Violence and Harassment Are a Safety Issue, Not an HR Issue (2026)

Harassment and violence used to be treated as a human resources matter. Since 1 January 2021 they sit inside Part II of the Canada Labour Code, which is the occupational health and safety part, and that changes what happens when an employer gets it wrong.

It also changes what an employer has to do in advance. A workplace assessment, a prescribed policy, mandatory training and a defined resolution process are requirements rather than good practice, and monetary penalties apply to violations.

What moved, and why it matters

Bill C-65 amended the Canada Labour Code and brought in the Work Place Harassment and Violence Prevention Regulations, both effective 1 January 2021. Legal analysis of the change describes it as establishing a single occupational health and safety regime for prevention in federally regulated workplaces.

Before that, violence and harassment were handled under two different parts of the Code. Now they are one integrated regime, and they are a safety hazard in the same sense that a missing guard or an untested atmosphere is a safety hazard.

The definition is broad on purpose: any action, conduct or comment, including of a sexual nature, that can reasonably be expected to cause offence, humiliation or other physical or psychological injury or illness to an employee.

Note what that covers. Psychological injury is named alongside physical injury, and a single comment can qualify if it meets the test. This is not limited to assault.

Provincially regulated employers are covered by their own occupational health and safety legislation rather than by these federal regulations, and the obligations are real there too. Ontario, for instance, can impose penalties up to $500,000 for corporations, alongside stop-work orders, prosecution and human rights complaints.

The assessment, and who you do it with

The central requirement is a workplace assessment that identifies the factors contributing to a risk of harassment and violence, and then develops and implements preventive measures against them.

It is not a solo exercise. The employer carries it out jointly with what the regulations call the applicable partner, and which partner that is depends on headcount. Guidance on the regulations sets out the structure: employers with 300 or more employees work with the policy committee, those with 20 to 299 with the workplace committee, and those under 20 with the health and safety representative.

That maps onto the committee structure most workplaces already have, which means the body doing your hazard inspections is also the body doing this.

The assessment must be reviewed and updated at least every three years, and monitored for accuracy in between. A change in operations, a change in premises or an occurrence all warrant a fresh look rather than waiting for the cycle.

Preventive measures come out of the assessment rather than from a template. That is the part that turns it from a document into a control.

Family violence is an employer obligation

This is the requirement that surprises employers most, and it is explicit in the regulations.

The risk factors an employer must consider include circumstances both internal and external to the workplace, and external factors specifically include family violence. An employer is expected to implement measures to mitigate the risk of family violence entering the workplace.

That sounds unusual until you think about the mechanism. A person who poses a risk to an employee at home knows where that employee works, what time they start, and what vehicle they drive. The workplace is the one location where they can reliably be found.

The practical measures are ordinary ones: controlling who can access work areas, being careful with what scheduling and location information is shared, having a plan for reception or front-line staff, and knowing what to do if someone arrives asking for a worker.

Handling it sensitively matters as much as handling it at all, and the regulations require the policy to describe how the privacy of the people involved will be protected.

This is not only an office topic

Most writing about workplace harassment pictures a desk. The trades exposure looks different and is often higher.

Roadside and traffic control work puts workers in direct conflict with frustrated drivers, and abuse directed at flaggers is routine enough that crews stop reporting it. Our guide to traffic control person equipment covers the struck-by side of that role, and the confrontation side belongs in the same risk assessment.

Service and delivery work means entering premises the employer does not control, alone, often without knowing who else is present. Late-night and overnight work removes witnesses and increases exposure.

Isolation compounds all of it. A worker who is alone is both a more attractive target and further from help, which is why violence risk belongs in a working alone assessment rather than being treated as a separate exercise.

Site-based harassment between workers is its own category, and it is the one most likely to be dismissed as banter. The legal test is not whether it was intended as a joke; it is whether the conduct could reasonably be expected to cause offence, humiliation or injury.

What the policy has to contain

The federal regulations prescribe the contents rather than leaving it open, which is useful because it gives you a checklist.

A mission statement on prevention and protection. A description of the roles of the employer, the employees, the designated recipient and the applicable partner. A list of the internal and external risk factors identified. A summary of the mandatory training. A summary of the resolution process, including who the designated recipient is and how they can be notified. The reasons a review of the assessment must be conducted. And a description of how privacy will be protected.

