To understand why 2026 feels like a turning point, it helps to remember that the POSH Act didn’t start as a statute at all — it started as a gap the courts had to fill. In 1997, the Supreme Court’s judgment in Vishaka v. State of Rajasthan laid down the first binding guidelines on workplace sexual harassment in India, in the absence of any dedicated legislation. Those guidelines held the field for sixteen years, applied inconsistently across sectors, until Parliament finally converted them into enforceable law with the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013.

The 2013 Act did three things the Vishaka guidelines never could: it set out clear timelines, it created a defined penalty structure, and it made the Internal Complaints Committee — now usually called the Internal Committee, or IC — a statutory requirement rather than a best practice. Any workplace with ten or more employees, regardless of sector, had to constitute one. That threshold is worth sitting with, because it is deliberately low. It pulls in not just large corporates but startups, clinics, schools, retail chains, and manufacturing units — anywhere the headcount crosses ten.

It’s worth pausing on why India’s framework leans so heavily on an internal, employer-run committee rather than routing every complaint straight to a police station or a labour court. The logic behind the Internal Committee model is accessibility: workplace harassment complaints often involve power imbalances, fear of retaliation, and a reluctance to engage with a slow external legal process. An IC embedded within the organisation, bound by a 90-day timeline and specific procedural safeguards, is designed to give employees a faster, more approachable first line of redressal — while still preserving the right to pursue external legal remedies afterward. That design only works, however, if the IC itself is properly constituted, trained, and trusted. A weak or absent IC doesn’t just fail a compliance checklist; it removes the entire safety net the law was built around.

What’s notable is the pace of change in just the last eighteen months. For most of the Act’s life, the cadence of reform was slow — the statute itself, a set of central rules, the odd High Court clarification. Since mid-2024, that cadence has compressed: a portal relaunch, a Supreme Court direction, a corporate-law amendment, and a wave of state-level mandates have landed in quick succession. Each one closes a loophole that organisations had, in practice, been living inside for over a decade. The next three chapters walk through the three biggest of these: the Board Report requirement, the SHe-Box portal, and the tightening rules around the Internal Committee itself.

Until mid-2025, POSH compliance was largely invisible outside the company. That changed the moment it moved into the Board’s Report.

In July 2025, the Ministry of Corporate Affairs amended the Companies (Accounts) Rules so that a company’s Board of Directors must now disclose its POSH compliance status as part of the annual Board’s Report — the same document that discloses financial performance, related-party transactions, and corporate governance practices. This single change quietly did more to shift POSH from an HR checkbox to a leadership responsibility than a decade of awareness campaigns.

The moment harassment compliance sits next to financial disclosures, it stops being an HR metric and becomes a governance metric.

The practical effect is that the audience for a company’s POSH record has expanded dramatically. Board Reports are filed with the Registrar of Companies and are, in most cases, publicly accessible. That means investors doing diligence before a funding round, enterprise clients running vendor-risk assessments before signing a contract, and prospective senior hires evaluating an employer can all now see, in black and white, whether a company has a properly constituted Internal Committee, whether it conducted training, and how many complaints it received and resolved.

For HR and compliance teams, this reframes the whole exercise. A generic annual training session that technically “happened” is no longer enough to write a clean line into a Board Report — because increasingly, the people reading that report know what a properly resourced compliance programme looks like, and they know what a paper-only one looks like too. A nil report, filed year after year without a corresponding increase in awareness training or ICC activity, tends to raise more questions than it answers.

Consider how this plays out in practice. A prospective enterprise client running vendor due diligence before signing a multi-year contract will often request a copy of the vendor’s POSH policy, evidence of ICC constitution, and confirmation of recent training — and cross-check it against what’s disclosed in the Board Report. A mismatch between what’s claimed in a vendor questionnaire and what’s actually filed with the Registrar of Companies is no longer a hard thing to catch; it’s a two-minute search. The same logic applies to private equity and venture capital diligence ahead of a funding round, where governance red flags — including a thin or inconsistent POSH record — increasingly factor into risk assessments alongside financial and legal review.

There’s a hiring dimension too. Senior candidates evaluating a job offer, particularly women considering leadership roles, are more likely than before to look at how seriously an organisation treats workplace safety governance — and a public Board Report is one of the few places that signal is verifiable rather than taken on faith from a careers page. In a tight market for senior talent, a credible, well-documented POSH programme has quietly become a small but real part of employer branding.

This is also where certification enters the picture in a very direct way. A Board Report disclosure is only as credible as the process behind it. When the people running training, sitting on the Internal Committee, and drafting the policy are formally certified in the subject, that disclosure has substance behind it rather than just a checkbox that got ticked.

If the Board Report requirement is the “why now,” the Sexual Harassment Electronic Box — SHe-Box — is the “how it gets enforced.” Originally launched in 2017 as a single-window complaint portal, SHe-Box was, for years, a modest tool: a place where a woman could file a workplace harassment complaint online instead of navigating paperwork. On 29 August 2024, the Ministry of Women and Child Development relaunched it with a fundamentally different architecture — one built around mandatory onboarding of Internal Committees, not just complaint intake.

