WorkSafe New Zealand is preparing the supporting regulations for the Health and Safety at Work Amendment Act 2026, which takes effect on 1 April 2027. Central to the new framework is the concept of "critical risks" — a designated set of activities where the consequences of a failure are severe enough to warrant mandatory, prescribed control measures rather than the general risk management approach that currently applies. This guide explains what the framework means in plain language.
The Problem the Framework Is Solving
Under the current HSWA, businesses are required to eliminate or minimise risks "so far as is reasonably practicable." This principle-based approach works well for lower-risk activities but creates ambiguity for high-hazard work. Different businesses apply widely varying standards to working at height or with hazardous substances — and when accidents occur, the question of what was "reasonably practicable" is often contested in court over years.
The critical risks framework replaces that ambiguity for designated high-hazard activities with clear, prescriptive minimum standards. If the standard says you must inspect safety harnesses daily, you inspect them daily. There is no room to argue that weekly inspection was "reasonably practicable."
What Are "Critical Risks"?
WorkSafe's indicative categories of critical risk activities include:
- Working at height — Any work above 1.5 metres where a fall is possible, including on roofs, scaffolding, ladders, or elevated platforms.
- Confined space entry — Work inside tanks, tunnels, silos, pits, or other enclosed spaces where hazardous atmospheres may be present.
- Hazardous substances — Handling, storing, or disposing of substances classified as toxic, corrosive, flammable, or explosive under the Hazardous Substances and New Organisms Act.
- Mobile plant and machinery — Operation of forklifts, excavators, cranes, and other mobile plant in areas where workers or members of the public may be at risk.
- Electrical work — Live electrical work or work in proximity to exposed conductors.
- Excavation and trenching — Open excavations above a defined depth threshold.
- Proximity to traffic — Work on or adjacent to live road traffic lanes.
What Are the New Obligations?
Critical Risk Registers
Every PCBU (business) with one or more critical risk activities must maintain a written critical risk register. The register must identify each critical risk, document the controls in place, assign responsibility for each control to a specific role, and record when controls are reviewed. The register must be updated annually and after any incident involving a critical risk.
Prescribed Minimum Controls
For each category of critical risk, WorkSafe will publish a prescribed minimum control standard. These standards will specify, for example, the minimum rated capacity for fall arrest equipment, the atmospheric testing requirements before confined space entry, and the exclusion zone dimensions around mobile plant. Compliance with the prescribed standard is mandatory — not a safe harbour, but a floor.
Officer Certification
Companies with 20 or more employees must have at least one officer (director or equivalent) certify annually in writing that the company's critical risk register is accurate and that the prescribed controls are being applied. This is a significant change: it places personal accountability on directors for the operational reality of the safety management system, not just its existence on paper.
Notifiable Critical Risk Failures
A failure of any prescribed control — for example, allowing work at height to proceed without the required fall arrest equipment in place — must be notified to WorkSafe within 24 hours, even if no injury or near-miss results. This is separate from the existing obligation to notify WorkSafe of serious harm incidents. It creates an audit trail of compliance failures that WorkSafe can use in enforcement decisions and that will become relevant in litigation.
How This Affects Public Liability Insurance
The critical risks framework raises the bar for what "reasonable precautions" looks like in a negligence claim. Post-April 2027, a claimant's lawyer establishing that a business failed to comply with a prescribed minimum control standard will have a powerful tool for demonstrating negligence — because WorkSafe has literally prescribed what the minimum standard is.
This increases the importance of maintaining public liability cover that is commensurate with the actual exposure you carry from your critical risk activities. If your work involves regular working at height, confined space entry, or mobile plant operation, review your cover limit with this in mind.
Practical Steps Before April 2027
- Identify which of your activities are likely to be designated as critical risks
- Begin building your critical risk register now using WorkSafe's draft guidance
- Review your existing controls against the draft prescribed minimum standards
- Identify any gaps and budget for closing them before the commencement date
- Brief your directors or senior leadership on the officer certification obligation
- Review your public liability insurance limit in light of your critical risk profile
- Establish a process for notifying WorkSafe of control failures within 24 hours
WorkSafe's website at worksafe.govt.nz will publish draft regulations and guidance for public consultation before the April 2027 commencement. Monitoring these updates is the best way to stay ahead of the compliance curve.