruction given by the PCBU to allow the PCBU to comply with the Act.
In practical terms, a customer who ignores a "wet floor" sign and walks through a freshly mopped area in slippery shoes has breached their own duty, and the law allows for prosecution of individuals, including customers, who disregard their obligations. In practice regulators concentrate their enforcement on PCBUs, who carry the primary duty and the deepest pockets, but the duty exists and can be relied on where a customer's own conduct is in issue.
Two points follow. First, a customer's duty does not relieve you of yours. A warning sign is a control that reduces risk, not a defence that transfers it. Your s 19(2) obligation to keep customers safe remains, so a wet floor still needs the spill cleaned up promptly, the area cordoned off while it dries, and the sign actually in place. Second, a customer who disregards clear and reasonable instructions will be relevant to whether you did everything reasonably practicable, but it will not automatically excuse you. Workers carry similar duties under s 28, including cooperating with your reasonable safety policies, which is why visitor and customer protocols matter.
What happens if a duty is breached
WHS breaches are criminal offences, not just regulatory infractions. The Act creates three tiers of offence:
- Category 1 (s 31): reckless or negligent conduct that exposes an individual to a risk of death or serious injury or illness. This is the most serious tier and carries the largest penalties, including imprisonment for individuals.
- Category 2 (s 32): a failure to comply with a health and safety duty where that failure exposes a person to a risk of death or serious injury or illness.
- Category 3 (s 33): a failure to comply with a health and safety duty without the exposure element.
The maximum monetary penalties in the model Act are indexed annually for CPI. As indexed for the year commencing 1 July 2026, the model maxima are:
- Category 1: $12,321,000 for a body corporate; $2,464,000 for an individual PCBU or officer; $1,232,000 for any other individual.
- Category 2: $2,470,000 for a body corporate; $494,000 for an individual PCBU or officer; $247,000 for any other individual.
- Category 3: $827,000 for a body corporate; $165,000 for an individual PCBU or officer; $83,000 for any other individual.
Each jurisdiction legislates its own amounts, and they differ, so check the Act in force where you operate. The most serious exposure sits above these tiers: industrial manslaughter, which several jurisdictions now criminalise, carries up to 20 years' imprisonment for individuals under the model offence, with a maximum body-corporate penalty of $21,274,000. The Commonwealth version provides for up to 25 years' imprisonment.
Enforcement rarely begins with prosecution. Your local regulator, such as SafeWork NSW, Workplace Health and Safety Queensland, WorkSafe Victoria or Comcare for Commonwealth workplaces, employs inspectors who can enter premises, issue improvement and prohibition notices requiring you to fix problems, and accept enforceable undertakings. Prosecution can follow where a duty holder fails to comply or where a serious incident occurs. Separately, a customer injured on your premises can sue you in negligence for damages, and the fact that you breached a WHS duty is strong evidence against you in that civil claim.
A compliance checklist for customer-facing businesses
A practical starting list, in rough priority order:
- Walk the customer's path: assess every area a customer can reach, from the carpark and entrance to the counter, the change room and the bathroom. Note spills, steps, trailing cables, unguarded edges and blind corners.
- Eliminate first, minimise second: WHS law requires you to eliminate risks where reasonably practicable, and to minimise them where elimination is not possible. Fix the hazard at the source before relying on signs or warnings.
- Communicate clearly: use plain-language signage and verbal instructions for hazards that remain, such as wet floors, hot surfaces and uneven ground.
- Provide protection where needed: supply visitors with personal protective equipment where the environment requires it, such as hard hats and high-visibility vests on site visits, or masks in a salon.
- Plan for emergencies: have a documented emergency plan, and provide and maintain first aid equipment and facilities appropriate to your premises.
- Train and supervise: make sure staff know how to manage customer-facing risks and how to respond when something goes wrong.
- Notify and record: a notifiable incident, meaning a death, serious injury or illness, or a dangerous incident, must be reported to the regulator immediately under s 38, and records of notifiable incidents must be kept for at least five years.
- Review regularly: revisit your risk assessment after incidents, complaints, layout changes or new equipment, and when a code of practice relevant to your industry is updated.
When a WHS lawyer should be involved
Most small and medium businesses manage day to day WHS without a lawyer. Professional help is usually worth the cost when:
- you are starting a higher risk business, fitting out premises or substantially changing how the business operates;
- a regulator inspector attends your premises or issues an improvement or prohibition notice;
- a notifiable incident occurs, because what you say and do in the first 48 hours can shape everything that follows;
- you are negotiating an enforceable undertaking or facing prosecution; or
- you want a formal audit of your policies, risk assessments and visitor protocols against the relevant codes of practice.
A WHS lawyer will review your risk assessments against the applicable codes, draft or redraft safety policies and customer and visitor protocols, advise on incident response and dealings with the regulator, and represent you in any enforcement action or prosecution. Given the penalty figures above, the cost of advice is trivial next to the cost of getting a serious incident wrong.
The duty most businesses miss
If one part of WHS law is consistently underestimated by customer-facing businesses, it is s 19(2): the duty to people who are not your workers. It is easy to treat a customer's injury as the customer's fault. They saw the step. They ignored the sign. But the law asks what you did, so far as reasonably practicable, to prevent the risk in the first place. A warning sign is a control, not a defence.
Start this week by walking your premises the way a customer would, from the carpark through the entrance to the counter and back out, and write down every step, spill hazard, trailing cable, unguarded edge and blind corner you find, with the fix for each one. A documented walk through of the customer's experience, and the controls you put in place because of it, is often the difference between a defensible position and an indefensible one.