Australia's WHS Act Makes Directors Personally Liable for PPE. The Due-Diligence Duty Can't Be Delegated.

Australia’s work health and safety law does something most directors never fully register.

It makes them personally liable for a missing pair of gloves.

Not the company. Not the safety manager. The officer.

The director. The secretary. The person who sits in the room when decisions about the whole business get made.

That is section 27 of the Work Health and Safety Act 2011.

And the duty it creates cannot be delegated.

The Duty You Cannot Hand to the Safety Manager

Under section 27, an officer must exercise due diligence to ensure the business meets its WHS obligations.

SafeWork NSW is blunt about who that catches: directors and secretaries, plus anyone who makes — or participates in making — decisions that affect the whole or a substantial part of the business, or who has the capacity to significantly affect its financial standing.

A chief financial officer can be an officer. A corporate counsel who sits in on the decisions can be an officer.

A floor supervisor is not. That is the point.

The duty sits with the people at the top — the ones who sign off on budgets, resources, and policy.

And it is personal.

“If an officer fails to exercise due diligence requirements, they can be held personally liable.” That is SafeWork NSW’s own wording.

An officer cannot delegate the duty to a consultant, a safety manager, or a spreadsheet. The officer must take an active, inquisitive role — make the decisions that allow the right measures to be put in place, then take reasonable steps to make sure they are actually taken.

What Due Diligence Actually Requires

Section 27(5) spells out the reasonable steps. The officer must:

1. Acquire and keep up-to-date knowledge of WHS matters.
2. Understand the operations and their hazards and risks.
3. Ensure the business has available for use — and actually uses — appropriate resources and processes to eliminate or minimise risk.
4. Ensure there are processes for receiving and responding to information about incidents, hazards, and risks.
5. Verify that those resources and processes are in fact provided and used.

Look at the verbs.

Not “provide resources.” Provide and use.

Not “have a process.” Have and implement.

Not “trust the system.” Verify.

Due diligence is not a document you sign once a year. It is an ongoing act of verification.

And verification requires evidence.

Why PPE Is Where Due Diligence Gets Tested

PPE is the control that fails quietly.

It is the last line of the hierarchy of controls — and the one that depends entirely on a worker actually having the right item, in the right grade, at the moment of exposure.

Which makes it the sharpest test of an officer’s due diligence.

The officer’s duty is not “we bought gloves.” It is “we made sure the gloves reached the right worker, for the right task, and we can show it.”

That distinction is the whole game.

The Manual Crib Room Cannot Prove Due Diligence

A manual PPE crib room distributes PPE fine.

It cannot prove that diligence was exercised.

Evidence of due diligence	Manual crib room	Automated PPE dispensing
Who drew PPE, and when	Sign-out sheet, often skipped	Automatic per-worker digital log
That the right grade was issued	Memory, or a guess	Item and grade logged at dispense
That limits were enforced	Honor system	Hardware-enforced per-worker limits
That reusable PPE came back	Weekly manual reconciliation	Dispense-and-return logged in the cell
A record for the regulator	Days of reconstruction	Report exported in seconds

The manual column fails the “verify” element of section 27(5).

The automated column is the verification, produced continuously.

When a regulator — or a coroner — asks an officer how they knew PPE was being used properly, the manual answer is a shrug. The automated answer is a report.

What a Director Can Actually Point To

Here is the practical bridge between the legal duty and the hardware.

SafeWork NSW says an officer may, to some extent, rely on information from others — but the officer “must be able to demonstrate the reasonableness of that reliance.”

Demonstrate. Not assert.

Per-worker dispensing logs are how an officer demonstrates it.

Every dispense is tied to an identity, an item, a quantity, and a timestamp. Reusable gear is tracked through its return. The whole thing exports as an audit trail.

That is the written record SafeWork NSW describes when it says a business should have “information gathering and reporting processes” and “a written register or other record of decisions.”

A PPE vending machine does not make an officer diligent. The officer’s decisions and oversight do that.

But the machine produces the evidence that the decisions were actually carried out — and that is the part directors historically cannot produce.

The 2026 Shift

The liability has been on the books since 2011. What changed is the expectation around it.

Alsco Australia, writing on workplace compliance in 2026, puts it directly: compliance “has officially moved beyond tick-the-box safety.” Regulators, insurers, and workers now all expect PPE to be actively managed across its lifecycle — not assumed.

The pressure is now on proof, not provision.

That is the environment in which a director’s personal due-diligence duty gets tested.

What to Spec

If you are an Australian industrial site — or supplying one — five things decide whether the PPE system actually supports due diligence:

1. Per-worker access control. Badge, PIN, or app. Every dispense named, none anonymous.
2. Per-dispense logging with a cloud audit trail. Exportable in seconds, not weeks of reconstruction.
3. Hardware-enforced issue limits. The machine refuses the fourth pair of gloves — the policy is the machine, not a manager’s memory.
4. Dispense-and-return for reusable PPE. Harnesses and respirators tracked across their lifecycle, not lost.
5. Mixed-SKU capacity. Gloves to fall protection in one unit, compartments matched to the product.

Spec the record, not just the cabinet.

The KioskForce Angle

KioskForce builds custom PPE vending machines from Nanjing, with hardware and software designed in-house and manufactured at partner factories in China.

That matters for one reason: the machine is built around your PPE program — your SKUs, your access-control method, your reporting requirements — not adapted from a snack machine.

For an Australian director, the question is not whether the WHS due-diligence duty exists. It does, and it is personal, and it cannot be delegated.

The question is whether, when someone asks you to demonstrate that diligence, you have a record to point to — or a shrug.

Automated PPE dispensing turns the shrug into a report.

---

Sources: SafeWork NSW — “The work health and safety duty of an officer” (guidance on section 27 of the Work Health and Safety Act 2011); Work Health and Safety Act 2011 (s27, s27(5)); Alsco Uniforms Australia — “Uniform Compliance in 2026” (February 2026).