New Zealand health & safety law is changing. What does a small business actually need to know?
A plain-English guide to the 2027 Health and Safety at Work Act changes, written for people running small New Zealand businesses.
Last reviewed: 22 September 2026 · Primary sources: NZ Legislation, WorkSafe New Zealand and MBIE.
If you run a small business, read these sections first. You can come back to the legal detail later.
Start with these three questions
The big change for a small business
From 1 April 2027, the law puts the strongest focus on the risks that could cause the most serious harm. First work out whether you are a small PCBU. Then work out which risks in your work meet the new “critical risk” test. You still need to check the other duties that continue to apply.
Am I a small PCBU?
From 1 April 2027, business size matters. A small PCBU is generally one with fewer than 20 workers, with special rules for workforces that fluctuate during the financial year.
What are my critical risks?
The new law puts much more focus on “critical risks”. In simple terms, these are risks covered by certain health and safety regulations, or risks where, if things go wrong, the likely result is very serious — such as death, a notifiable injury or illness, a notifiable incident, or a listed occupational disease.
What changes for me?
If you are a small PCBU, some of your main HSWA duties will apply only to critical risks from 1 April 2027. But that does not mean every other health and safety responsibility disappears. Other duties still apply, and critical risks must be given priority. We explain the legal detail further down and link to WorkSafe so you can check it for yourself.
Critical risk does not simply mean “high score”.
Checked against HSWA new section 22A and WorkSafe's “What is a critical risk?” guidance.
A risk matrix can still be useful. But a red box or a score of 20 is not what makes something a “critical risk” under the new law. The Act has its own test. That is important for businesses already using 5×5 risk matrices.
Look at the consequence if it occurs
WorkSafe explains that “likely to result” concerns the likely result if the risk occurs — not simply how likely the event itself is to happen.
Some regulated hazards are automatically critical
The amended Act's Schedule 1A identifies regulations associated with critical risks. Businesses need to check the actual work they perform.
Mental health can be relevant
Mental health is not left out. The new definition says that risk, in relation to a hazard, includes harm to mental health associated with that hazard.
What should a small business do before April 2027?
Check your size
Are you a small PCBU under the new rules?
Look at your work
What hazards actually arise from it?
Find critical risks
Apply the new legal definition.
Check controls
Are the important controls really working?
- Work out whether your organisation will be a small or large PCBU under the amended rules.
- Identify the hazards arising from your actual work — not a generic checklist copied from another industry.
- Identify which of those risks meet the new critical-risk definition or are captured by the specified regulations.
- Review the controls for each critical risk and ask whether they are effective and reasonably practicable.
- Make ownership visible: who is responsible for implementing and checking each important control?
- Keep evidence that important controls are actually being used and verified.
- Review contractor and overlapping-PCBU arrangements where duties are shared.
- Watch for further WorkSafe guidance before 1 April 2027 and update your approach when relevant guidance changes.
Myth or fact?
“Under 20 workers means health and safety no longer matters.”
Fact: Being under the 20-worker threshold is not a free pass. Some duties are narrowed to critical risks, but other requirements still apply and critical risks must be prioritised.
“If the chance of an accident is low, it cannot be critical.”
Fact: WorkSafe says the test looks at what is likely to result if the risk occurs. A remote event probability is not the same thing as the statutory serious-harm test.
“My 5×5 score decides whether it is critical.”
Fact: No. The Act defines critical risk. A matrix can support internal prioritisation but cannot replace the statutory test.
“Only employees count toward the 20-worker threshold.”
Fact: WorkSafe says workers can include employees, contractors, subcontractors, labour-hire workers, apprentices, trainees, work-experience students and volunteer workers carrying out work for the PCBU.
“A small PCBU never needs to manage another risk.”
Fact: Small PCBUs may choose to manage other risks, contractual arrangements can matter, and duties such as worker welfare still apply.
“Once we identify critical risks, we're finished.”
Fact: Critical risks must be managed so far as is reasonably practicable, and relevant controls should be monitored, reviewed and revised.
Quick check: am I likely to be a small PCBU?
Checked against the amended Act and WorkSafe's September 2026 small/large PCBU guidance.
Use this as a navigation aid, not a legal determination.
- Count everyone carrying out work in any capacity for the PCBU — not just permanent employees.
- If the workforce does not fluctuate because of the nature of the business: fewer than 20 workers generally means small PCBU; 20 or more means large PCBU.
- If worker numbers fluctuate because of the nature of the business, ask whether you reasonably expect fewer than 20 workers in at least nine months of the financial year.
