You are running a business. You manage your people, your workflows, your finances. You do not have a dedicated HR manager. You probably do not have a WHS officer. You may not even have anyone whose job title includes the word 'people'. And yet, under Australian law, you carry the same psychosocial duty of care as BHP, Westpac, and the Department of Defence.

That is not hyperbole. It is the explicit design of the model Work Health and Safety Act, adopted across every Australian jurisdiction and now strengthened -- in some states -- with new standalone regulations that came into force in late 2025.

The obligation to identify, assess, and control psychosocial hazards in your workplace does not scale with your headcount. It does not require you to have a policy document, a trained WHS officer, or an Employee Assistance Program. It requires you to do what is reasonably practicable, given the nature and scale of your business, to protect the psychological health and safety of everyone who works for you.

For most small and medium business owners, this obligation is entirely invisible -- until something goes wrong.

A December 2025 study of 288 Australian SME decision-makers found that many -- particularly those running smaller businesses -- were unaware of their legal obligations to manage psychosocial hazards at work.

That study, published by Queensland University of Technology, found that a large proportion of SMEs also lacked formal policies, designated personnel, or structured processes for hazard identification and control. The researchers noted that SMEs collectively employ approximately 8.5 million Australians -- around 65 percent of the entire workforce.

This is not a niche compliance problem for well-resourced organisations. It is the dominant compliance gap in the Australian economy. And regulators have noticed.

What the Law Actually Says -- and Why Size Doesn't Change It

Under the model Work Health and Safety Act -- in force across the Commonwealth, NSW, Queensland, South Australia, Tasmania, the ACT, and the Northern Territory -- every Person Conducting a Business or Undertaking (PCBU) has a primary duty of care to ensure, so far as is reasonably practicable, the health and safety of workers.

The definition of 'health' in that Act explicitly includes psychological health. It always has. What changed -- progressively from 2022 through to December 2025 -- is that regulators stopped treating psychological safety as an implied element of the general duty and started treating it as an explicit, positive, proactively enforceable obligation.

The model WHS Regulations now require PCBUs to identify psychosocial hazards, assess the risks they create, implement control measures using the hierarchy of controls, and monitor and review those controls on an ongoing basis. This is the same four-step process required for physical hazards. The law treats a psychosocial hazard -- unmanaged workload, bullying, poor role clarity, violence and aggression from clients -- with the same regulatory seriousness as a wet floor or an unguarded machine.

65%

of Australia's workforce -- approximately 8.5 million people -- is employed by SMEs (QUT, 2025)

$500K

maximum fine per incident for a Category 3 WHS offence -- the base-level criminal charge for failing to comply with a health and safety duty

Victoria moved to standalone psychosocial regulations -- the Occupational Health and Safety (Psychological Health) Regulations 2025 -- which took effect on 1 December 2025. These regulations are more prescriptive than the model framework in several respects. They require prevention plans for specific named hazards including aggression and violence, bullying, exposure to traumatic events, and high job demands. They restrict the use of training as a primary or predominant control measure. And they apply to every Victorian employer, regardless of size.

NSW strengthened its own framework with the Work Health and Safety Regulation 2025, which explicitly mandates the hierarchy of controls for psychosocial risk -- higher-order structural controls first, training and awareness measures last and only where other measures are not reasonably practicable.

The regulatory direction across every jurisdiction is consistent: proactive, systematic, documented management of psychosocial risk. Not a policy. Not an EAP phone number on a noticeboard. A system.

The One Legal Distinction That Helps -- and the Many That Don't

Small business owners are often told they have special protections under employment law. That is partly true, and it is worth understanding precisely where those protections apply -- and where they end.

The Small Business Fair Dismissal Code: where the protection exists

Under the Fair Work Act 2009, businesses employing fewer than 15 employees have access to the Small Business Fair Dismissal Code. This Code provides a framework for managing dismissal that, if followed correctly, can constitute a complete defence to an unfair dismissal claim. It also extends the minimum employment period before an employee can bring an unfair dismissal claim from six months to 12 months.

