Workplace Policies Expire. When Did You Last Check Yours?
Review your workplace policies at least once a year, and immediately when the law, your business, or your risks change. Since January 2025, employers have absorbed criminal wage theft laws, the right to disconnect, Payday Super, and new privacy policy rules that start on 10 December 2026. This guide covers how often to review, what triggers an early review and where to start.
Picture a practice principal at a 12-person accounting firm in Brisbane. The policy manual was signed off in mid-2024, saved to the shared drive and not opened since.
Since then, criminal wage theft laws, the right to disconnect for small business, and Payday Super have all taken effect. Firms providing certain accounting or legal services took on anti-money laundering obligations on 1 July 2026. New privacy policy rules start on 10 December 2026.
Review every workplace policy at least once a year, and immediately when the law, your business, or your risks change. The yearly review keeps the whole set current, while trigger-based reviews catch the changes that cannot wait twelve months.
This matters because a written policy is evidence. In a dispute, audit, or regulator’s inquiry, it shows what your firm knew and what it expected of its people.
Three habits keep your policies current:
Keep a register. List every policy, its owner and its next review date.
Review on a cycle. Check every policy at least yearly, and high-risk policies more often.
Name your triggers. A new law, an incident, a complaint or a new tool should prompt a review that month.
You can run this yourself or engage policy review services to do the heavy lifting. Either way, the test is the same: can you show today that each policy matches current law and how your people actually work?
The short version
-
Baseline: review every policy at least once every 12 months.
-
Triggers: review straight away after a change in law, structure, technology, an incident or a complaint.
-
Fixed cycles: some laws set their own timetable, such as an independent evaluation of an AML/CTF program at least every three years.
Free Resource: Workplace Policy Review Calendar
Start your register today. The calendar lists common workplace policies, suggested review cycles, the 2025 to 2026 trigger dates and a sign-off log.
Workplace law now changes several times a year
Australian workplace law no longer moves on a tidy annual rhythm. Recent commencement dates have landed in January, July, August and December, so a library reviewed every few years can fall behind within months.
Falling behind has real costs. In 2024 to 2025, the Fair Work Ombudsman recovered $358 million for more than 249,000 underpaid workers. It also secured a record $23.7 million in court penalties.
Policy review services catch that drift early, before it becomes a claim, a penalty, or a difficult conversation with a client.
Digging Deeper
The sections below set out how often to review, which changes have already landed and what should trigger an early review. They also show that the same rule applies across sectors and at every business size.
Three review timetables run side by side
No single law sets one review date for every workplace policy. Before you choose a cycle, or engage policy review services, it helps to know that three timetables run at once.
The annual baseline. A review at least every 12 months is the simplest cycle to run and the easiest to defend.
Risk-based cycles. Harassment, safety, privacy and pay policies deserve the closest attention. Lower-risk policies, such as a dress code, can run on a two-year cycle if nothing changes.
Fixed legal cycles. Some regimes set the timetable. Tranche 2 AML/CTF programs must be independently evaluated at least once every three years.
Work health and safety law takes a different approach. Under the model WHS laws, you must review safety control measures when they stop working. You must also review them before a workplace change, and when consultation shows a review is needed.
The Australian Human Rights Commission takes a similar line on the positive duty to prevent workplace sexual harassment. Its guidelines expect employers to review their prevention measures regularly and check that they work.
That is why experienced policy review services pair a yearly cycle with a live list of triggers. One without the other leaves gaps.
