Regulation 168: the policies and procedures every service must have

Last reviewed: 29 October 2026. Checked against the Education and Care Services National Regulations, reprint current as at 12 August 2026.

Quick answer

Regulation 168 requires the approved provider to ensure the service has policies and procedures on the matters listed in subregulation (2): health and safety (nutrition, sun protection, water safety, first aid, sleep and rest); incident, injury, trauma and illness; infectious diseases; medical conditions; emergency and evacuation; delivery and collection; excursions; transportation; safe arrival; a child safe environment; safe use of digital technologies (new in 2026); staffing including a code of conduct and the responsible person; interactions with children; enrolment and orientation; governance and management including confidentiality; acceptance and refusal of authorisations; payment of fees; and complaints, which must now be child focused. The penalty for not having them is $3,300 and a compliance direction may be issued. Family day care services need the extra policies in regulation 169.

Regulation 168 is the list every policy register is built on and the one assessors check first under Element 7.1.2. The list grew in 2026: digital technologies and online environments became a required policy, and the child safe environment and complaints policies gained specific content. This page sets out each required policy with the regulation it has to comply with, the related requirements in regulations 169 to 172, and how to review the set.

The required policies and procedures

Provision	Policy or procedure	Must include
168(2)(a)	Health and safety: nutrition and food, sun protection, water safety, first aid, sleep and rest	Nutrition, food and beverages and dietary requirements; sun protection; water safety including during water-based activities; administration of first aid; sleep and rest for children including the matters in regulation 84B.
168(2)(b)	Incident, injury, trauma and illness	Procedures complying with regulation 85.
168(2)(c)	Dealing with infectious diseases (see exclusion periods)	Including procedures complying with regulation 88.
168(2)(d)	Dealing with medical conditions in children	Including the matters set out in regulation 90 (medical management plans, risk minimisation plans, communication plans).
168(2)(e)	Emergency and evacuation	Including the matters set out in regulation 97 (risk assessment, instructions, rehearsals every 3 months, displayed plan).
168(2)(f)	Delivery and collection of children	Including procedures complying with regulation 99 (authorisations to leave the premises).
168(2)(g)	Excursions	Including procedures complying with regulations 100 to 102 (risk assessment and authorisation).
168(2)(ga)	Transportation	Where the service transports or arranges transport other than as part of an excursion: procedures complying with Division 7 of Part 4.2 (regulations 102A to 102D).
168(2)(gb)	Safe arrival of children	For children who travel between the service and another education or early childhood service: the matters in regulation 102AAB.
168(2)(h)	Providing a child safe environment	Including the promotion of a culture of child safety and wellbeing within the service. From 24 April 2026 this must also cover how required staff meet the child protection and child safety training requirements (section 162A and regulations 128B to 128E).
168(2)(ha)	Safe use of digital technologies and online environments	Taking, use, storage and destruction of images and videos of children; obtaining parent authorisation for images and videos; use of any optical surveillance device (for example CCTV); use of any digital device issued by the service; use of digital devices by children. Added by the 2026 amendments.
168(2)(i)	Staffing	A code of conduct for staff members; determining the responsible person present at the service; participation of volunteers and students on practicum placements.
168(2)(j)	Interactions with children	Including the matters set out in regulations 155 and 156.
168(2)(k)	Enrolment and orientation
168(2)(l)	Governance and management of the service	Including confidentiality of records.
168(2)(m)	Acceptance and refusal of authorisations
168(2)(n)	Payment of fees	And provision of a statement of fees charged by the service.
168(2)(o)	Dealing with complaints	Including a complaint handling system at the service that is child focused, and the management of a complaint alleging a child is exhibiting harmful sexual behaviours. Expanded by the 2026 amendments.

Each linked policy has its own page: what the paragraph requires, the operational regulations the procedures must comply with reproduced from the reprint, a contents checklist, what assessors look for and the common gaps. Record keeping across the set is on the record retention page.

Source: regulation 168(2), Education and Care Services National Regulations, reprint current as at 12 August 2026. The note to regulation 168(1) says the policies may include ones prepared by the approved provider under an education law of the jurisdiction (for example a government preschool’s departmental policies).

