Australia's WHS incident notification framework has just undergone its most significant expansion in a decade. Here is what every business now needs to report, to whom, by when — and why getting it wrong is more dangerous than the incident itself.

Something happens at your workplace. It is serious enough that you're thinking about it at midnight. You gather your team. You talk about it. You deal with it. You assume it's handled.

What you did not do was notify the regulator. And in an increasing number of Australian workplaces, that decision — the decision to manage internally, to assess the incident as not quite serious enough, to wait and see — has turned out to be the most expensive decision the business ever made.

The prosecution that follows a serious WHS incident is rarely about the incident alone. It is about what happened next. It is about whether the PCBU notified the regulator immediately, as required. It is about whether the site was preserved and evidence protected. It is about whether the regulator found out about the incident from a worker, a union, a media report, or a workers' compensation claim — rather than from the PCBU. And it is about whether the failure to notify was a mistake, or a deliberate choice to keep the regulator out.

On 5 December 2025, Safe Work Australia published the Model Work Health and Safety Legislation Amendment (Incident Notification) 2025. It is the most significant expansion of WHS incident reporting obligations in Australia since the model WHS laws were introduced in 2011. As of that date, the category of incidents that must be notified is materially wider. Three entirely new categories of notifiable events have been created. And the regulatory signal is unambiguous: the era of informal incident management, of dealing with things quietly and hoping they do not escalate, is over.

This blog explains what the law now requires, what the amendments change, and what every Australian business — from a two-person trade to a multi-site enterprise — needs to have in place to meet its notification obligations.

5 Dec 2025

Date Safe Work Australia published the most significant expansion of WHS incident notification obligations since 2011 — the Model WHS Legislation Amendment (Incident Notification) 2025

72%

Proportion of WHS prosecutions in which the defendant PCBU pleads guilty — reflecting that in most cases, the breach is not genuinely contested. The question is how large the penalty will be (Safe Work Australia, 2023)

The Framework Before the Amendments: What Was Already Required

Before addressing what has changed, it is worth being precise about what was already required — because a significant number of Australian businesses have been getting the existing framework wrong.

Under the model WHS Act (adopted in all jurisdictions except Victoria, which operates under equivalent OHS legislation), a PCBU has been required since 2011 to notify its state or territory WHS regulator immediately upon becoming aware of a notifiable incident. The duty applies to PCBUs — not just employers. It covers employees, contractors, visitors, and members of the public who are harmed in connection with the conduct of the business. And it applies regardless of whether the PCBU believes the incident was preventable, whether anyone has made a complaint, or whether the business intends to manage the situation through workers' compensation.

The three categories of notifiable incident under the original framework were: death of a person; serious injury or illness of a person (requiring immediate medical treatment, hospital admission, or resulting in incapacity); and dangerous incident — a near-miss event that exposed a person to a risk of death or serious injury even if no one was actually harmed. That last category is the one most commonly missed by SMEs. A near-miss is notifiable. An incident where someone could have been killed but was not is notifiable. Notification is not triggered by outcome — it is triggered by exposure to risk.

The consequences of failing to notify were already serious. Failure to notify is a standalone criminal offence under the WHS Act — separate from any underlying safety duty breach. A PCBU convicted of failing to notify faces penalties of up to $50,000 for an individual and $250,000 for a body corporate under the existing penalty framework (indexed annually from July 2024). Those penalties sit alongside — not instead of — any penalties for the underlying safety breach that caused the incident.

The Limitation Period Problem Most Businesses Don't Know About

SafeWork NSW v Prime Marble & Granite Pty Ltd [2024] NSWDC 17 confirmed a critical point about the two-year prosecution limitation period in the WHS Act: the clock starts running not when the incident occurred, but when the regulator first becomes aware of all elements of the offence. This means a PCBU cannot assume it is safe from prosecution because an incident happened more than two years ago. If the regulator later obtains evidence — through a workers' comp claim, a subsequent inspection, a whistleblower, or a media report — the limitation period restarts. Businesses that managed incidents internally and never notified the regulator are not protected by the passage of time. They are exposed until the regulator's knowledge is complete.

