You Don't Need an HR Department to Have a Legal Obligation

You are running a business. You manage your people, your workflows, your finances. You do not have a dedicated HR manager. You probably do not have a WHS officer. You may not even have anyone whose job title includes the word 'people'. And yet, under Australian law, you carry the same psychosocial duty of care as BHP, Westpac, and the Department of Defence.

That is not hyperbole. It is the explicit design of the model Work Health and Safety Act, adopted across every Australian jurisdiction and now strengthened, in some states, with new standalone regulations that came into force in late 2025.

The obligation to identify, assess, and control psychosocial hazards in your workplace does not scale with your headcount. It does not require you to have a policy document, a trained WHS officer, or an Employee Assistance Program. It requires you to do what is reasonably practicable, given the nature and scale of your business, to protect the psychological health and safety of everyone who works for you.

For most small and medium business owners, this obligation is entirely invisible, until something goes wrong.

A December 2025 study of 288 Australian SME decision-makers found that many, particularly those running smaller businesses, were unaware of their legal obligations to manage psychosocial hazards at work.

That study, published by Queensland University of Technology, found that a large proportion of SMEs also lacked formal policies, designated personnel, or structured processes for hazard identification and control. The researchers noted that SMEs collectively employ approximately 8.5 million Australians, around 65 percent of the entire workforce.

This is not a niche compliance problem for well-resourced organisations. It is the dominant compliance gap in the Australian economy. And regulators have noticed.

What the Law Actually Says, and Why Size Doesn't Change It

Under the model Work Health and Safety Act, in force across the Commonwealth, NSW, Queensland, South Australia, Tasmania, the ACT, and the Northern Territory, every Person Conducting a Business or Undertaking (PCBU) has a primary duty of care to ensure, so far as is reasonably practicable, the health and safety of workers.

The definition of 'health' in that Act explicitly includes psychological health. It always has. What changed, progressively from 2022 through to December 2025, is that regulators stopped treating psychological safety as an implied element of the general duty and started treating it as an explicit, positive, proactively enforceable obligation.

The model WHS Regulations now require PCBUs to identify psychosocial hazards, assess the risks they create, implement control measures using the hierarchy of controls, and monitor and review those controls on an ongoing basis. This is the same four-step process required for physical hazards. The law treats a psychosocial hazard, unmanaged workload, bullying, poor role clarity, violence and aggression from clients, with the same regulatory seriousness as a wet floor or an unguarded machine.

65% of Australia's workforce, approximately 8.5 million people, is employed by SMEs (QUT, 2025). $827,000 maximum fine for a body corporate for a Category 3 WHS offence (model WHS Act, as at 1 July 2026), the base-level criminal charge for failing to comply with a health and safety duty.

Victoria moved to standalone psychosocial regulations, the Occupational Health and Safety (Psychological Health) Regulations 2025, which took effect on 1 December 2025. These regulations are more prescriptive than the model framework in several respects. They require prevention plans for specific named hazards including aggression and violence, bullying, exposure to traumatic events, and high job demands. They restrict the use of training as a primary or predominant control measure. And they apply to every Victorian employer, regardless of size.

NSW strengthened its own framework with the Work Health and Safety Regulation 2025, which explicitly mandates the hierarchy of controls for psychosocial risk, higher-order structural controls first, training and awareness measures last and only where other measures are not reasonably practicable.

The regulatory direction across every jurisdiction is consistent: proactive, systematic, documented management of psychosocial risk. Not a policy. Not an EAP phone number on a noticeboard. A system.

The One Legal Distinction That Helps, and the Many That Don't

Small business owners are often told they have special protections under employment law. That is partly true, and it is worth understanding precisely where those protections apply, and where they end.

The Small Business Fair Dismissal Code: where the protection exists

Under the Fair Work Act 2009, businesses employing fewer than 15 employees have access to the Small Business Fair Dismissal Code. This Code provides a framework for managing dismissal that, if followed correctly, can constitute a complete defence to an unfair dismissal claim. It also extends the minimum employment period before an employee can bring an unfair dismissal claim from six months to 12 months. This is a meaningful protection in a specific and limited context, the procedural requirements for dismissal.

