PCBU obligations for workplace safety in New Zealand: a plain-language guide

If you run a business in New Zealand, manage one, or make decisions that affect how work gets done, you are almost certainly a PCBU. That acronym stands for Person Conducting a Business or Undertaking, and it is the cornerstone of how New Zealand's workplace safety law assigns responsibility.

The term comes from the Health and Safety at Work Act 2015 (HSWA), which replaced the old Health and Safety in Employment Act 1992 and fundamentally changed how the country approaches workplace safety. The shift was significant: instead of placing duties primarily on "employers," the law now places them on anyone who has influence or control over work, regardless of the employment arrangement.

This matters because modern work does not fit neatly into a traditional employer-employee box. Contractors, subcontractors, labour hire workers, volunteers, franchisees, and visiting workers all feature in today's operations. HSWA's PCBU framework captures them all.

What is a PCBU?

A PCBU is any person or organisation that carries out a business or any other type of work activity. According to WorkSafe New Zealand's introduction to HSWA, a PCBU can be a company, a partnership, a sole trader, a government agency, or any organisation that employs workers or controls a workplace. The term is intentionally broad. It captures modern working arrangements where responsibility is based on influence and control, not just employment status.

The critical distinction is that a PCBU is usually the business entity itself (the company), not the individual people within it.

The only common exclusion is a purely voluntary association that does not employ anyone. If your organisation employs even one person, it is a PCBU.

The primary duty of care

The primary duty is the big one. Under section 36 of HSWA, a PCBU must ensure, so far as is reasonably practicable, the health and safety of workers who work for the PCBU while they are at work, and workers whose activities are influenced or directed by the PCBU.

The PCBU must also ensure that other people — visitors, customers, delivery drivers, members of the public — are not put at risk by the work being carried out.

In carrying out this duty, WorkSafe's plain-language guide to HSWA specifies that the PCBU must provide and maintain a work environment that is without risks to health and safety, provide and maintain safe plant, structures, and systems of work, provide adequate welfare facilities, provide the information, training, instruction, or supervision necessary to protect people from risks, and monitor the health of workers and conditions at the workplace to prevent injury or illness.

That is a broad set of obligations. But the key phrase, "so far as is reasonably practicable," is where the practical reality lives.

What "reasonably practicable" actually means

This phrase appears throughout HSWA and determines how far a PCBU must go in managing risk. It does not require the elimination of every conceivable risk — it requires the elimination or minimisation of risks to the extent that is reasonable, given the circumstances.

Section 22 of HSWA defines the factors to consider: the likelihood of the hazard or risk occurring, the degree of harm that could result, what the PCBU knows (or ought reasonably to know) about the hazard or risk and ways to eliminate or minimise it, the availability and suitability of ways to eliminate or minimise the risk, and the cost of eliminating or minimising the risk (including whether the cost is grossly disproportionate to the risk).

In practice, this means you need to do what a reasonable, well-informed business would do in your situation. If a control exists that would significantly reduce risk and is not grossly expensive relative to the harm it prevents, you are expected to implement it. Ignorance of available controls is not a defence. The test is what you ought reasonably to know, not just what you actually know.

Officers: the personal duty of due diligence

HSWA introduced a new duty that did not exist under the old law: officers must exercise due diligence to ensure the PCBU complies with its health and safety obligations. An officer is typically a director, partner, or person who exercises significant influence over the management of the PCBU.

Under section 44 of HSWA, due diligence includes keeping up to date with health and safety matters, understanding the hazards and risks of the business, ensuring the PCBU has appropriate resources and processes, ensuring the PCBU has systems for compliance, and verifying that those resources and processes are actually being used.

This is a personal duty. An officer cannot discharge it by simply delegating safety to a health and safety manager. They must actively satisfy themselves that the business is meeting its obligations. WorkSafe has prosecuted officers who failed to exercise due diligence, and the courts have made clear that this duty requires proactive engagement, not passive oversight.

Workers and other people

Workers have their own duties under HSWA: to take reasonable care for their own health and safety, to ensure their actions do not adversely affect others, and to comply with reasonable instructions given by the PCBU. A worker is anyone who carries out work in any capacity for a PCBU, including employees, contractors, subcontractors, labour hire workers, apprentices, trainees, and volunteer workers.

Other people at the workplace (visitors, customers, delivery drivers) must take reasonable care of their own health and safety and must not adversely affect the health and safety of others.

Overlapping duties

In most real-world operations, multiple PCBUs share the same workplace. A warehouse might involve the site operator, a logistics contractor, a cleaning company, and visiting truck drivers, each a separate PCBU with overlapping duties to the workers at the site.

HSWA requires PCBUs with overlapping duties to consult, cooperate, and coordinate with each other to manage shared risks. This does not mean duplicating systems. It means clarity about who is responsible for what, and communication to ensure nothing falls through the gaps.