What the December 2025 Amendments Change: Three New Categories

The Model Work Health and Safety Legislation Amendment (Incident Notification) 2025 replaces the concept of 'notifiable incident' with the broader concept of 'relevant occurrence'. A relevant occurrence covers notifiable incidents (now in expanded form) and introduces two entirely new reporting categories. The result is that significantly more events now trigger an immediate obligation to notify the WHS regulator.

The amendments will take legal effect in each jurisdiction only once adopted into state and territory WHS laws. That process is underway but will take time — likely one to two years from December 2025. However, regulators have been explicit that they expect businesses to be preparing their systems now, and enforcement posture is already shifting in anticipation of the expanded framework.

New Category 1: The Violent Incident

The amendments add 'violent incident' as a new type of notifiable incident. A violent incident is defined as conduct that exposes a person to a serious risk of psychological harm through one or more of the following: sexual assault or suspected sexual assault; physical assault including with bodily fluids; deliberate deprivation of a person's liberty without lawful authority; or a threat of sexual or physical assault where there is a reasonable belief that the person making the threat intends and has the means to carry it out.

This is a profound expansion. Previously, violence at work only triggered notification if it resulted in serious physical injury or illness requiring immediate treatment. Under the new framework, a serious violent incident — including a credible threat — is notifiable regardless of whether anyone was physically harmed. For businesses in healthcare, aged care, disability support, education, retail, security, or any sector where client or customer aggression is a known risk, this creates a new and significant compliance obligation. A worker assaulted by a client who does not require hospitalisation may still be the subject of a violent incident that must be immediately notified.

New Category 2: The Notifiable Extended Absence

The amendments introduce a 'notifiable extended absence' — a new category requiring notification within 14 days (not immediately) where a worker is absent for 15 or more consecutive days, or anticipates such an absence based on a medical practitioner's opinion, and the absence is reasonably attributable to a physical or psychological injury or illness arising from the conduct of the business.

This is the amendment with the widest reach for ordinary SME operations. A worker whose psychological injury — stress, burnout, anxiety, a stress fracture of a relationship with management — results in absence of 15 or more consecutive days may now trigger a reporting obligation to the WHS regulator, not just to workers' compensation. The PCBU is not required to investigate or interrogate the worker's medical circumstances. It must simply consider all available information and, if the connection to work is reasonably attributable, notify within 14 days.

The practical implication is significant: many businesses have been managing extended absences entirely through HR and workers' compensation channels without any reference to WHS notification. That approach is now legally insufficient.

New Category 3: The Notifiable Suicide

The amendments create a specific notification obligation for suicide and attempted suicide of a worker. A notifiable suicide requires notification where: the death or attempt occurs at the workplace or in its immediate vicinity; the death or attempt occurs while the worker is at work; it occurs at a time when the worker would ordinarily be working and is not on leave and there are indicators suggesting a potential link to work; or, for a non-worker, the death or attempt occurs at a workplace where suicide is a reasonably foreseeable risk due to the nature of the workplace and physical hazards that could be used.

Critically, the 'arising from the conduct of a business or undertaking' test does not apply to notifiable suicides. Notification is triggered by the circumstances — not by a causal determination. A business is not required to have concluded that work caused the suicide before it must notify. The obligation to notify is separate from and precedes any investigation into causation.

The Complete 'Relevant Occurrence' Reference Table

Event Type: Death of a person

Timeframe: Immediately

Who Is Covered: Workers, contractors, visitors, members of the public

Key Threshold: Arises out of conduct of the business or undertaking

Event Type: Serious injury or illness

Timeframe: Immediately

Who Is Covered: Workers, contractors, visitors, members of the public

Key Threshold: Requires immediate medical treatment, hospital admission, or serious incapacity

Event Type: Dangerous incident (near-miss)

Timeframe: Immediately

Who Is Covered: Any person exposed at the workplace

Key Threshold: Exposed to serious risk of death or serious injury — harm does not need to have occurred

Event Type: Violent incident (NEW)

Timeframe: Immediately

Who Is Covered: Any person at the workplace

Key Threshold: Serious risk of psychological harm from assault, bodily fluid exposure, deprivation of liberty, or credible threat

Event Type: Notifiable suicide (NEW)

Timeframe: Immediately

Who Is Covered: Workers and, in high-risk workplaces, non-workers

Key Threshold: Occurs at or near workplace while working, or indicators of work link; no causal test required before notifying

Event Type: Notifiable extended absence (NEW)

Timeframe: Within 14 days

Who Is Covered: Workers only

Key Threshold: Absent 15+ consecutive days, reasonably attributable to physical or psychological injury/illness arising from the business

'Immediately' Means Now — Not When You've Worked Out What Happened

The most common misunderstanding about WHS notification in practice is that 'immediately' means 'promptly, once the dust has settled'. It does not.

