From April 2027 you only manage the risks that could hospitalise someone. That is a harder test, not an easier one

On 1 April 2027 a business with fewer than 20 workers stops having to manage every risk equally and manages its critical risks instead. Less paperwork, genuinely, and a real saving for anyone currently renting a folder full of it. The catch is the test underneath, because it is not the one most owners are using: it asks how badly someone would be hurt if something went wrong, not how likely the thing is to happen. Read it the usual way and you will drop the one risk you were meant to keep.

The sentence that does all the work

WorkSafe states the change in one line: from 1 April 2027, "small businesses (those with fewer than 20 workers) will be required to manage critical risks and to prioritise critical risk when complying with other provisions of the Act and its regulations."

Businesses with 20 workers or more still manage everything, with critical risks given the highest priority. Under 20, you manage the critical ones.

That is the reform. The Act passed in July 2026, so nothing changes in your business until 1 April 2027, and WorkSafe has said its detailed guidance is still being written. What it has already said, though, is the part that matters most: "All businesses will need to identify critical risks based on what they should reasonably know about their work." Nobody hands you the list. You produce it.

"Likely" does not mean what you think it means

A critical risk is a hazard described in the Act's new Schedule 1A, or, in WorkSafe's words, "any hazard likely to result in death, a notifiable injury, illness, incident, or an occupational disease" listed in Schedule 2 of the Accident Compensation Act 2001.

Then comes the sentence that decides how much work you actually have. WorkSafe: "The term 'likely to result' means the chance that death, a notifiable injury or illness, a notifiable incident, or an occupational disease will result when an incident or accident occurs. It does not refer to the likelihood of the event actually occurring."

Read it twice, because it inverts the way most owners think about risk. It is not "how often does this go wrong here". It is "when it goes wrong, how bad is it".

So "nobody has ever been hurt on it" is not an answer to this question. It is not even a reply to it. The steam wand has scalded nobody in nine years and is still perfectly capable of a burn that needs a skin graft, and it is the graft that makes it critical, not the nine years.

So what counts, in a cafe, a salon or a gym

You do not have to guess, because the list of notifiable injuries is already published and it is the same list the new test points at. WorkSafe's own table includes:

• a serious burn, meaning one that needs "intensive or critical care such as a compression garment or skin graft", and expressly not "a burn treatable by washing the wound and applying a dressing"
• serious lacerations, meaning "deep cuts that cause muscle, tendon, nerve or blood vessel damage, or permanent impairment"
• a serious eye injury, including "contact with any substance that could cause serious eye damage"
• loss of a bodily function, with electric shock and acute reaction to a substance given as the examples
• an injury or illness needing medical treatment within 48 hours of exposure to a substance
• a spinal injury, a serious head injury, or anything that requires admission to hospital as an inpatient

Now walk your own floor against that, not against a template. The honest questions in a cafe are the steam wand, the fryer if you have one, the slicer, and the stairs down to the cellar with a wet floor at the top. In a salon they are bleach, peroxide and colour working next to someone's eyes, plus hot wax. In a gym they are loaded bars, plate-loaded machines and anything electrical near sweat. You may conclude some of these are not critical. Fine, but conclude it on the severity test and write down why, because that note is the whole of your defence later.

Twenty workers, and the count is not your payroll

WorkSafe defines the threshold carefully: "A small business is defined as having fewer than 20 workers for at least nine months of a financial year."

Two things catch people there.

Worker is a wider word than employee. Under the Act it takes in contractors, apprentices, people on unpaid work experience and certain volunteers, all of whom WorkSafe treats as workers. A salon with twelve on payroll and nine renting chairs is not obviously a business with fewer than twenty workers, and neither is a gym running on contractor trainers.

Nine months is a threshold, not an average. Staff up for a busy summer and you may spend a third of the year on the wrong side of the line.

If you are anywhere near twenty, get that counted properly before you redesign anything on the strength of being small.

The free pass most owners will never claim

The same reform lets industry groups, unions, employer organisations and sector representatives write their own approved codes of practice from 1 April 2027 and submit them to WorkSafe for the Minister's approval. And here is what an approved code buys you, in WorkSafe's words: "where a business follows an ACOP, it is taken to have complied with the Act meaning enforcement action cannot be taken about a relevant matter."

That is about as close to a safe harbour as this law gets, and it costs an individual business nothing. Whether hospitality, hair and beauty, or fitness ends up with a code is going to be decided over the next year by a small number of people at an industry body, largely on the basis of whether members ask.

Ring yours and ask. It is the highest-return phone call in this whole reform and you may already be paying the subscription that entitles you to make it.

What you can stop buying, and what you cannot

Here is where it reaches your profit, and it is not where owners expect.

Most small businesses do not buy health and safety. They buy evidence of health and safety: a monthly subscription, an annual review, a printed system, a hazard register with forty rows on it including paper cuts. For a business under twenty workers, from 1 April 2027 that is the wrong product. The law will no longer ask you to manage forty things, and a forty-row register is not evidence you found the three that matter. It is closer to evidence you never looked.

Two practical consequences between now and April:

• anything you sign for twelve months from here runs past the change. Before you renew, ask the provider one question: what is different in what you get after 1 April 2027. If the answer is nothing, you have your answer.
• whatever comes out of the generic system should go into the two or three things that could actually put someone in hospital. A guard, an RCD, a mat, real training, or replacing the machine you have been nursing.

One more, for anyone who is a director of their own company. Officer duties have been narrowed to governance: understanding the risks in the work, making sure the business has the resources and processes to manage them, and verifying that it is using them. Short list, and it is the list you are personally measured against, separate from whatever you do on the floor as a worker.

The version of this that turns up when you sell

Health and safety looks like the least commercial thing in your business right up to the moment somebody buys it.

A serious injury does not just cost you the day. It creates a record: a notification, an investigation, possibly an enforcement outcome, all of it dated and disclosable. That record attaches to the company, not to you, which is why it quietly decides the shape of your deal. A buyer taking your shares takes the history with them, so an open or recent matter pushes them towards an asset sale instead, or towards holding back part of the price until it is resolved. Both cost you real money at settlement, and neither shows up anywhere in your profit.

The reverse is worth just as much and almost nobody builds it deliberately. A short, dated, specific critical-risk assessment with the controls beside it is one of the cheapest documents you will ever produce, and it answers a due diligence question in one page rather than in three weeks of correspondence. You have seven months of warning to write the version that helps you.