Six national changes have landed since January 2025
If your policies were last reviewed before 2025, several are now out of date. The table sets out the main national changes and the policies each one touches.
| Change | When | Policies to check |
|---|---|---|
| Criminal offence for intentional wage theft | 1 January 2025 | Pay, timekeeping, award interpretation |
| Right to disconnect for small business employees | 26 August 2025 (larger employers since 26 August 2024) | Out-of-hours contact, flexible work, on-call |
| Payday Super: super paid with wages | 1 July 2026 | Payroll, onboarding, super fund choice |
| AML/CTF obligations for tranche 2 services, including some accounting and legal work | 1 July 2026 | AML/CTF program, client onboarding, record keeping, training |
| Privacy policies must disclose automated decision-making | 10 December 2026 | Privacy policy, AI use, recruitment tools |
| Working from home term for the Clerks Award | Decision 27 August 2026, final term pending | Flexible work, hours and breaks for clerical staff |
This list is where most policy review services will start in late 2026. Two further changes are still proposals, so they belong on a watch list rather than in your policies.
In September 2026, the government released draft laws to ban non-compete clauses for employees earning at or below the high income threshold, currently $190,100. Consultation closed on 2 October, and the ban is intended to start in 2027.
In Victoria, a bill to create a right to work from home two days a week stalled on 10 September 2026. The upper house sent it to a committee, which is due to report on 20 October.
Some events should trigger a review that month
Some events can make a policy unreliable overnight. When one of these happens, review the affected policies within the month.
A new law, regulation, award variation or code of practice commences.
Your business changes shape: a merger, a new office, a new state or a new service line.
You adopt a new tool that touches staff or client data, including AI.
A complaint, incident, near miss or dispute exposes a gap.
An audit, regulator letter or insurer question asks for evidence.
Your people work differently from what the policy says.
The last trigger is the most common and the easiest to miss. A policy that describes a workplace you no longer run offers little protection.
AI is the clearest current example. In July 2026, Employment Hero research found one in three Australian workers used AI at work without their employer knowing. In the same study, 44 per cent of employers said staff used personal AI accounts at work.
If your policies say nothing about AI, that gap is worth closing first, with or without policy review services.
Professional services firms should start with five policies
Professional services firms hold sensitive client information, client money and hard-won reputations. That raises the stakes on five policy areas.
-
AML/CTF program. If your firm provides designated services, the program must be documented, approved by senior management and independently evaluated at least every three years.
-
Privacy policy. If the Privacy Act covers you, check the policy for automated decisions about people before 10 December. The OAIC began its first privacy policy compliance sweep in January 2026, with infringement notices of up to $66,000.
-
AI use. Set clear rules on which client information may go into AI tools, and which may not.
-
Out-of-hours contact. Client-facing roles create pressure to reply at night, so set reasonable expectations under the right to disconnect.
-
Flexible work and contracts. Check clerical staff arrangements against the draft Clerks Award term, and audit restraint clauses before the proposed non-compete ban arrives.
This is where policy review services can save a principal real time. One coordinated review can align the AML/CTF program, privacy policy and AI rules in a single pass, rather than three separate projects.
The same rule holds in trades, allied health and NFPs
The yearly-plus-trigger rule works in every sector. What changes is who holds the measuring stick.
Trades services
Safety policies carry the heaviest load, and site changes, new plant, and new subcontractors all trigger them. Payday Super and the right to disconnect also reach every employer with staff on the tools.
For a trades business, policy review services should cover both the site and the office.
Allied health and NDIS providers
Registered NDIS providers are audited against the NDIS Practice Standards, which have not been comprehensively reviewed since 2018. Supported independent living providers have had to register and meet new standards since 1 July 2026.
Policy review services for clinics should track both changes, along with privacy and clinical record-keeping.
Not-for-profits
Charities must meet the ACNC Governance Standards to stay registered, and boards should review governance policies regularly. Funding agreements often add their own policy requirements, so check them at every renewal.
Business size changes the method, not the obligation
Australia has about 2.66 million small businesses, or 97.3 per cent of all businesses, and small business employs about two in five private-sector workers. When policies drift across that many workplaces, the cost spreads through the economy.
A five-person firm can run its review on a spreadsheet. A national firm needs version control, formal sign-off and training records. For larger enterprises, policy review services often focus on consistency across states and sites.