This is a meaningful protection in a specific and limited context -- the procedural requirements for dismissal. It helps a small business owner demonstrate that a termination was procedurally fair.

Where the Code provides no protection at all

The Code does not protect a small business employer from:

• WHS prosecution. If a worker suffers psychological injury from a psychosocial hazard -- burnout from unmanaged workload, trauma from unaddressed aggression, harm from workplace bullying -- the employer faces potential criminal charges under the WHS Act. The Small Business Fair Dismissal Code is entirely irrelevant to WHS liability.

• General protections (adverse action) claims. If an employee exercises a workplace right -- raising a safety concern, making a complaint, asking about their entitlements -- and an employer takes action against them, this is adverse action under the Fair Work Act. There is no small business exemption. The compensation is uncapped. Critically, the onus of proof is reversed: the employer must prove the action was not taken for a prohibited reason. The Code does not help here.

• Workers' compensation claims. Psychological injury claims in Australia have a median direct compensation cost of $67,400 (Safe Work Australia 2023-24). The total cost to an employer -- including lost productivity, replacement, and management time -- typically runs to $150,000-$250,000 per claim. Workers' compensation liability does not scale with employer size.

• Common law damages. The High Court's 2024 decision in Elisha v Vision Australia confirmed that psychiatric injury damages are recoverable for breach of employment contract where a flawed disciplinary process was the cause. The primary judge had awarded $1,442,404.50. No small business exemption exists.

The Small Business Fair Dismissal Code helps you avoid an unfair dismissal claim. It provides no protection whatsoever against WHS prosecution, adverse action claims, workers' compensation liability, or psychiatric injury damages.

The critical practical point is this: in a small workplace with no HR infrastructure, the psychosocial hazards that most commonly drive legal liability -- bullying by a manager, unmanaged workload, workplace conflict -- are also the ones least likely to be reported, documented, or responded to before they become claims. The absence of a system is itself the risk.

What Psychosocial Hazards Actually Look Like in an SME

The legislative language -- 'psychosocial hazards', 'hierarchy of controls', 'risk assessment' -- can feel like the vocabulary of a large enterprise compliance program. It is not. The underlying hazards are everyday features of small workplace life.

Safe Work Australia identifies 17 psychosocial hazards. In an SME context, the most commonly present include:

Psychosocial Hazards Most Common in Australian SMEs

• High job demands -- workloads that regularly exceed the hours or capacity of available staff; no buffer when someone is absent

• Low job control -- workers with little say over how, when, or in what order they do their work; decisions made unilaterally by the owner

• Poor support -- no peer support, no structured supervision, no access to occupational health resources; workers solve problems alone

• Role overload -- employees wearing multiple hats across roles they were not hired for, with no corresponding reduction in original duties

• Poor organisational change management -- decisions made and communicated without warning, without consultation, with no adjustment period

• Workplace violence and aggression -- particularly acute in customer-facing roles in retail, hospitality, healthcare, and education

• Bullying and harassment -- including owner/founder behaviour that, in a flat structure with no HR function, has no internal check

• Remote or isolated work -- lone workers, after-hours workers, home-based workers

• Job insecurity -- particularly in project-based, casual, and seasonal SME workforces

• Traumatic events and content -- especially in healthcare, aged care, childcare, construction, and emergency services-adjacent roles

In a large organisation, some of these hazards are partially managed by structural features: multiple layers of management, peer relationships across teams, formal escalation pathways, and HR functions that provide a check on individual manager behaviour. In a small workplace, none of those structural moderators exist.

This is what makes psychosocial risk in SMEs structurally different from psychosocial risk in large organisations. The hazards are the same. The absence of informal controls is greater. And the consequences of a claim are proportionally more severe -- because an SME cannot absorb a $200,000 workers' compensation matter the way a multinational can.

'Reasonably Practicable' at SME Scale: What the Law Actually Expects

The central standard in WHS law is not 'do everything a large employer does'. It is 'do what is reasonably practicable'. That standard takes into account the likelihood of harm, the severity of potential harm, what is known about the hazard, and the availability and cost of ways to address it.

