From 1 April 2027, New Zealand businesses must put critical risks, the hazards that could kill or seriously hurt someone, ahead of everything else.
Small businesses (under 20 workers) focus on critical risks but still log them. Larger ones manage every risk, most dangerous first.
Following an official code of practice or another law’s rules for the same risk counts as compliance for that risk, if you do it properly.
Important notice
The information contained in this article is general in nature and you should consider whether the information is appropriate to your specific needs. Legal and other matters referred to in this article are based on our interpretation of laws existing at the time and should not be relied on in place of professional advice. We are not responsible for the content of any site owned by a third party that may be linked to this article. Mitti disclaims all liability (except for any liability which by law cannot be excluded) for any error, inaccuracy, or omission from the information contained in this article, any site linked to this article, and any loss or damage suffered by any person directly or indirectly through relying on this information.
Right now, someone on one of your construction sites could be working alone. Do you know who it is, where they are and what happens if something goes wrong?
Or maybe your kitchen assistant is cleaning a commercial slicer that’s still plugged in. Do they know the safe way to clean it?
Those are the kinds of questions New Zealand’s Health and Safety at Work Amendment Act is about to put front and centre. And the law just got updated, with the changes set to start on 1 April 2027.
Starting 1 April 2027, regardless of your industry, all eyes are on critical risks. The Health and Safety at Work Amendment Act 2026 wants businesses to focus on what matters most, their people’s safety. Now, the amendment doesn’t replace the Health and Safety at Work Act 2015, just updates it.
Change | Before | After (from 1 April 2027) |
|---|---|---|
Critical risks | Manage all risks, with no legal order of priority | Critical risks come first |
Business size | Same duties for every business | Under 20 workers: focus on critical risks. 20 or more: all risks, critical first |
Codes of practice | Following a code was evidence you met your duty | Following a qualifying code means you’re treated as having met it for that risk |
Other laws | Overlapping laws could mean doing the same job twice | Meeting another law’s rules for the same risk counts as compliance |
Directors and senior leaders | Open-ended list of due diligence steps | Clear governance duties with a fixed list |
Here are the four changes that matter most:
Critical risks come first for every business.
Small businesses should focus more on managing critical risks.
Following an approved code of practice, or meeting another law’s rules for the same risk, counts as compliance for that risk.
Directors and senior leaders get clearer governance duties.
Critical risks are at the heart of the new law. Businesses are expected to deal with them before anything else. So it helps to know exactly what makes a risk critical.
A critical risk is a risk tied to a hazard on the list in Schedule 1A of HSWA, from mining and quarrying to operating amusement devices. Basically, a critical risk is any hazard that would likely cause death, a serious injury or illness, a serious near miss or a work-related disease if something went wrong.
When something is “notifiable,” that means it’s serious enough that you’d have to report it to WorkSafe. Not like a stubbed toe or a mild bruise.
Start by finding the hazard and judging how serious it could be. Then put controls in place, removing the risk where you can and reducing it as far as is reasonably practicable where you can’t. Finally, check the controls work, and check them more often than you do for lower-level risks.
For a risk like working at heights, that could mean edge protection, trained workers and regular scaffold checks. And if an approved code of practice (ACOP) covers your risk, following it is a good starting point for safety.
The law now treats businesses differently by size. A small business, or small PCBU (Person Conducting a Business or Undertaking), has fewer than 20 workers for at least nine months of the financial year. With 20 or more, you already count as large.
Here’s what each size has to do:
Small businesses: Manage critical risks and prioritise them.
Large businesses: Manage both critical and other risks, with critical risks as the top priority.
So a 15-person business can put its limited time into the hazards that could seriously hurt someone. While a 200-person business still has to manage every risk, the most dangerous ones must come first.
Take note that small doesn’t mean paperwork-free. Small businesses still need to identify and log their critical risks and prioritise them.
The Health and Safety at Work Amendment Act doesn’t solely focus on critical risks. There are three other smaller changes that help you know when you’ve done enough.
An Approved codes of practice (ACOP) is a guide to meeting your safety duties for a specific risk. Following one isn’t required. But from 1 April 2027, if you follow one properly, the law treats you as having done what’s required for that risk.
Worth knowing: industry groups, unions and employer organisations can write their own codes too, not just WorkSafe. WorkSafe reviews each draft and decides whether to recommend it to the Minister for approval.
Unlike an ACOP, laws are mandatory. Some risks are covered by more than one law, such as the Building Act 2004, the Maritime Transport Act 1994 and the Land Transport Act 1998. If you comply with the requirement in the other Act for the same risk, you’re considered compliant with HSWA.
Officers, meaning company directors, partners, board members and chief executives, have clearer governance duties. They need to understand the risks, make sure the business has the resources and processes to manage them, and check those are being used. In short, leaders need to know the risks and confirm the controls are in place and being used.
While WorkSafe is still updating its guides, with more due before the changes start, you don’t need to wait. Here are some steps you can start on now:
Map your hazards and flag the critical ones: Check them against the hazards listed in Schedule 1A of HSWA, then add any others that could cause death or serious harm. A hazard log is one easy way to record them.
Check your size: Get ahead by counting your workers, including contractors and labour hire, to see if you’re a small or large business.
Look for codes and overlapping laws: If an approved code or another Act already covers a risk, following it counts. Once you know which one applies, you can turn its requirements into an inspection so everything becomes routine.
Sort out shared worksites: If other businesses work on your site, agree in writing who manages what, and keep a record of the checks each one completes.
Now, once you’ve spotted and logged a risk, the important thing is to keep an eye on it. Act on it, then check it’s actually been fixed. Platforms like Mitti (by SafetyCulture) give you a clear picture of what’s happening across all your sites. You also end up with a record of what was found and who’s fixing it, which helps if anyone asks for a risk assessment.
1 April 2027 may look a way off, but it’s always safer to deal with your critical risks even before the date.
The flow of information and notifications are essential for maintaining accountability across different areas of the business.
