Work health and safety (WHS) obligations for Australian small businesses

Published Saturday 25 July 2026

Table of contents

• What is work health and safety in Australia?
• Hazards and risks
• What are WHS obligations for small business employers?
• How do WHS laws work across states and industries?
• State and industry regulators and resources
• How do I set up a WHS system in a small business?
• What WHS records do you need to keep?
• Simplify WHS compliance with Xero
• FAQs on work health and safety for small businesses

Key takeaways

• If you own a small business in Australia, you're a person conducting a business or undertaking PCBU under the WHS Act. You have a legal duty to protect workers and others from harm, no matter how many people you employ.
• Setting up a WHS system involves identifying hazards, assessing and controlling risks, training and consulting your team, and planning for incidents. It doesn't need to be complicated to be effective.
• Keeping clear WHS records, including policies, training logs, risk assessments, and incident reports, gives you the evidence you need to demonstrate compliance during audits and inspections.
• WHS laws in Australia are enforced by state and territory regulators, each of whom provides free resources, templates, and guidance tailored to small businesses in their jurisdiction.

What is work health and safety in Australia?

Work health and safety (WHS) is the legal duty to protect workers and others from harm in your workplace. Under the WHS Act Australia, every person conducting a business or undertaking, (or PCBU) must ensure the health and safety of workers and others is protected, so far as is reasonably practicable.

If you run a small business in Australia, you're a PCBU. That means you're responsible for creating a safe work environment, whether you employ one person or 20, and whether your team works in a shopfront, on a building site, or from home.

Small business safety obligations apply to all businesses, regardless of size. You must:

• Identify and manage risks to health and safety.
• Consult with workers about WHS matters.
• Provide information, training, instruction, and supervision.
• Maintain safe work systems and facilities.
• Plan for emergencies and serious incidents.
• Notify the regulator of notifiable incidents.
• Keep records of your WHS activities.

These duties are proactive. You need to act before someone gets hurt, spotting hazards, assessing risks, and putting controls in place before an incident occurs.

Failing to meet your obligations under WHS laws can result in enforcement action, fines, and in serious cases, prosecution. More importantly, it can lead to injuries, illnesses, and long-term harm to the people who work for you.

Hazards and risks

Understanding hazards and risks is the starting point for any WHS system. A hazard is anything in your workplace that could cause harm. A risk is the likelihood that a hazard will actually cause harm, and how serious that harm could be. Identify hazards first, then assess the risk to decide what to do about it.

Most small businesses face hazards across four main categories:

• Physical hazards: machinery, tools, slippery floors, noise, heat, working at heights
• Chemical hazards: cleaning products, paints, solvents, pesticides, adhesives
• Biological hazards: viruses, bacteria, mould, animal or plant materials
• Psychosocial hazards: high workload, bullying, poor communication, isolation, unclear roles

Start by walking through your workplace and noting anything that could cause harm. Ask your team what they find difficult, uncomfortable, or unsafe. They'll spot hazards you might miss.

What are WHS obligations for small business employers?

As a small business employer in Australia, your WHS obligations cover every aspect of your workplace. Here's what you must do:

Identify hazards

Walk through your workplace and look for anything that could cause harm. Hazards can be physical (machinery, chemicals, noise), chemical, biological, or psychosocial . Ask your team what they see as risks to get the full picture.

Assess and control risks

Once you've identified hazards, assess who could be harmed, how likely it is, and how serious the consequences could be. Then apply controls to eliminate or reduce the risk.

Use the hierarchy of control: eliminate the hazard first, then substitute, isolate, use engineering controls, apply administrative controls, and use personal protective equipment (PPE) as a last resort.

Consult workers

Your team knows the work best. Consult them when you identify hazards, assess risks, make changes to the workplace, or introduce new equipment or processes. Consultation can be informal in small businesses, but it must be genuine.

Provide training and supervision

Make sure everyone knows how to do their job safely. Provide induction training for new workers, task-specific training for high-risk activities, and refresher training when you introduce new equipment or change procedures. Supervise workers, especially those who are new, young, or inexperienced.

For more on managing your team safely, see the guide on effective leadership.

Maintain safe work systems and facilities

Keep the workplace clean, well-maintained, and fit for purpose. Ensure equipment is safe and regularly inspected. Provide adequate lighting, ventilation, and facilities like toilets and drinking water.

Plan for emergencies

Have a plan for what to do in an emergency, such as a fire, medical incident, or natural disaster. Make sure everyone knows the plan, and practise it regularly.

Notify serious incidents

If someone is seriously injured or becomes seriously ill (or worse) at work, you must notify your state or territory WHS regulator immediately. Preserve the incident site until an inspector says you can clean it up.

Keep records

Document your WHS activities. Keep records of risk assessments, training, incidents, and any corrective actions you take. Records prove you've met your obligations and help you improve over time.