Immediately means as soon as you become aware. Not after you have consulted your lawyer. Not after you have called your insurer. Not after you have conducted an internal review to decide whether the incident is notifiable. Not after the weekend. The duty to notify is triggered by awareness — and once triggered, it must be acted on without delay.

In practice, this means the process of notifying the regulator should be running in parallel with emergency response, not sequentially after it. The questions 'is this person safe?' and 'should we notify the regulator?' are asked at the same time. If there is any genuine uncertainty about whether an incident is notifiable, the consistent advice from WHS practitioners and regulators is to notify and then provide supplementary information — not to delay notification while the assessment is being made. A call to the regulator that turns out to be unnecessary carries no penalty. A failure to call that turns out to have been required carries criminal liability.

Notification is made by telephone to the relevant state or territory WHS regulator. The contact details are publicly available on each regulator's website. Written notification is required if the regulator requests it, or within the timeframe specified by the regulator (commonly 48 hours after the initial call).

If there is any genuine uncertainty about whether an incident is notifiable, notify first and clarify later. A call that turns out to be unnecessary carries no consequence. A failure to call that turns out to have been required carries criminal liability.

Site Preservation: The Amendment That Changes Everything About Evidence

The December 2025 amendments made a change to the site preservation obligation that many businesses have not yet absorbed. Previously, the obligation was to preserve the site of a notifiable incident — meaning the physical location — until an inspector arrived or the regulator gave permission to disturb it.

The amended obligation is materially broader. PCBUs are now required to preserve evidence of the occurrence, including electronic and digital records and witness details, so far as is reasonably practicable. This is not confined to the physical site. It extends to:

Evidence Preservation — What Is Now Explicitly Required

• CCTV footage and digital recordings — must be preserved immediately; overwriting or deletion of relevant footage following a notifiable occurrence is a serious compliance failure

• Electronic communications — relevant emails, messages, scheduling records, complaints, and prior incident reports that may bear on the circumstances of the occurrence

• Witness details — names and contact details of all persons who witnessed the occurrence or have relevant information must be recorded and preserved before they leave the site

• Physical evidence — the site itself, including plant, equipment, and materials involved or present at the time of the occurrence

• Documents and records — training records, risk assessments, prior incident reports, maintenance logs, or other documents relevant to understanding what happened and what controls were or were not in place

The practical significance is that a business cannot undertake normal operations that have the effect of destroying evidence, even inadvertently, without establishing that this was reasonably necessary and that the evidence was already preserved. Where electronic records are concerned — including CCTV systems that automatically overwrite — the obligation to preserve means acting immediately to secure the footage. A 24-hour automatic overwrite cycle is not a defence.

The new amendment also introduces a mutual notification obligation: where one party has a duty to notify the regulator, they must also immediately notify any other party with a corresponding duty to preserve evidence. Where multiple PCBUs are present — as is common in construction, events, or shared facility settings — each must be notified, each must act, and each carries their own obligation.

What Regulators Are Already Doing — and What the Data Shows

The December 2025 amendments formalise a regulatory posture that has been hardening for several years. Regulators have been explicit: they are moving from an educative to an enforcement approach, and incident notification failures are a specific enforcement priority.

SafeWork NSW has planned a 25 percent annual increase in inspector compliance visits through to 2026, with psychosocial checks built into every visit to larger employers. Safe Work Australia's WHS prosecutions data (updated to 2023) records 293 prosecutions nationally in that year alone, with construction at the top but prosecutions spread across industries. In 72 percent of cases, the defendant PCBU pleaded guilty — indicating that in the vast majority of WHS prosecutions, the breach is not genuinely disputed. The question before the court is how serious the breach was and how large the penalty should be.