Some laws scale with size. Small businesses got the right to disconnect a year after larger employers. Small business employers can also follow the Voluntary Small Business Wage Compliance Code to avoid referral for prosecution under the wage theft offence.
A firm that grows past a size threshold has a review trigger, whether or not anyone notices.
Global trends also shape Australian policy, and France introduced a right to disconnect in 2017.
The European Union has delayed its AI Act rules for high-risk workplace AI, such as recruitment screening, to December 2027. Firms with overseas clients or parent companies may meet those rules first through their contracts.
Choosing in-house or external policy review services
Both approaches work if someone owns the process. The choice usually comes down to time, expertise and independence.
Run the review in-house if you have an HR or compliance lead with current legal knowledge and protected time. Choose external policy review services if you lack either, or when an audit, a board or an insurer needs an independent view.
Good policy review services should do five things:
Map each policy against current law, awards and sector standards.
Compare the written policy with what staff actually do.
Rewrite in plain English so that staff can follow it.
Set review dates, owners and triggers for the next cycle.
Leave you with a register you can maintain yourself.
Be wary of policy review services that swap your documents for templates. A template can be current and still be wrong for your workplace.
A seven-step yearly review keeps the evidence
Build the register. List every policy, its owner, its last review and its next review date.
Rank by risk. Put harassment, safety, privacy, pay and AML/CTF at the top.
Check against the law. Note every relevant change since the last review.
Check against practice. Ask staff and managers how the policy works in real life.
Update, approve and date. Record who signed off and when.
Train and communicate. Tell staff what changed and provide training where needed.
Set the next date and the triggers. Then put them in the calendar.
Whether you use internal staff or policy review services, keep the evidence. A dated review record is part of your proof that you took reasonable steps.
Frequently asked questions
How often should workplace policies be reviewed in Australia?
Review workplace policies at least once every 12 months, and straight away after a trigger such as a new law or an incident. Some regimes set fixed cycles, such as AML/CTF independent evaluations at least every three years.
Is there a legal requirement to review policies every year?
No single Australian law requires workplaces to review every policy yearly. WHS laws require reviewing safety control measures when triggered. The positive duty also expects regular review of prevention measures, so a yearly cycle is the practical way to meet both.
Which policies need attention before the end of 2026?
Your privacy policy comes first if you use automated tools in decisions about people, because new disclosure rules start on 10 December 2026. Then check out-of-hours contact, payroll and super, AI use and, for tranche 2 firms, the AML/CTF program.
What do policy review services include?
Policy review services compare each policy with current law and practice, rewrite unclear wording, and assign owners, review dates, and triggers. A good provider leaves you with a register you can maintain yourself.
Can we review our own policies instead of using policy review services?
A firm can review its own policies if someone has current legal knowledge and protected time. A practical split is to run the yearly check in-house and use policy review services for high-risk policies, new laws or an independent view.
Do small businesses need formal policies at all?
Small businesses benefit from short, current written policies, because most workplace laws apply regardless of size. Written policies are how you show you took reasonable steps.
Review yearly, and sooner when something changes
Review every workplace policy at least once a year, and immediately when the law, your business, or your risks change. With commencement dates now spread across the calendar, a yearly review alone is no longer enough.
If you lead a professional services firm, start with your privacy policy before 10 December, then work through the rest by risk.
General information only
This article provides general information for Australian organisations as at October 2026 and is not legal advice. Several items described are drafts, bills or pending decisions and may change. Seek professional or legal advice before acting, and have a qualified adviser review compliance-heavy policies.
How can SBAAS help
If your policy manual was last opened in 2024, the gap is rarely effort. The law has moved faster than a busy principal can track.
SBAAS provides policy review services that check each policy against current law and the way your firm actually works, then rewrite it in plain English. We start by reviewing what you already have, and you approve the scope before any work begins.
Book a short call through https://sbaas.com.au/about-us/ to see whether a review would suit your practice. We will talk through what has changed and where to start.
