Psychosocial hazards and New Zealand law: what is actually required

Where the duty comes from

It rests on one line. Section 16 of the Health and Safety at Work Act 2015 defines health as follows, and this is the definition in full:

Because of that definition, every duty in the Act that refers to "health and safety" reads as physical and mental health, and safety. There is no separate mental health duty because none is needed.

Section 36, the primary duty of care, then requires a PCBU to ensure, so far as is reasonably practicable, the health and safety of workers. Two of its sub-clauses do most of the work here. Section 36(3)(c) requires the provision and maintenance of safe systems of work, which is the hook for how work is designed. Section 36(3)(g) requires that the health of workers and workplace conditions are monitored to prevent injury or illness.

Section 30 adds the risk management principle: eliminate risks so far as is reasonably practicable, and if that is not reasonably practicable, minimise them.

One more, often overlooked. The Act's definition of "hazard" expressly includes a person's behaviour where that behaviour has the potential to cause death, injury or illness. Bullying, harassment and violence are not an awkward fit with health and safety law. They are inside the definition.

What is a psychosocial hazard?

WorkSafe published Managing psychosocial risks at work: Good Practice Guidelines for all businesses in April 2025. Its definition:

WorkSafe organises them into three categories rather than a flat list, and says explicitly that the categories are not strict or separate and that its examples are not complete lists.

How work is designed

Long working hours. Heavy or unmanageable workloads, especially with constant time pressure. Low job control, where people have little say over how or when work is done. Lack of role clarity. Boring or repetitive tasks. Not having the skills needed, or having skills go unused. Shift work without enough time to rest. Over-reliance on technology, and digital surveillance used to constantly monitor.

Social factors at work

Poor leadership. Lack of trust in management. Poorly managed organisational change. Poor relationships with colleagues, managers or customers. Lack of support. Bullying or harassment. Discrimination, unfair treatment, feeling undervalued. No opportunity to learn or progress. Job insecurity, short-term contracts, low pay. Struggling to balance work and home.

The work environment

Poor physical conditions, lack of space, poor lighting, excessive noise. Lack of proper tools, equipment or training. Working remotely or in isolation. Exposure to traumatic events. High pressure to meet deadlines, targets or budgets. Extreme or unstable conditions.

Note what is not on that list. Fatigue and burnout appear in WorkSafe's guidance as outcomes of exposure, not as hazard categories. That distinction matters when you are writing a risk register.

The technical point most commentary gets wrong

It is tempting to point at regulations 5 to 8 of the General Risk and Workplace Management Regulations 2016, the identify, control, maintain and review cycle, and say that is the legal requirement to do a psychosocial risk assessment. It is not.

Regulation 4 limits them. Regulations 5 to 8 apply "when managing particular risks to health and safety, as specified in regulations". They only operate where another regulation switches them on for a named risk. No regulation switches them on for psychosocial risk.

Searching the full text of those regulations, the words psychosocial, mental, fatigue, bullying and harassment appear zero times.

So the identify, assess, control and review cycle for psychosocial risk is a section 30 and section 36 obligation supported by WorkSafe good practice guidance. It is not a regulation 5 to 8 obligation. That is a distinction worth getting right, because a lot of published material in this area has it wrong.

The part that is genuinely a "must"

WorkSafe uses a must and should convention in the guidelines, and it is a useful discipline. Risk assessment is framed as "you should". Two things are framed as "must".

You must eliminate or minimise the risk. Once you know about a psychosocial risk, section 30 and section 36 require you to eliminate it so far as is reasonably practicable, and minimise it if elimination is not reasonably practicable. WorkSafe adds that cost should only be a reason not to act if it is grossly disproportionate to the risk, and that weighing cost should be the final consideration.

You must engage with workers. This one has teeth. Section 58 requires a PCBU to engage with workers who are or are likely to be directly affected by a health or safety matter. Failing to do so is an offence carrying a fine of up to $20,000 for an individual and $100,000 for any other person.

Section 60 sets out when engagement is required, and the first item maps directly onto this topic: when identifying hazards and assessing risks. It also applies when making decisions about ways to eliminate or minimise those risks, when proposing changes that may affect worker health or safety, and when making decisions about monitoring worker health.

Section 59 sets the quality bar. Information shared in a timely manner. A reasonable opportunity for workers to express views and raise issues. A reasonable opportunity to contribute to the decision. Views actually taken into account. Workers advised of the outcome.

In other words, a psychosocial risk assessment done to your workers rather than with them is not just poor practice. It misses a statutory duty that carries its own penalty.

When WorkSafe will actually get involved

Worth quoting, because this area attracts a lot of fear-based marketing:

That is WorkSafe's stated regulatory approach. Anyone telling you WorkSafe is about to prosecute you over a single grievance is selling something.

