Universities submitted their whole of organisation prevention and response plans under the National Higher Education Code to Prevent and Respond to Gender-based Violence (Code) in January 2026, with many now revising and resubmitting following feedback from the GBV Regulator. Most now have a GBV policy in some form and have reviewed and updated their complaint and misconduct frameworks to ensure compliance with the Code.

Nine months in, sector experience shows the scale of change is significant, even for well-resourced institutions. Aligning staff and student processes, which were historically kept separate, has been a major shift, as has the increased focus on leadership and governance by the Vice-Chancellor and governing body.

We take a brief look at some of the key challenges:

1. The scope of the Code is broad, and complexities arise when triaging 'borderline' cases: The Code imposes significant obligations for managing GBV matters, meaning universities need clear processes for deciding whether a report or disclosure falls within scope. That assessment is not always straightforward: the Code’s definition is deliberately broad, extends beyond violence, and may capture less serious conduct that is gender-based and likely to cause harm. Assessing whether a disclosure or report is in scope requires careful judgment by a suitably skilled and experienced person.
2. Conduct historically considered to be outside a university's jurisdiction is now in scope: This can include off-campus conduct, private relationships, conduct predating enrolment, and online communications unconnected to university systems. While universities have always offered support to disclosers in this context, the Code now imposes an obligation to investigate a formal report of GBV where the respondent is a student or staff member. The investigation scope must be informed by safety and wellbeing considerations and requires resourcing not previously directed at conduct in private settings. Many universities have had to substantially amend their policy suites to ensure they are able to adequately address off-campus GBV.
3. Code obligations can arise in relation to historical conduct: Any disciplinary response of a university must apply the standards of conduct that applied [ME1.1]at the time the conduct occurred. However, disclosures or reports that occur post 1 January 2026 of historical conduct will still trigger obligations for a university under the Code, including in relation to support, investigation, disciplinary responses (where codes of conduct applicable at the time were allegedly breached), reporting and governance. In this sense, the Code will impact the way universities respond to historical conduct.
4. Code implementation needs to be tailored, not uniform: The Code requires universities to proactively and broadly engage with GBV as a societal issue. There is no one size fits all approach: while the Code and its guidance are highly prescriptive, the risks, policy structure and resourcing of each university differ, so prevention and response should be tailored to institutional context. Universities should examine their obligations under the Code and apply them to their specific circumstances, adapting their approach as issues arise and lessons are learned.
5. Decision making should be reasonable, proportionate and risk based: The Code provides a clear framework for responding to issues when they arise, but universities have faced challenges applying it to complex individual cases. The Code cannot prescribe an answer for every case, and Universities may need to apply the spirit of the Code where its application to a particular scenario is uncertain.
6. The Code is part of a broader trend towards more active governance over safety, culture, risk and compliance: In a sector facing increased obligations on governing bodies in a number of areas, the Code requires active involvement of, and oversight by, the Vice-Chancellor and governing body. GBV prevention and response cannot simply be delegated to HR, legal or safety teams: the strategy must be led by the VC and approved and actively overseen [ME3.1]by the governing body. The whole-of-organisation approach brings together university functions that have not previously worked together in this way, and governing bodies must receive regular, data-informed reports, and act on trends to foster the safety and wellbeing of university communities.
7. Universities are managing significant practical and legal tensions: Coordinating multiple frameworks and stakeholders' raises real challenges, particularly disciplinary processes that may sit in tension with Code obligations and require amendment to ensure processes are designed to conclude within 45 business days while remaining procedurally fair and trauma informed. There are avenues for universities to manage these risks practically and effectively, and we anticipate that best practice will emerge over time as universities adjust to these new requirements.
8. The regulatory risk is significant: Beyond potential action from the GBV Regulator, multiple other regulators can become involved in a GBV related matter, including the Tertiary Education Quality and Standards Agency, the State safety regulator and the National Student Ombudsman.

Ultimately, by the Code, the Government is seeking to materially improve the sector's prevention of and response to gender-based violence that occurs in university communities. The practical challenges for universities and private providers implementing the reforms are real and significant. However, being guided by this overriding objective in making difficult decisions will assist providers to navigate the significant regulatory risks involved.

As the Code approaches its first anniversary its practical demands will keep evolving. Universities can take stock now: revisit prevention and response plans against the GBV Regulator's feedback, confirm the governing body is receiving regular, data-informed reporting, pressure-test triage processes against real scenarios as they arise, and benchmark against best-practice responses. Other higher education providers can learn from universities' early experiences in preparing for implementation of the Code to their institutions from 1 January 2027.

We can assist with prevention and response plans, aligning systems, policies and practices with regulator expectations, and assisting you to respond appropriately to complex disclosures and reports.