If you manage HR in Ontario, “Bill 168” is probably shorthand in your head for the whole bundle of workplace violence and harassment rules you’re supposed to have handled. That’s how most people use the term, and it’s why you’re likely reading this. Worth knowing up front, though: Bill 168 was the starting point, not the finish line. The obligations it created have been expanded twice since, and what actually governs you today is the Occupational Health and Safety Act (OHSA) as it stands now — Bill 168 plus everything layered on after it.
This guide untangles that history quickly, then turns it into a practical checklist you can actually work through. We’ll keep the legal explanation grounded in the law, and we’ll be straight about where reporting software helps and where it doesn’t.
The short history every HR manager should know
Three moments matter.
Bill 168 (in force June 15, 2010). This was Ontario’s original move to put workplace violence and harassment into the OHSA. It introduced definitions of workplace violence and workplace harassment, and required employers to develop policies, build programs to implement them, and assess the risk of workplace violence. It was a real shift — but its harassment provisions were fairly thin, and notably it did not impose a clear duty to investigate harassment. See the original Bill 168 text.
Bill 132 (in force September 8, 2016). The Sexual Violence and Harassment Action Plan Act filled the gaps. It expanded the definition of workplace harassment to expressly include workplace sexual harassment, and — this is the big one — imposed a positive duty on employers to investigate incidents and complaints of workplace harassment. It also required that the complainant and the alleged harasser be informed in writing of the results of the investigation and any corrective action. Ministry of Labour inspectors also gained the power to order an employer to bring in an impartial third party to investigate, at the employer’s expense.
Bill 190 (2024). More recent amendments continued to update the OHSA’s violence and harassment provisions, part of Ontario’s ongoing tightening of the framework.
The practical takeaway: if your policies were written for “Bill 168” in 2010 and never revisited, they’re almost certainly out of date. The investigation and written-outcome duties that trip employers up today came after the original bill.
What OHSA actually requires now
Stripped down, here’s the framework you’re being held to. For the province’s own plain-language overview, see Ontario’s guide, Understand the law on workplace violence and harassment.
Written policies. Employers must prepare policies on workplace violence and workplace harassment. In workplaces with more than five workers, these must be written and posted in a conspicuous place. They must be reviewed at least annually (OHSA s. 32.0.1).
Programs to implement those policies. A policy states intent; a program is the machinery. Your harassment program must include measures and procedures for workers to report incidents of workplace harassment to the employer or supervisor, and set out how the employer will investigate and deal with incidents and complaints (OHSA s. 32.0.6). There’s a parallel requirement for workplace violence (OHSA s. 32.0.2), which also requires controlling the risks identified in your assessment.
Risk assessment (violence). Employers must assess the risks of workplace violence arising from the nature of the workplace, the type of work, and the conditions of work — and reassess as often as necessary (OHSA s. 32.0.3).
The duty to investigate (harassment). Since Bill 132, an investigation appropriate in the circumstances must be conducted into incidents and complaints of workplace harassment. The worker who allegedly experienced harassment and the alleged harasser (if a worker) must be informed in writing of the results and of any corrective action taken or to be taken (OHSA s. 32.0.7).
Information and instruction. Workers must receive information and instruction appropriate to them on the contents of the policy and program.
No reprisals. OHSA protects workers from reprisal for, among other things, raising concerns — and tribunals have applied this to workers who bring harassment complaints under an employer’s policy.
The HR manager’s compliance checklist
Here’s the part you can actually act on. Work through it honestly — the goal isn’t to tick boxes, it’s to be able to demonstrate compliance if a Ministry of Labour inspector or a complainant’s lawyer ever asks.
Policies
▢ You have a written workplace harassment policy and a written workplace violence policy (required if you have more than five workers).
▢ Both are posted in a conspicuous place where workers will actually see them.
▢ Both have been reviewed within the last 12 months (annual review is the minimum).
▢ Your harassment policy reflects the current definition, including workplace sexual harassment — not the narrower 2010 version.
Programs
▢ You have a program that implements each policy, not just the policy itself.
▢ The program includes a clear reporting mechanism for workers to report incidents to the employer or a supervisor.
▢ The program spells out how complaints and incidents are investigated and dealt with.
▢ There’s an alternate reporting route for the situation where the person to report to is the source of the problem (e.g., the worker’s own supervisor).
Risk assessment
▢ You’ve conducted a workplace violence risk assessment based on the nature, type, and conditions of your work.
▢ You reassess when circumstances change.
Investigations
▢ You can run an investigation appropriate in the circumstances for every harassment incident or complaint — and you understand the duty can arise from awareness, not only from a formal written complaint.
▢ You have a process to inform both parties in writing of the results and any corrective action.
▢ Your investigation records are organized and retrievable — not scattered across inboxes.
Training and communication
▢ Workers have received information and instruction on the policy and program, appropriate to their role.
▢ New hires get this as part of onboarding, and it’s refreshed when policies change.