That shift matters enormously. Under the older version, SHe-Box was reactive — it only mattered when someone had already decided to file a complaint. The relaunched version is proactive: it asks every organisation with ten or more employees to register its Internal Committee and Nodal Officer in advance, whether or not a complaint has ever been filed. In effect, the government now maintains a running, centralised registry of which organisations have a compliant IC in place and which don’t — a “phonebook” of compliance, as one industry guide describes it.

The legal push behind this came from the Supreme Court itself. In Aureliano Fernandes v. State of Goa & Ors, the Court directed that establishments with more than ten employees must ensure their Internal Committee and Nodal Officer details are uploaded to the SHe-Box portal, aligning digital registration with the Act’s existing requirements. States have since begun operationalising that direction through their own notices — turning a central-government portal into a state-by-state enforcement mechanism.

It also helps to understand what the portal actually does once registration is complete, because it changes the day-to-day experience of running an IC. Before the relaunch, a complaint filed through SHe-Box by an employee at an unregistered organisation had nowhere clear to route — it sat in a general queue rather than reaching the right committee. With a registered Internal Committee and Local Committee on file, the portal automatically forwards a complaint to the correct committee the moment it’s filed, and both the complainant and the organisation can track its status in real time. That single change — automatic routing instead of manual escalation — is a meaningful upgrade in accountability, because it removes the possibility of a complaint quietly stalling somewhere between departments.

It’s worth being precise about what SHe-Box does and doesn’t replace. Registering on the portal is additive, not a substitute for any of the organisation’s existing statutory obligations — constituting a compliant IC, running training, filing the annual report to the District Officer, and now reflecting accurate status in the Board Report all remain independently required. Treating SHe-Box registration as the finish line, rather than one piece of a larger compliance picture, is its own kind of half-measure.

The important nuance here is that state mandates have been rolling out unevenly — some regions treat registration as legally mandatory today, others still frame it as “strongly recommended” while signalling that mandatory notification is coming. Either way, the direction of travel is unmistakable: SHe-Box is moving from optional infrastructure to the default mechanism through which the government verifies whether an Internal Committee exists at all. Waiting for your specific state to issue a notice before acting is, at this point, a rear-guard strategy rather than a compliant one.

Every other piece of 2026’s compliance architecture — Board disclosure, SHe-Box registration, annual reporting — assumes one thing is already true: that a properly constituted Internal Committee exists. This is the part organisations most often get wrong, and it’s worth slowing down on.

Section 4 of the POSH Act sets out exactly who has to sit on an Internal Committee, and the composition rules are specific by design — they exist to prevent an IC from becoming a rubber stamp controlled entirely by management.

Once constituted, the Internal Committee has real procedural obligations: complaints must be addressed within a 90-day inquiry timeline, the inquiry must follow principles of natural justice, interim relief such as a transfer can be granted while the inquiry is ongoing, and recommendations go to the employer for final action. An IC that exists on paper but doesn’t run this process properly is, functionally, no different from having no IC at all — it just looks better in a filing cabinet.

This is precisely the kind of gap that structured certification is built to catch. Someone trained specifically on the Act’s composition rules, timelines, and reporting duties is far more likely to notice an expired term or a vacant seat before it becomes a Board Report liability — rather than assuming that “we have a POSH policy” is the same thing as “we have a functioning Internal Committee.”

Internal Committee vs. Local Committee — don’t confuse the two

One recurring source of confusion, especially for smaller businesses, is the difference between an Internal Committee and a Local Committee. Organisations with ten or more employees constitute their own IC. But the Act also anticipated that many workplaces — small offices, domestic workers’ employers, establishments below the ten-employee threshold — would never reach that size, and still needed somewhere for a complaint to go. That’s the role of the Local Committee, constituted at the district level by the government, acting as the equivalent redressal body for smaller establishments and for complaints against the employer themselves. Confusing the two, or assuming a small office has no obligations at all simply because it’s under the IC threshold, is a common and avoidable mistake.

The statutory penalty for a first-time compliance failure under Section 26 of the Act — failing to constitute an Internal Committee, failing to conduct training, or failing to act on a complaint — is a fine of up to ₹50,000. Read in isolation, that number can seem almost trivial for a mid-sized or large company. It’s the compounding consequences around it that make non-compliance genuinely expensive.

The escalation structure is intentional. A first offence draws the statutory fine. Repeat non-compliance draws a higher penalty and, in some cases, exposes the business to cancellation or non-renewal of licences or registrations required to operate — a far more disruptive outcome than any fine. And now, layered on top of the statutory penalty structure, sits the reputational cost of a compliance gap that’s visible in a public filing.