WorkSafe has identified failures in managing overlapping duties as a common factor in enforcement actions, including cases involving port operations and infrastructure projects where changes in control arrangements were not adequately reassessed.

What happens when things go wrong

HSWA creates three tiers of offence for duty holders, with penalties that reflect the seriousness of the failure.

Reckless conduct (section 47) is the most serious. If a PCBU or officer engages in conduct that they know could expose someone to serious injury or death, and does so recklessly, the maximum penalties are up to $3 million for a body corporate, up to $600,000 and five years' imprisonment for an individual who is a PCBU or officer. This is reserved for the most egregious failures.

Failure to comply with a duty that exposes someone to risk of death or serious injury (section 48) carries maximum penalties of $1.5 million for a body corporate and $300,000 for an individual PCBU or officer.

Failure to comply with a duty (section 49), where no one was exposed to risk of death or serious injury, still carries maximum penalties of $500,000 for a body corporate and $100,000 for an individual.

These are not theoretical. WorkSafe's prosecution records show fines regularly in the hundreds of thousands of dollars. In 2023, one New Zealand meat processing company received a record $502,500 fine after a worker death. A ski field operator was fined $440,000 the same year. In a separate case, a logistics company was fined $506,300 after a worker was crushed by falling pallets from a forklift. WorkSafe found that the company's pedestrian safety system relied on administrative controls that were ambiguous and contradictory.

The trend is clear: fines are increasing, particularly where the PCBU was on notice of the risk but failed to act.

What proactive compliance looks like

Meeting your PCBU obligations is not a one-time exercise. It requires ongoing identification and management of risks, active worker engagement, and systems that are not just in place but actually working.

A proactive approach includes conducting regular risk assessments and keeping your hazard register current, engaging workers in identifying hazards and designing controls (this is a legal requirement under HSWA, not optional good practice), using the hierarchy of controls (eliminate, isolate, minimise) in that order of priority, monitoring workplace conditions to ensure controls remain effective over time, and building a coaching-first safety culture where near misses are reported, discussed, and learned from rather than ignored or punished.

Technology plays an increasingly important role here. Computer vision AI that works with your existing CCTV cameras can continuously monitor for hazards like pedestrian-vehicle interactions, exclusion zone breaches, and speed violations, providing the kind of ongoing risk visibility that HSWA's "reasonably practicable" standard increasingly expects. The data and reporting these systems generate also creates an auditable trail of identified risks, implemented controls, and measured outcomes: exactly the evidence that demonstrates proactive compliance.

With 99% of data processed on-premise and faces automatically blurred, these systems also address the privacy considerations that come with workplace monitoring.

inviol customers typically see a 67% reduction in risk through this combination of continuous monitoring and coaching. That is the kind of measurable improvement that demonstrates a PCBU is genuinely managing risk, not just documenting it.

The bottom line

Your PCBU obligations under HSWA are not complicated in principle: identify risks, manage them so far as is reasonably practicable, involve your workers, and make sure your officers are actively engaged. But the standard is high, the penalties for failure are significant, and the expectation is that you are continuously improving, not standing still.

If you want to see how continuous safety monitoring can support your PCBU compliance, book a demo and see inviol's platform in action.

Frequently Asked Questions

What is a PCBU in New Zealand?

A PCBU (Person Conducting a Business or Undertaking) is any person or organisation that carries out a business or work activity. Under the Health and Safety at Work Act 2015, the PCBU is the primary duty holder responsible for ensuring the health and safety of workers and others affected by the work. This can be a company, partnership, sole trader, or government agency.

What is the primary duty of a PCBU under HSWA?

The primary duty under section 36 of HSWA is to ensure, so far as is reasonably practicable, the health and safety of workers while at work and of other people who may be affected by the work. This includes providing a safe work environment, safe plant and systems, adequate training and information, and monitoring workplace conditions.

What does "reasonably practicable" mean under HSWA?

Reasonably practicable means doing what a reasonable, well-informed business would do given the circumstances. The law requires you to consider the likelihood and severity of potential harm, what you know (or should know) about available controls, the suitability of those controls, and whether the cost of implementation is grossly disproportionate to the risk.

What are the penalties for breaching PCBU duties?

Penalties range from fines of up to $500,000 for a body corporate (for duty failures not involving risk of death) to $3 million and five years' imprisonment for individuals in cases of reckless conduct. WorkSafe regularly prosecutes PCBUs, with fines in recent cases reaching over $500,000.

What is an officer's duty of due diligence?

Officers (directors, partners, and people with significant management influence) must exercise due diligence to ensure the PCBU complies with its safety obligations. This includes staying informed about safety matters, understanding the business's risks, ensuring adequate resources and processes exist, and verifying that those systems are actually being used. This is a personal, non-delegable duty.