Identify psychosocial hazards in small teams

Psychosocial hazards are aspects of work that can cause psychological or physical harm. In small teams, common psychosocial risks include:

• unclear roles and responsibilities
• high or unpredictable workload
• lack of support or recognition
• bullying, harassment, or disrespectful behaviour
• isolation or poor communication

To manage psychosocial hazards, take the following steps:

1. Clarify roles and set realistic workload expectations.
2. Provide regular feedback and recognition.
3. Encourage open communication and respect.
4. Offer access to support, such as an employee assistance program.
5. Address bullying or harassment immediately and seriously.

Psychosocial hazards are just as important as physical hazards. Ignoring them can lead to stress, burnout, and mental health conditions that affect your team's wellbeing and your business's performance.

Prepare emergency plans and first aid

Every workplace needs an emergency plan. Your plan should set out how you and your team respond to serious events. For a small business, your plan should include:

• roles and responsibilities (who calls 000, who evacuates, who accounts for everyone)
• communication methods (alarms, messages, phone trees)
• evacuation procedures (exit routes, assembly points)
• first aid arrangements (first aid kits, trained first aiders)
• practice drills (at least once a year)

You must have a first aid kit that's appropriate for your workplace. The contents depend on your industry and the risks you face. You should also have at least one trained first aider on site during working hours.

Run regular evacuation drills so everyone knows what to do. After each drill, review what went well and change what you need to improve.

Incident notification and workers' compensation

A notifiable incident is a serious workplace event that must be reported to your WHS regulator immediately. Notifiable incidents include:

• death of a person
• serious injury or illness (for example, amputation, serious burns, loss of consciousness, exposure to a dangerous substance)
• dangerous incidents (for example, uncontrolled explosion, collapse of a structure, escape of a dangerous substance)

If a notifiable incident occurs, follow these steps to respond and meet your legal duties:

1. Ensure the area is safe.
2. Preserve the incident site (don't disturb it unless it's unsafe to leave it).
3. Notify your state or territory WHS regulator immediately (by phone or online).
4. Document what happened (take photos, collect witness statements, record the sequence of events).

Workers' compensation is separate from WHS, but it still links closely to your safety obligations. If a worker is injured or becomes ill because of their work, they may be entitled to workers' compensation. This covers medical expenses, lost wages, and rehabilitation.

You must have workers' compensation insurance if you employ people. The requirements vary by state and territory. Contact your state workers' compensation authority for details.

How do WHS laws work across states and industries?

A national framework sets workplace health and safety rules in Australia. State and territory regulators then enforce those rules. This means there are some differences in how the law applies depending on where you operate.

Model WHS laws

Model WHS laws are a set of nationally consistent work health and safety laws developed by Safe Work Australia. They were designed so that businesses operating across multiple states face the same core obligations regardless of where they work.

Most states and territories have adopted the model laws, including New South Wales, Queensland, South Australia, Tasmania, the Australian Capital Territory, and the Northern Territory. Victoria and Western Australia have their own separate WHS legislation, though the core duties and principles are similar.

If you operate in a model law jurisdiction, the Work Health and Safety Act 2011 (or its state equivalent) is your primary legislation. Safe Work Australia publishes the model laws, codes of practice, and guidance at safeworkaustralia.gov.au.

State and territory regulators enforce WHS laws in their jurisdiction. They:

• Inspect workplaces
• Investigate incidents
• Issue improvement and prohibition notices
• Prosecute serious breaches

Industry codes of practice provide practical guidance on how to manage specific risks. Codes exist for industries like construction, agriculture, retail, and hospitality. Following a code of practice is not mandatory, but it's one way to show you've met your WHS obligations.

If you operate in multiple states, you need to understand the requirements in each location. The core duties are the same, but the details, such as notification procedures, record-keeping requirements, and penalties, can vary.

State and industry regulators and resources

Each state and territory has its own WHS regulator. Here's where to find them:

• Australian Capital Territory: WorkSafe ACT
• New South Wales: SafeWork NSW
• Northern Territory: NT WorkSafe
• Queensland: WorkSafe Queensland
• South Australia: SafeWork SA
• Tasmania: WorkSafe Tasmania
• Victoria: WorkSafe Victoria
• Western Australia: WorkSafe WA
• Commonwealth (for federal government workplaces): Comcare

These regulators provide free resources, templates, and industry-specific guidance for small businesses, including webinars and toolkits.

Industry codes of practice are available from Safe Work Australia and your state regulator. Use them to understand acceptable controls for your industry.

How do I set up a WHS system in a small business?

Setting up a WHS system doesn't need to be complicated, and closely mirrors your obligations as an employer. Follow this five-step process to build a simple, repeatable system that scales with your business.

1. Identify your top hazards

Inspect the work environment and look for anything that could cause harm. Consider physical hazards (machinery, tools, slippery floors, noise, heat), chemical hazards (cleaning products, paints, solvents), biological hazards (viruses, bacteria, mould), and psychosocial hazards (workload, stress, bullying, isolation).

