Child and Youth Safe Organisations Regulations 2023

The Regulations operate through a small number of interlocking concepts that define entities, trigger reportability, allow specified disclosures, and set infringement penalties. Each concept is implemented by prescription, that is by identifying particular organisations, crimes and recipients that the Act must treat in specified ways.

Recognised Aboriginal organisation and recognised Torres Strait Islander organisation (regulation 4)

• The Regulations make an organisation that is an Aboriginal and/or Torres Strait Islander Community-Controlled Organisation, within the meaning of clause 44 of the National Agreement on Closing the Gap (published July 2020) as amended or substituted, count as a "recognised Aboriginal organisation" or "recognised Torres Strait Islander organisation" for the Act's definitional purposes (reg 4). The concept therefore imports the external, policy-based definition in the National Agreement verbatim by reference, and it is open to change if that external source is amended or replaced.

Prescribed entity; head; relevant entity (regulation 4A)

• The Police Service is prescribed as an entity for the purposes of section 5 of the Act (reg 4A(1)). The Commissioner of Police is prescribed as the head of that entity for the purposes of the Act's definition of "head" (reg 4A(2)). The Police Service is also prescribed as a "relevant entity" where that term is used in the Act (reg 4A(3)). The practical effect is to slot an existing public body directly into the Act's entity taxonomy, and to fix which officeholder will carry powers or responsibilities attached to the head role under the Act.

Prescribed reportable conduct (regulation 5)

• For the purposes of section 7(2)(g) of the Act, the Regulations list particular criminal offences that, when committed against, with or in the presence of a child, are "reportable conduct", irrespective of the status of any criminal proceedings (reg 5). The listed offences are:
  • an offence under Division 270 of the Criminal Code Act 1995 (Commonwealth) (reg 5(a));
  • an offence under section 124A or 125E of the Criminal Code (state) (reg 5(b)), noting the instrument cites section numbers and the Criminal Code title; and
  • an offence under sections 298, 299 or 300 of the state Criminal Code, but only in respect of an offence specified in paragraph (b) (reg 5(c)). The cross-reference structure means the Regulations capture particular state sexual offences as reportable conduct when they correspond to the offences in paragraph (b).

Prescribed persons and purposes for disclosure (regulation 6)

• For the purposes of section 40(3)(k) of the Act, the instrument prescribes that an entity may disclose information to three named oversight bodies: the Health Complaints Commissioner, the Ombudsman and the Custodial Inspector. Each prescription is limited by purpose: disclosure is allowed only for the performance of a function conferred on the named person under their enabling Act or under the Child and Youth Safe Organisations Act (reg 6(a)-(c)). The concept is a delegated information-sharing exception limited to specified statutory functions.

Infringement offences and penalty units (regulation 7)

• The Regulations prescribe offences against certain Act sections as infringement offences for the purposes of section 59 of the Act and fix penalty-unit amounts for those infringement notices (reg 7). Specifically:
  • An offence against section 34(2) of the Act is an infringement offence with a penalty of 24 penalty units (reg 7(a)).
  • An offence against section 45 of the Act is an infringement offence, where the penalty differs by actor: 24 penalty units for a worker and 72 penalty units for an entity or entity regulator (reg 7(b)(i) and (ii)).
  • An offence against section 46 of the Act is an infringement offence, similarly set at 24 penalty units for a worker and 72 penalty units for an entity or entity regulator (reg 7(c)(i) and (ii)).

Administrative facts and procedural conceptions

• The Regulations cite their short title, commencement rule, and administrative allocation. They are displayed and numbered under the Rules Publication Act 1953, were notified in the Gazette on 29 November 2023, and are administered in the Department of Justice. The instrument also carries annotations showing later insertions and rescissions (reg 4A inserted S.R. 2026 No. 18; reg 6A inserted S.R. 2024 No. 79 then rescinded S.R. 2023 No. 82), which are part of its operational history.

In sum, the main conceptual devices are prescription by reference (tying Act definitions to an external agreement), entity nomination (bringing a Police Service within the Act), offence-listing (defining reportable conduct by reference to specified criminal provisions), limited information-sharing permissions, and the conversion of certain Act offences into infringement notice liabilities with specified penalty units.