The ACC gap, and why prevention carries the weight

There is a genuine reason psychosocial harm sits differently from a broken wrist. Under section 21B of the Accident Compensation Act 2001, cover for work-related mental injury requires the injury to be caused by a single event that the person experiences, sees or hears directly, and that could reasonably be expected to cause mental injury to people generally.

Gradual process harm, chronic stress, sustained bullying, burnout, generally falls outside that. There is no compensation backstop the way there is for a physical injury. Which means the prevention duty under the Health and Safety at Work Act is doing more work here, not less.

How big is this in New Zealand?

WorkSafe's published figures, drawn from its Workforce Segmentation and Insight surveys in 2020 and 2021 and the New Zealand Psychosocial Survey 2021. These are five to six year old numbers and should be quoted as such.

• 60% of workers reported work-related stress in the previous 12 months
• 31% reported work-related anxiety, 20% work-related depression
• 35% of workers were exposed to at least one offensive behaviour: 23% bullying, 16% cyberbullying, 14% threats of violence, 11% sexual harassment, 11% physical violence
• 43% of employers had no policy for managing bullying and harassment
• 47% had no policy guiding their response to violent incidents
• but 87% of employers said they felt a strong sense of responsibility for staff mental health

That last pair is the story. Concern is close to universal. Systems are not.

WorkSafe's 2024 review of work-related suicide examined 1,678 coronial findings from 2017 to 2021 and identified 197 that met its criteria for an actual work-related suicide, with job demands, work hours, workload, job security, bullying and interpersonal relationships among the recurring stressors.

What changes on 1 April 2027

The Health and Safety at Work Amendment Act 2026 received Royal assent on 9 July 2026 and comes into force on 1 April 2027. It is not a psychosocial reform. The word psychosocial appears nowhere in it. But three changes matter here.

The definition of health is unchanged. "Health means physical and mental health" survives intact. Everything above still stands.

Mental health gets its first express mention in the risk provisions. New section 22A(3) provides that risk, in relation to a hazard, includes harm to mental health that is associated with the hazard. The select committee explained that the existing definition of health was already considered sufficient, and that this makes it explicit.

The primary duty narrows for small businesses. New section 36(7) provides that section 36, except the welfare facilities clause, applies to a small PCBU only in relation to critical risks. A small PCBU is defined as one where fewer than 20 workers carry out work in any capacity.

Be careful how you read that third one. It does not mean small businesses stop having to manage psychosocial risk. Section 30 is untouched. The worker engagement duties in sections 58 to 61 are untouched. And section 22A(3) expressly pulls mental health harm into the risk assessment. What changes is that the scope of the small PCBU primary duty narrows to critical risks, and whether a particular psychosocial risk qualifies will be a fact-specific judgement.

One more watch item. The reform strengthens the safe harbour status of approved codes of practice and lets third parties propose new ones. There is currently no approved code of practice on psychosocial risk, so no safe harbour is available for it. That may change now that others can put codes forward.

What good looks like in practice

• Ask, using what you already have. WorkSafe suggests surveys, focus groups, or for smaller businesses regular conversations and observation, plus data you already hold: incident and near miss records, workload data, overtime hours, shift patterns, complaints and grievances, customer feedback, exit interviews.
• Assess likelihood and consequence. Frequency, duration and intensity of exposure on one side. Number of workers affected, impact on ability to work, support needed to recover, chance of fatality on the other.
• Fix the work, not the worker. WorkSafe is clear that most effort should go on eliminating or preventing risks. Resilience and mindfulness training are not controls for a workload problem. They sit at the bottom of the hierarchy, and offering them instead of changing work design inverts it.
• Review it as a cycle. WorkSafe: hazard identification, risk assessment, risk management and review of controls are not one-off tasks, they are ongoing and continuous.
• Officers have to do their own homework. Under section 44, officers must exercise due diligence. WorkSafe's guidance says officers cannot solely rely on others, and must learn about and keep up to date with the risks and how to manage them.

What no course can do

We should be straight about this, because the sector is not always. No training course makes a business compliant. Compliance under section 36 is the outcome of what you actually do about your own risks so far as is reasonably practicable, and training is one control among many.

What training can do is give managers and teams a shared language for hazards that are otherwise easy to talk around, make the difference between a wellbeing initiative and a risk control obvious, and get people to raise things early enough to be fixed cheaply.

Our Psychological Safety and Wellbeing course is built for New Zealand leaders and teams on exactly that basis, using realistic warehouse and logistics settings so it lands with frontline teams rather than only office ones. Where the issue is how people handle the conversation itself, Workplace Assertiveness and Communication is usually the more useful starting point, and boards and officers working through the section 44 due diligence duty tend to start with Governing Health and Safety Risk.