Read the 2026 landscape as a leader, not an auditor
Most of this year's new obligations share three features. They move the burden of proof onto a named person, they run on a shorter clock, and they reach into systems the school didn't design.
What actually changed
Strip out the commentary and the last eighteen months look like this.
| In force | Obligation | Where | What it asks of leaders |
|---|---|---|---|
| 10 June 2025 | Statutory tort for serious invasions of privacy | Commonwealth | Individuals can now sue for intrusion on seclusion or misuse of personal information |
| 1 October 2025 | Child Safe Organisations Act 2024 | Queensland | Ten Child Safe Standards for any organisation working with children |
| 1 December 2025 | OHS (Psychological Health) Regulations 2025 | Victoria | Identify psychosocial hazards and control them through work design and systems, with no transition period |
| 1 July 2026 | Reportable Conduct Scheme | Queensland | The head of the organisation notifies within 3 business days, gives an interim report within 30, and faces a fine of almost $17,000 for failing to |
| 10 December 2026 | Automated decision-making transparency (APP 1.7 to 1.9) | Commonwealth | The privacy policy must name the decisions software makes, or substantially shapes, that significantly affect people |
| By 10 December 2026 | Children's Online Privacy Code registered | Commonwealth | New rules for online services likely to be used by children |
None of these is unreasonable on its own. Every one of them protects someone who deserves protecting. The difficulty is that they arrive as a queue, and each one assumes the school already has an instrument that can absorb it.
Three shifts hiding in the list
The burden of proof is moving to a named person
Queensland's scheme doesn't fine the school, it fines the head. Victoria's regulations don't ask for a policy, they ask for controls that are installed, used and maintained. A policy proves you intended something. A record proves you did it. Most compliance instruments in schools are very good at the first and nearly silent on the second.
I think of it as a ladder: documented, attested, evidenced, verified. Most schools live on the first rung. The 2026 obligations are written for the third.
The clock is getting shorter
Three business days doesn't fit an annual compliance calendar. A calendar tells you when something is due. It can't tell you that something has just happened, who owns it, and what the record has to show by Wednesday.
Every software choice is now a governance decision
From 10 December, your privacy policy has to name the kinds of decisions your software makes about people, including software that only recommends a decision to a human. Attendance flags, wellbeing alerts, enrolment scoring, and the AI tools staff picked up on their own all sit in scope. That isn't an IT question. It's a question about who in the school decides, and on what.
Why more effort won't fix it
The sector's instinct has been to work harder. AITSL's review of red tape found that schools answered rising accountability requirements by creating compliance manager roles, while duplicated reporting of the same information to different authorities kept growing. That isn't a problem solved. It's a problem staffed.
The gaps show up where the instruments stop. Aon's 2026 survey of 306 independent schools found only 61 per cent had clear accountability lines for psychosocial risk, now a top three risk for the sector. That's nearly four in ten schools carrying a major risk with no named owner, months after Victoria made controlling it a legal duty.
The pattern is consistent. Our instruments were built to answer an auditor's question: was it documented? The 2026 landscape asks a leader's question: is it controlled, who owns it, and can you show me now?
Five questions for your next board meeting
- For each obligation above, who is the named owner, and do they have the authority to act on it?
- If a reportable conduct allegation landed at 3pm on a Friday, could you meet the three business day deadline with the records you hold today?
- Which of your controls are documented, and which are evidenced?
- Which software makes or shapes decisions about students or staff, and will it be in your privacy policy by 10 December?
- Which psychosocial hazards have you controlled through the design of work, rather than through a wellbeing program?
If any answer takes longer than a minute, the problem isn't your people. It's the instrument.
The point
The landscape will keep moving. The schools that cope won't be the ones with the longest policy library. They'll be the ones whose instruments were built for the person who has to answer.
If you'd like to work through any of these questions for your own school, our door is open and the conversation costs nothing.
This is a governance view, not legal advice. Check obligations for your jurisdiction with your adviser.
References
Every date and figure above was checked against these sources on 1 October 2026.
- Queensland Family and Child Commission: What is the Reportable Conduct Scheme
- Queensland Family and Child Commission: Child Safe Organisations
- Premier of Victoria: New regulations start today to protect workers
- Norton Rose Fulbright: Victoria's new psychological health regulations are now in effect
- Rigby Cooke Lawyers: Tort for serious invasion of privacy is now in effect
- Allens: Automated decision-making transparency: what APP entities need to know about the APP 1 amendments
- Office of the Australian Information Commissioner: Children's Online Privacy Code
- Australian Institute for Teaching and School Leadership: Review to reduce red tape for teachers and school leaders
- The Educator: Mental health crisis in independent schools is now a board-level risk
The four we are asked every time.
Still weighing something up? Thirty minutes with us, on your own registers, answers the rest.
Get in contact01What new compliance obligations do Australian schools face in 2026?
Queensland's Reportable Conduct Scheme started on 1 July 2026, and from 10 December 2026 a school's privacy policy must describe the decisions its software makes or substantially shapes about people. The Children's Online Privacy Code is due to be registered by the same date. They follow Victoria's psychological health regulations (1 December 2025), Queensland's Child Safe Organisations Act (1 October 2025) and the Commonwealth privacy tort (10 June 2025).
02Who is accountable under Queensland's Reportable Conduct Scheme?
The head of the organisation. The head must notify within three business days, give an interim report within 30, and faces a fine of almost $17,000 for failing to.
03Does the automated decision-making rule apply to schools?
It applies to organisations covered by the Australian Privacy Principles, which includes most independent schools. It reaches software that makes a decision or substantially shapes one that significantly affects a person, including tools that only recommend a decision to a human.
04What is the difference between a documented and an evidenced control?
A documented control is a policy that says what the school intends to do. An evidenced control has a record showing it was actually done, by whom and when. The 2026 obligations increasingly ask for the second.
Discover more about EthosOne
Related article · The principal isn't the problem. The role is. · View→
Article by Pete Holliday arguing principal workload is a role design and systems problem a board can control, with five changes to make this term.
Guide · WHS obligations for schools · View→
WHS obligations for schools: the register, the assessment that matched the activity, hazards, incidents and the trail.
Guide · AI governance in schools · View→
The complete guide to AI governance in schools: who decides, what is logged, and which duties AI touches.
Template · School risk register · View→
Free Risk Register for independent schools: Risk-Register.xlsx with a worked example, a four-page How-to and the What-next brochure for EthosOne Risk Management. Risks and hazards in one workbook, linked.