The Regulations affect a narrow, identifiable set of actors by aligning statutory labels and procedural consequences under the Act.

Entities captured by the Act via prescription

• The Police Service is directly prescribed as an entity and as a relevant entity (regulation 4A(1) and (3)). The effect is that the Police Service, as prescribed, must be treated as any other entity appearing in the Act for responsibilities, reporting, or compliance obligations that apply to entities or relevant entities under the Act. The Commissioner of Police is prescribed as the head of that entity for purposes of the Act's definition of "head" (regulation 4A(2)), which identifies who will exercise any functions or duties the Act attaches to the "head" role for that entity.

Aboriginal and Torres Strait Islander organisations

• Organisations that are Aboriginal and/or Torres Strait Islander Community-Controlled Organisations under clause 44 of the National Agreement on Closing the Gap are prescribed as "recognised Aboriginal organisation" or a "recognised Torres Strait Islander organisation" for purposes of the Act (regulation 4). This prescription affects any provision of the Act that confers rights, obligations, exemptions, or interaction protocols on organisations falling under those recognised labels. In practical terms it affects community-controlled Indigenous organisations that meet the external definition.

Workers and entities subject to infringement notices

• The Regulations identify particular offences under the Act as infringement offences and fix different penalty units depending on whether the offender is a worker or an entity or entity regulator (regulation 7). Where sections 45 and 46 of the Act are contravened, a worker may be liable for 24 penalty units whereas an entity or entity regulator may be liable for 72 penalty units (regulation 7(b) and (c)). An offence under section 34(2) of the Act is prescribed as an infringement offence attracting 24 penalty units for the relevant person (regulation 7(a)). The classification divides liability between individuals in the workforce and corporate or regulator entities.

Organisations required to treat certain criminal offences as reportable conduct

• Any organisation subject to the Act's reporting obligations is required to treat as reportable conduct the offences listed in regulation 5 when committed against, with or in the presence of a child. The Regulations operate irrespective of criminal procedure status, because they state the offences are reportable whether or not criminal proceedings have been commenced or concluded (regulation 5). This affects internal reporting systems, compliance officers, and boards in organisations regulated by the Act.

Oversight bodies authorised to receive disclosed information

• The Health Complaints Commissioner, the Ombudsman and the Custodial Inspector are the persons to whom information may be disclosed under section 40(3)(k) for the performance of their statutory functions (regulation 6). The prescription affects both entities that hold information about reportable incidents and those oversight bodies by creating a permitted pathway to share information for defined functions.

Department of Justice and Gazette readership

• Administratively, the Regulations are administered by the Department of Justice and were notified in the Gazette on 29 November 2023. Entities and practitioners who track commencement and application should note those facts for timing and publication follow-up (regulations 1 and 2, Gazette notation).

Temporal impacts and amendment timing

• The annotations attached to regulation 4A indicate an insertion by S.R. 2026 No. 18 applied 1 April 2026. Regulation 6A has a recorded insertion in 2024 and a rescission annotation applied 27 November 2025. Those applied dates mean the affected stakeholders may have been outside or inside the regime at different times depending on the amendment timeline. Entities must therefore track the applied dates in the annotations to know whether a prescription was operative at a given time.

Who does not appear in the Regulations

• The Regulations do not purport to broaden the Act to other named public bodies beyond those listed. They do not themselves create new criminal offences; they classify certain Act offences as infringement offences and list criminal offences that the Act should treat as reportable. No other sanctioning bodies or private parties are prescribed beyond the named oversight officers.

In short, prescribed entities (Police Service), prescribed recognised Indigenous organisations, entities and workers liable under specified Act provisions, and the three oversight bodies named in regulation 6 are the principal actors materially affected by the Regulations as written.

The Regulations do not independently create the Act's primary duties but clarify which actors, crimes and recipients fall within the Act's obligation and information-sharing structure. The result is a modest set of clarified duties and permitted rights under the Act as implemented.

Duty to treat specified offences as reportable conduct (regulation 5)

• For the purposes of the Act's reporting framework in section 7(2)(g), organisations subject to the Act must treat the offences listed in regulation 5 as "reportable conduct" when those offences are committed against, with or in the presence of a child. The Regulator need not await criminal proceedings because the prescription explicitly applies whether or not criminal proceedings have been commenced or concluded (reg 5). The practical duty flows from the Act's reporting obligations; the Regulations determine what kinds of offending trigger that duty.