Sources
Allens. (2026, September). Treasury releases details of proposed ban on post-employment restraints, no-poach arrangements and wage fixing. https://www.allens.com.au/insights-news/insights/2026/09/treasury-releases-details-of-proposed-ban-on-post-employment-restraints-no-poach-arrangements-and-wage-fixing/
Australian Institute of Company Directors. (n.d.). ACNC governance standards. https://aicd.com.au/regulatory-compliance/acnc-governance-standards.html
Australian Small Business and Family Enterprise Ombudsman. (2025). Contribution to Australian business numbers. https://www.asbfeo.gov.au/contribution-australian-business-numbers
Australian Small Business and Family Enterprise Ombudsman. (2025, July). Contribution to Australian employment. https://asbfeo.gov.au/sites/default/files/2025-11/Contribution%20to%20Australian%20Employment.pdf
AUSTRAC. (2025, July). AML/CTF obligations factsheet for tranche 2 reporting entities. https://www.austrac.gov.au/sites/default/files/2025-07/AMLCTF_obligations_factsheet_for_tranche_2_REs.pdf
Baker McKenzie. (2023). Australia: AHRC’s new enforcement powers: Is your business complying with the positive duty? https://insightplus.bakermckenzie.com/bm/employment-compensation/australia-ahrcs-new-enforcement-powers-is-your-business-complying-with-the-positive-duty
Department of Employment and Workplace Relations. (2024, December 16). The new wage theft criminal offence will commence on 1 January 2025. https://www.dewr.gov.au/closing-loopholes/announcements/new-wage-theft-criminal-offence-will-commence-1-january-2025
Fair Work Commission. (2026, August 27). Working from home: Clerks Award decision issued. https://www.fwc.gov.au/about-us/news-and-media/news/working-home-clerks-award-decision-issued
Fair Work Ombudsman. (2025, August 26). Start of the right to disconnect and casual changes for small businesses. https://www.fairwork.gov.au/newsroom/news/start-right-disconnect-and-casual-changes-small-businesses
Fair Work Ombudsman. (2025, October 29). $358 million back-paid to Australian workers [Media release]. https://www.fairwork.gov.au/newsroom/media-releases/2025-media-releases/october-2025/20251029-annual-report-2024-25-media-release
Fair Work Ombudsman. (2026, February 3). Payday Super: New rules starting 1 July 2026. https://www.fairwork.gov.au/newsroom/news/payday-super-new-rules-starting-1-july-2026
Information Age. (2026, September). Victoria’s WFH law suffers major setback. https://ia.acs.org.au/article/2026/victoria-s-wfh-law-suffers-major-setback.html
King & Wood Mallesons. (2026, September). The upcoming ban on non-compete, non-poaching restrictions and wage-fixing arrangements. https://www.mallesons.com/content/mallesons/au/en/insights/latest-thinking/the-upcoming-ban-on-non-compete-and-non-poaching-restrictions-and-restrictions-on-no-poach-and-wage-fixing-arrangements
National Law Review. (2026). EU nears approval of agreement to delay rules for AI use in employment decisions. https://natlawreview.com/article/eu-nears-approval-agreement-delay-rules-ai-use-employment-decisions
NDIS Quality and Safeguards Commission. (2025, October). NDIS Practice Standards review: Discussion paper. https://www.ndiscommission.gov.au/sites/default/files/2025-10/NDIS%20Practice%20Standards%20Review%20Discussion%20Paper%20-%20Standard.docx
NDIS Quality and Safeguards Commission. (n.d.). About NDIS Practice Standards reform. https://www.ndiscommission.gov.au/practice-standards
Office of the Australian Information Commissioner. (2025, December). Privacy compliance sweep to put privacy policies under the spotlight. https://oaic.gov.au/news/media-centre/privacy-compliance-sweep-to-put-privacy-policies-under-the-spotlight
Safe Work Australia. (n.d.). Identifying, assessing, controlling and reviewing psychosocial risks. https://www.safeworkaustralia.gov.au/safety-topic/managing-health-and-safety/mental-health/managing-risks/identifying-assessing-controlling-and-reviewing
SmartCompany. (2026, July 7). Guilty secret: One in three Aussies using AI chatbots at work. https://www.smartcompany.com.au/artificial-intelligence/guilty-secret-one-in-three-aussies-using-ai-chatbots-at-work/
Startup Daily. (2024, August 26). Australian workers now have the right to disconnect, but what really matters is how their bosses react. https://www.startupdaily.net/?p=120080
White & Case. (2026). Australian privacy update: Automated decision making transparency requirement. https://www.whitecase.com/insight-alert/australian-privacy-update-automated-decision-making-transparency-requirement
Eric Allgood is the Managing Director of SBAAS and brings over two decades of experience in corporate guidance, with a focus on governance and risk, crisis management, industrial relations, and sustainability.