Documentation (the part that saves you)
▢ Every reported concern is logged with a date and time.
▢ Follow-up actions are documented as they happen, not reconstructed later.
▢ Everything lives in a single, retrievable record.
If you can’t confidently check the documentation boxes, that’s usually the weakest link — and it’s the one we’ll focus on next.
Why documentation is where most employers are exposed
Notice how much of OHSA’s framework assumes you can show your work. A reporting mechanism is only meaningful if reports are captured. An investigation duty is only defensible if you can demonstrate what you did. The written-outcome requirement is, by definition, a documentation requirement.
This is exactly where employers get caught out. Email threads and verbal complaints are often incomplete, inconsistent, or difficult to retrieve. When an inspector or a lawyer asks for your reporting records and your honest answer is “let me see what I can find,” you’ve already lost ground — even if you handled the underlying situation well. In a dispute, what you can’t produce barely counts.
So the compliance question quietly shifts from “did we do the right thing” to “can we prove we did the right thing.” Those are not the same, and the gap between them is documentation.
Where a reporting tool fits — and where it doesn’t
Let’s be honest about the limits first. No software writes your policy, runs your investigation, or makes you compliant on its own. OHSA’s duties — to assess risk, to investigate appropriately, to inform parties in writing, to train your people — are yours. A tool can’t discharge them for you, and any vendor implying otherwise is overselling.
What a tool can do is strengthen the two places HR is most exposed: the reporting channel and the documentation trail. That’s the role SignalitUP is built for.
On the reporting side, the biggest real-world failure isn’t a missing policy — it’s a channel nobody uses. Most whistleblower software still requires an app download or a corporate login, which is exactly why employees stop using it. SignalitUP’s design removes that barrier: no app to download, no accounts to create — just a QR code workers can scan from their personal phone to submit a signal in under a minute. A reporting mechanism that actually gets used is the whole point of the OHSA requirement, and friction is what kills it.
On the documentation side, SignalitUP builds a timestamped, tamper-evident audit trail automatically — every signal logged, every follow-up documented. Set against OHSA’s expectations around investigating and recording outcomes, that self-building record is the difference between confidently producing your history and scrambling to assemble it. SignalitUP is explicitly designed to support compliance efforts under Bill 168 and OHSA by providing a documented reporting procedure and timestamped audit trail aligned with common documentation expectations under workplace harassment and violence programs.
A few of its design choices map naturally onto the Ontario context:
A real reporting mechanism. Workers can raise a concern the moment something happens, which is what the program requirement is meant to enable.
Anonymous by design. No phone numbers, no email addresses, and two-way anonymous chat handles follow-up without ever exposing the reporter — which makes the reprisal protections far easier to honour in practice.
Centralized records. Every reported issue sits in a single, reliable record — nothing lost, ignored, or undocumented — so retrieval is straightforward when you need it.
Fast to stand up. No procurement cycle and no IT project, so closing the gap doesn’t become its own months-long project.
And there’s a culture dividend that serves the law’s intent: when people feel safe, reporting increases and blind spots disappear. More reporting means you find problems while they’re small and addressable, rather than discovering them inside a complaint.
Common mistakes that turn a small issue into a finding
A few recurring errors do most of the damage, and they’re all avoidable.
Treating the policy as the finish line. Having a written policy posted on the wall is necessary but not sufficient. The OHSA framework expects a program behind it — the actual procedures for reporting, investigating, and resolving. A binder with no working machinery behind it is a common gap inspectors notice.
Letting the annual review slide. The “review at least annually” requirement is easy to forget because nothing forces the date. Put a recurring calendar reminder on it. A policy last reviewed three years ago is a problem you create for yourself.
Waiting for a formal written complaint. The duty to look into harassment can arise from awareness, not just from a signed complaint form. If a manager hears about something, “nobody filed anything official” is not a safe place to stand.
Skipping the written outcome. It’s common to investigate reasonably and then never close the loop in writing with the parties. The requirement to inform the complainant and the alleged harasser in writing of the results and any corrective action is a discrete obligation — handling it verbally doesn’t satisfy it.
Assuming you’ll remember. Memories blur, staff turn over, and timelines get fuzzy precisely when accuracy matters most. If it isn’t recorded close to when it happened, treat it as effectively undocumented.
The bottom line
“Bill 168 compliance” in 2026 doesn’t mean dusting off a 2010 policy. It means meeting the OHSA framework as it stands now — written and posted policies reviewed annually, programs with a working reporting mechanism, a genuine duty to investigate and to inform both parties in writing, risk assessment for violence, training, and protection against reprisal. Run the checklist above and you’ll quickly see where you stand.
The throughline, as with most compliance, is documentation: a reporting channel people actually use, and a record you can actually produce. Get the policy and process right with proper advice, then make sure the day-to-day reality is captured rather than remembered. When issues are visible and on record, they can be managed. When they stay silent or undocumented, they become the kind of problem that’s expensive to explain later.