Right to disclose to certain oversight bodies (regulation 6)

• Entities and persons subject to the Act gain a statutoryly authorised right to disclose information to three named oversight bodies for the purpose of those bodies performing their statutory functions: the Health Complaints Commissioner, the Ombudsman and the Custodial Inspector. The right is purpose-limited: disclosure is authorised only where it is for a function conferred on the named oversight body under its own enabling Act or under the Child and Youth Safe Organisations Act (reg 6(a)-(c)). The practical right enables sharing of information without breaching the Act's confidentiality prohibitions so long as the disclosure fits the prescribed purpose.

Designation of the Police Service and the Commissioner as an entity and head (regulation 4A)

• By prescribing the Police Service as an entity and the Commissioner as its head, the Regulations require the Police Service to be treated as an entity subject to any duties the Act imposes on entities, and to accept that the Commissioner is the official to whom duties, notifications and powers attaching to the "head" role in the Act will apply (reg 4A). Any rights that accrue to heads under the Act, such as the capacity to give notices or to perform specific functions in relation to that entity, will therefore fall to the Commissioner as prescribed.

Infringement liabilities and actor distinctions (regulation 7)

• The Regulations convert contraventions of specified Act sections into infringement offences for the purposes of section 59 of the Act and fix penalty units. This creates a practical enforcement pathway for the regulator to issue infringement notices rather than initiating prosecution, subject to the Act's section 59 procedures. The Regulations distinguish between worker-level and entity-level liability, fixing higher penalty units for entities or entity regulators than for workers in respect of sections 45 and 46 (reg 7(b) and (c)). The effect is to scale administrative monetary consequences up for organisational actors relative to individuals.

Citation, commencement and administrative facts (regulations 1-2)

• The Regulations provide that they may be cited as the Child and Youth Safe Organisations Regulations 2023 (reg 1) and that they commence on the day their making is notified in the Gazette (reg 2). That fixes who has the administrative duty to track timing and to apply the prescriptions from the notified date.

Limitations and conditionality

• The Regulations frequently operate "for the purposes of" specific Act provisions, meaning the duties and rights they clarify are conditional on the sections of the Act that invoke them. For example, regulation 5 is expressly "for the purposes of section 7(2)(g) of the Act", so the duty to treat an offence as reportable depends on section 7(2)(g) establishing a reporting obligation. The Regulations therefore cannot, standing alone, impose new reporting duties that the Act does not contemplate.

Recordkeeping and compliance implied duties

• While the Regulations do not articulate recordkeeping or procedural steps, the practical requirements they impose (e.g., treating certain offences as reportable; the availability of authorised disclosures) imply that organisations will need processes to identify covered offences, determine when disclosure to the named oversight bodies is lawful for function performance, and to manage the potential for infringement notices under the Act’s enforcement regime.

Taken together, the Regulations narrow and specify who must do what under the Act by identifying the actors and events that will trigger statutory duties and by creating a prescribed disclosure channel and an infringement-notice enforcement option with fixed penalty units.

The Regulations set concrete infringement penalties and identify the mechanism by which certain Act contraventions can be dealt with through infringement notices. They do not create criminal penalties themselves beyond those already in the Act; they instead specify which Act offences can be handled by infringement notice and the penalty-unit values to be applied.

Infringement offence designations (regulation 7)

• For the purposes of section 59 of the Act, the Regulations prescribe the following:
  • An offence against section 34(2) of the Act is an infringement offence carrying a penalty of 24 penalty units (reg 7(a)).
  • An offence against section 45 of the Act is an infringement offence, with a 24 penalty unit liability for a worker and a 72 penalty unit liability for an entity or entity regulator (reg 7(b)(i)-(ii)).
  • An offence against section 46 of the Act is an infringement offence, with 24 penalty units for a worker and 72 penalty units for an entity or entity regulator (reg 7(c)(i)-(ii)).

