Psychosocial Risk & ISO 45003 in 2026: A Practical Guide

Why psychosocial risk is now board-level

Three forces moved psychosocial risk from HR pilot project to QHSE leadership agenda in recent years:

1. ISO 45003:2021 gave QHSE teams guidelines for managing psychosocial risk within an OH&S management system based on ISO 45001 — same plan-do-check-act, same management-review cadence, applied to psychosocial hazards. On 4 October 2026 ISO's page showed the 2021 edition as current and under its routine five-year review; ISO 45001, the standard it builds on, is itself in revision (see our integrated management systems guide).
2. CSRD ESRS S1 disclosures require undertakings in scope, where their own workforce is a material topic, to report quantitative metrics on training, health and safety and work-life balance. In the 2023 ESRS, which apply up to financial year 2026, these are S1-13 to S1-15, and the guidance on recordable work-related ill health lists mental illnesses such as anxiety and post-traumatic stress disorder among its examples (Delegated Regulation (EU) 2023/2772, AR 92). From financial year 2027 the scope narrows to undertakings and groups with more than 1,000 employees on average and over €450M net turnover (Directive (EU) 2026/470, in force since 18 March 2026, with national transposition due by 19 March 2027), and they report against the revised standards in Delegated Regulation (EU) 2026/1563 (published on 21 September 2026, in force on 10 November 2026, and an option for financial years beginning in 2026). There the same metrics are S1-12 to S1-14 and the list of examples is gone: work-related ill health is defined as illness caused or made worse by workplace factors, including organisational risk factors, and a case is recordable if it results in death or absence from work.
3. EU-OSHA's 2026–2028 Healthy Workplaces Campaign, Together for mental health at work, is an EU-wide campaign on mental health at work.

The upshot: psychosocial risk is no longer a wellbeing intuition. It is an auditable QHSE discipline with disclosure consequences.

The legal baseline is older than the standards. In Great Britain, HSE states that employers have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it, the same duty as for other health and safety risks. In the EU, the general risk-assessment obligation of Directive 89/391/EEC is the base. On 20 July 2026 the European Commission opened a second-phase consultation of social partners on a possible Quality Jobs Act (C(2026) 5109). It considers addressing psychosocial risks within that risk-assessment obligation and possibly setting minimum requirements to prevent them, including sexual harassment at work. A consultation is not a legislative proposal and creates no new duty; this guide does not predict its outcome. This is general information, not legal advice.

12 working psychosocial hazard categories (our synthesis)

This list is our own working taxonomy, not a list published by ISO or HSE. Categories 1 to 6 follow the six areas of the HSE Management Standards (demands, control, support, relationships, role and change); categories 7 to 12 are hazards we add so that each can be assessed and tracked on its own:

1. Demands (workload, work pace, deadlines)
2. Control (autonomy over how and when work is done)
3. Support (line-manager and peer support)
4. Relationships (interpersonal conflict, bullying, harassment)
5. Role clarity (conflicting or unclear responsibilities)
6. Change (poorly managed organisational change)
7. Isolation (lone working, remote working)
8. Violence and aggression (third-party threats, customer-facing roles)
9. Work-life balance (always-on culture, shift design)
10. Job insecurity (precarious contracts, restructuring exposure)
11. Recognition and reward (perceived fairness)
12. Exposure to traumatic events (first responders, healthcare, frontline)

A 2026 programme assesses each category, not just the top three.

Where the data already exists

QHSE leaders often assume psychosocial-risk programmes need a brand-new data pipeline. Most of the data already exists, scattered across:

• Pulse surveys (engagement platforms): demands, control, support, recognition
• Incident management: violence-and-aggression events, bullying-and-harassment reports
• HRIS: absence patterns, turnover, exit-interview themes, overtime exposure
• EAP / occupational health: case-mix trends (anonymised aggregate)
• Lone-worker platform: welfare-check completion, panic events, after-hours exposure
• Time and attendance: shift-pattern compliance, rest-period violations
• Helpline / whistleblowing: substantiated complaint themes

The 2026 programme aggregates these into a single psychosocial dashboard — not a new survey.

Leading vs lagging indicators

Do not rely on lagging indicators (sickness absence, turnover, claims) alone. A balanced scorecard pairs them with leading indicators:

Leading

• Pulse-survey scores against the 12 categories
• Manager 1:1 completion rate
• Welfare-check completion (lone-worker)
• Training coverage on bullying / harassment / mental-health first aid
• Rest-period compliance

Lagging

• Work-related stress absence days
• Turnover by manager / team
• Substantiated bullying / harassment cases
• Violence-and-aggression incident rate
• EAP case volume (aggregate)

Track both monthly. At management review, compare leading-indicator improvement with lagging-indicator outcomes later on (this guide suggests a 6–12 month lag).

