Working with Vulnerable People (Background Checking) Regulation 2012

Role-based registration. The Act establishes a system where a person can be registered for a specific role with a particular employer, rather than holding a general clearance. The Regulation gives content to this concept by requiring the employer to supply a statement of activities and a risk management strategy. Role-based registration is narrower than a clearance-based registration and ties the person’s authorisation to the employer’s operational context. The Commissioner presumably uses the risk management strategy to assess whether the employer’s safeguards are adequate before approving the registration. The obligation under section 6 to notify changes means that role-based registration is not static; the conditions can shift as the employer’s activities or risk controls change.

Risk management strategy. This is the core compliance document under the Regulation. Section 5(2) defines it in detail: it must contain a statement of commitment to vulnerable people’s safety and wellbeing, a code of conduct for engaged persons, policies and procedures for handling complaints and reporting incidents or suspicions of harm, a discipline policy for breaches, compliance policies and procedures (including implementing and reviewing the strategy, and keeping written records such as expiry dates of role-based registrations), and strategies for communication and support including training materials that help identify risks and instruct how to handle disclosures. The strategy is not a one-off document; the compliance procedures must include review. The employer bears the cost of drafting, maintaining, and implementing this document. For a small community organisation or sole trader, the prescriptive list may represent a significant compliance burden relative to the scale of the operation.

Corresponding law. The Act uses this term to recognise interstate background-checking regimes. Section 7 prescribes seven specific laws: the New South Wales Child Protection (Working with Children) Act 2012, the Victorian Worker Screening Act 2020, the Queensland Working with Children (Risk Management and Screening) Act 2000, the Western Australian Working with Children (Screening) Act 2004, the South Australian Child Safety (Prohibited Persons) Act 2016, the Tasmanian Registration to Work with Vulnerable People Act 2013, and the Northern Territory Care and Protection of Children Act 2007. These laws are recognised “as in force from time to time,” meaning that amendments to those laws are automatically captured without amending the Regulation. The practical effect is that a negative notice or cancellation under any of these interstate laws must be disclosed by an applicant under section 4A, and presumably can be considered by the Commissioner when determining an application under the Act.

Negative notice. The term appears in section 4A but is defined only by reference to “however described” under a corresponding law. It captures any interstate equivalent of an adverse screening determination that prevents a person from working with vulnerable people. The Regulation does not create a uniform definition; it relies on each corresponding law’s own terminology (e.g., “prohibited order,” “negative notice,” “disqualification order”). This creates a potential gap where an interstate scheme has no exactly analogous notice but still prohibits the person from working. The applicant must nonetheless report it, and the Commissioner must assess it using the Act’s own criteria.

Role-based registration information. Section 5 introduces two prescribed pieces of information the employer must supply: a statement of activities and the risk management strategy. The Act’s section 42B(3) requires only “the information prescribed by regulation.” This means the Commissioner cannot demand anything beyond these two items as a condition of processing a role-based registration application, though the Commissioner could presumably request additional information informally. The statement of activities is not defined further, so its scope is left to the employer’s description, but it must be specific enough to allow the Commissioner to assess whether the activity is a regulated activity and what conditions might be needed.

The Regulation directly affects three categories of persons and entities: applicants for registration involving children, employers who engage persons under role-based registration, and the Commissioner (as the administering official). Indirectly, it affects vulnerable people (children and other vulnerable persons) who are the intended beneficiaries of the background-checking scheme, though the Regulation itself imposes no duties on them.

Applicants for registration to engage in regulated activity involving children. Section 4A adds an extra disclosure step not required for applicants working only with vulnerable adults. Before the Commissioner can consider the application, the applicant must provide a written statement about any interstate negative notice or cancellation. This applies only to applicants for registration involving children, not to those seeking adult-only registration. The cost of compliance is minimal (preparing a truthful statement), but the risk of non-disclosure could be significant: if the applicant fails to disclose a prior interstate negative notice and the Commissioner later discovers it, the Act’s provisions on false or misleading information could apply, potentially leading to refusal or cancellation of registration.