Actor-differentiated penalties

• The Regulations deliberately scale penalties by actor category. For sections 45 and 46, a worker incurs 24 penalty units whereas an entity or entity regulator incurs 72 penalty units (reg 7(b)-(c)). The threefold higher quantum for an entity or regulator signals a higher administrative monetary exposure for organisational breach than for individual worker-level breach under those particular Act sections.

Infringement notices as enforcement tool

• By prescribing offences as infringement offences for the purpose of section 59 of the Act, the Regulations allow for the practical enforcement route of issuing infringement notices rather than pursuing criminal prosecution for those specified contraventions. The Act's section 59 (not reproduced in the Regulations) will govern the procedures and limitations for issuing infringement notices. The Regulations therefore expand the regulator's toolbox by setting which Act contraventions can attract infringement-based enforcement and the monetary scale applicable.

No new criminal penalties in Regulations

• The Regulations themselves do not create new criminal offences or higher criminal penalties beyond those set in the Act or in other named statutes. Their enforcement role is confined to designating certain Act offences as amenable to infringement notices and setting penalty-unit amounts for those infringement notices.

Compliance risk: entities bear larger exposure

• The fixed penalty units expose entities and entity regulators to larger monetary consequences for contraventions of sections 45 and 46 than individual workers face (reg 7(b)-(c)). Organisations should therefore consider the financial risk of non-compliance, and the potential for repeated infringement notices to aggregate into material administrative costs.

Implementation of penalties dependent on Act processes

• The operationalisation of the infringement regime will depend on the Act's section 59 machinery, including who proposes, issues or withdraws infringement notices, timeframes, appeal or review rights and whether infringement notices preclude or sit alongside other enforcement options. The Regulations do not describe procedural safeguards or remedies for contested infringement notices; those details will lie in the Act.

Administrative enforcement and the Department of Justice

• The Regulations state they are administered in the Department of Justice. That administrative assignment signals which department will be responsible for implementing the regulation, but the Regulations do not allocate enforcement roles between agencies. Enforcement practice will therefore depend on the Act's enforcement design and how the administering department operationalises infringement notices and other compliance responses.

Overall, the Regulations specify a limited, administrable enforcement architecture: a subset of Act contraventions may be dealt with by infringement notice and the instrument fixes the penalty quantum for those infringement notices, with higher financial exposure for entities than for individual workers for certain contraventions.

The Regulations are constructed to operate only in conjunction with the Child and Youth Safe Organisations Act 2023 and by cross-reference to a small number of other statutes and an intergovernmental policy document. The instrument relies on those texts to identify who is covered, which offences trigger reporting and which oversight bodies may receive disclosed information.

Dependence on the Act

• Each operative provision in the Regulations is framed "for the purposes of" a specified section of the Act (for example, regulation 4 refers to the Act's definitions of recognised Aboriginal and Torres Strait Islander organisations; regulation 4A refers to section 5 and section 4 of the Act; regulation 5 refers to section 7(2)(g); regulation 6 refers to section 40(3)(k); regulation 7 refers to section 59). The Regulations therefore do not create independent law but supply the detailed content that the Act requires to operate. Any reader must consult the Act for the substantive duties, powers, procedural mechanisms and any definitions not filled in by the Regulations.

Cross-references to Commonwealth and state Criminal Codes

• Regulation 5 makes explicit cross-jurisdictional references to:
  • Division 270 of the Criminal Code Act 1995 (Commonwealth) (reg 5(a));
  • sections 124A and 125E of the state Criminal Code as cited (reg 5(b)); and
  • sections 298, 299 and 300 of the state Criminal Code insofar as they relate to the offences in reg 5(b) (reg 5(c)).
• These references mean that the Act's reportability rules will import definitions and elements from both Commonwealth and state criminal statutes. Where the criminal definitions, elements or thresholds are amended in those codes, the scope of what counts as reportable conduct under the Act may change accordingly, unless the Regulations are updated.

Reference to the National Agreement on Closing the Gap

• Regulation 4 prescribes the definition of "recognised Aboriginal organisation" and "recognised Torres Strait Islander organisation" by reference to clause 44 of the National Agreement on Closing the Gap, published by the Department of the Prime Minister and Cabinet of the Commonwealth in July 2020, "as amended or substituted from time to time" (reg 4). This creates a living link to an intergovernmental agreement. If the National Agreement or clause 44 is amended or replaced, the population of organisations treated as "recognised" under the Act will change automatically in line with the external document, absent further amendment of the Regulations.

