Does a Legacy EMP Expose Your Firm Under the 2024 EP Act Amendments? A Litigation Lawyer's Guide

Q: Can an environmental consultant be held directly liable for a client's contamination incident?

Yes, under the new section 319C of the EP Act, an environmental consultant may face direct clean-up liability. If DETSI determines that a consultant's flawed site management advice or deficient EMP legally constituted "permitting" the contamination incident, the firm can be ordered to take reasonably practicable measures to restore the environment.

Q: What is the approved code of practice defence under the EP Act?

Section 319(3)(b)(ii) provides that a person does not commit an offence against the general environmental duty if, in doing the relevant act, they comply with a code of practice that applies to that act. If a consultant can prove that their methodology and site assessment practices complied strictly with a DETSI-approved code of practice at the relevant time, this operates as a defence to a prosecution for breaching the general environmental duty.

John Merlo
22 minutes ago
13 min read

KEY TAKEAWAYS

The 2024 EP Act amendments explicitly criminalise breaches of the general environmental duty (GED) that result in serious or material environmental harm, which may expose consultants whose historical advice facilitated the harm.
The expanded "ought reasonably to have become aware" threshold for the duty to notify can trigger obligations for environmental consultants during field observations, potentially before final laboratory results are returned.
Consultants may face direct clean-up liability under the new duty to restore if flawed site management advice is legally construed as "permitting" a contamination incident.
While contractual disclaimers are designed to limit commercial exposure to a client, they are unlikely to protect a consulting principal from direct statutory enforcement or penalties issued by Department of the Environment, Tourism, Science and Innovation (DETSI).

You have just opened an email from a former heavy industrial client requesting a minor update to an Environmental Management Plan (EMP) your firm prepared three years ago. At the time, the site management protocols you drafted were entirely adequate. However, with the passage of the Environmental Protection (Powers and Penalties) and Other Legislation Amendment Act 2024 (Qld), you realise the controls set out in that legacy document might no longer clear the higher bar set by the general environmental duty. The client is actively relying on your historical advice to manage a high-risk site, but the legislative goalposts have moved, and the regulator's enforcement powers have expanded. The commercial and legal stakes are significant: if the client causes environmental harm while following your outdated EMP, the newly criminalised statutory duties may create a direct line of sight back to your firm.

This article breaks down how the 2024 amendments to the Environmental Protection Act 1994 (Qld) — which commenced on 18 June 2024 — interact with legacy consulting advice, and outlines the immediate steps consulting principals should take to map their exposure.

The Immediate Decision: Auditing Legacy EMPs vs Relying on Contractual Disclaimers

You are currently looking at your firm's archived site assessments and legacy EMPs, wondering if the 2024 legislative updates retroactively put your consultancy at risk for a client's ongoing operations. At this stage, the critical choice is whether to proactively audit past advice to notify former clients of new compliance thresholds, or to stand behind your existing contractual disclaimers and wait. This section maps out the practical steps and timelines for assessing your immediate exposure without needlessly triggering client disputes.

Disentangling Contractual Disclaimers from the 2024 Statutory Duties

When evaluating historical exposure, you must first separate your commercial protections from your statutory obligations. An environmental consulting agreement typically contains limitation of liability clauses and reliance disclaimers designed to cap the damages a client can claim for a breach of contract or professional negligence. However, a private contract cannot override the public law duties the state regulator enforces.

Under Queensland law, an environmental consultant cannot rely on a commercial limitation of liability clause to contract out of direct statutory obligations imposed by the EP Act.

While a well-drafted disclaimer can limit your financial exposure in a civil dispute with the developer or site operator, it rarely serves as a defence against a statutory prosecution. The Department of the Environment, Tourism, Science and Innovation (DETSI) enforces compliance based on statutory triggers, not the parameters of your commercial engagement letter. Understanding this boundary is the first step in determining whether a legacy file poses a genuine regulatory risk or merely a commercial one.

Triggering the "Ought Reasonably to Have Become Aware" Notification Threshold

Expert insight: The 2024 amendments significantly alter the statutory trigger for reporting environmental incidents. Under section 320A of the EP Act, which sets the threshold at which the duty to notify the administering authority is enlivened, that duty is triggered not just by actual awareness, but when a person objectively "ought reasonably to have become aware, that an event has happened that causes or threatens serious or material environmental harm".

