Your lawyer just told you “training isn’t enough”. Here’s what they mean.

Legal counsel has put psychosocial regulation in front of the board, and now "psychosocial hazards" sits on the risk register as an item nobody is quite sure how to close out. The reflex is to reach for what already exists: the EAP contract, the resilience training delivered last year, the wellbeing champions established after the last engagement survey. Then comes the uncomfortable realisation that this stack was never built to discharge a legal duty. It was built to support people who were already struggling. The organisation is now being asked to demonstrate something different, to a different audience, against a standard that has changed.

So before this turns into a procurement exercise for more of the same, it is worth being precise about what actually changed and what a regulator is actually looking for. Because the gap between those two things is where the exposure sits.

What actually changed on 1 December 2025?

Victoria's Occupational Health and Safety (Psychological Health) Regulations 2025 came into force on 1 December 2025, and in doing so completed a framework that now runs across every Australian jurisdiction (VGSO, 2025). This was not Victoria acting alone. New South Wales overhauled its WHS Regulations in August 2025 with a modern, psychosocial-first framework, and the Australian Institute of Company Directors now maps psychosocial regulations and codes across every jurisdiction in the country (Risk Training Professionals, 2025; AICD, 2024).

Read that the way legal counsel reads it. The question is no longer whether the jurisdiction has caught up. It has. The question is whether the organisation has a defensible answer when an inspector asks how psychosocial hazards were identified, what actions were taken, and how the organisation knows those actions were effective.

Why doesn't training count any more?

This is the part that catches operators out, because for years "we ran the training" was a reasonable answer to "what are you doing about it". It no longer is. The Victorian regulations state plainly that information, instruction and training are not enough on their own. Employers are expected to first address the underlying sources of psychosocial risk and then demonstrate that effective controls are in place to reduce harm (Maddocks, 2025).

That is a specific instruction, not a matter of tone. The hierarchy of controls requires organisations to first address psychosocial hazards at their source — redesign the unreasonable workload, resolve the role conflict, reduce the exposure to aggression — before relying on lower-order controls such as information, instruction and training. Training sits near the bottom of that hierarchy. Leading with it is the regulatory equivalent of putting up a "mind the gap" sign instead of fixing the gap. It may support compliance, but only after the organisation can demonstrate that it first sought to remove or materially reduce the hazard itself.

This is the point at which a wellbeing initiative becomes a legal-risk discussion. Resilience training teaches people how to cope with a hazard. The regulator wants evidence that the hazard itself was addressed. They are related concepts, but they are not the same control.

Where does the EAP fit, then?

The EAP is necessary. It is also downstream. An EAP is reactive support that activates after someone has already been harmed enough to pick up the phone — it sits at the bottom of the cliff. Useful, humane, and important — but not an answer to the regulator's question about what was done to identify and address the underlying hazards before people reached the point of harm.

That is the gap. Between the hazard arising in the operating model and the EAP catching the casualty, there is a stretch of ground where the actual work of prevention lives — and for most organisations it is unmanaged. It gets absorbed informally by accidental counsellors: the supervisor everyone offloads to, the team lead who notices first. That is not a system. It relies on individuals rather than process, leaves no meaningful record of emerging risk, and provides little evidence of due diligence when organisational decisions and controls come under scrutiny.

There is also an operational benefit that is often overlooked: prevention and EAP services work together. Building structure between early warning signs and formal support reduces crisis presentations while increasing appropriate early referrals. The result is fewer escalations and better use of existing support services.

What does officer due diligence actually require?

Due diligence is not demonstrated by good intentions or a commitment to wellbeing. It is demonstrated by what can be shown. Officers are expected to understand the work health and safety risks facing their organisation and ensure there are effective processes to identify and manage them. For psychosocial hazards, "reasonably practicable" is no longer a vague concept; the codes increasingly define what good looks like.

In practice, the first thing a regulator asks about is the system. Not the training register. The system:

• A documented psychosocial risk assessment that reflects the realities of the organisation's work, workforce and operating model, rather than a generic template populated for compliance purposes.
• A risk register that records those hazards, the controls in place and who is responsible for them, and that is actively reviewed rather than simply filed away.
• Evidence that identified hazards resulted in action, with priority given to removing or reducing the hazards themselves before introducing awareness, training or other administrative controls.

This is what making the invisible visible means in compliance terms. Psychosocial hazards are invisible precisely because nothing in the standard stack surfaces them as data. A risk assessment converts a vague board-level concern into a risk register that can be actively governed and readily understood by an inspector.

Isn't this just more compliance overhead?

It would be, if it were treated as a paperwork exercise. Organisations that get this wrong treat the register as the deliverable and stop there. A document that records risks but shows no evidence of action is worse than no document at all, because it demonstrates that the risks were known but not addressed.

The organisations that get it right treat the assessment as the start of an operating discipline. A tier-2 construction principal, for instance, does not have a "mental health" problem to solve; it has identifiable hazards — fatigue from roster design, exposure to high-stakes decisions under time pressure, isolation on remote sites — each of which has a control that sits well above training in the hierarchy. A multi-site aged care provider has different hazards again: occupational violence, grief load, chronic understaffing. The point of structured prevention is that it is specific to an organisation's work, which is exactly what a generic training package can never be.

Scale matters too. Once a workforce grows beyond the point where leaders can personally know and monitor everyone — often cited as around 150 people, known as Dunbar's number — informal noticing starts to break down. Structure has to carry what relationships once did. Most multi-site organisations crossed that threshold years ago and have been relying on goodwill ever since.

What is the actual fix?

The solution is a system that sits upstream of the EAP and ahead of the harm: identify psychosocial hazards, hold them in a risk register, act on the findings, and review. That is people-risk infrastructure, and it is what regulators expect to see. The EAP stays. Training stays. But neither carries the compliance burden alone. What changes is that the organisation can demonstrate how psychosocial risks are identified and managed, rather than relying on the claim that training was delivered.