For a small business, reasonably practicable controls will look proportionally different in complexity and cost. They will not, however, look like nothing.

The Department of Defence conviction of December 2025 -- the first conviction of a Commonwealth employer for failing to manage psychosocial risks -- is instructive precisely because it identified a minimum standard that had not been met. That standard was not extensive or expensive. The court found that Defence had failed to:

• Train supervisors to understand that performance management processes could be a psychosocial hazard

• Train supervisors to identify psychosocial risk signals in workers going through those processes

• Establish escalation pathways to occupational health or medical assessment

• Establish criteria for suspending a process when a worker's wellbeing required it

• Monitor and document worker wellbeing throughout the process, not just performance outcomes

The Defence conviction establishes that the minimum standard is not about policy documents -- it is about operational capability: supervisors who can see risk when it is in front of them, and a system that acts on what they see.

For a small business owner who is also the direct manager of every employee, the translation of that standard is direct. You need to be able to identify when someone you work with is not coping. You need to have -- or know how to access -- a pathway for referring them to support. And you need a mechanism through which they can raise concerns about their psychological safety that does not require them to raise it with you directly, particularly if you are the source of the problem.

That last element is the acute structural gap in small workplaces: in a large organisation, a worker who is experiencing harm from their direct manager can raise a concern with HR, an EAP, a Health and Safety Representative, or a more senior manager. In a business with five employees, the owner is often simultaneously the manager, the HR function, the senior leader, and potentially the source of the hazard. There is no structural alternative reporting pathway. The worker's only options are to raise the concern directly -- which is often psychologically unsafe -- or to say nothing until the situation escalates into a claim.

The Officer Problem: When the Business Owner Is Personally Exposed

WHS law does not only impose obligations on the business. Under section 27 of the model WHS Act, 'officers' of a PCBU -- including directors and senior managers -- have a personal, non-delegable duty to exercise due diligence to ensure the business meets its WHS obligations.

In practice, for most small businesses, the officer is the business owner. The duty is not discharged by being unaware of the obligation. Due diligence requires:

• Acquiring knowledge of psychosocial hazard obligations

• Understanding the operations of the business and the hazards and risks associated with them

• Ensuring resources and processes are available to eliminate or minimise psychosocial risks

• Ensuring processes exist for receiving, considering, and responding to information about psychosocial incidents

• Verifying that those processes are being used

Personal Liability Is Not Covered by Your Business Insurance

• WHS prosecution of an officer under s.27 is a personal criminal liability. It cannot be indemnified by the company.

• Officers convicted of Category 3 offences face fines of up to $100,000 personally (in addition to any fine imposed on the business).

• The fact that you did not know your obligations is not a defence -- due diligence requires proactive acquisition of knowledge.

• In a small business where you are the only officer, you carry this duty entirely alone.

This personal dimension of the WHS duty is what makes the SME psychosocial risk problem qualitatively different from a cost-of-compliance question. It is a personal legal exposure question for the business owner.

The Minimum System a Small Business Needs

Meeting your psychosocial WHS obligations as a small business does not require the infrastructure of a large employer. It requires a system proportionate to your scale that addresses the four core elements of the legal framework.

1. Identification

You need a process -- formal or informal -- for identifying psychosocial hazards in your workplace on an ongoing basis. This is not a one-time exercise. It should be triggered by changes to work arrangements, personnel changes, incidents, and regular scheduled review. For a micro business, this might be as simple as a quarterly check-in against a documented list of common hazards. For a business of 50 or more, a structured survey or risk assessment process is expected.

2. Assessment and Control

Once identified, hazards need to be assessed for likelihood and severity of harm and responded to with control measures that follow the hierarchy -- starting with work design and structural changes, not simply communication, training, or reminders. This is the element that most SMEs miss: the hierarchy of controls in WHS law means you cannot simply tell workers to manage their own stress. You need to address the structural causes.

