What the 1 April 2027 critical-risk changes mean for small PCBUs

From 1 April 2027, small businesses will be expected to identify the risks that could kill someone, cause notifiable harm or lead to a recognised occupational disease—and put those risks first.

What is changing?

The Health and Safety at Work Amendment Act 2026 comes into force on 1 April 2027. Under the amended Health and Safety at Work Act 2015, a small PCBU must manage and prioritise its critical risks.

A small business is defined as one with fewer than 20 workers for at least nine months of a financial year. Businesses with 20 or more workers must manage both critical and other risks, while giving critical risks the highest priority.

The change aims to make duties more proportionate. The owner of a ten-person contracting company does not have the same resources as a major infrastructure company. That is not a free pass—it is a direction to focus properly on what could cause the most serious harm.

What is a critical risk?

A critical risk is not simply a hazard with a high score in a risk register. The amended legislation covers risks associated with hazards listed in Schedule 1A of HSWA, as well as hazards likely to result in death, a notifiable injury or illness, a notifiable incident, or a listed occupational disease.

Common critical risks for SMEs

Every business must identify critical risks from the work it actually performs. For construction, maintenance, manufacturing and trade businesses, they may include:

• Falls from roofs, scaffolds, ladders or unprotected edges
• Workers struck or crushed by vehicles and mobile plant
• Contact with live electricity or underground and overhead services
• Machinery entanglement, crushing or unexpected start-up
• Uncontrolled hydraulic, pneumatic, electrical or mechanical energy
• Exposure to asbestos, silica dust, fumes or hazardous substances
• Confined spaces, excavation collapse or falling objects
• Structural collapse, fire, explosion or chemical release

A copied register is not enough. A roofer, workshop and office consultancy do different work and need different critical controls.

Five practical steps before April 2027

1. Identify the work that could cause the greatest harm

Walk through normal work, non-routine jobs, maintenance, emergencies and foreseeable changes. Ask workers what could kill or permanently harm someone, where the business relies on one control, and what changes when people are rushed or short-staffed.

2. Identify the critical controls

A critical control is essential to preventing a serious event or reducing its consequences. For height work, this might include designed edge protection, verified scaffolding, suitable anchors, inspections and rescue arrangements. “Be careful” is not a critical control.

3. Give each control an owner

Be clear about who checks it, when it is checked, what evidence is kept, what happens when it fails and who can stop the work. If everyone is responsible, there is a fair chance nobody is checking.

4. Verify controls where the work happens

A signed form does not prove a control works. Observe the task, speak with workers, inspect equipment and check competency, isolation records, permits and emergency arrangements.

5. Review changes, incidents and near misses

Revisit controls when the task, equipment, site, contractor or conditions change—and whenever a control fails or a worker raises a concern.

Can a small PCBU ignore non-critical risks?

The framework makes critical risks the priority, but businesses should not assume every other health and safety matter can be ignored. Applicable regulations and specific duties still matter. Slow health risks such as silica, asbestos and excessive noise must not be dismissed merely because harm is not immediately visible.

What does this mean for owners and directors?

The amendments clarify officer duties around governance. Officers need to understand relevant risks, ensure the business has suitable resources and processes, and verify those resources and processes are being used. For an SME owner, that means knowing the critical risks, making effective controls available and checking them at the workface.

A simple preparation checklist

• Confirm whether the business meets the small-business definition.
• Identify critical risks from the work actually performed.
• Involve workers in identifying risks and workable controls.
• Define the critical controls for each risk.
• Assign an owner and verification method to every critical control.
• Give workers authority to stop work when a critical control is missing.
• Record and close corrective actions.
• Review risks when work, equipment or conditions change.

How Auditsure can help

Auditsure Ltd provides practical critical-risk assessments for SMEs across Auckland and Waikato. This can include reviewing the work, speaking with workers and supervisors, identifying credible serious events, confirming critical controls, checking their effectiveness and producing a concise improvement plan.

The aim is not to bury an SME in paperwork. It is to help the business see the risks that matter most, check the controls and close the gaps.

This article provides general information and is not legal advice. PCBUs should consider their work, applicable regulations and current WorkSafe guidance.