Overlap with oversight statutes

• Regulation 6 prescribes permitted disclosures to three oversight officers and ties the authorised disclosures to the functions those officers perform under their enabling statutes or the Child and Youth Safe Organisations Act. The enabling Acts cited are the Health Complaints Act 1995, the Ombudsman Act 1978 and the Custodial Inspector Act 2016. Disclosure permissions therefore operate at the intersection of the Act, the Regulations and those oversight statutes. Practically, disclosure will be permitted only where the disclosure aligns with functions those Acts confer on the named officers.

Administrative law and delegated legislation context

• The Regulations are subordinate instruments enacted under the relevant legislative head of power in the Act (the Regulations themselves do not restate that power). They are displayed and numbered under the Rules Publication Act 1953 and have Gazette notification details. Any challenge to the Regulations' validity would turn on the empowering provisions of the Act and administrative law doctrine; the Regulations themselves do not provide interpretive rules beyond their prescriptions.

Potential for future interaction via amendment annotations

• The annotations to regulation 4A and regulation 6A show that the Regulations can and have been amended by subsequent subordinate instruments (S.R. 2026 No. 18; S.R. 2024 No. 79; S.R. 2023 No. 82). Those amendment instruments are separate statutory instruments which themselves interact with the Act and other statutes. Users must therefore check the consolidated instrument and applied dates to determine current law.

In short, the Regulations operate as a connector between the Act and particular criminal statutes, certain oversight bodies' enabling Acts, and an external intergovernmental agreement. They do not create new substantive criminal law but align the Act's reporting and disclosure architecture with other legal instruments.

The Regulations include explicit annotations recording insertions and rescissions made by later statutory rules. Those annotations are the authoritative amendment history contained within the instrument.

Original instrument and Gazette notification

• The Regulations were notified in the Gazette on 29 November 2023, which, under regulation 2, is the commencement trigger. The instrument is cited as the Child and Youth Safe Organisations Regulations 2023 (regulation 1). The Regulations are administered by the Department of Justice. The instrument's initial content is current as at the Gazette notification.

Recorded insertions and rescissions

• Regulation 4A carries an insertion annotation: "[Regulation 4A Inserted by S.R. 2026, No. 18, Applied: 01 Apr 2026]" (immediately above the text of regulation 4A). The inserted regulation prescribes the Police Service as an entity and the Commissioner of Police as the head, and prescribes the Police Service as a relevant entity for the purposes of the Act (regulation 4A(1)-(3)). The annotation indicates the instrument was modified by S.R. 2026 No. 18 and that the amendment was applied from 1 April 2026.

• Regulation 6A contains two annotations. The first reads "[Regulation 6A Inserted by S.R. 2024, No. 79, Applied: 27 Nov 2024]" indicating it was inserted by S.R. 2024 No. 79 and applied on 27 November 2024. The second annotation reads "[Regulation 6A Rescinded by S.R. 2023, No. 82, Applied: 27 Nov 2025]". The presence of a rescission annotation means regulation 6A was removed by a later instrument S.R. 2023 No. 82 applied 27 November 2025. Note that these inserted and rescinded annotations are recorded verbatim in the instrument and should be read in conjunction with applied dates to determine the effective windows for regulation 6A.

Implications of "as amended or substituted from time to time" language

• Regulation 4 prescribes organisations "within the meaning of clause 44 of the National Agreement on Closing the Gap ... as amended or substituted from time to time". That phrasing imports future amendments to the National Agreement into the Regulations' operation without separate amendment to the Regulations. It therefore creates an amendment pathway by reference rather than by direct subordinate instrument; the set of organisations covered may change when the National Agreement is changed.

Administrative responsibility for amendments

• The Regulations are administered in the Department of Justice. The Department will therefore be the primary administrative contact for consolidated versions, amendment proposals and for public advice about changes to the Regulations. However, amendments themselves are effected by statutory rules such as S.R. numbers recorded in the annotations.

What the amendment record does not show

• The Regulations include no narrative explanatory memorandum or second reading speech text in the instrument itself. The annotation entries record the provenance and applied dates for amendments but do not describe the policy rationale behind them. The instrument therefore supplies an audit trail of textual change but not the policy documents that motivated the changes.

