In brief 11 min read
Biosecurity risks such as pest, weed and disease outbreaks are often firmly on the risk radar of companies, given their potential to have catastrophic impacts on businesses and impact the economy as a whole. It can be not only a management issue for businesses that import goods at a national border level, but is also a critical issue:
- within the domestic supply chain – in particular for primary producers, logistics, warehousing and retail operators; and
- for infrastructure and renewable companies who have projects which interface with agricultural land.
While many companies in these sectors have well established processes for managing biosecurity risk, the bar is nevertheless rising. Businesses are increasingly expected to take proactive responsibility for biosecurity, and to have robust processes in place to continuously understand their risk exposure and do everything reasonably within their power to minimise these risks. This includes having strategies, policies, practices, contracts, procedures and training in place which are appropriate to manage biosecurity risk.
This is evident from the gradual introduction of a 'general biosecurity duty' under biosecurity legislation in various States, enforceable through significant criminal penalties. Corporations are also increasingly being held to a high standard by their customers, suppliers, shareholders, financiers, employees, landholders and other stakeholders from an ESG perspective.
The implications of a biosecurity crisis can be catastrophic across whole of business operations – including for production, trade, market access, ability to meet contractual obligations with suppliers, and from a workforce and reputational perspective. In such circumstances, interactions with regulators and other stakeholders are paramount, and where biosecurity orders or movement control orders are issued by regulators, this can give rise to questions on avenues for legal remedies and compensation. Early and coordinated engagement across governance and stakeholder management functions is essential to mitigating these risks.
Our multi-disciplinary team of biosecurity specialists across our practice groups would be pleased to assist you with the management of biosecurity risks across your business.
Key takeaways
- A growing number of States (including NSW, Queensland, Tasmania, the ACT and South Australia) have introduced Biosecurity Acts which impose a 'general biosecurity duty'. The duty requires businesses to proactively be aware of the biosecurity risks that arise from their activities and take all reasonable and practical steps to prevent or minimise those risks.
- This significantly shifts responsibility for managing biosecurity risk from government to business.
- Federal and State regulators hold significant powers to regulate biosecurity. In the event of a biosecurity incident, this includes the power to lock down a site, destroy produce and prevent the movement of produce across regional and State borders.
- Non-government stakeholders, such as customers, suppliers, shareholders, financiers, employees, landholders and investors are also increasingly holding business to higher biosecurity standards.
- This means that businesses need to scrutinise whether their current governance frameworks, policies and procedures in respect of biosecurity and crisis management are adequate in the context of their own unique interfaces with biosecurity on both a day-to-day basis, and in the event of a biosecurity incident.
Biosecurity legislation – the bar is rising
General Biosecurity Duty
A general biosecurity duty has been progressively adopted across most of Australia over the last several years. Queensland,1 NSW,2 Tasmania,3 and the ACT4 have all imposed a general biosecurity duty under a Biosecurity Act. South Australia has also legislated such a duty but it has not yet come into force.5 Victoria has undertaken industry consultation on whether to enact such a duty.
Responsibility for identifying and managing biosecurity threats is shifting from governments to individual operators.
The precise formulation of the general biodiversity duty differs among the States. However, the duty generally requires any person who deals with biosecurity matter (which is very broadly defined to include any living thing other than a human) to take all reasonable and practical measures to prevent or minimise any biosecurity risks that the person knows about or ought reasonably to know about.
Businesses that operate in a jurisdiction with a general biosecurity duty need to establish processes to continuously:
- be aware of current and emerging biosecurity risks;
- be aware of the measures that they can implement to prevent or minimise those risks; and
- implement any such measures that fall within the scope of the general biosecurity duty.
A breach of the general biosecurity duty may give rise to criminal and civil penalties.
Under biosecurity legislation, there are also obligations in relation to the mandatory notification of biosecurity incidents to the regulator.
Regulatory powers
Even in States which have a general biosecurity duty, governments have not shied away from using their extensive legislative powers to directly regulate biosecurity and respond to incidents.
At the Commonwealth level, this includes the power to restrict or prohibit the entry of goods, or classes of goods, into Australia and the power to require the inspection, treatment or destruction of goods.
Each State and Territory also has extensive powers in the event of a declared biosecurity emergency. This can include the power to require testing of produce, require the destruction of materials, prevent the transportation of produce or materials from a premises (effectively 'locking down a premises') or require operators to take steps to decontaminate or treat a premises.
Liaising with regulators is a critical aspect of responding to a biosecurity incident to ensure that the risk management settings are right. The implications of biosecurity orders and movement control orders also may give rise to considerations as to potential avenues for legal challenge and compensation regimes.
