NSW added section 26A to the Work Health and Safety Act 2011. It came out of the Industrial Relations and Other Legislation Amendment (Workplace Protections) Act 2025, assented in July 2025, and it commenced on 1 July 2026.
The section does one thing. It says a PCBU must comply with an applicable approved Code of Practice, or manage the hazards and risks in a different way that provides a standard of health and safety equivalent to or higher than the Code.
That's it. One sentence, and it reclassifies thirty documents from guidance into duty. NSW is the first jurisdiction to go this far — everywhere else, Codes remain evidentiary. If you work across borders, your NSW sites now run to a different rule.
Nothing was rewritten in the Managing the Risk of Falls at Workplaces Code of Practice. Same document, same clauses. What changed is that it is now the minimum performance standard for anyone managing fall risk in NSW.
Read it again with that in mind and the tone shifts. The Code says you should eliminate the need to work at height where you can — design the plant so servicing happens at ground level, install the unit where it can be reached from a permanent walkway. It says where you can't eliminate, you should use a fall prevention device: guardrail, a working platform, edge protection. Only then work positioning, then fall arrest, then administrative controls like a spotter or a no-go zone.
That order used to be best practice you could argue around. Now it's the baseline, and jumping down the list is a departure you carry.
The same applies to the parts people skim. Ladder use and its limits. Roof work on brittle or fragile material. Anchor point inspection and maintenance intervals. Competency and training. Emergency procedures. Each of those 'shoulds' is now a line you either meet or justify.
Codes of Practice were written to fill the gaps legislation leaves behind. The Act sets the duty, the Regulation sets some specifics, and the Code is meant to bridge the distance between the two in language a workplace can use.
The problem is that bridging job forces them to be broad. A Code has to cover a two-storey reroof, a high-rise facade, a shed in a paddock and a plant room on a hospital. So it's written in general terms, it leans on words like 'suitable', 'adequate' and 'so far as is reasonably practicable', and it leaves a lot open to interpretation.
That was manageable while the Code was guidance. Now that it's the standard, the interpretation is the risk. You're being measured against a document that deliberately doesn't tell you exactly what to do on your site, and the burden of showing you read it correctly sits with you.
Two people can read the same clause and land in different places. One says a static line meets it, the other says the Code clearly prefers a walkway and guardrail here. Only one of those reads holds up after an incident, and you don't get to find out which until it matters.
So don't carry that call alone. Get the interpretation checked by someone who reads these documents for a living and has seen how they're applied — a competent height safety designer, an experienced WHS advisor, or the regulator's own guidance material. Ask what the Code actually expects for your task, your building and your workers, and get the reasoning in writing.
That's not gold plating. Under section 26A, the written reasoning is the compliance. Getting help to build it properly is cheaper than defending a guess.
You're the PCBU with the most surface area. Every subcontractor working at height on your site is your exposure too, and shared duties don't divide — they overlap.
The practical work is a gap analysis. Take the falls Code, take your SWMS, your site rules, your edge protection standard, your ladder policy, your inspection registers, and compare them clause by clause. Where you match, note it. Where you don't, either fix the control or write the equivalent-or-higher case with a real risk assessment behind it.
Then push it down the chain. A subbie's SWMS that says 'harness and lanyard' where the Code says a fall prevention device is reasonably practicable is now a document that fails on its face. Reviewing those on arrival, and rejecting them properly, is part of the job now.
And keep the records. The whole point of section 26A is that the standard is knowable in advance. If you did the comparison and made a call, that paperwork is your defence. If you didn't, silence reads as non-compliance.
If people go on your roof, you have a duty. Cleaners, plant technicians, solar installers, window crews, telco contractors. You may not employ any of them, but you control the workplace they're working in.
The falls Code's preference for elimination and passive protection is exactly where most existing buildings fall short. A roof with two anchor points and nothing else is a building designed around fall arrest — the fourth rung down the hierarchy — for tasks that happen every month. Under the new rule, that's a gap you're expected to have identified.
It also lands squarely on maintenance. Anchor points and static lines have inspection and recertification requirements. An expired logbook is not a paperwork problem any more; it's a shortfall against the standard you're now required to meet.
The honest read: if your building has never had an access review, this is the year to do one. It's cheaper as a review than as a notice.
Not much changes in what you should already be doing, and quite a lot changes in what you can insist on.
The Code is a public document. If it says a working platform is what this task calls for and you've been handed a harness and an anchor, you now have a written standard to point at, not just an opinion. Consultation is still a duty. Raising it is still protected.
It also makes the training and competency requirements harder to skip. Inductions that tick a box without covering the actual system on the actual roof were always weak. Now they're measurable against a standard.
The flip side is that the controls are there to be used. A guardrail that's been moved, an anchor that's been used past its inspection date, a ladder set up on a slope — those were bad practice before and they're a breach of a duty now.
One thing worth being precise about, because it gets over-applied. A rescue plan (rope access) is required where rope access is the method of work. It is not a blanket requirement for every job where someone wears a harness.
The falls Code expects emergency procedures proportionate to the system in use. Where rope access is used, that means a rescue plan (rope access) with the equipment, the competency and the practised procedure behind it. Where the system is a walkway and guardrail, the emergency planning looks completely different and much simpler.
Getting that distinction right saves you writing documents you don't need and, more importantly, stops the one you do need from being a template nobody's rehearsed.
Fair question. Does the regulator have the resources to audit every site against thirty Codes? No. Will you get by without giving the Code due consideration? Possibly — plenty do.
But that's not the test. The test is what happens on the day it does land on you. If you're picked up in a check and you've done nothing, are you ready for what follows? If there's an incident involving your design or your install, can you stand behind what's in place and show why?
That's the whole shift. The odds of being asked haven't changed much. The cost of not having an answer has.
Here's the part nobody's saying out loud. Thirty Codes, each with dozens of 'shoulds', now form a mandatory standard — and the evidence of compliance has to be current, findable and tied to the work.
A folder of management plans won't do it. It never really did, but now the gap between the document and the practice is the gap between compliance and a separate breach. What you need is the register that's actually filled in, the inspection that's actually recorded, the induction that's actually signed by the person who did it, and the departure that's actually justified.
That's an administration problem, and it's the one we build for. Interactive process flows instead of long plans, with the evidence captured as the work happens rather than assembled the week before an audit.
Work out which Codes apply to your operations. For most of our clients that's falls, construction work, managing WHS risks, and one or two more.
Run the comparison. Your controls and documents against the Code, line by line, with the result written down.
Fix what's short. Where you're going a different way, build the equivalent-or-higher case properly — assessment, reasoning, evidence.
Then make it stick. Consultation with your people, training so they know what the standard is, and a system that keeps the evidence current instead of letting it go stale.
None of that is exotic. It's the same discipline that makes a safety system worth having in the first place. Section 26A just removed the option of not doing it.