Practical consequence

• Users must consult the consolidated version of the Regulations and check the annotation applied dates to understand whether a given provision was in force at a particular time. The presence of applied dates for inserted or rescinded provisions (for example the 1 April 2026 applied date for regulation 4A) is determinative of whether the change is already operative.

In summary, the Regulations have a compact amendment history recorded within the instrument, comprising at least one later insertion (reg 4A) and an insertion-plus-rescission episode for a repealed provision (reg 6A). The Regulations also incorporate by reference an external document with its own amendment power, which further affects the effective coverage of the instrument over time.

The Regulations themselves do not record any litigation history. They contain no references to judicial decisions, no case citations, and no mention of judicial interpretation or challenge. The instrument therefore provides no direct record of litigation that has interpreted, applied or contested its provisions.

What the absence of litigation history implies

• Because the Regulations are recent subordinate legislation with limited scope, and because the instrument only prescribes entities, offences and disclosure recipients for the purposes of the Act, there may be few opportunities for immediate case law to develop solely on the text of the Regulations. Any judicial contestation likely would arise in the context of an application of the Act where the Regulations' prescriptions are in dispute, for example where parties contest whether a particular offence falls within the listed offences in regulation 5, or where a disclosure to a named oversight body is challenged as outside the permitted purpose in regulation 6.

Potential avenues for future litigation (logical possibilities, not recorded in the instrument)

• Disputes could involve:
  • Interpretation of the cross-references to criminal offences, such as whether a particular set of facts satisfies the elements of an offence in Division 270 of the Commonwealth Criminal Code or sections referenced in the state Criminal Code as cited in regulation 5.
  • Whether a particular organisation truly qualifies as an Aboriginal and/or Torres Strait Islander Community-Controlled Organisation under clause 44 of the National Agreement, given that regulation 4 imports clause 44 by reference.
  • Whether a disclosure made to a named oversight body fell within "the performance of a function conferred on" that oversight officer under their enabling Act or the Act, as required by regulation 6.
  • Procedural fairness or administrative law challenges to the issuance of infringement notices as authorised by regulation 7 and section 59 of the Act.

Limitations on predicting outcomes

• The Regulations do not provide doctrinal materials, precedents or interpretive guidance. Any mention here of possible dispute areas is descriptive of conceivable legal questions that arise from the structure of the instrument; it is not an account of existing litigation, because the Regulations contain none.

Practical note for practitioners

• Absent recorded litigation, practitioners and compliance officers should treat the Regulations as an authoritative statement of the current delegated law and be attentive to how tribunals and courts might construe the cross-referenced criminal statutes and the National Agreement when those matters are litigated in the future. Keep track of any cases that arise under the Act that cite the Regulations and monitor administrative releases from the Department of Justice.

In short, the instrument itself contains no litigation history. Any judicial developments will be external to the Regulations and will need to be tracked as the Act and Regulations are applied in practice.

The Regulations are short and precise, but a number of practical traps and implementation risks arise from the way the instrument operates by cross-reference and by actor-differentiated penalties. These are concrete points to watch for when advising clients or implementing compliance programmes.

1. Living reference to the National Agreement on Closing the Gap (regulation 4)

• Regulation 4 prescribes recognised Indigenous organisations by reference to clause 44 of the National Agreement "as amended or substituted from time to time". That language imports future changes without separate amendment to the Regulations. If a client relies on a static list or an archived version of clause 44, they may be treating the scope as fixed when it is not. Compliance processes must therefore track updates to the National Agreement and to clause 44 in particular.

2. Cross-jurisdictional offence references (regulation 5)

• The list of reportable offences in regulation 5 includes Division 270 of the Commonwealth Criminal Code and particular sections of the state Criminal Code. Determining whether an incident triggers the reporting duty requires mapping the facts against the elements of those offences, which may be set out in different statutes with differing elements and definitions. An organisation cannot simply rely on generic descriptors such as "sexual offence" without checking the statutory wording of the cited provisions.