The category of penalty depends on the seriousness of the breach. Category 3 offences — failures to comply with a duty that expose persons to risk but do not involve recklessness — carry maximum penalties of $50,000 for individuals and $250,000 for bodies corporate (pre-indexation). Category 2 offences carry $150,000 and $1.5 million respectively. Category 1 — reckless conduct exposing workers to risk of death or serious injury — carries maximum penalties of $300,000 or imprisonment for individuals, and $3 million for corporations (pre-indexation; from July 2024, penalties are indexed annually and the Category 1 maximum for a body corporate now exceeds $17 million under the Commonwealth framework). Industrial manslaughter carries up to $18 million and 25 years imprisonment.

Failure to notify is typically prosecuted as a Category 3 offence. But where a failure to notify is part of a broader pattern of non-compliance — where the business knew, or ought to have known, that the incident was notifiable and chose not to report — regulators have the capacity to characterise the conduct as more serious. And where the notification failure allowed a dangerous condition to persist that then caused further harm, the underlying safety breach that enabled that harm becomes a separate prosecution matter.

293

WHS prosecutions recorded nationally in 2023 alone — across all industries, all business sizes (Safe Work Australia, 2023)

$17M+

Maximum Category 1 penalty for a body corporate under the Commonwealth WHS framework from July 2025 — indexed annually

5 years

Minimum record retention for notifiable incident documentation under the model WHS framework — including notification details, investigation records, and corrective actions

The Six Most Common Notification Failures — and Why They Happen

Based on enforcement patterns, legal commentary, and the structural gaps that WHS inspectors consistently identify in SME operations, six failure modes account for the majority of notification compliance failures in Australian businesses.

1. 'It didn't seem serious enough'

The most common single failure: the business assessed the incident internally, concluded it was below the notification threshold, and did not call the regulator. This assessment is frequently wrong — particularly for dangerous incidents (near-misses) and psychological harm events, where the seriousness of the risk exposure rather than the actual injury determines notifiability. If there is any uncertainty, the correct answer is to notify.

2. 'We were dealing with the person first'

Emergency response and regulatory notification are sequential in many organisations' thinking but must run in parallel in practice. Once the immediate welfare of the person has been secured, notification should have begun. Waiting until the person is stable, or out of hospital, or has been interviewed by management, delays a duty that is triggered by awareness.

3. 'We were waiting for HR / the insurer / the lawyer'

The duty to notify belongs to the PCBU — not to external advisers. Consulting those parties is appropriate, but notification cannot wait for their sign-off. Legal advice does not suspend the notification obligation. Insurance advice does not suspend it. HR process does not suspend it. Many prosecutions for late notification involve businesses that notified only after weeks of internal process — weeks that the regulator views as a deliberate attempt to control information.

4. 'We thought workers' comp covered it'

Workers' compensation and WHS notification are parallel, unrelated systems. Lodging a workers' comp claim does not notify the WHS regulator. The regulator does not receive copies of workers' comp claims. A business that routes everything through workers' comp and assumes notification is covered has not met its WHS obligation.

5. 'We didn't know it was notifiable'

Ignorance of the obligation is not a defence. The duty to know what is notifiable rests with the PCBU and its officers. With the December 2025 amendments materially expanding what must be reported, businesses that have not reviewed their incident notification protocols against the new framework are operating with an outdated system — and a corresponding legal exposure.

6. 'The incident happened off-site' or 'it was the contractor's responsibility'

The duty to notify extends to incidents arising out of the conduct of the business, regardless of where they occur. A worker injured while travelling between worksites, a remote worker who suffers a serious psychological injury, a contractor harmed while working on a PCBU's project — each may generate a notification obligation. Multiple PCBUs may simultaneously carry notification obligations for the same event. The contractor's notification does not discharge the principal contractor's obligation.