- If the business has not operated for the whole current financial year, the Act uses the expected worker numbers for the following financial year.
- If your workforce changes across the threshold, revisit which duties apply.
Could this be a critical risk?
- Identify the hazard. Start with the work actually done.
- Check the regulations. If the hazard is one described through Schedule 1A, it is a critical risk.
- If not, consider the realistic harm. If the risk occurs, is the resulting harm likely to include death, a notifiable injury or illness, a notifiable incident, or a listed occupational disease?
- Use what you know — and ought reasonably to know. Consider industry knowledge, past incidents, worker input and credible guidance.
- Document borderline decisions. WorkSafe specifically recommends recording the reasoning and reviewing it when work or circumstances change.
Do not: decide solely from a numerical risk score.
Working with contractors or another business?
This is one of the areas where the detail changes depending on who is working together.
If two or more PCBUs have a duty about the same work, the amended Act sets different co-operation rules depending on whether they are small or large PCBUs.
For a small PCBU working alongside another PCBU, the law requires co-operation — which includes consulting, co-operating and coordinating activities — so far as is reasonably practicable in relation to critical risks. A small PCBU may also co-operate about other risks.
A contract can go further. The amended Act allows businesses to agree that a small PCBU will co-operate about risks that are not critical risks too.
In everyday terms: do not assume “I'm a small business” means you can ignore how your work affects another contractor, client or business. Check who has a duty, what risks are shared, and what your contract requires.
Checked against new section 34 of HSWA as inserted by the Health and Safety at Work Amendment Act 2026. This provision applies from 1 April 2027.
Real examples from WorkSafe
These are not examples we invented. They come from WorkSafe's September 2026 guidance and show how the new critical-risk test can work in everyday workplaces.
Deep fryer
WorkSafe's example says hot-oil splashes or a fryer fire can lead to severe burns. It classifies this as a critical risk.
Cleaning chemicals
WorkSafe says hazardous-substance regulations cover this example, so it is automatically a critical risk.
Forklifts and moving loads
WorkSafe gives a pedestrian being struck by a forklift as an example of a work activity that can create a critical risk.
Working with cattle
WorkSafe gives being trampled while handling cattle as an example of a work activity where a critical risk may arise.
Robbery or violence
Whether this is critical depends on the circumstances. WorkSafe gives a late-night store selling alcohol and tobacco as an example where physical assault may create a critical risk.
Minor cut opening stock
WorkSafe contrasts the examples above with a minor cut while opening boxes, where the likely outcome is a minor injury. In its example, that is not a critical risk.
Source: WorkSafe, “What is a critical risk?” Guidance applies from 1 April 2027. Examples still need to be considered in the circumstances of each workplace.
For owners, directors and other officers
Court discussion below refers to the existing HSWA officer duty. It is not a court ruling on the new 2027 critical-risk provisions.
The amendments clarify officer due-diligence duties around governance. An officer still needs to understand relevant health and safety matters and risks, ensure appropriate resources and processes exist, and verify that the organisation is actually using them.
Gibson v Maritime New Zealand [2026] NZHC 813
The High Court decision concerned the former Ports of Auckland chief executive and the officer due-diligence duty under the existing HSWA. It followed a worker's death when a shipping container fell during port operations. The case is useful when thinking about governance, systems and verification — but it should not be presented as a judgment under the new 2027 provisions.
Why we include it: the judgment records allegations and findings concerning reasonable steps to ensure an exclusion-zone system was clearly documented and effectively implemented, and reasonable steps to verify relevant resources and processes. Readers should use the judgment itself for the Court's reasoning rather than treating this summary as legal advice.
What else is changing?
Approved Codes of Practice
Changes strengthen the role of approved codes of practice, including safe-harbour provisions in specified circumstances, and allow industry and other groups to develop proposed ACOPs for approval.
Overlapping legislation
The amendments clarify situations where another Act manages the same health and safety risk.
Notification & regulator focus
The reforms also address notifiable injuries and illnesses and align regulator functions more closely with the critical-risk focus.
Approved Codes of Practice: a change worth watching
Approved Codes of Practice (ACOPs) are practical documents that show ways of doing particular work safely. From 1 April 2027, they become more important in some situations.
If an approved code covers the same risk and the same situation or circumstances as your work, and you act in accordance with it, the amended Act says you are taken to have complied with HSWA and the regulations in relation to that risk.
That protection is sometimes called “safe harbour”. It is not a blanket approval of everything a business does. The code has to match the risk and circumstances in question.