The fact that each jurisdiction has its own powers, which overlap with other jurisdictions means that it can be difficult to navigate this patchwork of regulation. Fortunately, recent years has seen some attempts at harmonising regulation between jurisdictions. This includes:
- a number of jurisdictions (including NSW, Queensland, Tasmania, the ACT and now South Australia) have enacted Biosecurity Acts which, while not identical, share many common features such as a general biosecurity duty and a broadly harmonised regime for managing biosecurity incidents;
- the Commonwealth, and each of the Australian States and Territories, are parties to the Intergovernmental Agreement on Biosecurity (2019) and the National Environmental Biosecurity Response Agreement (2021). These arrangements provide for:
- the establishment of National Management Group (NMG) with responsibility for managing suspected pest or disease incidents;
- a set of national significance criteria which the NMG will apply when deciding whether an incident of a pest or disease requires a national response;
- the NMG to decide whether an eradication or a management strategy is warranted; and
- the preparation of response plans for biosecurity incidents.
A spectrum of considerations across business operations
Biosecurity has rapidly evolved into a core governance issue for organisations, driven by escalating environmental, operational and supply‑chain risks. As experience from recent large‑scale disruptions has shown, early and coordinated engagement across governance and stakeholder management functions is essential to mitigating these risks.
Regulators and stakeholders increasingly expect organisations to embed consideration of biosecurity issues within their broader governance and risk frameworks, including identification on risk registers, clear management accountabilities and routine board reporting. Key considerations include:
- Directors’ duties: Biosecurity now forms part of the broader spectrum of risks directors are expected to identify, monitor and manage, and is an integral part of compliance and risk management. A director's duty to act with care, skill and diligence under the Corporations Act 2001 (Cth) and at common law would encompass the duty to be informed of biosecurity issues that may affect an organisation, and to ensure that robust and responsive governance and risk frameworks are in place. Directors should ensure that biosecurity risks are regularly reviewed and that governance, reporting and escalation mechanisms are sufficiently robust to support informed oversight and timely intervention.
- Board and management interaction: Boards will need to ensure they are receiving appropriate information about any biosecurity incidents to make timely and informed decisions, while also ensuring that management's ability to respond effectively is not unduly hampered. This may involve the Chairperson or a member of the risk committee and/or the CEO working together to disseminate information between management and the board. The board should also ensure that it provides appropriate support to management during this challenging time for their organisations.
- Continuous disclosure obligations: As part of their ongoing assessment of their disclosure obligations, listed entities will need to consider whether (and when) a biosecurity incident may trigger a continuous disclosure obligation. Biosecurity incidents may give rise to market‑sensitive information where they affect earnings forecasts, the supply of or demand for an organisation's goods or services, material contracts and financing arrangements, or involve Government intervention or regulatory action.
- Stakeholder communications: Alongside any required disclosures, organisations should also consider the appropriateness and timing of disclosures to and communications with key stakeholders, including any regulators, shareholders, financiers, contractual counterparties (customers and suppliers) and employees.
- Business continuity planning: Boards should satisfy themselves that robust business‑interruption strategies are in place, including having appropriate delegations of authority in place in the event of a biosecurity incident, and contingencies for personnel, procurement and sales channels.
- Insurance coverage: Organisations should regularly reassess the currency and scope of their insurance programs as to the extent to which biosecurity incidents may be covered, including under business interruption cover. Particular attention should be paid to potential exclusions (which may include pandemics or viruses) and notification requirements.
- Industry engagement: Participation in initiatives such as the Biosecurity Business Pledge can help organisations to sharpen their focus on biosecurity considerations. Organisations can be proactively engaged in best practice measures within their industries and organisations to manage biosecurity risks, and in sharing practical tools recognising the importance of biosecurity.
Biosecurity incidents can have an immediate and material impact on an organisation, in particular businesses with complex or international supply chains. Disruptions to procurement and key inputs can create commercial, regulatory and counterparty risks.
Organisations whose contractual arrangements are affected by biosecurity incidents may consider whether relief under any force majeure or similar provisions may be enlivened. This will depend on whether the relevant drafting contemplates or would extend to biosecurity events, whether a causal nexus exists between the event and the impact on their businesses, and compliance with any notice, mitigation and other procedural requirements. As we saw during the COVID‑19 pandemic, hardship alone will rarely suffice as a trigger, and disputes may arise where parties attempt to rely on broad or ill‑fitting force majeure definitions. If the relevant drafting would extend to cover biosecurity events, there may be a right to terminate if the event occurs for a specified period. Alternative avenues may involve seeking to reduce the volume of goods and/or services procured or supplied by under a relevant contract or otherwise negotiating a commercial arrangement with the contractual counterparty that is mutually acceptable in the circumstances.
We are seeing a slow but steady focus on how companies assess, disclose and manage their biodiversity and nature-related risks and impacts. This is likely to also be relevant to how companies manage biosecurity risk, since risk and resilience in one area can inform the other. So far, the CEOs of 14 Australian superannuation funds have said that nature risk is an area of increasing importance for them, and we are observing a growing commitment across different sectors to nature-related voluntary standards and frameworks.
These voluntary standards include the Task Force for Nature-Related Financial Disclosures (TNFD) framework, which outlines how businesses can assess and disclose nature-related risks and impacts. The International Sustainability Standards Board (ISSB) recently announced that it will draw upon the TNFD framework to advance its own work to introduce incremental disclosure requirements on nature-related risks and opportunities, with the aim of finalising a draft of such requirements by the Convention of Biological Diversity's COP17 in October 2026. We expect that nature may, in time, be integrated into Australia's mandatory climate-reporting regime, to create a more holistic sustainability reporting framework. The Australian Sustainable Finance Roadmap emphasises that the Government is taking a 'climate first, not only' approach.