3. Reportability irrespective of criminal proceedings (regulation 5)

• The Regulations make specified offences reportable whether or not criminal proceedings have commenced or concluded. Entities that adopt a policy of waiting for police action before internal reporting will be non-compliant if the Act imposes a reporting duty that the Regulations bring into scope. Compliance frameworks must therefore be able to act pre-trial on reportable events.

4. Prescribing Police Service as entity and Commissioner as head (regulation 4A)

• Regulation 4A prescribes the Police Service as an entity and the Commissioner as the head. That raises practical questions about how a policing body will meet duties typically applied to private or non-police public entities, for example governance, reporting and remediation obligations under the Act. The regulation fixes who occupies the "head" role but does not elaborate how policing administrative structures will adapt. Entities engaging with police bodies should check internal protocols for interacting with the Commissioner in the context of the Act.

5. Information disclosure limited to statutory functions (regulation 6)

• Regulation 6 allows disclosures to the Health Complaints Commissioner, the Ombudsman and the Custodial Inspector, but only for the performance of functions conferred by their enabling Acts or the Child and Youth Safe Organisations Act. Organisations contemplating wider information-sharing should not assume the prescription authorises disclosure for ancillary or investigatory purposes outside those statutory functions. A disclosure that falls outside the permitted purpose could risk breaching confidentiality obligations under the Act.

6. Asymmetry in penalty units between workers and entities (regulation 7)

• Regulation 7 sets 24 penalty units for workers and 72 penalty units for entities or entity regulators for contraventions of sections 45 and 46 of the Act. Entities should be aware that organisation-level breaches carry a much larger monetary exposure. This asymmetry may influence how regulators prioritise enforcement, how insurers respond to incidents, and how organisations allocate compliance resources.

7. Temporal complexity in amendment annotations (regulation 6A, 4A)

• The annotations show insertions and rescissions with different applied dates. For example, regulation 4A was inserted with an applied date of 1 April 2026, whereas the main instrument commenced on 29 November 2023. Regulation 6A shows an insertion and rescission with different S.R. numbers and applied dates. Practitioners must check the consolidated, current version and the applied dates of amendments rather than relying on the print date of an earlier copy.

8. No procedural detail for infringement notices in the Regulations (regulation 7)

• The Regulations designate certain contraventions as infringement offences and fix penalty units but do not contain procedural safeguards or mechanisms for disputing an infringement notice. Appealing or contesting an infringement notice will depend on the procedures in the Act or other administrative law avenues, so entities should plan for remedies outside the Regulations.

9. Narrow list of disclosure recipients (regulation 6)

• Only three oversight officers are listed as authorised recipients for information disclosures under section 40(3)(k). Organisations that may need to share information with other regulatory or welfare bodies should not assume regulation 6 covers those recipients. They should map disclosure permissions elsewhere in the Act or in other statutes to avoid unauthorised disclosures.

10. Reliance on other Acts without text in the instrument

• The Regulations cite sections from the Act and from other statutes, but they do not reproduce those other statutes. Practitioners must consult the Criminal Code Act 1995 (Cth), the state Criminal Code, the Health Complaints Act 1995, the Ombudsman Act 1978, the Custodial Inspector Act 2016 and the Child and Youth Safe Organisations Act 2023 to understand the full scope and interplay. Failure to consult those texts can lead to misapplication of the Regulations' prescriptions.

Addressing these gotchas requires careful cross-referencing, up-to-date monitoring of external documents (National Agreement, criminal statutes), and integrating the Regulations into a broader compliance architecture rather than treating them as a standalone rulebook.

Compliance with these Regulations will require targeted, documentable steps because the instrument functions largely by prescription and cross-reference. Below are steps an entity, employer, regulator or compliance officer should take to operationalise the Regulations' prescriptions.

1. Confirm whether your organisation is within the Act's scope

• Review the Child and Youth Safe Organisations Act 2023 to determine whether your organisation is an "entity" or a "relevant entity" under the Act. If your organisation is the Police Service or interacts with it, note that regulation 4A prescribes the Police Service as an entity and the Commissioner as the head for specified purposes (reg 4A(1)-(3)). For Indigenous organisations, check whether you qualify as an Aboriginal and/or Torres Strait Islander Community-Controlled Organisation under clause 44 of the National Agreement, because if so you are prescribed as a "recognised Aboriginal organisation" or "recognised Torres Strait Islander organisation" for Act purposes (reg 4).

