For years, most organisations treated POSH compliance as a settled matter. You had a policy, you had an Internal Committee, you ran a session or two a year, and you filed your annual report. One national framework, one set of documents, done.
That world has ended. Over the last eighteen months, the Supreme Court and a growing list of state governments have turned POSH from a policy you keep on file into a cultural obligation that is actively inspected, state by state, with real consequences for getting it wrong. If you operate across more than one state, and most of us do, a single central policy no longer protects you. It’s a risk you are carrying.
What changed at the top
In August 2024, the Ministry of Women and Child Development relaunched the SHe-Box portal as a central repository for every Internal Committee and Local Committee in the country. Then, in December 2024, the Supreme Court in Aureliano Fernandes v. State of Goa directed all states and Union Territories to actively enforce the POSH Act, and mandated that every entity employing ten or more people upload its Internal Committee and Nodal Officer details on SHe-Box.
That direction is why your inbox has been filling up with state circulars. The Court didn’t just reaffirm the law. It handed enforcement to the states, and the states have moved.
The state-wise picture every CHRO needs to track
Karnataka. The Labour Department has directed all government, semi-government and private establishments to constitute Internal Committees and register on SHe-Box, and is conducting a state-wide survey to monitor compliance. Registration and reporting are being actively tracked, not assumed. Additionally, the annual report should include the External committee member qualifications as well as evidence of a separate managerial training.
Maharashtra. Mumbai’s private establishments were told to complete SHe-Box registration by 15 May 2025. More significantly, a May 2026 circular empowered District Collectors, Women and Child Development officers and others to physically inspect workplaces against a detailed 31-point checklist covering IC formation, complaint timelines, awareness, confidentiality, annual reporting and SHe-Box onboarding. This is inspection with teeth.
Tamil Nadu. In June 2025, the state notified a Standard Operating Procedure (G.O. Ms. No. 64) that spells out the responsibilities of employers, ICs, Local Committees, District Officers and NGOs, explicitly covers virtual and remote workplaces, and requires annual compliance reports to be filed by 31 January even when no complaints are received. Additionally, the statement also said that the act is the baseline, and company policies can be expanded to cover all genders.
Delhi. In June 2025, the Department of Women and Child Development issued a public notice requiring all public and private organisations, including subordinate offices, to register on SHe-Box.
Telangana. The state runs its own T-SHe-Box portal alongside an active Women Safety Wing, so compliance here means meeting a state-specific system, not just the national one.
And the list keeps growing. Rajasthan, Odisha and districts in Uttar Pradesh such as Noida have issued their own mandatory registration notices. As of early 2026, more than 1,61,000 workplaces had registered on SHe-Box, yet Internal Committee details had been updated for only around 68,000 of them. That gap is exactly what inspectors are now looking for.
Why this is a leadership issue, not a filing exercise
The instinct will be to treat this as a checklist: register on the portal, tick the box, move on. That instinct is precisely the exposure.
What the new rules imply is that they make your compliance visible and verifiable to an outside authority for the first time. An inspector in Mumbai can now arrive with a 31-point checklist. A Tamil Nadu SOP defines exactly what your IC should have done and by when. The penalty for a missing Internal Committee is a fine, but repeated non-compliance can cost you your licence to operate, and none of that captures the reputational damage of being publicly named as a workplace that didn’t take its people’s safety seriously.
For any organisation operating across states, the practical implication is uncomfortable but clear. Your central POSH policy is now the floor, not the ceiling. Each state adds its own registration system, its own deadlines, its own reporting formats and its own inspection regime, and you are accountable for all of them at once.
What to do now, not next quarter
Start by mapping every state you have a physical or registered presence in, and treat each as a separate compliance jurisdiction with its own checklist. Confirm that every Internal Committee is not just constituted on paper but registered on the relevant portal, that its members are trained, and that your annual reports are filed on each state’s timeline. Then close the gap most employers miss: the culture behind the compliance. An IC that exists only to satisfy an inspector will not earn the trust of a woman deciding whether it is safe to come forward, and that trust is the entire point of the law.
The states have stopped asking whether you have a policy. They have started checking whether it works. The organisations that will come through this well are the ones that stop treating POSH as paperwork and start treating it as what it always was: a commitment to the safety of every person in the room.
Register where you must. Inspect yourself before someone else does. And build the culture that makes all of it true.