Employer Obligations for Mental Health at Work: What Australian Law Actually Requires You to Do

Most of the people who ask us this question have already done something. There is a mental health policy on the intranet. There is an EAP number in the induction pack. The board asked whether the organisation is compliant and someone said yes, because those two things exist.

Then a manager reads a regulator's news release about a prosecution and comes back with a different question: is that actually what the law asks of us?

No. And the gap between what most employers have and what the duty requires is not a paperwork gap.

What does Australian law actually require employers to do about mental health at work?

The same thing it requires for physical safety. Under work health and safety law an employer must eliminate psychosocial risks so far as is reasonably practicable, or minimise them where they cannot be eliminated. In practice that is a four-step cycle: identify the hazards in your work, assess them, control them at the source, and review whether the controls worked. All of it in consultation with the people doing the work.

The word that does the work in that sentence is psychosocial. The hazards are not people's private lives. They are features of the job: workloads that never come down, supervision that is not there, change handled badly, exposure to difficult people or difficult material, low control over how work gets done. These are conditions the employer creates, so they are conditions the employer is responsible for.

The codes of practice for managing psychosocial hazards at work set out how a regulator expects that duty to be met. We have written about the Code of Practice itself separately. This page is about what it asks of you.

One sentence version: you used to be able to show you cared. Now you have to show you looked, what you found, and what you changed.

Is a mental health policy enough?

No. A policy is a statement of intent, and none of the four steps is satisfied by a statement of intent. The regulator stopped asking what you intended and started asking what you did. The test that decides an audit or a prosecution is the difference between documented intention and demonstrable control: what you found, when, what you changed, and whether it worked.

For years a policy did a useful job. It showed the organisation had thought about the issue and would not be caught entirely flat-footed. That was a reasonable thing to have in a period when nobody was checking.

That period has ended. Can you show which hazards you found, and when you looked? Can you show what you changed about the work in response? Can you show evidence that the change worked, and that you looked again?

The uncomfortable version, which we hear from safety leads more than from anyone else: the organisations that get into trouble often have very good policies. What they cannot produce is anything that happened.

What do the four steps look like in a real workplace?

Identify means going looking, not waiting. Assess means writing down which teams and roles carry which hazards, how often and how severely. Control means changing the work, not the person. Review means checking whether it worked and looking again. It is a cycle, not a project, and the review step is where most organisations we talk to have nothing to show.

Going looking is the step people skip because it feels like inviting trouble. The duty is to find the hazards before they become someone's injury. "Nobody has complained" is not looking. The workloads, the supervision gaps, the badly handled restructure: those are found by asking, observing and reading what the organisation already knows.

Assessing them is the same discipline you already apply to plant and chemicals, with the same expectation that it is written down. Which teams, which roles, how often, how severe. A risk register that names psychosocial hazards alongside the physical ones is what a regulator expects to see, and a psychosocial risk assessment is how you build one.

Changing the work is where the hierarchy of controls bites. Adjusting load, redesigning roles, fixing supervision, managing change properly: those are controls at the source. Training, policies and a helpline are administrative controls, the lowest rung. Relying on them alone is exactly what regulators have prosecuted.

Reviewing is the part that catches organisations out. The regulator will ask what you found last time, what you changed, and what you found after that. If the honest answer is that you looked once, in 2023, you have a project, not a system.

What have employers actually been prosecuted for?

For the absence of a system, not for the harm. Read WorkSafe Victoria's own accounts of its recent psychosocial prosecutions and the pattern is hard to miss. None of the organisations was fined because someone was hurt. Each was fined because nothing was in place that could have identified the hazard, received a report, or responded.

In October 2023, WorkSafe Victoria prosecuted Court Services Victoria over conditions at the Coroners Court that contributed to a worker's death. Court Services Victoria pleaded guilty to failing to provide and maintain a safe workplace and was convicted and fined $379,157 plus $13,863 in costs in the Melbourne Magistrates' Court. In WorkSafe's words, the organisation failed to conduct any adequate process to identify risks, or any adequate risk assessment of the risks to psychological health.

In March 2024 the same regulator prosecuted a Melbourne sign company, Printco, and its director over about four years of verbal abuse, intimidation and threats towards a sub-contractor who developed a mental injury. The company was fined $20,000 and the director $20,000 in the Moorabbin Magistrates' Court. The company's bullying policies were found inadequate: no reporting procedures, no definitions, no examples, no worker training.

In May 2025, a Victorian toy wholesaler was convicted and fined $100,000 plus $6,060 in costs in the Heidelberg Magistrates' Court over the risk of psychological injury from sexual harassment by a director. The regulator's finding was that the company had no formal system to identify, prevent, manage, investigate or respond to inappropriate behaviour.

Look at what each finding turns on. Not that distress existed. Not that someone behaved badly on a particular day. That there was no system: no way for the hazard to be identified, no route for it to be reported, no control operating, nobody who would have known. The harm was the evidence. The absence of a system was the offence.

Does having an EAP meet the duty?

No. An EAP is a lower-order support inside the system, not the system. It is an administrative control, the lowest rung of the hierarchy, and it waits to be asked. Around 5% of a workforce ever uses one, so as evidence that hazards are being identified and controlled it shows almost nothing. It has a place. It is not the answer to the regulator's question.

We have answered the narrower question, whether an EAP is mandatory, on its own page.

What evidence will a regulator ask for?

Four things: what you found and when, what you changed, whether it worked, and who you consulted. The records most organisations hold (a policy, an EAP contract, a training register) answer none of those. The records a regulator asks for are the ones that show a cycle running.

This is worth sitting with, because it is where the cost of getting it wrong lives. Safe Work Australia's latest figures put the median compensation for a serious psychological claim at $67,400, more than four times the median across all serious claims, with a median 35.7 working weeks off work, the longest of any claim category. Serious mental health condition claims rose 14.7% in a single year. Those are the costs of the harm. The prosecutions above are the cost of having nothing that would have noticed.

The question a regulator is really asking is not whether your people are well. It is whether, if they were not, anything you have built would have noticed.

What should we do this quarter?

Run one honest pass of the cycle, small and written down. Identify the hazards in one part of the business by asking the people who work there. Write a short assessment. Change one thing about the work, not about the people. Set a date to check whether it worked. That is a system beginning, and it is what a regulator recognises.

We are not going to pretend this is simple. Identifying psychosocial hazards means asking questions that some leaders would rather not ask, and consultation means hearing answers that cannot then be unheard. That is the point of the duty.

If it helps, start with the risk assessment, read what the Code of Practice asks for and how ISO 45003 frames it, and use the hazards article to check you are looking in the right places. The narrow question, whether an EAP is mandatory, is answered here.

You already had the duty. What changed is that someone is now asking to see the work.