He founded SBAAS in 2019 to extend his corporate strategies to small businesses, quickly becoming a vital support. His background in IR, governance and risk management, combined with his crisis management skills, has enabled businesses to navigate challenges effectively.
Eric’s commitment to sustainability shapes his approach to fostering inclusive and ethical practices within organisations. His strategic acumen and dedication to sustainable growth have positioned SBAAS as a leader in supporting small businesses through integrity and resilience.
Qualifications:
- Master of Business Law
- MBA (USA)
- Graduate Certificate of Business Administration
- Graduate Certificate of Training and Development
- Diploma of Psychology (University of Warwickshire)
- Bachelor of Applied Management
Memberships:
- Small Business Association of Australia –
International Think Tank Member and Sponsor - Australian Institute of Company Directors – MAICD
- Institute of Community Directors Australia – ICDA
- Australian Human Resource Institute – CAHRI
Our Consulting Services
Management Consulting
Compliance & Risk
Professional Writing Services
Consistency in Communication
Small Business Consulting
Sustainable Businesses
Start-ups
Set-up for Success
Further Reading
Workplace Policies Expire. When Did You Last Check Yours?
Review your workplace policies at least once a year, and immediately when the law, your business, or your risks change. Since January 2025, employers have absorbed criminal wage theft laws, the right to disconnect and Payday Super, and new privacy policy rules starting on 10 December 2026. This guide covers how often to review, what triggers an early review and where to start.
You Just Screened Out Your Best Candidate. They Were 52.
A quarter of Australian employers now call a 52-year-old an older worker. AI screening tools are being sued in the United States for rejecting applicants over 40. Meanwhile, KPMG puts the value of getting more over-55s into work at $29 billion a year. Here is what age bias actually costs, and how to take it out of your hiring in 30 days.
Your Honest Ad Might Still Be Breaking the Law
You did not lie. You did not mean to mislead anyone. You believed every word. And you can still be on the wrong side of the law. That is the hard truth about advertising in Australia: good intentions are not a defence. What matters is the impression your words leave, not the honesty behind them. Here is how to stay on the right side of the line.
The Contractor on Your Books Might Now Be an Employee
Since August 2024, the paperwork no longer settles whether a worker is an employee or contractor. A new Fair Work test looks at the real substance of the relationship, not the label on the agreement. For allied health practices built on contractor clinicians, that change carries real risk. Here is what the test asks, and how to check your arrangements before an audit or a dispute does it for you.
Australia Is Offshoring Its Own Future Workforce
Telstra, NAB, Officeworks and Woolworths have all moved corporate roles offshore this year. Accounting firms have been doing it for a decade. The roles leaving are the ones that trained a generation, and youth unemployment now sits at more than double the national rate. Here is what the data shows, and what small businesses can do about it.
The Warranty Ran Out. Your Responsibility Didn’t.
A customer brings back something you sold. It stopped working, and the warranty ended last month. Most owners think that settles it. It does not. The manufacturer’s warranty is not where your obligations end, nor is it where your customer’s rights end. The real test is something else entirely, and it is worth knowing before the next conversation at the counter.