The National Higher Education Code to Prevent and Respond to Gender-based Violence (Code) commenced on 1 January 2026. It is mandatory, not optional best practice, and requires higher education providers to comply with seven standards.
Providers are expected to understand what the Code requires and take a ‘whole-of-organisation’ approach to achieving compliance.
This article helps providers understand what the standards require, how they interact with existing psychosocial duties, and what practical compliance looks like.
Gender-based violence is any form of physical or non-physical violence, harassment, abuse or threats, based on gender, that results in, or is likely to result in, harm, coercion, control, fear or deprivation of liberty or autonomy. Sadly, in Australian university communities, the evidence shows it remains prevalent.
The Code was a recommended response to this evidence and forms part of the National Plan to End Violence against Women and Children 2022–2032 and the Action Plan for Addressing Gender-based Violence in Higher Education. But what is ‘The Code’?
Simply, it’s a set of mandatory standards for higher education providers in connection with preventing and responding to gender-based violence, including in relation to student accommodation. At first glance, however, compliance with the Code appears to be anything but simple.
Providers must understand and take active steps to comply with the Code: compliance is mandatory, not optional, and failure to comply risks regulatory action from the newly established Gender-based Violence Regulator.
Understanding what the Code requires
The Code comprises seven standards, each carrying its own set of obligations. Below, we break down the key requirements of each standard to give providers a practical overview of what compliance looks like.
1. Accountable leadership and governance
Standard 1 establishes accountability at the top. Providers’ Higher Education Principal Executive Officers are personally accountable for compliance, and governing bodies must have expertise in student and staff safety.
The central obligation is to prepare, implement, and publish a Whole-of-Organisation Prevention and Response Plan, one that addresses the drivers of gender-based violence, reflects the needs of disproportionately affected groups, and is endorsed by the governing body. Providers must also develop an outcomes framework, report to their governing body at least every six months, and provide the Secretary with copies of the plan and regular progress reports.
2. Safe environment and systems
Standard 2 requires providers to create safe environments by:
- ensuring working with children checks are complied with;
- asking prospective employees and members of the governing body to declare whether they have been investigated for, or determined to have engaged in, gender-based violence so any risks can be considered and addressed;
- requiring employees to declare any existing or previous intimate personal relationships they have with an employee or student if certain criteria are met so that a conflict-of-interest management plan can be implemented;
- prohibiting the use of non-disclosure agreements, unless requested by a discloser, and ensuring they do not prevent the discloser from sharing their experience; and
- requiring settlement terms to not contain a non-disparagement clause that requires the discloser to keep their experience confidential.
Providers must also have and implement a policy on preventing and responding to gender-based violence that meets certain criteria and must implement any recommendations made by the National Student Ombudsman.
3. Knowledge and capability
Standard 3 focuses on building institutional knowledge and capability. It requires providers to deliver ongoing, evidence-informed prevention education and training to students, leadership, and staff.
Providers must also deliver specialised training on responding to a disclosure to students in leadership positions, leadership, staff and other people the provider considers necessary, and promote and widely disseminate evidence-informed prevention communication and key messaging across their study, work, living and social environments.
Critically, staff conducting risk assessments, investigations, or disciplinary proceedings must have demonstrated expertise in gender-based violence, and staff responding to formal reports must have relevant knowledge and experience. Where a provider lacks internal capability, qualified external specialists must be engaged.
4. Safety and support
Standard 4 turns the focus to what happens after a disclosure or formal report is made. Every response must be safe, person-centred, trauma-informed and grounded in best practice; and providers must back that commitment with action.
Risk assessments are required in response to all disclosures and formal reports, with identified risks actively managed on an ongoing basis. When safety measures are implemented, providers must genuinely engage with and seriously consider the discloser’s views.
Staff with relevant expertise must be assigned to work collaboratively with the discloser to develop a tailored support plan, one that addresses safety measures, prioritises urgent access to accredited specialists and interpreter services, and considers academic or work adjustments. A separate support plan must also be developed in consultation with the respondent, and critically, the same staff cannot be assigned to support both parties.