Where the Code provides no protection at all

• WHS prosecution. If a worker suffers psychological injury from a psychosocial hazard, burnout from unmanaged workload, trauma from unaddressed aggression, harm from workplace bullying, the employer faces potential criminal charges under the WHS Act. The Small Business Fair Dismissal Code is entirely irrelevant to WHS liability.
• General protections (adverse action) claims. If an employee exercises a workplace right and an employer takes action against them, this is adverse action under the Fair Work Act. There is no small business exemption. The compensation is uncapped, and the onus of proof is reversed.
• Workers' compensation claims. Psychological injury claims in Australia have a median direct compensation cost of $67,400 (Safe Work Australia 2023–24). The total cost to an employer typically runs to $150,000–$250,000 per claim.
• Common law damages. The High Court's 2024 decision in Elisha v Vision Australia confirmed that psychiatric injury damages are recoverable for breach of employment contract where a flawed disciplinary process was the cause. The primary judge had awarded $1,442,404.50.

The Small Business Fair Dismissal Code helps you avoid an unfair dismissal claim. It provides no protection whatsoever against WHS prosecution, adverse action claims, workers' compensation liability, or psychiatric injury damages.

The critical practical point is this: in a small workplace with no HR infrastructure, the psychosocial hazards that most commonly drive legal liability, bullying by a manager, unmanaged workload, workplace conflict, are also the ones least likely to be reported, documented, or responded to before they become claims. The absence of a system is itself the risk.

What Psychosocial Hazards Actually Look Like in an SME

The legislative language, 'psychosocial hazards', 'hierarchy of controls', 'risk assessment', can feel like the vocabulary of a large enterprise compliance program. It is not. The underlying hazards are everyday features of small workplace life.

Safe Work Australia identifies 17 psychosocial hazards. In an SME context, the most commonly present include high job demands, low job control, poor support, role overload, poor organisational change management, workplace violence and aggression, bullying and harassment (including owner/founder behaviour that, in a flat structure with no HR function, has no internal check), remote or isolated work, job insecurity, and exposure to traumatic events and content.

In a large organisation, some of these hazards are partially managed by structural features: multiple layers of management, peer relationships across teams, formal escalation pathways, and HR functions that provide a check on individual manager behaviour. In a small workplace, none of those structural moderators exist.

This is what makes psychosocial risk in SMEs structurally different from psychosocial risk in large organisations. The hazards are the same. The absence of informal controls is greater. And the consequences of a claim are proportionally more severe, because an SME cannot absorb a $200,000 workers' compensation matter the way a multinational can.

'Reasonably Practicable' at SME Scale: What the Law Actually Expects

The central standard in WHS law is not 'do everything a large employer does'. It is 'do what is reasonably practicable'. That standard takes into account the likelihood of harm, the severity of potential harm, what is known about the hazard, and the availability and cost of ways to address it.

For a small business, reasonably practicable controls will look proportionally different in complexity and cost. They will not, however, look like nothing.

The Department of Defence conviction of December 2025, the first conviction of a Commonwealth employer for failing to manage psychosocial risks, is instructive precisely because it identified a minimum standard that had not been met. The court found that Defence had failed to train supervisors to understand that performance management processes could be a psychosocial hazard, train supervisors to identify psychosocial risk signals, establish escalation pathways to occupational health or medical assessment, establish criteria for suspending a process when a worker's wellbeing required it, and monitor and document worker wellbeing throughout the process.

The Defence conviction establishes that the minimum standard is not about policy documents, it is about operational capability: supervisors who can see risk when it is in front of them, and a system that acts on what they see.

For a small business owner who is also the direct manager of every employee, the translation of that standard is direct. You need to be able to identify when someone you work with is not coping. You need to have, or know how to access, a pathway for referring them to support. And you need a mechanism through which they can raise concerns about their psychological safety that does not require them to raise it with you directly, particularly if you are the source of the problem.

That last element is the acute structural gap in small workplaces: in a large organisation, a worker who is experiencing harm from their direct manager can raise a concern with HR, an EAP, a Health and Safety Representative, or a more senior manager. In a business with five employees, the owner is often simultaneously the manager, the HR function, the senior leader, and potentially the source of the hazard. There is no structural alternative reporting pathway.

The Officer Problem: When the Business Owner Is Personally Exposed

For a real, recent example of exactly this personal exposure in practice, a small business, a director's own conduct, and a $100,000 conviction that followed, see “Small Business Owners: You're Personally Liable for WHS Failures (Even Without an HR Department).”

WHS law does not only impose obligations on the business. Under section 27 of the model WHS Act, 'officers' of a PCBU, including directors and senior managers, have a personal, non-delegable duty to exercise due diligence to ensure the business meets its WHS obligations.

