Most council executives are aware, at least in general terms, that their organisation carries obligations under the Chain of Responsibility provisions of the Heavy Vehicle National Law. Fewer are aware that the due diligence duty under that same law attaches to individual executives personally, not only to the council as an entity. The amended HVNL commenced on 1 August 2026, and it did nothing to soften that.
The distinction matters because it changes the question from "has our organisation done enough" to "can I, personally, demonstrate what I did to satisfy this duty."
What Due Diligence Actually Requires
Under the HVNL, an executive must exercise due diligence to ensure their organisation complies with its primary duty. The law sets that obligation out as five reasonable steps (NHVR, 2026):
- Acquire, and keep up to date, knowledge about the safe conduct of transport activities
- Understand the nature of the organisation’s transport activities and the hazards and risks associated with them, including risk to the public
- Ensure the organisation has, and uses, appropriate resources to eliminate or minimise those hazards and risks
- Ensure the organisation has, and implements, processes to eliminate or minimise those risks, to receive and act on information about incidents, and to comply with its primary duty
- Verify that those resources and processes are in fact being provided, used and implemented
For a busy executive, those five collapse into three questions worth being able to answer without notice: do I know what our transport activities truly involve? Have I made sure the controls and resources exist? Have I checked that they are working with monitoring processes in place? The last of these is where most organisations begin to fail. A policy on file is not verification.
Breaches carry real consequences for individuals. An executive who fails to exercise due diligence faces the same maximum penalties as an individual who breaches the primary duty directly: $70,580 for a category 3 duty breach, $212,090 where the breach exposes a person to a risk of death or serious injury, and $436,850 or five years imprisonment, or both, for a reckless category 1 breach (NHVR, 2026). These amounts are indexed annually. They are personal exposures, separate from any penalty the council itself may face.
Why This Cannot Simply Be Delegated
A common response to personal duty provisions is to delegate the detail downward, to fleet, risk or procurement teams, and treat the executive role as oversight in name only. The verification element of due diligence makes this approach difficult to defend. An executive who has never asked to see evidence that a safety control is fitted, functioning and routinely checked has not verified anything. They have delegated the duty, which the law does not allow, rather than delegated the task, which it does.
Council Governance Already Has the Mechanism
Most councils do not need to build anything new. In NSW, councils have been required to have an Audit, Risk and Improvement Committee since 4 June 2022; risk management framework and internal audit requirements took effect from 1 July 2024, and councils must attest to compliance from the 2024–25 annual report onward (NSW Office of Local Government, 2026). In Victoria, Local Government Act 2020 (Vic), s 53 requires every council to establish an Audit and Risk Committee. Queensland is the exception: audit committees are mandatory only for Brisbane City Council and the councils listed as “large” in the Local Government Regulation 2012, and the Queensland Audit Office has noted that Queensland is the only state that does not require all councils to have one. These committees already exist to check whether the organisation’s risks and controls hold up under scrutiny over time.
Fleet safety, and heavy vehicle safety in particular, is a natural and currently underused agenda item for that existing structure, rather than a reason to build a new one.
The Owned and Contracted Fleet Gap
This is also where the mixed nature of most council fleets becomes relevant. Waste, mowing, road maintenance and civil works are often delivered through a combination of owned vehicles and multiple contractors, procured at different times against different specifications. When an audit or risk committee asks what safety controls are verified across the full fleet footprint, a fragmented procurement history rarely produces a clean answer, and an executive who cannot answer that question in the moment has already fallen short of the verification standard the duty expects.
This is not a gap a council can contract away. The NHVR’s regulatory advice on local government as a Chain of Responsibility party is explicit that contracting a service out does not contract the duty out: a council remains a CoR party for transport activities it engages others to perform, and is expected to select capable providers, communicate its safety expectations, and work with them on shared controls (NHVR, 2026).
Questions Worth Bringing to the Next Audit Cycle
- Can I currently produce evidence, not just policy, of what safety controls are fitted and verified across our owned and contracted heavy vehicles?
- Has our risk or audit committee reviewed heavy vehicle safety as a distinct item, or has it been absorbed into general fleet reporting?
- If asked to show what I personally did to satisfy the due diligence duty this year, what would I point to?
A Governance Opportunity, Not Just an Exposure
Councils that route heavy vehicle safety verification through their existing audit and risk committee turn a personal legal exposure into a documented, repeatable governance process, one that protects executives individually while also giving elected members a clear line of sight over a real operational risk.
The cost of doing this is one agenda item. The cost of not doing it is personal.
Executives wanting a starting point can use our one-page agenda item, Heavy Vehicle Safety Verification. It sets out a recommended motion, the evidence to ask management to produce for owned and contracted vehicles, and a suggested review cadence - ready to hand to your committee secretary.
(Download the one-page agenda item)