The National Higher Education Code on Gender Based Violence (the Code) marks one of the most significant regulatory shifts in the higher education sector in over a decade. Introducing mandatory, enforceable standards governing how providers prevent, respond to and report gender based violence (GBV).

The code has applied to universities since 1 January 2026, and all other TEQSA registered providers must be fully compliant by 1 January 2027. 

This is not guidance: it is law

Administered by the Secretary of the Department of Education, and overseen by the new GBV Regulator, the Code has legal effect. Non compliance can result in financial penalties, enforceable undertakings and court ordered compliance, and may also trigger separate regulatory action under the TEQSA Act.

In practical terms, the Code elevates GBV prevention and response from policy aspiration to core regulatory obligation, with personal accountability sitting at executive level.

A whole of organisation obligation

With seven mandatory standards that reach far beyond complaints handling the Code requires providers to embed GBV prevention and response into leadership, governance, systems, culture and data.

Providers must demonstrate clear leadership accountability, with the Principal Executive Officer directly responsible for compliance. A publicly available, whole of organisation Prevention and Response Plan must be developed, implemented and reviewed, informed by evidence, risk assessment and lived experience, and supported by measurable actions and reporting.

Operationally, the Code requires providers to strengthen staff suitability controls, manage conflicts of interest (including intimate personal relationships), and implement comprehensive GBV policies that actively support prevention, safe disclosure and fair outcomes. Restrictive confidentiality provisions and inappropriate settlement practices are expressly prohibited.

Raising the bar on capability and response

Education and training are no longer optional or ad hoc. Providers are required to deliver ongoing, trauma informed, evidence based education, including specialist capability for staff who receive and respond to disclosures. Training must also be evaluated for effectiveness, not simply delivered.

When disclosures occur, responses must be safe, timely and person centred. The Code sets clear expectations around accessible reporting pathways, same day notifications, procedural fairness, proportionate decision making and transparent outcomes. Support arrangements must be tailored, actively managed and reviewed for both disclosers and respondents.

Data, transparency and student accommodation

The Code elevates expectations around data collection, reporting and transparency, and providers must collect de identified data across the full lifecycle of cases, report annually in a detailed and disaggregated way, and use that data to drive continuous improvement.

Student accommodation is squarely within scope. The Code applies to accommodation that providers own or operate, as well as accommodation they contractually control or formally affiliate with. Providers must maintain active oversight and assurance and must withdraw affiliation where compliance cannot be achieved.

Preparing for January 2027

For private and non university providers, 1 January 2027 is not a transition point, it is a compliance deadline. 

The GBV regulator’s first round of assessments for universities demonstrates that implementing the Code is a substantial undertaking, even for well resourced institutions. As the sector continues to embed these new standards, non university providers have the advantage of time, and insight, to take a front footed approach to compliance and be fully prepared by 1 January 2027. Governance frameworks, policies, training programs, data systems and accommodation arrangements required by the Code cannot be credibly built at speed. Providers will need to commence now if they are to achieve compliance by the deadline.  

The National Higher Education Code on Gender Based Violence introduces significant new obligations for the sector, and early preparation ahead of the 1 January 2027 deadline will be critical for providers to meet these comprehensive regulatory requirements.

We can support providers across the full lifecycle of implementation, from interpreting the Code and assessing current readiness, through to designing whole of organisation approaches, developing policies and frameworks, planning implementation, and establishing robust evaluation, reporting and continuous improvement processes, alongside targeted capability uplift for boards, executives and policy teams to embed trauma informed, culturally safe and person centred approaches. 

Please reach out at any time to discuss how we can help your organisation.