We are also seeing nature and biodiversity feature in Federal level environmental law reform. For example, reforms to the Environment Protection and Biodiversity Conservation Act 1999 (Cth) (EPBC Act), passed in December 2025, now permit the Environment Minister to make National Environmental Standards. The draft Standards on 'Matters of National Environmental Significance' set out policy objectives directed at supporting the viability of threatened species and ecological communities in the wild, among other things.
From a biosecurity perspective, these developments may mean an increasing focus on how companies understand, manage and report on the feedback loop between biodiversity and biosecurity. This may lead to heightened expectations as to how, for example, companies test resilience against possible future scenarios for the state of nature, and how companies conduct nature risk assessments that incorporate biosecurity risks. We are also seeing increased scrutiny of relevant governance and controls (such as accountability for nature) at board level.
Biosecurity events can give rise to various employment and work health and safety issues. Businesses operating in sectors susceptible to biosecurity hazards should ensure appropriate frameworks are in place to reduce the risk of a biosecurity event and respond appropriately to any biosecurity events that occur.
To reduce the risk of a biosecurity event, businesses should conduct regular risk assessments to identify potential health and safety risks and exposure points (e.g. potential transmission pathways) and implement controls to mitigate those risks and limit potential exposure, including appropriate policies, procedures, equipment and training.
Businesses should also ensure their action response plan takes into account:
- work health and safety obligations, including in relation to the relevant biosecurity hazard and psychosocial hazards (e.g. arising from any workforce impacts);
- any requirements under applicable industrial instruments, including in respect of consultation and potential disputes with employees; and
- options to address workforce impacts, including changes to duties and hours of work and in some circumstances potentially standdowns.
Biosecurity in infrastructure and renewable energy projects
Biosecurity concerns are ever present in renewables and certain other infrastructure projects and persist throughout the planning, construction, operation and decommissioning phases. In the early stages of securing land tenure for projects, developers and operators are increasingly required by landowners to consider and commit to specific biosecurity activities and standards applicable to their land. These typically including pest management (including drone and other aerial operations), stock control, restrictions on soil movement and quality, fencing construction and maintenance, and decommissioning activities.
Often, the precise nature of these activities and the context of the landowner's agricultural operations will not be known during the planning and development phase. Despite this, landowners will typically require protection and certainty that their existing land uses and applicable certifications are protected. This is particularly pertinent during the construction period – where the influx of materials and personnel onto their land is most disruptive. Land tenure documents must therefore strike a balance between the landowners' need for detail and security on biosecurity-related matters on the one hand, with the developer's need to preserve flexibility in project design and delivery methodology. This balance also needs to be maintained throughout the lifetime of the project – noting that land use, technology and biosecurity regulations and guidance are likely to evolve over a 30+ year project lifespan.
This expectation from landowners that land tenure documents will address biosecurity has been bolstered by recent reforms to NSW planning guidelines. In late 2024, the NSW Government published its Renewable Energy Planning Framework, which introduced, for the first time, expectations regarding biosecurity from a planning perspective. The new Private Agreement Guideline (one of the Framework documents) suggests that agreements with host and neighbouring landowners should provide reasonable and practical measures to prevent, eliminate or minimise the potential biosecurity impacts of a development, and landholders should understand the biosecurity protocols an applicant proposes to use during each phase of a project.
Actions you can take now
All businesses should take action to proactively ensure that their governance arrangements, strategies, policies, practices, contracts, procedures and training are appropriate to manage biosecurity risk.
There is no 'off-the-shelf' solution to biosecurity. Each business will need to develop its own plans.
We consider that some of the key elements will involve the following:
- Map governance and controls.
- Audit biosecurity risks and assess those risks against mitigation measures.
- Implement and regularly review Biosecurity Management Plans.
- Consider biosecurity risk management within supplier contracts and land access arrangements.
- Consider options to address workforce impacts and provide training for employees.
- Build relationships with regulators.
- Develop and regularly review Incident Management Plans.
Our multi-disciplinary team of biosecurity specialists across our practice groups would be pleased to assist you with the management of biosecurity risks in your business.
Allens Legal Team
Environment and Planning: Rebecca Pleming, Dennis Smith, Lydia Watson-Moore
Real Estate: Nathaniel Jende, Rasa Bergin
Corporate: Jessica Choong, Simrin Panag
Disputes and ESG: Emily Turnbull, Maya Ranganathan
IP: Tony Shaw, Tommy Chen
Employment and WHS: Chloe Wilton
Footnotes
-
Biosecurity Act 2014 (Qld) s 23
-
Biosecurity Act 2015 (NSW) s 22
-
Biosecurity Act 2019 (Tas) s 70
-
Biosecurity Act 2023 (ACT) s 22
-
Biosecurity Act 2025 (SA) s40