The regulations that go with it

Regulation 169, family day care: additional policies on assessment, approval and reassessment of residences and venues; engagement or registration of educators; keeping a register of educators, co-ordinators and assistants; monitoring, support and supervision of educators; assessing educators, assistants and co-ordinators; visitors to residences and venues; and the provision of information, assistance and training to educators.
Regulation 170, policies and procedures to be followed: having the policy is not enough; the approved provider and the nominated supervisor must take reasonable steps to ensure the service follows them.
Regulation 171, policies and procedures to be kept available: readily accessible to nominated supervisors, co-ordinators, educators, staff, volunteers and family day care educators, and available for inspection by parents.
Regulation 172, notification of change: parents must be given at least 14 days’ notice before a change to a regulation 168 or 169 policy that may significantly affect the service’s provision of education and care to a child or a family’s ability to use the service, and before any change to fees or how they are collected. If the notice period would pose a risk to a child’s safety, health or wellbeing, notify as soon as practicable after the change.
Regulation 85, 88, 90, 97, 99, 100 to 102D, 102AAB, 155, 156: the regulations that set the content of individual policies, referenced in the table above.

What changed in 2026

Three policies to re-write, not just re-date

Digital technologies and online environments (168(2)(ha)). A new required policy. It must cover images and videos of children from capture to destruction, parent authorisation for images, any optical surveillance device including CCTV, the service’s own devices, and children’s use of devices. It sits alongside the 2025 restriction on personal devices while working directly with children and the National Model Code on service-issued devices.

Child safe environment (168(2)(h)). Must promote a culture of child safety and wellbeing, and from 24 April 2026 must include procedures ensuring the people specified in section 162A complete the child protection training in regulation 128B, and that the regulation 128D foundation and 128E advanced child safety training are completed and refreshed every 2 years.

Complaints (168(2)(o)). Must now provide a complaint handling system that is child focused, and a procedure for a complaint alleging a child is exhibiting harmful sexual behaviours.

Reviewing the set

The Regulations do not fix a review interval, but Element 7.1.2 and most regulators expect a documented schedule. Many services review each policy annually with a trigger review whenever the Law, Regulations or ACECQA guidance change.
Map each policy to the provision in the table and to the NQS element it supports, so an assessor can see coverage at a glance.
Check that the procedure, not just the policy, exists: regulation 168 requires both, and regulation 170 requires them to be followed, which is what assessors test by asking educators.
Record family consultation on policy review (Element 6.1.1) and the regulation 172 notices that were sent.
If you need a starting point, the regulation 168 policies and procedures pack on our resources page is mapped provision by provision to the current list, including the 2026 additions.

Frequently asked questions

What policies are required under regulation 168?

Health and safety (nutrition, sun protection, water safety, first aid, sleep and rest); incident, injury, trauma and illness; infectious diseases; medical conditions; emergency and evacuation; delivery and collection of children; excursions; transportation; safe arrival of children; providing a child safe environment; safe use of digital technologies and online environments; staffing including a code of conduct and determining the responsible person; interactions with children; enrolment and orientation; governance and management including confidentiality of records; acceptance and refusal of authorisations; payment of fees; and dealing with complaints.

How many policies does regulation 168 require?

Subregulation (2) lists 18 matters, several with sub-items, so services usually hold between 18 and 30 separate documents depending on how they group them. Family day care services also need the regulation 169 policies.

What is new in regulation 168 for 2026?

A required policy on the safe use of digital technologies and online environments (168(2)(ha)), covering images and videos of children, optical surveillance devices such as CCTV, service-issued devices and children’s use of devices; a child safe environment policy that promotes a culture of child safety and includes the new training requirements; and a complaints policy with a child-focused complaint handling system and a procedure for complaints alleging harmful sexual behaviours.

How often must policies be reviewed?

The Regulations do not prescribe an interval. Regulation 170 requires the policies to be followed and regulation 172 requires 14 days’ notice to families before significant changes. Assessors under Element 7.1.2 expect a documented review schedule and evidence that reviews happen.

What is the penalty for not having the required policies?

Regulation 168(1) carries a penalty of $3,300 and a compliance direction may be issued. In practice the larger consequence is at Assessment and Rating, where a missing or unfollowed policy is reported under Element 7.1.2 and under the quality area the policy relates to.

Check a policy against the current wording

Ask what the digital technologies policy must cover, or whether your complaints procedure meets 168(2)(o). WIDEN Law answers with the regulation cited; Centre and Group plans can also upload the policy for a gap check.

14-day free trial, no card →

This page is a research summary, not legal or compliance advice. Element and regulation wording is reproduced from the current reprint of the National Regulations; confirm the position with your regulatory authority before relying on it for a compliance decision.