Ask your team what they see as risks. They're the ones doing the work, so they'll spot hazards you might miss.

For example, in a retail shop, common hazards include slippery floors, manual handling of stock, customer aggression, long periods standing, and repetitive scanning. In a trades business, they might include power tools, working at heights, manual handling, noise, dust, and fatigue from long hours.

2. Assess risks

For each hazard, consider who could be harmed (workers, customers, contractors, visitors), how they could be harmed (injury, illness, psychological harm), how likely it is (almost certain, likely, possible, unlikely, rare), and how serious it could be (catastrophic, major, moderate, minor, insignificant).

Prioritise risks based on likelihood and consequence. Focus on the highest risks first.

3. Control risks

Apply the hierarchy of control to eliminate or reduce risks. Work through the following levels in order:

1. Eliminate the hazard (for example, stop using a dangerous chemical).
2. Substitute it with something safer (for example, use a less toxic cleaning product).
3. Isolate the hazard (for example, install guards on machinery).
4. Use engineering controls (for example, install ventilation to remove fumes).
5. Apply administrative controls (for example, rotate tasks to reduce fatigue, provide training).
6. Use PPE as a last resort (for example, gloves, safety glasses, ear protection).

Document the controls you put in place. This shows you've thought about the risk and taken action.

4. Train and consult

Brief your team on the hazards they face and the controls you've put in place. Provide induction training for new workers, task-specific training for high-risk activities, and refresher training when you introduce new equipment or change procedures.

Record who attended training, what was covered, and when. Involve your team in WHS decisions. Ask for their input when you identify hazards, assess risks, or make changes.

5. Plan for incidents

Write an emergency plan that covers fire, medical emergencies, and other serious incidents. Include roles and responsibilities, communication methods, evacuation procedures, and first aid arrangements.

Log all incidents and near misses, even if no one was hurt. Investigate what went wrong and update your controls to prevent it happening again. Review your WHS system regularly, especially after an incident, when you introduce new equipment, or when you hire new workers.

What WHS records do you need to keep?

Keeping clear WHS compliance records proves you've met your obligations and helps you improve over time. Here's what you must keep records of:

• Policies and procedures: Document your WHS policy, emergency plan, and safe work procedures. These set out your commitment to WHS and how you manage risks.
• Risk assessments and safe work method statements: Keep records of hazard identification, risk assessments, and the controls you've put in place. For high-risk construction work, you must prepare a safe work method statement (SWMS) before the work starts.
• Training and competency: Record who attended training, what was covered, and when. Keep certificates of competency for workers who operate machinery, handle dangerous goods, or perform high-risk work.
• Equipment checks and maintenance: Log inspections, testing, and maintenance of equipment, machinery, and plant. This includes ladders, power tools, lifting equipment, and electrical appliances.
• Incident reports and corrective actions: Document all incidents, near misses, and hazards reported by workers. Record what happened, what you did to investigate, and what controls you put in place to prevent it happening again.
• Evidence of safety spend: Keep receipts and invoices for safety equipment, training, maintenance, and any other WHS-related expenses. This helps you track costs, claim tax deductions, and demonstrate your investment in safety.

Store records securely and keep them for at least five years. Digital records are fine, as long as they're backed up and easy to retrieve.

For more on record-keeping and compliance, see the ATO's record-keeping guide.

Simplify WHS compliance with Xero

Managing WHS obligations alongside your day-to-day business operations can feel overwhelming. Xero helps you stay organised by keeping all your business records, including safety-related expenses and training costs, in one place.

Track your WHS spending, store digital receipts, and generate reports that show your investment in workplace safety. With automated record-keeping and real-time insights, you can focus on protecting your team while Xero handles the admin.

Ready to see how Xero makes running your business easier? Get one month free.

FAQs on work health and safety for small businesses

Here are answers to common questions about WHS obligations, compliance, and practical steps for Australian small businesses.

Do I need a WHS policy if I only have a few employees?

Yes, you still need a WHS policy, even if you only have a few employees, and it can be a simple one-page document that explains how you manage health and safety.

How often should I review my WHS system?

Review your WHS system at least once a year, and any time an incident occurs, so you can pick up new hazards and fix gaps quickly.

What happens if I don't comply with WHS laws?

Your state or territory regulator can issue an improvement notice (requiring you to fix a problem) or a prohibition notice (stopping work until you fix a serious risk). Serious breaches can lead to prosecution, fines, and in extreme cases, imprisonment.

Do I need workers' compensation insurance?

Yes, if you employ people. Workers' compensation insurance covers medical expenses and lost wages if a worker is injured or becomes ill because of their work. The requirements vary by state and territory, so check with your local workers' compensation authority.

How do I manage WHS if my team works remotely?

Remote workers face different hazards, such as poor ergonomics, feeling isolated, and working too many hours. Assess the risks by asking workers about their home setup, workload, and support. Provide guidance on setting up a safe workspace, managing workload, and staying connected, and check in regularly.