HSWA Amendment Act 2026: Getting Critical-Risk Ready

What you need to know and start preparing for now

Key takeaway: The Health and Safety at Work Amendment Act 2026 makes managing critical risks the main purpose of New Zealand’s health and safety law from 1 April 2027. The Act’s future after the election is uncertain, but the standard boards are already held to isn’t – the Port of Auckland conviction made clear that officers need evidence their critical controls are working, not just that systems exist. The next six months are the time to build that evidence.

In July 2026 the Health and Safety at Work Amendment Act received Royal Assent, and it takes effect on 1 April 2027. It’s the biggest change to the Health and Safety at Work Act (HSWA) since 2015, and it puts one idea at the centre of the system: the prioritisation of critical risks – the ones that could kill someone or cause serious permanent injury, illness, or long-term harm.

There’s a complication. The general election is on 7 November, and some parties have signalled they’d repeal or revisit parts of the Act. Commencement was pushed back to April 2027 – after the election. So, it’s fair to ask whether it’s worth preparing for a law that might change before it starts.

It is, because the work the Act asks for is work boards should already be able to show. This post covers what’s changing, what isn’t, and a practical checklist for the months between now and April.

Key dates for the HSWA Amendment Act 2026

• 9 February 2026 – Bill introduced to Parliament
• 9 July 2026 – Royal Assent
• 7 November 2026 – General election
• 1 April 2027 – Changes take effect

HSWA Amendment Act 2026: What changes on 1 April 2027

The Act rewrites HSWA’s purpose. Instead of treating every risk with the same weight, the law will prioritise managing critical risks, and WorkSafe’s role is being refocused the same way. The practical changes depend on the size of your business.

One part of the Act is already in force: since 10 July 2026, following certain approved codes of practice counts as meeting the duty for that risk. Two codes have that status so far – port cargo handling and forestry harvesting – and others will only get it once they’re reviewed and reapproved.

For most organisations with critical risks, the duty to manage everything stays. What changes is the expectation that you can show critical risks are getting the attention they need, and that critical controls are effective. WorkSafe has published guidance on officer duty and working with other PCBUs to manage work risks.

What doesn’t change, whatever the election brings

The bar for officers wasn’t set by this Act – it was set in court.

When former Port of Auckland CEO Tony Gibson was convicted in 2024 of failing in his due diligence as an officer, it wasn’t because Port of Auckland lacked safety systems. It was because he couldn’t show he’d verified those systems were working. The Court drew the line between “work as imagined” – what the procedures say should happen – and “work as done” – what actually happens on site. His appeal was dismissed in April 2026, so that reading stands. (We’ve written about what the Port of Auckland conviction means for boards.)

That standard applies under the law as it is today. If the Amendment Act survives, it writes critical risk into the law’s purpose. If it’s repealed or changed, the expectation that officers can show their critical controls are working doesn’t go away. Either way, the preparation is the same.

A six-month readiness checklist for the HSWA Amendment Act 2026

This is written for the H&S lead who’ll be briefing the board. By April, you should be able to answer yes to each of these.

• Critical risks are named separately. Your risk register distinguishes the handful of risks that could kill or seriously harm someone from everything else, rather than burying them in a long list scored the same way.
• Each critical risk has named critical controls and an owner. Not “follow procedures” – the specific critical controls that stand between normal work and a fatality, and the person accountable for each one.
• Critical controls are checked on a schedule, in the field. Verification happens where the work is done, by people who know what a working critical control looks like, on a set cadence. A completed form isn’t the same thing (documented isn’t the same as working).
• Board reporting shows whether critical controls are working. Your report tells the board which critical controls were verified, which failed, and what happened next – not just how many inspections were done or how many incidents were logged.
• Contractors are included. Where you share work with other businesses, you’ve agreed how critical risks will be managed and verified across that boundary. From April, small contractors may only be obliged to co-operate on critical risks, so make sure those conversations happen.
• Officers have been briefed. Directors and executives understand what’s changing, what isn’t, and the questions they should be asking about critical risk at every meeting.

If several of those are a no today, that’s normal. Six months is enough time to fix most of them, provided the work starts before the new year rather than in March.

Building capability

Readiness isn’t only about systems. Each layer of the organisation needs to understand its part in critical risk management. IMPAC has built three courses that map to those layers:

• Boards and executives: Critical Risk Programme Governance is a half-day workshop on what effective governance of critical risk looks like, how to read effectiveness reporting with confidence, and how to ask oversight questions that go beyond the numbers.
• H&S and general managers: Critical Risk Management Fundamentals is a one-day course covering how a critical risk programme works end to end – identifying risks, choosing critical controls, verifying them, and structuring the programme.
• Supervisors and field teams: Critical Control Verification is a practical one-day workshop on carrying out verifications that give an accurate picture of whether controls are actually protecting people.

If you’re planning how to brief your board on critical risk, starting with the governance session gives directors a shared language before the detail arrives.

Frequently asked questions

• What if the election changes the Act? Some parties have said they’d repeal or revisit it. But the due diligence standard set by the Port of Auckland case applies under current law, so the preparation in this post is worthwhile either way.
• Does the Act define critical risk? Yes – broadly, risks associated with hazards that could cause death, serious injury, serious illness, or long-term harm. We covered the Bill’s approach in our earlier post on the Amendment Bill.
• We have more than 20 workers. Does anything change for us? You still need to manage all your risks, but you’ll be expected to prioritise critical ones – and be able to show that you have.
• Do officers have new duties? The Act clarifies that an officer’s due diligence relates to their governance role and sets out more clearly what’s expected. The core question for officers stays the same: can you show you know your critical risks are being controlled?
• When should we start? Now. Verification schedules take time to bed in, and the first few rounds usually surface gaps that need fixing before reporting means anything to a board.

Part of our critical risk governance series.

Critter is built by IMPAC – New Zealand’s leading health and safety company, with 27 years of experience guiding organisations through complex critical risk challenges. Learn more about IMPAC.