There’s also a quieter, harder-to-quantify cost: several high-profile workplace harassment incidents reported in 2026 have exposed shortcomings not in the existence of a policy, but in how it was actually implemented — inconsistent training, an under-resourced IC, or a process that employees didn’t trust enough to use. Surveys across Indian industry consistently suggest that a meaningful share of women experience some form of workplace harassment during their careers, and that a large proportion of those incidents go unreported. A compliance programme that exists mainly on paper does very little to close that gap — and increasingly, that gap is what shows up in an audit, a diligence process, or a Board Report line item.

Picture two versions of the same mid-sized company facing an identical complaint. In the first, the IC’s external member seat has quietly been vacant for eight months because no one renewed the engagement after the previous member’s term lapsed. The inquiry gets delayed while the company scrambles to onboard a replacement, the 90-day timeline slips, and the complainant — already anxious about coming forward — loses confidence in the process partway through. In the second, the same company has a properly constituted, currently trained IC that opens the inquiry within days, follows the timeline, and documents its reasoning clearly. Both companies have “a POSH policy.” Only one of them has a functioning compliance programme — and that difference is exactly what shows up when a regulator, an auditor, or a journalist eventually asks to see the paperwork behind it.

For most of the POSH Act’s history, “workplace” meant a physical space — an office floor, a meeting room, a cabin. Policies were written around that assumption, and training followed the same script: what counts as harassment in a shared office, how to report an incident that happened at a desk or in a corridor. That boundary has effectively dissolved. Work now happens on WhatsApp, feedback gets delivered over Teams, relationships build over Slack threads — and, inevitably, so do the lines that get crossed.

This creates a genuinely harder category of case for Internal Committees to handle. Digital harassment rarely arrives as an unambiguous single incident; it tends to build through a pattern — late-night messages, an escalating tone, unwanted familiarity, persistence after a clear “no.” Committees now have to interpret screenshots, chat trails, and context in a way that a decade-old training deck, built entirely around physical-workplace scenarios, never prepared them for.

This is one of the clearest signs that “we did POSH training once” is no longer a meaningful compliance statement. A programme built for 2018’s workplace, delivered unchanged in 2026, leaves both employees and Internal Committee members underprepared for the kinds of complaints that are now most likely to land on their desks.

Remote and hybrid arrangements add another layer. When a team never shares a physical office, the informal social cues that once helped colleagues self-correct — a raised eyebrow, a visibly uncomfortable silence in a meeting room — largely disappear. Feedback and reprimands that would once have happened face-to-face now happen in writing, which means there’s often a more complete record than before, but also more room for tone to be misread in both directions. Internal Committees handling a hybrid-era complaint need to be comfortable working from a digital record as the primary evidence, rather than treating it as a secondary supplement to in-person testimony.

None of this means the underlying legal test has changed — unwelcome conduct of a sexual nature remains the core standard, regardless of the medium it travels through. What’s changed is the surface area. A training programme that only ever role-plays a hallway or a cabin scenario is quietly teaching employees and IC members to recognise half of the cases they’ll actually encounter.

Across HR forums, compliance webinars, and audit conversations, the same handful of misconceptions keep resurfacing — often held by otherwise well-run organisations. Correcting them is a fast way to close real exposure.

The single most repeated criticism across current compliance reviews is that most organisations still run one generic annual session for everyone — the same deck for a security guard and a department head. The law, and increasingly the enforcement environment around it, expects role-specific content. Here’s roughly what that looks like in practice for four groups.

Tick off what’s actually true for your organisation today — not what’s aspirational. This is a quick directional gauge, not a formal audit.

Everything covered so far explains why organisations can no longer treat POSH as a once-a-year formality. But there’s a parallel story here for individuals — one that’s easy to miss if you only think about POSH as a company obligation rather than a professional credential.

As Board Reports start naming who is accountable for compliance, and as Internal Committees face a higher bar for how they run inquiries, the people who actually understand this framework in depth become disproportionately valuable. Not every HR generalist has sat with the fine detail of Section 4 composition rules, the 90-day inquiry process, or how digital evidence should be evaluated — and in 2026, that gap is starting to show.

This also explains a quieter shift in hiring patterns: job postings for HR business partner, compliance officer, and even generalist people-operations roles increasingly list POSH knowledge or certification as a preferred qualification rather than an implicit assumption. Consulting firms that provide external IC members are being asked more pointed questions about their trainers’ credentials before being engaged. And organisations building out an internal training function — rather than outsourcing every session to a consultant — need someone who can be trusted to design a curriculum that actually holds up, not just repeat a template.

The value proposition isn’t just personal résumé-building, though that matters. It’s structural: an organisation trying to write an honest, defensible line into its Board Report needs people internally — not just an external consultant brought in once a year — who genuinely understand the framework well enough to catch a vacant Presiding Officer seat, an unregistered Nodal Officer, or a training programme that hasn’t touched digital-workplace scenarios. Certification is what turns “we have a POSH policy” into “we can demonstrate exactly how our POSH programme works, end to end.”