In practice, for most small businesses, the officer is the business owner. The duty is not discharged by being unaware of the obligation. Due diligence requires acquiring knowledge of psychosocial hazard obligations, understanding the operations of the business and the hazards associated with them, ensuring resources and processes are available to eliminate or minimise psychosocial risks, ensuring processes exist for receiving and responding to information about psychosocial incidents, and verifying that those processes are being used.

Personal Liability Is Not Covered by Your Business Insurance. WHS prosecution of an officer under s.27 is a personal criminal liability. In a growing number of jurisdictions, including NSW and South Australia, it is an offence to insure against WHS fines. Officers convicted of Category 3 offences face fines of up to $165,000 personally under the model WHS Act (as at 1 July 2026), in addition to any fine imposed on the business. In a small business where you are the only officer, you carry this duty entirely alone.

This personal dimension of the WHS duty is what makes the SME psychosocial risk problem qualitatively different from a cost-of-compliance question. It is a personal legal exposure question for the business owner.

The Minimum System a Small Business Needs

Meeting your psychosocial WHS obligations as a small business does not require the infrastructure of a large employer. It requires a system proportionate to your scale that addresses four core elements.

1. Identification, a process, formal or informal, for identifying psychosocial hazards on an ongoing basis, triggered by changes to work arrangements, personnel changes, incidents, and regular scheduled review.
2. Assessment and Control, hazards assessed for likelihood and severity, responded to with control measures that follow the hierarchy, starting with work design and structural changes, not simply communication or reminders.
3. Consultation, genuine consultation with workers throughout the risk management process. The absence of documented consultation is one of the first things a regulator will look for.
4. Reporting Infrastructure, the element small businesses are most structurally deficient in, and the one that most directly drives claims. Workers need a mechanism to raise concerns that is accessible, genuinely confidential, and does not require raising it directly with the person who may be causing the harm.

The absence of a reporting pathway is not neutral. It is a control failure. A worker with no safe mechanism to raise a concern is a worker who will either leave, escalate to a regulator, or make a workers' compensation claim.

Where Salus Fits in an SME Context

For a small business, the immediate value is straightforward: Salus provides the reporting infrastructure that your organisational structure cannot generate on its own. A worker in a five-person business who is experiencing harm from the owner's behaviour has, for the first time, a pathway that does not require them to raise the concern directly with the owner.

The second value is data. Salus aggregates concern data, anonymously and confidentially, to generate lead indicators of systemic psychosocial risk within the organisation's own workforce over time. For a business owner who is genuinely committed to meeting their obligation but who has no formal process for knowing what is happening in their workplace, this is the visibility that makes proactive management possible.

For a business of any size, the fundamental shift Salus enables is from reactive to proactive: from responding to claims after they crystallise, to identifying and addressing risks before they do.

The Bottom Line for Small Business Owners

The psychosocial duty under Australian WHS law applies to you now, in full, regardless of the size of your business or the absence of dedicated HR or WHS personnel. The regulatory landscape has shifted decisively, across every jurisdiction, toward proactive, documented, enforceable management of psychological health at work.

The QUT research tells us that most SME owners do not yet understand this. That gap closes two ways: through education, or through a regulator investigation triggered by a worker's claim. The first is cheaper, less traumatic, and within your control.

What regulators are looking for is not a polished policy manual or an expensive EAP subscription. They are looking for a system: evidence that you identified the psychosocial hazards in your workplace, assessed the risks, put controls in place, consulted your workers, and gave them a way to tell you when something was wrong.

A policy on paper is not a control. A system that works in practice, that identifies risk, enables disclosure, and generates the information that allows action, is the standard the law expects.

The obligation is already yours. The question is whether you have the infrastructure to meet it.

Key Sources: Langdon, Karanikas & Hon (QUT, 2025): Psychosocial Hazard Management in Small to Medium-Sized Enterprises in Australia | Safe Work Australia: Key Work Health and Safety Statistics 2023–24 | Model Work Health and Safety Act 2011 (Cth) | Work Health and Safety Regulation 2025 (NSW) | Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic) | Department of Defence conviction, NSW Local Court, December 2025 | Elisha v Vision Australia [2024] HCA 50 | Safe Work Australia: Model Code of Practice, Managing Psychosocial Hazards at Work | Fair Work Act 2009 (Cth) ss.341, 361, 789FA | WorkSafe QLD: Updated Guidance for Small Business, August 2025

This article provides general information only and does not constitute legal advice. Specific legal obligations vary by jurisdiction, workforce type, and circumstances. Employers should seek appropriate professional advice in relation to their specific obligations.