3. Consultation

WHS law requires consultation with workers throughout the risk management process. For a small business, this can be done through regular team discussions, one-on-one check-ins, or simple surveys. What it cannot be is non-existent. The absence of documented consultation is one of the first things a regulator will look for.

4. Reporting Infrastructure

This is the element that small businesses are most structurally deficient in, and it is the one that most directly drives claims. Workers need a mechanism to raise psychosocial safety concerns that is accessible, genuinely confidential, and does not require them to raise the concern directly with the person who may be causing the harm. In a five-person office where the owner is present every day, the practical barrier to disclosure is high. A worker experiencing harm from their manager's behaviour -- unreasonable demands, bullying, unfair treatment -- has no safe pathway in a business that has not created one.

The absence of a reporting pathway is not neutral. It is a control failure. A worker with no safe mechanism to raise a concern is a worker who will either leave, escalate to a regulator, or make a workers' compensation claim.

Where Salus Fits in an SME Context

Salus was built for organisations that need to meet their psychosocial obligations without the infrastructure of a large enterprise. The reporting channel is confidential, accessible 24 hours a day, and works without requiring a worker to identify themselves, physically attend an HR office, or navigate a manager hierarchy that may itself be the source of concern.

For a small business, the immediate value is straightforward: Salus provides the reporting infrastructure that your organisational structure cannot generate on its own. A worker in a five-person business who is experiencing harm from the owner's behaviour has, for the first time, a pathway that does not require them to raise the concern directly with the owner.

The second value is data. Salus aggregates concern data -- anonymously and confidentially -- to generate lead indicators of systemic psychosocial risk. For a business owner who is genuinely committed to meeting their obligation but who has no formal process for knowing what is happening in their workplace, this is the visibility that makes proactive management possible.

For a business of any size, the fundamental shift Salus enables is from reactive to proactive: from responding to claims after they crystallise, to identifying and addressing risks before they do.

The Bottom Line for Small Business Owners

The psychosocial duty under Australian WHS law applies to you now, in full, regardless of the size of your business or the absence of dedicated HR or WHS personnel. The regulatory landscape has shifted decisively -- across every jurisdiction -- toward proactive, documented, enforceable management of psychological health at work.

The QUT research tells us that most SME owners do not yet understand this. That gap closes two ways: through education, or through a regulator investigation triggered by a worker's claim. The first is cheaper, less traumatic, and within your control.

What regulators are looking for is not a polished policy manual or an expensive EAP subscription. They are looking for a system: evidence that you identified the psychosocial hazards in your workplace, assessed the risks, put controls in place, consulted your workers, and gave them a way to tell you when something was wrong.

The Defence case and the broader pattern of prosecution and enforcement across Australian jurisdictions in 2024 and 2025 establish one clear principle that applies equally to a 500-person corporation and a 10-person small business:

A policy on paper is not a control. A system that works in practice -- that identifies risk, enables disclosure, and generates the information that allows action -- is the standard the law expects.

The obligation is already yours. The question is whether you have the infrastructure to meet it.

Key Sources

Langdon, Karanikas & Hon (QUT, 2025): Psychosocial Hazard Management in Small to Medium-Sized Enterprises in Australia | Safe Work Australia: Key Work Health and Safety Statistics 2023-24 | Model Work Health and Safety Act 2011 (Cth) | Work Health and Safety Regulation 2025 (NSW) | Occupational Health and Safety (Psychological Health) Regulations 2025 (Vic, effective 1 December 2025) | Department of Defence conviction, NSW Local Court, December 2025 | Elisha v Vision Australia [2024] HCA 50 | Safe Work Australia: Model Code of Practice -- Managing Psychosocial Hazards at Work | Fair Work Act 2009 (Cth) ss.341, 361, 789FA | WorkSafe QLD: Updated Guidance for Small Business, August 2025

This article provides general information only and does not constitute legal advice. Specific legal obligations vary by jurisdiction, workforce type, and circumstances. Employers should seek appropriate professional advice in relation to their specific obligations.