Employers. This is the group most affected by the Regulation. Employers who wish to engage a person under role-based registration must prepare and maintain a risk management strategy meeting the eight detailed requirements in section 5(2). That strategy must include policies, procedures, training materials, and record-keeping systems. The employer must also provide a statement of the activities the person will perform. Once the role-based registration is in place, the employer must monitor for changes and notify the Commissioner under section 6 if there is a change in program or activity likely to affect the registration conditions, or a change in the information previously given. This ongoing duty imposes a continuous compliance monitoring cost. For a large organisation (e.g., a government department or a hospital) the cost may be absorbed into existing human resources functions; for a small community sports club or a sole practitioner, the burden may be disproportionate. The Regulation does not exempt any employer based on size or sector, so the same prescriptive requirements apply across the board.

Commissioner. The Commissioner is the recipient of the information and notifications created by sections 4A, 5, and 6. The Regulation gives the Commissioner a clearer basis for assessing child-related applications (by mandating the interstate disclosure) and for administering role-based registrations (by defining the information the employer must provide and the changes that must be reported). The list of corresponding laws in section 7 tells the Commissioner which interstate screening outcomes must be recognised. This reduces discretion to some degree: if a negative notice under a corresponding law exists, the Commissioner must consider it; but the Regulation does not dictate what weight to give it, so residual discretion remains.

Interstate coordination bodies. By prescribing specific interstate laws, the Regulation affects the administrative coordination between ACT and other jurisdictions. When an interstate law is amended, the change is automatically captured (because the reference is “as in force from time to time”), which may create operational pressure on the Commissioner to keep up with amendments in seven other jurisdictions. This is an administrative burden that falls on the ACT government, but it reduces uncertainty for applicants and employers because they do not need to rely on the Regulation being updated every time another state changes its law.

Duty to disclose interstate negative notices and cancellations (applicant). Under section 4A, an applicant for registration involving children must provide a written statement about whether the applicant has ever received a negative notice under a corresponding law for child-related regulated activity, or had their registration cancelled under such a law. This is a prescribed requirement for a valid application; the Act’s section 18(2)(d) allows the regulation to prescribe such statements. The duty is not ongoing; it applies at the time of the application only. The applicant has no duty to disclose interstate notices received after the application, though the Act may require that separately.

Duty to provide information for role-based registration (employer). Section 5(1) prescribes two pieces of information the employer must give to the Commissioner under section 42B(3) of the Act: a statement about the activities the person will be engaged in, and the employer’s risk management strategy. The employer must provide this at the time of applying for role-based registration. The section does not say the employer must provide the information again unless there is a change (covered by section 6), but the risk management strategy itself must include policies for implementing and reviewing it, implying periodic updating.

Duty to maintain a prescribed risk management strategy (employer). The risk management strategy must contain the eight elements listed in section 5(2): a commitment statement, code of conduct, complaint handling procedures, discipline policy, compliance policies and procedures (including review and record-keeping), and communication and training strategies. The employer must actually have such a document; merely saying one exists is not enough if the Commissioner requests it. The duty is ongoing because the strategy must be reviewed under the compliance procedures.

Duty to notify changes (employer). Section 6 imposes a notification duty on the employer if two conditions are met: the employer engages a person in a regulated activity, and the person has role-based registration. The employer must give written notice to the Commissioner of (a) a change in program or regulated activity that is likely to affect the registration conditions, and (b) a change in the information previously given under section 5 (i.e., the statement of activities or the risk management strategy). The duty is triggered by a change that is “likely to affect” the conditions of registration. This requires the employer to make a judgment call; an overly cautious interpretation could lead to reporting trivial changes, while an overly narrow one could risk non-compliance. The duty is not time-limited; the employer must give notice promptly after the change occurs.

Rights of the applicant and employer. The Regulation does not create any rights directly; it only imposes duties. However, by specifying what information the Commissioner can require under sections 4A and 5, the Regulation implicitly limits the Commissioner’s power to demand other information for those purposes. An applicant or employer can argue that the Commissioner is not entitled to insist on additional written statements or documents beyond what the Regulation prescribes. Similarly, by listing the corresponding laws, section 7 gives an applicant the right to have a negative notice or cancellation under only those laws considered; an equivalent order under a law not listed may not qualify, which could be either an advantage or disadvantage depending on the circumstance.

The Regulation itself does not create penalties; it operates by reference to the Act. The primary enforcement mechanism is found in section 71 of the Working with Vulnerable People (Background Checking) Act 2011, which section 6 of the Regulation supplements by specifying what obligations of employers are prescribed for the purposes of subsection 71(2)(b). That subsection makes it an offence for an employer to fail to comply with prescribed obligations. The maximum penalty is not specified in the Regulation but is presumably set in the Act; the republication endnote states that the value of a penalty unit at the date of republication is $160 for an individual and $810 for a corporation, under the Legislation Act 2001.