Providers must also actively promote available support services and evaluate their effectiveness at least every three years, using those findings to shape future service delivery.
5. Safe processes
Standard 5 is where the rubber meets the road, setting out the procedural framework for how disclosures and formal reports are received, managed, and resolved.
It starts with accessibility: providers must offer multiple reporting channels (including in-person, email, phone, and online) and ensure that disclosures can be made anonymously. From there, multiple pathways must be available for managing those disclosures, ranging from agreed resolutions between the parties through to full investigation. Importantly, providers must have regard to the wishes of the discloser when determining which pathway to take.
That said, before progressing a disclosure to investigation, providers must first seek and consider the discloser’s views, though they retain the ability to investigate where necessary for safety. Once a formal report is made, however, it must be investigated regardless of where the alleged violence occurred.
Standard 5 also recognises the impact of drawn-out investigative procedures, requiring formal reports to be finalised within 45 days, inclusive of any disciplinary process. Providers must also ensure disciplinary processes afford procedural fairness to respondents and impose sanctions proportionate to the substantiated conduct — up to and including expulsion. Throughout this process, disclosers must be kept informed and notified of outcomes on the same day as the respondent.
If an appeal is lodged, it must be finalised within 20 business days, with extensions permitted only where genuinely required and personally approved by the Higher Education Principal Executive Officer.
6. Data, evidence and impact
Standard 6 requires providers to collect, report, and use data to inform their approach to preventing and responding to gender-based violence. From 2027, providers must submit annual de-identified data to the Secretary, including the number and type of disclosures, demographic data, investigation outcomes, and satisfaction measures. This data must be collected safely and in accordance with privacy laws, and used to strengthen the provider’s whole-of-organisation approach and contribute to the national evidence base.
7. Safe student accommodation
Standard 7 extends the Code’s protections into student accommodation, recognising that where students live is just as important as where they study.
The obligations are tiered depending on the provider’s relationship with the accommodation. For accommodation directly owned or managed by the provider, the requirements are extensive: staff must be screened for prior gender-based violence allegations, residents and staff must complete tailored prevention training, risk assessments must be conducted within 48 hours of a disclosure, and support plans must be developed collaboratively with both the discloser and respondent within the same timeframe. Providers also retain the power to permanently remove a respondent from accommodation where a substantiated allegation warrants it.
For accommodation under the provider’s control but not directly managed, providers must have binding arrangements in place requiring equivalent protections — covering prevention plans, policies, training, and data reporting. For affiliated accommodation providers that refuse to comply, the consequences are stark: providers must report them to the Secretary and cease all promotion, marketing, and reservation of student spaces.
Practical compliance
The Code commenced for universities and non-self-accrediting higher education institutions on 1 January 2026 and will commence for other private or independent higher education providers on 1 January 2027.
The starting point for compliance is understanding what each standard requires and creating a plan for how it will be met. Importantly, the Code is not a ‘set and forget’; the policies and systems created to comply with it must be utilised by providers to manage gender-based violence on an ongoing basis.
Gender-based violence is also a psychosocial hazard which, under work health and safety law, higher education providers already carry a positive duty to identify and control. Providers should see the Code as fitting directly into this framework, with its requirements for prevention strategies, risk assessment, reporting pathways, and support being the types of measures the law expects providers to implement.
Providers should ensure their Code compliance is embedded within their WHS psychosocial risk management system to ensure a consistent approach to gender-based violence and avoid duplication, and view the Code as a mechanism satisfying both frameworks through one cohesive approach.
At Source, we regularly assist Australian universities with Code compliance, both initially, and after a disclosure of formal report.
If you require assistance with Code compliance, or want to better understand how these reforms interact with other emerging changes in the higher education sector, reach out to a member of the Source Workplace team.
Article by: Riley Anastasio, Legal Counsel – Workplace