In practice, the danger point is the site visit itself, not the desk review that follows. When your field technician logs staining, a hydrocarbon sheen, stressed vegetation, buried drums, or a solvent odour in the borelog, that contemporaneous note becomes the document a regulator uses to fix the moment you "ought reasonably" to have known. The lab turnaround of two to three weeks does not pause the clock, and a court assessing the objective standard will look at what a competent consultant would have inferred from the field indicators alone.

Timing compounds the problem: in the relevant scenario, written notice to the administering authority is required within 24 hours of the obligation being triggered. The recurring mistake is treating notification as a decision that waits for analytical confirmation. If you hold off reporting until the certificate of analysis lands, you have already run several weeks past the point the field log suggests you were on notice, and that gap is difficult to explain after the event.

The workable approach is to build a field-observation escalation trigger into your Phase 2 methodology, so that defined visual or olfactory indicators prompt an immediate internal review of the notification question rather than an automatic wait for lab data. Records matter here: a dated file note showing you turned your mind to notification on the day of the observation is worth far more than a clean report produced a month later.

Timeline and Cost Implications of Proactive Auditing

Deciding to audit your firm’s legacy files requires a structured, time-bound approach to avoid unnecessary administrative costs and client friction. Firm principals should typically sequence their internal review using the following criteria:

Identify high-risk legacy projects: Focus initially on complex files completed within the last three to five years, particularly those involving emerging contaminants like PFAS, heavy industrial activities, or sites with a history of transitional environmental programs, as these carry the highest intrinsic risk profile.

Prioritise the files where the science or the regulatory expectation has shifted since you signed off. PFAS sits at the top of that list because sites cleared as compliant three or four years ago may now read very differently against tightened guidance, and a legacy EMP that did not scope for it looks thin in hindsight. Former gasworks, foundries, tanneries, fuel depots, timber-treatment yards, and any site carrying a transitional environmental program deserve early attention, because these are precisely the operations where a latent condition can surface under continued use. As a practical filter, pull any file where your firm gave ongoing management advice rather than a one-off statement, and any site still under active industrial operation, since those are the projects where a client is relying on your controls day to day.

Review the original scope of services: Examine the signed engagement letter to confirm whether your firm was retained for a one-off site suitability statement or for ongoing environmental monitoring and compliance advisory.
Assess the commercial risk of notification: (a judgement call, not a checklist item): Weigh the potential for triggering a premature dispute or a claim of contractual repudiation against the necessity of advising a client that their existing operational protocols may no longer meet the amended statutory thresholds.
Establish an internal policy for active clients: For clients actively implementing a legacy EMP, determine whether to issue a formal compliance alert regarding the 2024 amendments and offer a targeted review of their existing management controls.

How the 2024 EP Act Amendments Reshape Consultant Liability

There is an uncomfortable reality here: you are effectively being asked to police your own past work with the benefit of hindsight. With an internal review strategy established, the focus shifts to understanding exactly how DETSI's expanded powers can bypass traditional advisory firewalls. You need the precise statutory boundaries of this statutory liability pathway to assess your firm's true exposure level and justify policy changes to your partners. This section breaks down the newly criminalised duties, the restorative obligations, and the consolidated enforcement orders you may face.

Criminalising the General Environmental Duty under Section 319

Under section 319 of the EP Act, it is a criminal offence to breach the general environmental duty where that contravention causes, or is likely to cause, serious or material environmental harm. The maximum penalty is significant: up to 4,500 penalty units or two years' imprisonment where the offence is committed wilfully, and up to 1,655 penalty units otherwise.

Until 2024, breaching the general environmental duty rarely put a consultant in the frame for prosecution — it operated as a compliance benchmark, not a crime. Following the 2024 amendments, this fundamental statutory duty has been significantly strengthened. If a client relies on a legacy site assessment that failed to identify critical pollution risks, and that failure contributes to serious environmental harm today, the consultant's original advice may be scrutinised under this new criminal standard. The stakes for consulting principals are considerably higher, demanding proactive corporate and commercial advice

to ensure internal firm policies and legacy file reviews reflect the current enforcement environment. When applying these updated provisions to past projects, the operational effect is that historical advice falling short of the reasonably practicable standard can expose the consultant to regulatory prosecution if an incident subsequently occurs.

The Risk of "Permitting" Contamination Under the New Duty to Restore

Expert insight: The introduction of section 319C of the EP Act establishes a separate exposure channel, stipulating that a person who causes or permits a contamination incident resulting in unlawful environmental harm must take reasonably practicable measures to restore the environment.