The specific duties in sections 5 and 6 of the Regulation, if breached, could therefore give rise to an offence. For example, if an employer fails to provide the prescribed information (the statement of activities and risk management strategy) when applying for role-based registration, or fails to notify a change under section 6, the employer may be liable for a penalty. The Act’s section 71(2)(b) is broad; the Regulation merely fills in what the prescribed obligations are.

Enforcement is the responsibility of the Commissioner, who can investigate non-compliance and may refer matters for prosecution. The Commissioner also has administrative tools: the Act empowers the Commissioner to refuse or cancel registration, and non-disclosure under section 4A could lead to such administrative action even without a criminal prosecution.

The Regulation does not specify any civil penalty regime; enforcement appears to be through criminal sanctions and administrative action. There is no private right of action for affected vulnerable people under the Regulation; it is a public law regime enforced by the state.

The amendment history shows that previous versions of section 4A had expiry dates; the current version does not. This means that the disclosure obligation for child-related applicants is now permanent, and the risk of prosecution for non-compliance is ongoing. Employers should note that the duty under section 6 is an ongoing one; failure to update the Commissioner when a change occurs could lead to liability.

Working with Vulnerable People (Background Checking) Act 2011. The Regulation is made under this Act and derives its authority from it. Every section references a specific provision of the Act: section 4A relates to Act section 18(2)(d); section 5 relates to Act section 42B(3); section 6 relates to Act section 71(2)(b); section 7 relates to the definition of “corresponding law” in the Act’s dictionary. The Regulation cannot expand or contradict the Act; it only prescribes matters that the Act leaves to regulation. If the Act were amended to remove the regulation-making power for any of these provisions, the corresponding section of the Regulation would become inoperative.

Legislation Act 2001. The Regulation is a subordinate law under the Legislation Act. The dictionary (section 3) notes that definitions in the Legislation Act apply. The note to section 4 explains that notes in the Regulation are explanatory and not part of the regulation, pursuant to section 127(1), (4), and (5) of the Legislation Act. The dictionary also confirms that terms used in the Regulation have the same meaning as in the Act, by operation of section 148 of the Legislation Act. The penalty unit values are set under the Legislation Act, not the Regulation.

Corresponding laws prescribed by section 7. The Regulation lists seven interstate laws that are recognised as corresponding laws for the purposes of the Act. This means that negative notices, cancellations, and similar determinations under those laws are to be taken into account under the ACT scheme. The reference “as in force from time to time” means that amendments to those laws are automatically incorporated without amending the Regulation. Potential conflicts could arise if an interstate law uses different definitions of “vulnerable person” or “regulated activity”; the Regulation does not resolve those differences, leaving it to the Commissioner to apply the ACT Act’s definitions. The list does not include any laws from other countries or territories (e.g., New Zealand, the United Kingdom), so overseas screening outcomes are not captured as corresponding laws.

Other ACT laws. The dictionary at the end of the Regulation references the Legislation Act but does not mention other ACT laws such as the Human Rights Act 2004 or the Discrimination Act 1991. However, the Act itself may be subject to those instruments, and the Regulation’s operation must not conflict with them. For example, requiring disclosure of an interstate negative notice that was based on a mental health condition could raise discrimination issues. The Regulation does not address this.

Regulatory overlap. The Regulation does not duplicate or replace any other background-checking regime; it is specific to the ACT scheme. However, an entity that operates across borders may need to comply with multiple corresponding laws simultaneously. For example, an employer in the ACT who also operates in NSW must ensure its risk management strategy meets the ACT Regulation’s requirements and also comply with NSW obligations under the Child Protection (Working with Children) Act 2012 (NSW). The Regulation does not harmonise those obligations; it merely recognises NSW law as a corresponding law.

The Regulation was originally made on 6 February 2012 (SL2012-4) and commenced on 8 November 2012, except for sections 1 and 2 which commenced on notification. It has been amended five times, plus one indirect amendment.

A2019-13: Working with Vulnerable People (Background Checking) Amendment Act 2019. This Act amended the dictionary of the Regulation. The amendment commenced on 1 February 2021 after a later commencement order. The exact dictionary changes are not detailed in the source, but the amendment history indicates a reference to “amdt 1.5”.