The designated recipient is worth pausing on: this is the named person to whom an occurrence is reported. A policy that says report to your supervisor fails where the supervisor is the problem, which is a common enough scenario that naming an alternative route is the point.

Training is mandatory rather than recommended, and it applies to employees as well as managers. A policy nobody has been trained on is a document rather than a control.

Record-keeping runs long federally, at ten years, which is worth knowing before anyone decides to tidy up a filing system.

The resolution process is timed

The regulations set out a detailed procedure for resolving occurrences, with specific steps and timelines rather than leaving pace to the employer.

That matters because delay is the most common failure. A complaint that sits for months does more damage than the original conduct in many cases, and under this regime the delay itself can be the violation.

The process runs through negotiated resolution, conciliation where both parties agree, and investigation by a qualified investigator where it is not resolved. The person who reported it retains options at each stage.

Non-retaliation has to be part of the framework. The same principle applies here as in a work refusal: a worker who reports and is then penalized has been given a reason never to report again, and so has everyone who watched.

Anonymous and third-party reporting routes are worth building in, because the people most at risk are frequently the least able to put their name to a complaint.

Where this sits alongside everything else

Treating this as a safety hazard rather than a personnel matter is the shift that makes the rest follow.

It goes into the hazard assessment with the other hazards. It gets preventive measures the way a chemical exposure does. It gets reviewed on a cycle. And it gets reported and investigated rather than managed quietly.

Physical controls are part of the answer where the risk is external: access control, lighting, visibility, layout of reception and service counters, and communication systems for workers off site. Those are engineering controls, and they sit above policy in the hierarchy for the same reason a guard sits above a procedure.

Incident response belongs in the plan too, including first aid provision, which is covered in our guide to CSA Z1220 first aid kit requirements.

And where crews work outdoors, at night or in isolation, the conspicuity and exposure controls overlap with this risk rather than sitting apart from it. See our guides to CSA Z96 classes and levels and cold stress at work in Canada. For the wider programme see the complete PPE checklist for Canadian workers, our guide to PPE requirements for Canadian construction sites, our guide to who pays for PPE in Canada and our guide to CSA certified versus CSA compliant.

Frequently Asked Questions

Is workplace harassment a safety issue or an HR issue in Canada?

A safety issue. Bill C-65 and the Work Place Harassment and Violence Prevention Regulations, both effective 1 January 2021, brought harassment and violence into Part II of the Canada Labour Code, which is the occupational health and safety part. Provincially regulated employers have equivalent obligations under their own occupational health and safety legislation.

What counts as harassment or violence?

The federal definition covers any action, conduct or comment, including of a sexual nature, that can reasonably be expected to cause offence, humiliation or other physical or psychological injury or illness to an employee. Psychological injury is named alongside physical, and the test is whether the conduct could reasonably be expected to cause it rather than whether it was intended to.

Who carries out the workplace assessment?

The employer, jointly with an applicable partner determined by size. Employers with 300 or more employees work with the policy committee, those with 20 to 299 with the workplace committee, and those with fewer than 20 with the health and safety representative. The assessment must be reviewed at least every three years.

Does family violence really fall to the employer?

Under the federal regulations, yes. Risk factors must include circumstances external to the workplace, and family violence is named specifically, with employers expected to implement measures to mitigate the risk of it entering the workplace. Practical measures include access control, care with scheduling information and a plan for front-line staff.

What must the prevention policy contain?

Prescribed elements including a mission statement, the roles of employer, employees, designated recipient and applicable partner, the internal and external risk factors identified, a training summary, a summary of the resolution process and how to notify the designated recipient, the reasons for reviewing the assessment, and how privacy will be protected.

Why does the designated recipient matter?

Because a policy that says report to your supervisor fails when the supervisor is the problem. Naming a specific person to receive occurrences gives a route that does not depend on the reporting line, which is one of the more common reasons incidents go unreported.

This guide is general workplace safety information, not legal advice. Harassment and violence prevention obligations differ between federally regulated workplaces and those governed by provincial or territorial legislation, and the requirements summarized here are the federal ones. Confirm your obligations with the authority that governs your workplace or with qualified legal counsel. Anyone experiencing harassment or violence at work should use their workplace reporting process, contact their occupational health and safety authority or union representative, and in an emergency contact local emergency services.