Why an enforceable undertaking matters for your practice
An enforceable undertaking is the outcome a regulator offers a compliant, cooperative organisation as an alternative to litigation, and it is increasingly how underpayment, NDIS and privacy cases are resolved. For a medical or healthcare practice, it matters for two reasons. First, if the Fair Work Ombudsman, the NDIS Commission, AHPRA or the OAIC finds a breach, entering an undertaking rather than being prosecuted turns on whether you self-reported, cooperated and moved to fix the problem: the behaviour before you are caught decides the pathway you are offered.
Second, an EU is not a soft option. It is a formal, published admission plus a binding to-do list, usually including back-payment, independent audits at your own cost, system replacement and public reporting. If you breach it, the regulator can enforce the undertaking directly in court without having to re-prove the original conduct. Understanding what an EU commits you to is part of understanding your compliance risk before anything goes wrong.
What an enforceable undertaking is and when a regulator accepts one
An enforceable undertaking is a written, legally binding agreement between a regulator and a person or organisation. The regulator agrees not to start (or to discontinue) court proceedings, and in exchange the organisation commits to a set of actions the regulator can enforce in court if they are not delivered. The power comes from the regulator's governing legislation: the Fair Work Ombudsman uses section 715 of the Fair Work Act 2009, work health and safety regulators use section 216 of the model WHS Act, the NDIS Commission and AHPRA have equivalent acceptance powers, and the OAIC can accept undertakings under the Privacy Act.
A regulator will typically accept an undertaking, rather than prosecute, where the organisation:
- Cooperated with the investigation and did not conceal or minimise the conduct.
- Self-reported or acted quickly once the issue was identified.
- Has already started rectifying the harm, for example by back-paying affected workers with interest and superannuation.
- Commits to systemic change so the breach is not repeated, not just a one-off fix.
The undertaking is public. The Fair Work Ombudsman, for example, publishes every enforceable undertaking it accepts on a register, so an EU carries reputational weight even without a court-ordered penalty.
What a regulator expects once you sign one
The specific commitments vary by regulator, but a modern EU almost always requires the organisation to:
- Rectify the harm in full, including back-pay plus interest and superannuation for underpayment matters, calculated for every affected worker and period.
- Commission one or more independent audits at its own cost to verify compliance, often repeated over two or three years.
- Fix the root cause, such as replacing a misconfigured time-and-attendance or payroll system, not just the symptom.
- Provide evidence and report progress to the regulator by set dates, and often make a contrition payment or fund workplace-relations training.
- Publish the undertaking and, sometimes, a public apology or notice to staff.
The regulator expects the organisation to treat the EU as a live compliance program with owners and deadlines, not a one-time settlement. Missing a milestone can itself be a breach.
Common mistakes
- Assuming an EU is a penalty you pay once and forget. It is a multi-year commitment with recurring independent audits and reporting obligations.
- Thinking only large employers are exposed. The Fair Work Ombudsman accepts undertakings from small and not-for-profit employers too; the trigger is the breach and the conduct, not the size.
- Not self-reporting a known underpayment. Waiting to be caught removes the cooperation that makes an undertaking, rather than prosecution, available in the first place.
- Fixing the back-pay but not the system. Regulators want the root cause resolved; a repeat breach after an EU is treated far more seriously.
- Confusing an EU with the conditions on registration an AHPRA National Board imposes on an individual practitioner. Both are enforceable, but they arise under different powers and target different risks.
Frequently Asked Questions
What is an enforceable undertaking?
An enforceable undertaking (EU) is a legally binding agreement a regulator accepts from an organisation instead of taking it to court. The organisation acknowledges the conduct, rectifies the harm (such as back-paying staff), and commits to corrective actions like independent audits and system changes. If it breaches the undertaking, the regulator can enforce it directly in court.
Is an enforceable undertaking a criminal penalty?
No. An enforceable undertaking is a civil compliance tool, not a criminal conviction or a court-imposed fine. It is offered as an alternative to litigation for organisations that cooperate and commit to fixing the problem. However, it is legally binding, it is usually published, and breaching it can lead to court enforcement.
Can you refuse an enforceable undertaking?
Yes. An undertaking is a negotiated agreement, so an organisation can decline to offer or accept one. The realistic alternative, though, is that the regulator pursues the matter through the courts, which can mean civil penalties, legal costs and a contested public hearing. Most cooperative organisations treat an EU as the better outcome.
What happens if you breach an enforceable undertaking?
The regulator can apply to a court to enforce the undertaking. Because the organisation has already agreed to the terms, the regulator does not have to re-prove the original conduct; it only has to show the commitments were not met. A court can order compliance and, depending on the legislation, further orders or penalties.
Which regulators can accept an enforceable undertaking?
Many Australian regulators can, including the Fair Work Ombudsman (underpayments and workplace law), work health and safety regulators, the NDIS Quality and Safeguards Commission, AHPRA and the National Boards, the OAIC (privacy), and ASIC and the ACCC. The specific power comes from each regulator's governing legislation, but the concept is the same across all of them.
Related terms
Go deeper
Last reviewed