The New Notification Obligations That Will Catch the Most Businesses Unprepared

• Violent incidents not resulting in physical injury: a worker who is sexually assaulted by a client but does not require hospitalisation, a threatening incident that does not result in contact — now immediately notifiable under the violent incident provisions

• Extended absences for psychological injury: a worker absent for 15+ consecutive days due to work-related stress, burnout, or anxiety — notifiable within 14 days under the extended absence provisions

• Work-linked suicides and attempts: a worker suicide or attempt that occurs at or near the workplace, while the worker is working, or with indicators linking it to work — immediately notifiable regardless of whether the PCBU has formed a view on causation

• Incidents involving non-workers: visitors, customers, and members of the public harmed in connection with the business's conduct — always covered by existing notification obligations but frequently overlooked by businesses that think only about employees

Record Keeping: What Must Be Retained and For How Long

The duty to notify is only the first of the obligations that attach to a notifiable occurrence. Once notification has been made, a separate obligation to retain records comes into effect. Under the model WHS framework, records of notifiable incidents must be kept for a minimum of five years from the date of the notification. Those records are the evidence base for any subsequent investigation — and the absence of complete records is itself an indicator of non-compliance.

Minimum Records That Must Be Retained for 5 Years

• The notification itself: date, time, method (telephone), who made the call, what information was provided, and any confirmation or case reference number from the regulator

• The internal incident report: time-stamped record of when the incident was discovered, what happened, who was involved, what the immediate response was, and when management became aware

• Site preservation record: what evidence was preserved, how, by whom, and when — including CCTV footage secured, witness details recorded, physical evidence documented

• Investigation record: methodology, findings, root cause analysis, and conclusions — even where the business conducted an internal investigation before the regulator's involvement

• Corrective action log: what systemic or operational changes were made in response to the incident, by whom, by what date, and with what verification that the change was implemented

• Consultation records: documentation of consultation with workers and health and safety representatives about the incident findings and proposed changes

• Regulator communications: any subsequent correspondence, requests for information, inspection visits, or regulatory outcomes

Businesses that are audited or investigated following a notifiable occurrence will be asked to produce these records. Where records are incomplete, reconstructed after the fact, or simply absent, the regulatory inference is that the compliance system was not functioning. In prosecution, incomplete records are both evidence of the breach and an aggravating factor in penalty.

The December 2025 amendments also clarify that the site preservation obligation — now extending to digital and electronic records — begins immediately upon awareness of the relevant occurrence. This means the five-year record retention obligation and the immediate preservation obligation run from the same triggering event.

What a Functional Notification System Looks Like

For most Australian SMEs, the gap between what WHS notification law requires and what exists in practice is significant. The good news is that a functional notification system is not complicated. It requires four things.

First, a clear internal decision rule for what is notifiable: not a lengthy policy document, but a laminated single-page reference that every manager and site supervisor has access to, that sets out the categories of events that require immediate notification and the contact details for the relevant regulator. With the December 2025 amendments, this document needs to be updated to include violent incidents, notifiable extended absences, and notifiable suicides.

Second, a designated notification responsibility — a specific person, and a named backup, whose job it is to make the notification call. The duty must not be diffuse. If everyone is responsible, no one acts. The person responsible must have the authority to notify without waiting for sign-off from above, and must know that legal and HR consultation runs in parallel, not as a pre-condition.

Third, a parallel evidence preservation protocol — a checklist that activates immediately alongside emergency response, ensuring CCTV is secured, witnesses are recorded, and physical evidence is preserved before operations resume. The protocol should be specific enough to be acted on under pressure, by a person who has never had to use it before.

Fourth, a documented trail — a mechanism for recording what happened, when, who was notified, what evidence was preserved, and what happened next. This does not need to be sophisticated. It needs to be contemporaneous, complete, and retained.

A worker's compensation claim submitted to the insurer does not notify the WHS regulator. A workers' comp system and a WHS notification system are parallel obligations — neither discharges the other.

Where Salus Fits

The notification framework described in this blog depends on information reaching the right person at the right time. For the vast majority of notifiable occurrences, that means a worker, a manager, or a bystander needs to raise a concern — needs to report what happened — before the clock on the notification obligation even starts running.

The structural gap in most SMEs is not that they don't know they need to notify. It is that incidents are not surfaced in the first place. A worker who experienced a violent incident but did not feel safe reporting it to management. A pattern of near-misses that were discussed informally on the floor but never made it into writing. An extended absence that everyone understood was work-related but that HR handled as a personal matter without reference to WHS. Each of these is a notification failure waiting to become a prosecution.