WorkSafe says the new safe-harbour rule will apply to ACOPs approved from 1 April 2027. It will also apply to two existing ACOPs identified by WorkSafe: forestry and harvesting operations (2025), and loading and unloading cargo at ports and on ships (2024). Other existing ACOPs can still be used as evidence of whether duties were met.
Industry, worker and employer organisations will also be able to develop proposed ACOPs and submit them to WorkSafe for consideration. WorkSafe says more guidance on that process is still to come.
Checked against amended section 226 of HSWA and WorkSafe's September 2026 guidance.
What changes for officers?
If you are a director, partner, board member, chief executive or another person who meets HSWA's definition of an officer, the 2027 amendments clarify what due diligence looks like.
WorkSafe describes the amended duty as a governance role: understand the health and safety matters and risks relevant to the business, make sure the business has appropriate resources and processes to manage them, and verify that those resources and processes are actually being used.
The amendments also separate a person's officer role from work they may personally do as a worker. That distinction matters for people who wear both hats in a small organisation.
Practical point: this is another reason we should not reduce health and safety to “we have a policy”. The officer duty is about understanding, ensuring the right systems exist, and checking that the business is actually using them.
Checked against amended section 44 of HSWA and WorkSafe's “Understanding the changes” guidance. This is general information, not a determination that a particular person is an officer.
What is not changing?
The 2027 reforms change the way some duties work, especially for small PCBUs. They do not wipe the slate clean.
Worker welfare still matters
WorkSafe says businesses still need to provide adequate worker welfare facilities, so far as is reasonably practicable. That includes things such as toilets, drinking water, hand-washing facilities and first aid.
Emergency planning still matters
Small PCBUs still need emergency plans. The changes are not a reason to stop preparing for emergencies that could affect workers or other people at work.
Worker involvement still matters
The reforms do not mean health and safety becomes a paperwork exercise for the owner alone. Existing worker engagement, participation and representation requirements need to be considered according to the Act.
Checked against WorkSafe's September 2026 small-PCBU guidance and the amended Act.
A sensible way to prepare now
You do not need to rebuild your whole health and safety system overnight. Start with what you already have and work through it carefully.
- Check your size. Work out whether the new small-PCBU definition is likely to apply to your business.
- Look at the work you actually do. Identify the hazards that come from that work.
- Find your critical risks. Use the new legal definition and the relevant regulations — not just your risk-matrix score.
- Look at the controls already in place. Ask whether they are suitable and whether they are actually being used.
- Check shared work. If contractors, clients or other businesses are involved, work out where duties overlap.
- Keep the useful parts of your current system. Do not throw away good risk assessments, procedures or records simply because the law is changing.
- Keep watching WorkSafe. More guidance is expected before the changes take effect.
The aim is not more paperwork. It is to know which serious risks matter most, what you are doing about them, and whether those controls are working.
Questions small businesses are likely to ask
Do I need to throw away my existing risk register?
No. WorkSafe recommends using existing assessments where useful. Review them against the new critical-risk definition and make your reasoning visible.
Do welfare facilities still matter?
Yes. WorkSafe says worker welfare duties continue across workplaces, including adequate toilets, drinking water, hand-washing facilities, first aid and emergency planning, so far as is reasonably practicable.
Can a psychosocial hazard ever be critical?
Potentially. The Act expressly includes associated mental-health harm in the definition, and WorkSafe also explains that psychosocial hazards can create serious flow-on risks depending on the circumstances.
What if I work alongside another business?
Overlapping duties still matter. PCBUs sharing the same duties must consult, cooperate and coordinate so far as is reasonably practicable. WorkSafe says more specific guidance for the new small-PCBU settings is still to come.
Does “small PCBU” mean fewer than 20 employees?
Not necessarily. The statutory test concerns workers carrying out work in any capacity. WorkSafe's worker examples are broader than employees alone.
Should I wait until April 2027?
No need to rebuild everything now, but businesses can identify likely critical risks, review existing controls and follow new WorkSafe guidance as it is released.
2027 small-business readiness check
Five quick questions to help you decide what is worth reviewing before 1 April 2027. This is a practical prompt, not a compliance score or legal assessment.
Read the official sources
NZQC uses primary and regulator sources rather than treating third-party summaries as the law.
Health and Safety at Work Amendment Act 2026 — NZ Legislation ↗ WorkSafe — Understanding the changes ↗ WorkSafe — Am I a small or large PCBU? ↗ WorkSafe — What is a critical risk? ↗ WorkSafe — Managing critical risks for small PCBUs ↗ Courts of New Zealand — Gibson v Maritime New Zealand [2026] NZHC 813 ↗