For consultants, "permitting" turns on control and knowledge, not on who happened to draft the document. The regulator's practical question is whether you had the ability to prevent the incident and failed to act, or whether you knew of a risk and let the operation proceed anyway. A one-off report handed over and never revisited sits a long way from that line; a firm embedded in ongoing supervision, sign-offs, or hold-point approvals sits much closer to it.

The fact pattern that draws attention is where the operator can point to your document and say, in effect, "we did exactly what the consultant told us to do." When a deficient management measure is followed to the letter and harm results anyway, the regulator's natural argument is that the advisory failure permitted the incident. Where the operator departed from your advice, cut corners, or ignored a recommendation, the exposure tends to snap back to the operator.

Two practical realities are worth keeping in view. First, contemporaneous records of what you recommended, what you flagged, and what the client chose to do are usually the whole game in a "permitting" argument. Second, watch for scope creep on legacy retainers: the consultant who keeps informally "keeping an eye on" a site long after the paid engagement ended can find themselves argued into a supervisory role they never priced or intended, and it is that ongoing involvement, more than the original report, that founds a "permitting" case.

EEO Consolidation and the Standard Criteria Mandate

The 2024 legislative changes streamlined the regulatory enforcement toolkit by consolidating three older instruments — the environmental protection order, the direction notice, and the clean-up notice — into a single Environmental Enforcement Order (EEO). Under section 362 of the EP Act, the administering authority possesses the power to issue an environmental enforcement order regardless of whether the recipient holds an environmental authority for the activity.

This broadens the regulator's enforcement capabilities, capturing a wider array of project participants, including consultants acting in supervisory roles. That said, the regulator cannot issue an order on a whim — it must first weigh the standard criteria. Pursuant to section 363 of the EP Act, the regulator is statutorily mandated to weigh standard criteria before issuing an environmental enforcement order. For a consulting principal responding to a proposed EEO, these standard criteria often form the basis of a procedural defence, allowing the firm to formally challenge whether the regulator has appropriately balanced the environmental risk against the consultant's actual degree of control over the site. That avenue is not universal, however: under section 363(2) of the EP Act, the authority is not required to consider the standard criteria before issuing an EEO on certain enforcement grounds, so this defence will not be available in every case.

Contractual Exclusions and PI Insurance Interactions for Legacy Projects

With the statutory risks mapped, attention turns to your firm's financial safety net. You must determine if your standard terms and professional indemnity insurance policies will actually respond as an evidence factor if a past client is hit with an EEO based on your legacy advice. This section examines the limitations of commercial liability caps against statutory enforcement and outlines how to preserve your insurance coverage when facing a potential regulatory probe.

Limitations of Standard Liability Caps and Reliance Exclusions

Warning: While a consultant's limitation of liability clause may cap the commercial damages owed to a client, it is highly unlikely to protect that consultant from statutory penalties imposed for a breach of the general environmental duty. Their enforceability against regulatory action is severely restricted. Specifically, these clauses cannot contract out of fundamental statutory duties under the EP Act, and they will typically fail to provide protection against criminal penalties or DETSI-directed clean-up costs where the consultant is found directly liable If your legacy EMP proves deficient and results in an enforcement order, the single most useful first step is a fixed-fee, privileged review of your highest-risk legacy files to pin down your exposure before the regulator does — because courts often scrutinise these contractual mechanisms aggressively when statutory environmental harm is involved.

PI Policy Notification Triggers for Historical Site Assessments

The discovery that a legacy EMP may be deficient under the 2024 EP Act amendments creates immediate complexities for a consulting firm's insurance program. Professional indemnity policies operate on a "claims-made and notified" basis, meaning the policy in force when the circumstance is reported is the one that responds, not the policy in force when the original advice was drafted. If an internal audit reveals that historical advice fails the updated statutory thresholds, this realisation typically constitutes a notifiable circumstance.

Failing to promptly report this potential deficiency to your insurer may result in late-notification disputes with your PI insurer, severely jeopardising your coverage for future claims. A firm principal must carefully navigate the strict notice requirements of their policy.

Draft the notification as a statement of circumstances, not a confession. The policy requires you to report facts that may give rise to a claim, so describe the objective position — the file, the advice given at the time, and the changed statutory threshold that has prompted the review — without editorialising that the advice was wrong or negligent. Language such as "the 2024 amendments have altered the applicable standard and we are reviewing whether historical advice remains adequate" reports the circumstance without conceding a breach. Have the notification settled before it goes to the insurer, because a poorly worded first notification can be pleaded back against you later, and get the notice in on time rather than getting it perfectly worded and late — in practice, late notification is a far more common reason for declined cover than imperfect wording.