Salus provides the confidential, accessible reporting channel that surfaces these events before they become buried. When a worker submits a concern — about a violent incident, about a near-miss, about their own psychological distress or that of a colleague — the concern is documented, timestamped, and visible to the people who need to act on it. The record that Salus generates is the contemporaneous evidence trail that WHS investigation requires and that informal management systems never produce.

For businesses implementing the December 2025 notification framework: the first question is whether your workers can easily report the events that will now trigger your notification obligation. If the answer is 'only to their manager, in person, during business hours', the notification system has a structural gap at its foundation.

The Bottom Line for Every Australian Business

The December 2025 amendments are not a technical refinement to an existing framework. They are a material expansion of what Australian businesses are required to report to WHS regulators — one that brings violent incidents, extended psychological absences, and work-linked suicides into the scope of mandatory immediate notification.

For any business that has been managing these events through HR, workers' compensation, or informal process alone: that approach is now, at best, legally incomplete, and at worst, directly contrary to a criminal notification obligation.

The enforcement environment is already tightening. The regulatory signal — in inspector visit volumes, in prosecution data, in the explicit language of the December 2025 amendments — is that the era of self-regulated internal incident management is ending. The regulator expects visibility. The law requires it. And the consequences of silence are now, formally and finally, more dangerous than the incident itself.

The 6-Point Notification Compliance Checklist for Every Australian Business

• Updated incident decision-rule document: every manager holds a current reference listing all categories of 'relevant occurrence' — including the three new categories from the December 2025 amendments — with regulator contact details for their state or territory

• Designated notification responsibility: a named person (and named backup) with authority to call the regulator without delay and without waiting for legal, HR, or insurance sign-off

• Parallel evidence preservation protocol: an immediate-action checklist for securing CCTV, recording witnesses, and protecting physical and digital evidence that activates at the same time as emergency response

• Confidential worker reporting mechanism: a channel through which workers can report incidents — including violent incidents and psychological harm — without being required to approach their manager directly or wait for business hours

• Incident register with five-year retention: a documented record of every notifiable occurrence, notification details, evidence preservation steps, investigation findings, corrective actions, and regulator communications

• Annual protocol review: the notification decision-rule and protocol is reviewed against current legislative requirements at least annually — including when state or territory laws adopt the December 2025 model amendments

Next in this series: Blog 30 examines what WHS inspectors actually look for when they audit an organisation's incident management system — the seven documentation gaps that most commonly trigger enforcement action, and what 'proving compliance' requires in practice.

Key Sources

Safe Work Australia: Model Work Health and Safety Legislation Amendment (Incident Notification) 2025 (5 December 2025) | Safe Work Australia: Notifiable Incidents, Extended Absences and Suicides Handbook (2025) | Herbert Smith Freehills Kramer: Australia — Major Reforms to the Model WHS Framework and Incident Notification Duties (December 2025) | Norton Rose Fulbright: Safe Work Australia Amendments to Model WHS Act — Incident Notification (December 2025) | Global Workplace Insider: Safe Work Australia Amendments to Model WHS Act — Incident Notification (December 2025) | Mondaq: Major Reforms to the Model WHS Framework and Incident Notification Duties (December 2025) | Safe Work Australia: Updated WHS Prosecutions Data — 2023 (2024) | SafeWork NSW v Prime Marble & Granite Pty Ltd [2024] NSWDC 17 (limitation period) | McCullough Robertson: Limitation Periods Under the WHS Act — When Does the Clock Start Ticking? (February 2024) | Sprintlaw: Notifiable Incidents Explained — Essential Guide for Australian Employers (2025) | Sentrient: Compliance Reporting in Australia (December 2025) | Model WHS Act 2011 ss.35-39 (incident notification and site preservation) | Safe Work Australia: WHS Prosecutions Dashboard 2023

This article provides general information only and does not constitute legal advice. WHS notification obligations vary by jurisdiction and are subject to change as the December 2025 model amendments are adopted into state and territory legislation. Businesses should seek independent legal advice in relation to their specific circumstances and monitor their jurisdiction's adoption of the amended model provisions.