2. Update reportable conduct policies and reporting triggers

• Incorporate regulation 5 into your reportable conduct policy. Ensure that staff and compliance officers treat:
  • offences under Division 270 of the Commonwealth Criminal Code;
  • offences under state Criminal Code sections 124A and 125E; and
  • offences under state Criminal Code sections 298, 299 and 300 insofar as they relate to the offences specified in paragraph (b), as reportable conduct when committed against, with or in the presence of a child, and do so irrespective of whether criminal proceedings have commenced or concluded (reg 5). Update internal forms, incident classification workflows, and intake triage scripts to flag these statutory references.

3. Train staff on how statutory cross-references operate

• Provide legal or compliance training to relevant staff (HR, child safety officers, legal counsel) so they can map factual allegations to the statutory elements of the cited offences. Given the cross-jurisdictional nature of the references, ensure training covers both the Commonwealth Criminal Code Division 270 and the relevant sections of the state Criminal Code.

4. Define authorised disclosure channels and purposes

• Implement and document procedures for disclosing information to the three oversight bodies named in regulation 6. Confirm that any disclosure to the Health Complaints Commissioner, the Ombudsman, or the Custodial Inspector is made only for the performance of a function conferred on that officer under their enabling Act or the Child and Youth Safe Organisations Act (reg 6(a)-(c)). Create checklists for officers to verify that the disclosure aligns with an authorised function before sharing information.

5. Reassess governance and who exercises the "head" role

• If your organisation is the Police Service or interacts with it, confirm whether notices or functions that the Act assigns to "heads" will be carried out by the Commissioner as prescribed by regulation 4A(2). Where other organisations have different internal governance structures, ensure the identity of the "head" is fixed in governance documents to minimise ambiguity about delegation and accountability.

6. Prepare for infringement notice risk

• Because regulation 7 prescribes infringement offences and fixes penalty units, update risk registers and incident response policies to reflect the monetary exposure: 24 penalty units for workers in specified contraventions and 72 penalty units for entities or entity regulators in respect of sections 45 and 46 (reg 7(b)-(c)). Ensure that incident reporting timelines and remedial action plans prioritise matters that could trigger these infringement liabilities. Consult the Act to determine the procedural safeguards and appeal avenues for infringement notices under section 59.

7. Maintain a compliance calendar for external references

• Track changes to referenced instruments: the National Agreement on Closing the Gap (clause 44) and the criminal statutes cited in regulation 5. Because regulation 4 imports clause 44 "as amended or substituted from time to time", keep a standing process to monitor the National Agreement for changes that affect recognised organisations. Also monitor amendments to Division 270 of the Commonwealth Criminal Code and the state Criminal Code sections cited in regulation 5.

8. Recordkeeping and evidence trails

• Keep contemporaneous records demonstrating how your organisation determined that an incident met the statutory criteria for reportable conduct and any decision to disclose information to a named oversight body for a permitted function. Where an infringement notice is issued, retain documentation of internal investigations, remedial actions and rationale for any non-disclosure decisions. These records will support administrative reviews or appeals if enforcement action is taken.

9. Liaise with insurers and legal counsel

• Notify relevant insurers that the Regulations expose entities to higher infringeable penalties for certain contraventions. Seek legal advice on whether your insurance covers regulatory fines or infringement notices. Obtain counsel on incident-handling protocols that balance obligations to report under the Act with privacy, criminal investigation needs and staff rights.

10. Stay up to date with consolidated legislation and administrative guidance

• Use the Department of Justice as the administrative contact point for the Regulations and consult consolidated versions of the Regulations to ensure you are working with the current law, including applied dates for inserted or rescinded provisions (for example, regulation 4A’s applied date of 1 April 2026) and any changes to provisions such as the now-rescinded regulation 6A. If the Department issues guidance or forms, incorporate that material into your compliance programme.

By following these concrete steps,mapping coverage, updating policies, training staff, documenting decisions and monitoring external references,entities can translate the Regulations’ prescriptions into operational compliance. The essential tasks are legal classification of incidents against the cited offence provisions, ensuring authorised disclosures are purpose-limited, and managing the financial and administrative exposure created by the fixed penalty units for infringement notices.