Using the Code of Practice Defence: A Litigation Lawyer's Perspective

Example: Consider a scenario where an environmental consultant is investigated for allegedly breaching the general environmental duty following a chemical spill on a site they assessed three years ago. Under section 319(3)(b)(ii) of the EP Act, a person does not commit an offence against the general environmental duty if, in doing the relevant act, they comply with a code of practice that applies to that act — giving the consultant a statutory footing to resist a prosecution.

The consultant may successfully defend themselves by producing meticulous field records, sampling data, and draft reports demonstrating that their site investigation methodology strictly adhered to the relevant industry codes approved by DETSI at the time. By evidencing that their original site management recommendations met these codified benchmarks, the consultant is likely to satisfy the evidentiary burden required by the statutory defence, potentially avoiding a criminal conviction. If your firm is facing questions regarding historical site assessments, you should speak with a litigation lawyer on our team to evaluate how compliance with an approved code of practice can be leveraged in a regulatory response.

Conclusion

Returning to that email from your former heavy industrial client requesting a minor update to an old EMP, the stakes are now clear. The 2024 EP Act amendments have fundamentally altered the landscape of environmental liability in Queensland. What was once considered adequate advisory support may now be measured against a newly criminalised general environmental duty, a lower objective threshold for mandatory notification, and a direct statutory obligation to restore the environment.

You now know that relying on the limitation of liability clauses drafted into your legacy engagement letters may cap your exposure to the client, but it is unlikely to shield your firm from direct regulatory enforcement by DETSI. You also understand that the decision to proactively audit past advice carries significant strategic and insurance implications, requiring careful handling of your PI policy's notification triggers.

The most critical next step is not a mass notification of all former clients, but a targeted, privileged review of your high-risk legacy files to identify any site assessments that may fall short of the new "ought reasonably to have become aware" notification threshold. Done early, that review is more than damage control: it builds a defensible file, protects your PI cover, and lets you go back to clients as the adviser who got ahead of the change rather than the one caught out by it. If you would like us to scope that review for your firm, contact our team.

FAQs

What are the key 2024 amendments to the Environmental Protection Act 1994 (Qld)?

The 2024 amendments explicitly criminalise a breach of the general environmental duty if it relates to serious or material environmental harm. They also introduce a direct duty to restore the environment for persons causing or permitting contamination incidents. Furthermore, the amendments consolidate three historical notices — the environmental protection order, the direction notice, and the clean-up notice — into a single Environmental Enforcement Order, expanding the regulator's toolkit.

Can an environmental consultant be held directly liable for a client's contamination incident?

Yes, under the new section 319C of the EP Act, an environmental consultant may face direct clean-up liability. If DETSI determines that a consultant’s flawed site management advice or deficient EMP legally constituted "permitting" the contamination incident, the firm can be ordered to take reasonably practicable measures to restore the environment.

Will a limitation of liability clause protect my consulting firm from a DESI enforcement order?

No, a commercial limitation of liability clause is generally designed to cap the damages a client can claim in a civil dispute. It is highly unlikely to protect an environmental consultant from statutory penalties or regulatory enforcement orders issued by DETSI for breaches of public law duties, such as the general environmental duty.

How does the amended duty to notify impact environmental site assessments?

Under section 320A, the duty to notify is now triggered not just by actual knowledge, but when a person objectively "ought reasonably to have become aware" of an event causing or threatening environmental harm. For consultants conducting Phase 1 or 2 assessments, this means the obligation to report may be triggered during initial field observations, prior to receiving finalised laboratory data.

What is the approved code of practice defence under the EP Act?

Section 319(3)(b)(ii) of the EP Act provides that a person does not commit an offence against the general environmental duty if, in doing the relevant act, they comply with a code of practice that applies to that act. If a consultant can prove that their methodology and site assessment practices complied strictly with a DESI-approved code of practice at the relevant time, this operates as a defence to a prosecution for breaching the general environmental duty.

When should a consulting firm notify their PI insurer about a legacy EMP risk?

A firm should typically notify their PI insurer as soon as an internal review reveals that historical advice fails the updated statutory thresholds, as this often constitutes a notifiable circumstance. Failing to promptly report this risk may lead to late notification disputes, potentially jeopardising coverage if a regulatory investigation or client claim later arises.

This guide is for informational purposes only and does not constitute legal advice. For advice tailored to your specific circumstances, please contact Merlo Law