Turning psychosocial data into action

Three intervention layers move the needle:

1. Job design — workload modelling, decision-latitude expansion, rest-period redesign, shift-pattern reform.
2. Manager capability — training line managers in psychosocial-risk conversation, 1:1 quality, early-warning recognition.
3. Individual support — EAP, mental-health first aid, occupational-health pathways. Necessary but not sufficient — and never a substitute for job design.

A worked example: from survey scores to a decision

This example is constructed for illustration. A distribution depot has four teams, and a pulse survey shows low "demands" and "support" scores in the night shift team of 14, while overtime hours in that team have risen for three months and two supervisors have left. The steps below show how the data sources above turn into a record that an auditor could follow.

The point is the chain from data to hazard to control to review. A dashboard that stops at step 1 is a measurement, not a management system.

Questions to ask a vendor of psychosocial or wellbeing software

These are demonstration prompts. The answers are claims until you see them work, and none of them is a statement about a particular product. The site's psychosocial risk software page lists what the reviewed profiles document and does not rank them.

1. What is the smallest group for which results are shown, and can an administrator lower it?
2. Which data does the product hold about individuals, and who can see it? The GDPR guide for EHS data covers the questions a data protection officer will ask.
3. Does it connect to the incident, lone-worker and HR systems you already run, and which connections are included in the quoted price?
4. Does it produce a risk-register entry and an action, or only a score?
5. What security and privacy evidence is published? The security and trial evidence study sets out what the reviewed profiles document about security, and the SOC 2 and ISO 27001 study explains how to read an assurance claim.

The glossary entries on ISO 45001 and management review set out the terms used in the steps above, and the workplace violence prevention page covers category 8 in more depth.

Integration with EHS, HR and EAP

The 2026 architecture treats psychosocial risk as a shared service:

• EHS / QHSE owns the management system, the risk register, the ISO 45003 audit, the violence-and-aggression incident pipeline, the lone-worker data feed.
• HR owns survey instruments, absence and turnover data, manager training, EAP contract.
• EAP / OH owns anonymised case-mix reporting back to the programme.
• A joint steering committee reviews the dashboard monthly and the ISO 45003 management review quarterly.

CSRD S1 audit readiness

ESRS S1 disclosures to prepare for (our ESRS disclosures guide covers the wider standard):

• Quantitative metrics on workforce composition, training hours, work-life balance, health and safety, social dialogue (S1-6 to S1-15 in the 2023 ESRS; S1-5 to S1-14 in the revised ESRS from financial year 2027)
• Process descriptions for how risks and impacts on the workforce are identified and managed (i.e. your ISO 45003-aligned programme)
• Engagement with workers and their representatives (S1-2 in both versions)

Build the disclosure data set from your existing HRIS, EHS and psychosocial dashboard — not from a parallel reporting workstream.

FAQ

Is ISO 45003 certifiable? ISO publishes ISO 45003 as guidelines for managing psychosocial risk within an OH&S management system based on ISO 45001, not as a set of requirements. ISO 45001 is the requirements standard organisations certify to. Ask your certification body how it treats psychosocial hazards and ISO 45003 in an ISO 45001 audit.

Do we need a separate platform? Not necessarily. You can combine an EHS platform (incident, audit, risk), an engagement-survey platform, and a lone-worker platform, with a BI overlay for the dashboard.

How do we handle small-team confidentiality? Set a minimum reporting group size before reporting (this guide uses 10+). Use rolling 12-month windows for smaller teams. Never identify individuals from anonymised data.

What's the relationship to wellbeing initiatives? Wellbeing initiatives (yoga, mindfulness apps) are layer-3 interventions. They are part of the toolkit but cannot substitute for job-design and manager-capability work.

How do we get the CFO on board? CSRD S1 disclosure exposure, turnover cost, absence cost, and litigation risk.

How does this connect to ISO 45001? ISO 45003 is written for use within an ISO 45001-based management system. The same risk register, the same audit cycle, the same management review — with psychosocial hazards added as a named family.

Related reading

• Lone Worker Safety Software 2026
• Behavior-Based Safety Software 2026
• EHS Software for SMEs 2026
• EU OSH Strategic Framework 2026
• ISO 45001 Software
• CSRD Compliance Software
• AI in QHSE Software

Sources

• ISO 45003:2021, psychological health and safety at work and ISO 45001:2018 (iso.org)
• HSE: What are the Management Standards?
• Commission Delegated Regulation (EU) 2023/2772, ESRS S1 and Commission Delegated Regulation (EU) 2026/1563, revised ESRS (EUR-Lex)
• Directive (EU) 2026/470 amending the CSRD scope (EUR-Lex)
• EU-OSHA: Healthy Workplaces campaign 2026–2028, Together for mental health at work

Updated 4 October 2026: ISO 45003's status, the revised ESRS numbering and dates, the scope threshold in Directive (EU) 2026/470, the HSE Management Standards and the EU-OSHA campaign were re-checked against the sources. The description of the campaign and the certifiability answer were narrowed to what the sources say, and the legal baseline (including the Commission's July 2026 consultation), a worked example and vendor questions were added.

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the standards and regulations cited now link to their official texts.