Free regulation checker
Answer a few questions about the business and see which laws apply, which are close to the line and which covers they touch. Then send the client a branded PDF.
Example figures. Change them to your client's.
What was turnover last financial year?
Use the group's figures where there is one: several of these laws count across the group.
4 laws apply, 1 close to the line.
7 covers to review
Ransomware payment reporting
In force since 30 May 2025, enforced from 1 January 2026
Turnover over $3m, so a ransom paid by the business or by anyone for it, the insurer included, must be reported within 72 hours.
Cyber
Department of Home AffairsSerious invasion of privacy
In force since 10 June 2025
This applies to every business, whatever its size. Check the cyber and liability policies respond to a privacy claim.
Cyber and privacyProfessional indemnity
OAICPrivacy Act principles
In force; small business exemption under review
Turnover over $3m, so the privacy principles and data breach notification apply.
Cyber and privacy
OAICPsychosocial hazards
NSW code binding since 1 July 2026
With 140 staff the business must manage psychosocial risks like any other hazard. In NSW the code of practice has been binding since 1 July 2026. In Victoria the Psychological Health Regulations have applied since 1 December 2025.
Management liabilityEmployment practicesStatutory liability
Safe Work AustraliaClimate reporting
Group 2 from 1 July 2026, Group 3 from 1 July 2027
Meets 1 of the 3 Group 3 tests and is close on another. Growth could bring it in from July 2027.
Directors and officers
ASIC RG 280Checking a whole book? Flag every client who crosses a line with a free trial
What to tell your client
Of the laws we checked, Ransomware payment reporting, Serious invasion of privacy, Privacy Act principles and Psychosocial hazards apply to your business. Climate reporting is close to the line, so growth could bring it in. Before renewal we should review your cyber, cyber and privacy, professional indemnity, management liability, employment practices, statutory liability and directors and officers cover.
A general guide to where each law draws its lines, not legal advice. Illustrative only, not advice. The policy wording and the insurer decide. Nothing you type leaves your browser unless you make the PDF.
Why it matters
72 hrs
to report a ransom paid by or for a business with turnover over $3m, the insurer's payment included.
Department of Home Affairs$478k
is the cap on damages for distress under the new privacy tort. There is no small business exemption.
OAIC, statutory tort1 July
2026: NSW codes of practice, including psychosocial hazards, became legally binding.
NSW Government, codes of practice bindingIn plain English
They are not just for big business, they reach the insurance and they keep changing.
Ransomware reporting and the privacy principles start above $3m turnover. Climate reporting starts at 2 of 3 size tests. Staff numbers bring in the psychosocial duties.
Cyber for ransomware and privacy, management liability for psychosocial hazards, D&O for climate reporting. A new duty is a new way to be sued or fined.
A business near a threshold today may cross it next year. We flag those as close to the line so the conversation starts early.
Law by law
What each one requires, the penalty and the covers it touches. Each links to its source.
In force since 30 May 2025, enforced from 1 January 2026
Cyber Security Act 2024, Part 3
A business with turnover over $3m that pays a ransom, or has one paid for it, must report the payment within 72 hours.
In force since 10 June 2025
Privacy Act 1988, Schedule 2
Anyone can now sue for a serious, intentional or reckless invasion of their privacy. There is no small business exemption.
In force; small business exemption under review
Privacy Act 1988, Australian Privacy Principles
Businesses with turnover over $3m must follow the 13 privacy principles and report eligible data breaches.
Group 2 from 1 July 2026, Group 3 from 1 July 2027
Corporations Act 2001, sustainability reports (ASIC RG 280)
Large entities that lodge financial reports must report climate risks. Group 2 started with years from 1 July 2026, Group 3 starts with years from 1 July 2027.
How brokers use it
Ransomware reporting and the privacy principles turn on $3m turnover. Climate reporting turns on revenue, assets and staff. A client can cross a line without anyone noticing.
Department of Home AffairsRansomware and privacy point to cyber. Psychosocial hazards point to management liability and employment practices. Climate reporting points to D&O. Review those lines when a law applies.
A short letter that lists the laws that reach the business, and the covers you reviewed, is good advice and a good record.
The client PDF
Your logo and details, the laws that reach the business, what each means and the cover it touches. It starts the renewal conversation on the client's agenda, not the premium.
The laws that reach your business
Test yourself
Brokers hear these every week. See how many you can call.
A business with $2m turnover must report a ransom payment within 72 hours.
Questions brokers ask
With a free trial
Coverbound keeps each client's size and activities on file, flags them when they cross a line and puts the check in your renewal pack. 14 days free, no card.
Eight questions. A clear answer. A letter to send.
More free tools