Last month, UNSW was penalised $213,120 for systemic record-keeping failures affecting 63 casual academics over five years. The university had already remediated over $12 million in underpayments, with a further $1.3 million owed to former staff it couldn't locate. The Fair Work Ombudsman's assessment: fundamentally a governance issue. Not a payroll error. Not a calculation mistake. A governance failure, in systems that were never designed to catch the problem before it compounded.
That's one university. Now multiply it across five regulatory shifts that landed in 2025, every one of which moved the standard from "are you compliant?" to "prove it." They're all in effect now. The question for 2026 isn't whether these rules apply. It's whether you can meet them.
The five shifts
Start with criminal wage theft under Section 327A of the Fair Work Act. The criminal threshold is intent, proved beyond reasonable doubt, and most directors hear that and relax — they'd never deliberately underpay someone. But prosecutors don't need to prove you meant to steal. If you knew your governance processes were broken and did nothing, that's wilful blindness, and wilful blindness is how intent gets established in court. Ten years imprisonment. A criminal record attached to you personally, not a corporate fine the company writes off. The defence isn't good intentions. It's evidence that you had systems catching the problem before it compounded.
Right to Disconnect under Section 333M. An employee refuses contact outside working hours and files an FWC complaint. Before the Commission gets involved, you're expected to have attempted workplace-level resolution. If unresolved, the FWC must commence dealing with the application within 14 days — producing the communication timestamp, the roster from your WFM, actual hours from time and attendance, the contract terms, and the award provisions, all correlated into a single timeline that proves the contact was reasonable. The manager who sent the text has personal exposure. Breach a Stop Order and civil penalties run to $19,800 per contravention for individuals, $99,000 for bodies corporate.
ASAE 3000 assurance opinions now require a named engagement partner to personally attest that the evidence trail is sufficient. It's not legislation — it's the assurance standard that determines whether regulators, insurers, and boards trust your compliance data. If the auditor can't reconcile care minutes across rostering, attendance, and qualification systems, the opinion comes back qualified.
AN-ACC care minute targets under the Aged Care Act. Minimum care minutes per resident per day, verified against roster data, actual attendance, and staff qualifications. The government doesn't sanction "the aged care sector" in the abstract. It sanctions the specific provider, the specific facility — and it wants the data.
Contractor misclassification under the Closing Loopholes amendments. Section 15AA replaced the High Court's contract-only test with a whole-of-relationship test, making it harder to structure genuine employment as contracting. Under the accessory liability provisions, anyone involved in structuring a sham arrangement can be held liable for every entitlement that should have applied. The defence is evidence the engagement was genuinely independent — not a contract that says so, evidence that it was so.
Five provisions. Five regulators. One thing in common: every one requires evidence that crosses system boundaries. No policy closes that gap. No single system in your stack produces what any of these regulators want to see.
So here's what 2026 looks like
The first criminal wage theft prosecution under Section 327A will land. The Fair Work Ombudsman has the powers and has said publicly they intend to use them. It doesn't matter whether it's your industry or your state. When the first director is charged, every board in the country will ask the same question: could that be us? That's what happened with cybersecurity after the Optus breach — one event turned a theoretical risk into a standing board agenda item overnight. The compliance equivalent is coming.
The first publicised Stop Order will set precedent. The provision is live, but as of early 2026 the FWC has not yet substantively considered a standalone case. Nobody knows what "reasonable" contact actually means, because no case has defined it yet. The first named manager in the press will do for after-hours contact what the first wage theft prosecution will do for payroll governance: make it real.
Auditors will extend cross-system reconciliation beyond care minutes. ASAE 3000 already requires it for aged care. Auditors who've built that methodology — reconciling data across rostering, attendance, and qualification systems — will apply it to payroll compliance, WFM configuration validation, and contractor classification. Once they know how to check across systems in one domain, they check in all of them.
And companies that find problems will have to disclose them. The Woolworths and Bunnings pattern will continue, but the calculus has changed. Criminal provisions mean sitting on a known underpayment is now wilful blindness — exactly how prosecutors establish intent under 327A. Expect more voluntary self-disclosures, more remediation headlines, and more boards asking why the governance infrastructure wasn't there before the problem compounded.
People keep saying they need to "update the policy." They're right — but a policy is a statement of intent. When a regulator, an auditor, or your own board says "prove it," they don't want to read your policy. They want the evidence trail. And that trail runs through the gaps between your systems, exactly where nobody is looking.
The companies building governance infrastructure now will be ready. Everyone else will find out the hard way that 2025 was the setup and 2026 is when it starts to bite.
Note. References: Fair Work Act (s327A criminal wage theft; s333M Right to Disconnect; s15AA Closing Loopholes); ASAE 3000; Aged Care Act (AN-ACC care minutes); Fair Work Ombudsman enforcement (incl. UNSW). General information only, not legal or compliance advice.