SL2020-18: Working with Vulnerable People (Background Checking) Amendment Regulation 2020 (No 1). Notified 5 May 2020, remainder commenced 6 May 2020. This regulation inserted section 4A (application for registration - written statement about applicant status under corresponding law) with an expiry date of 6 May 2021. It was a temporary measure, likely intended to address a perceived gap during the COVID-19 period.

A2020-14: COVID-19 Emergency Response Legislation Amendment Act 2020. This Act amended A2019-13 (the 2019 Amendment Act) itself, specifically amending the commencement provisions of that Act to delay the commencement of the dictionary amendments to 1 February 2021. This is an unusual procedural amendment that indirectly affected the Regulation by changing the date on which the dictionary changes came into effect.

A2020-29: Working with Vulnerable People (Background Checking) Amendment Act 2020. This Act amended section 5 (heading and text) and section 6 of the Regulation. The heading of section 5 was substituted, and the section was amended by amendments 1.21 and 1.22, with paragraphs renumbered by the LA (Legislation Act) upon republication. Section 6 was amended by amendment 1.23. These changes commenced on 1 February 2021, aligning with the delayed commencement of A2019-13.

SL2021-22: Working with Vulnerable People (Background Checking) Amendment Regulation 2021 (No 1). Notified 22 September 2021, remainder commenced 23 September 2021. This regulation reinserted section 4A after its expiry on 6 May 2021, with a new expiry date of 29 September 2023. Again, a temporary measure.

A2025-39: Working with Vulnerable People (Background Checking) Amendment Act 2025. Notified 15 December 2025, part 3 commenced 16 December 2025. This is the most recent amendment. It inserted section 7 (corresponding laws) and reinserted section 4A (application for registration - written statement). Importantly, the amendment history does not show an expiry clause for this insertion of section 4A, unlike the previous two temporary insertions. This suggests that section 4A is now intended to be permanent. Section 7 is entirely new, providing the list of seven corresponding laws.

The source text - the republished Regulation and its endnotes - contains no reference to any legal proceedings, court cases, or tribunal decisions involving the Regulation. This is unsurprising because regulations of this type rarely generate direct litigation; challenges typically arise under the primary Act. The Regulation itself is a procedural and prescriptive instrument that is unlikely to be independently challenged unless it exceeds the regulation-making power under the Act.

There is no mention of any judicial consideration of section 4A, 5, 6, or 7 in the endnotes. The amendment history does not indicate that any provision was amended in response to a court ruling. The absence of litigation history does not mean the Regulation has been uncontroversial; it may simply mean that disputes have been resolved administratively by the Commissioner or through internal review mechanisms under the Act.

Parties affected by the Regulation could potentially seek judicial review if the Commissioner misapplied the prescribed requirements. For example, if an employer disputes that a change was “likely to affect” the conditions of registration under section 6, and the Commissioner prosecutes the employer for failing to notify, the courts would need to interpret that phrase. Or if an applicant argues that a particular interstate order is not a “negative notice” for the purposes of section 4A, that could be litigated. However, no such cases are recorded in the source.

The Regulation’s dictionary also defines “risk management strategy” in detail, but there is no case law interpreting what constitutes compliance with each element. This leaves employers in some uncertainty about the exact standard the Commissioner will apply.

Section 4A is now permanent but its history of temporary insertion may cause confusion. The current version of section 4A, inserted by A2025-39 on 16 December 2025, has no expiry clause. However, many practitioners may have become accustomed to treating it as a temporary measure based on its 2020 and 2021 incarnations, which expired after about a year and two years respectively. An applicant who works only with adults may assume the obligation does not apply to them; it does not - section 4A only covers applications involving children. But someone with interstate dealings might overlook the disclosure requirement if they are inattentive to the most recent amendment.

The definition of “risk management strategy” is prescriptive and any missing element could invalidate the document. Section 5(2) lists eight distinct content requirements. An employer who drafts a simple policy statement without, for example, a specific code of conduct or explicit discipline policy may not satisfy the Regulation. The term “risk management strategy” might suggest a less formal document, but the Regulation gives it a specific meaning. The Commissioner could reject the role-based registration application if the strategy does not cover all eight items. This is a trap for organisations that treat the strategy as a generic OHS risk document rather than a compliance-specific one.

The notification duty under section 6 is triggered by changes “likely to affect the conditions of role-based registration.” This is vague. What constitutes a change “likely to affect” conditions? A change from one regulated activity to another regulated activity might affect conditions; a change in shift hours might not. An employer must make a judgment call without clear guidance. Over-reporting every minor change wastes resources; under-reporting risks an offence. The Regulation gives no examples, so employers must rely on the Commissioner’s guidance (if any) or take a conservative approach.

Corresponding laws are “as in force from time to time,” but only those specifically listed. Section 7 lists seven interstate laws. If a person has a negative notice under a law of the Commonwealth (e.g., the Disability Services Act) or a law of another country (e.g., New Zealand’s Children’s Act), it is not a corresponding law. The applicant is not required to disclose it under section 4A, and the Commissioner presumably cannot consider it. This creates a gap: a person with a serious adverse screening outcome in a non-prescribed jurisdiction could still apply for registration in the ACT without disclosure. However, the Act may still allow the Commissioner to consider other information under general provisions.

The dictionary is sparse and relies heavily on cross-references. The Regulation’s dictionary (section 3 and the dictionary at the end) does not define many terms; it refers to the Act and the Legislation Act. For example, “regulated activity” is defined in the Act’s section 8, not in the Regulation. An employer trying to understand the Regulation alone cannot get the full picture; they must read the Act simultaneously. This increases the compliance burden.

Penalty unit values are not fixed in the Regulation. The Regulation does not state the penalty for non-compliance; one must look to the Act’s section 71 and the Legislation Act’s section 133 for the current penalty unit amount. At the republication date, it was $160 for an individual and $810 for a corporation per penalty unit. If the Act sets a maximum of, say, 20 penalty units, the fine could be $3,200 for an individual and $16,200 for a corporation. These amounts can change without amending the Regulation, so a duty-holder must stay alert to inflation adjustments.

For applicants for registration involving children. Before submitting an application under the Act, obtain the written statement required by section 4A. The statement must address two matters: whether the applicant has ever received a negative notice (however described) under a corresponding law for a child-related regulated activity, and whether any registration for such an activity has ever been cancelled under a corresponding law. The statement should be made in writing and signed by the applicant, and attached to the application form. The applicant must be truthful; providing false or misleading information could lead to refusal or cancellation of registration and potentially prosecution under the Act. There is no need to provide copies of the interstate negative notice or cancellation order unless the Commissioner requests them, but keeping records is prudent.

For employers engaging persons under role-based registration. First, before the person commences regulated activities, the employer must prepare a risk management strategy that covers all eight elements in section 5(2). The strategy must be a single document (or set of documents) containing a commitment statement, code of conduct, complaint handling policies, discipline policy, compliance procedures (including review and record-keeping), and communication and training strategies. It must be practical and operational, not merely aspirational. The employer should also prepare a statement of activities describing the specific duties the person will perform. Both documents must be provided to the Commissioner as part of the role-based registration application under section 42B of the Act.

Second, after registration is granted, the employer must monitor for changes. If the person’s program or regulated activity changes in a way that could affect the conditions of registration, the employer must notify the Commissioner in writing under section 6(2)(a). Similarly, if the information previously provided (the statement of activities or the risk management strategy) changes, the employer must notify under section 6(2)(b). “Change” includes amendments to the risk management strategy itself. The employer should keep a log of when changes occur and document the date of notification to the Commissioner.

Third, the employer must ensure the risk management strategy is reviewed and updated as required by its own compliance policies. The Regulation does not prescribe a review interval, but the strategy must include procedures for implementing and reviewing it. Practical compliance would see an annual review at minimum, and updates whenever the law, the organisation’s activities, or the risk profile changes.

For all employers. Maintain written records about each person engaged with role-based registration, as required by the risk management strategy’s compliance policies. For example, record the date of expiry of each role-based registration (as noted in the example in section 5(2)(e)(ii)). This ensures the employer can manage renewals and avoid unintentional lapses.

For organisations operating across multiple jurisdictions. Check the list of corresponding laws in section 7. If you have employees or volunteers who hold negative notices or cancellations under any of those seven interstate laws, that information must be considered for ACT applications involving children. The ACT Commissioner may request further details, so maintain records of interstate screening outcomes.

Document everything. The Regulation’s obligations are heavily paperwork-based. An employer should keep a dedicated compliance folder with the current risk management strategy, copies of notices given to the Commissioner under section 6, and records of training sessions conducted under the strategy. This not only helps in an audit by the Commissioner but also demonstrates due diligence if any offence is alleged.