Psychosocial Risk & ISO 45003 in 2026: A Practical Guide
By Dimitris Mitsios · Dimitris works at Tekmon, which pays for sponsored placements on this site. Disclosure · AI-assisted (how pages are made)
Psychosocial risk is now a board-level QHSE topic. Here is how to translate ISO 45003 and CSRD S1 into a measurable programme that integrates with your existing EHS, HR and EAP stack.
Why psychosocial risk is now board-level
Three forces moved psychosocial risk from HR pilot project to QHSE leadership agenda in recent years:
- ISO 45003:2021 gave QHSE teams guidelines for managing psychosocial risk within an OH&S management system based on ISO 45001 — same plan-do-check-act, same management-review cadence, applied to psychosocial hazards. On 21 October 2026 ISO's page still showed the 2021 edition as current, with its routine five-year review closed on 3 September 2026 (stage 90.60) and no decision recorded; ISO 45001, the standard it builds on, is itself in revision (see our integrated management systems guide).
- CSRD ESRS S1 disclosures require undertakings in scope, where their own workforce is a material topic, to report quantitative metrics on training, health and safety and work-life balance. In the 2023 ESRS, which apply up to financial year 2026, these are S1-13 to S1-15, and the guidance on recordable work-related ill health lists mental illnesses such as anxiety and post-traumatic stress disorder among its examples (Delegated Regulation (EU) 2023/2772, AR 92). From financial year 2027 the scope narrows to undertakings and groups with more than 1,000 employees on average and over €450M net turnover (Directive (EU) 2026/470, in force since 18 March 2026, with national transposition due by 19 March 2027), and they report against the revised standards in Delegated Regulation (EU) 2026/1563 (published on 21 September 2026, in force on 10 November 2026, and an option for financial years beginning in 2026). There the same metrics are S1-12 to S1-14 and the list of examples is gone: work-related ill health is defined as illness caused or made worse by workplace factors, including organisational risk factors, and a case is recordable if it results in death or absence from work.
- EU-OSHA's 2026–2028 Healthy Workplaces Campaign, Together for mental health at work, is an EU-wide campaign on mental health at work.
The upshot: psychosocial risk is no longer a wellbeing intuition. It is an auditable QHSE discipline with disclosure consequences.
The legal baseline is older than the standards. In Great Britain, HSE states that employers have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it, the same duty as for other health and safety risks. In the EU, the general risk-assessment obligation of Directive 89/391/EEC is the base. On 20 July 2026 the European Commission opened a second-phase consultation of social partners on a possible Quality Jobs Act (C(2026) 5109). It considers addressing psychosocial risks within that risk-assessment obligation and possibly setting minimum requirements to prevent them, including sexual harassment at work. A consultation is not a legislative proposal and creates no new duty; this guide does not predict its outcome. This is general information, not legal advice.
What the law requires, by jurisdiction
The rules differ in three ways that matter to a QHSE team: whether they bind, what they ask an employer to do, and what has to be written down. Each row below was read in the primary text on 21 October 2026. Use the row for the place where your people work rather than a blend of all of them; Victoria's regulations, for example, are made under its own Occupational Health and Safety Act 2004, so the model WHS row does not describe them.
| Jurisdiction and instrument | Binding or guidance | What it requires | Record it implies | Source (read 21 Oct 2026) |
|---|---|---|---|---|
| Victoria, Australia. Occupational Health and Safety (Psychological Health) Regulations 2025, S.R. No. 103/2025, made on 30 September 2025 and in operation since 1 December 2025; WorkSafe Victoria's compliance code Psychological health, in effect from the same day | Regulations: binding. Code: not mandatory, but a duty holder who follows it is taken to have complied with the duties it covers | Identify psychosocial hazards so far as reasonably practicable (reg 14). Eliminate the risk or, if that is not reasonably practicable, reduce it by changing the management of work, the systems of work, the work design, plant or the workplace environment; information, instruction or training may stand alone only when none of those changes is reasonably practicable, and may never be the main control in a mix (reg 15). Review and, where needed, revise controls before a relevant change, after a report of a psychological injury or hazard, after a notifiable incident, on new information, when the controls are not working or at a health and safety representative's request (reg 16) | The regulations set no duty to write the assessment down. The code advises keeping records of each hazard, the risk assessment, the controls, their review and who was consulted, with care for employee privacy, for example in a risk register or WorkSafe's prevention plan template | Authorised version 001 on legislation.vic.gov.au; WorkSafe Victoria, how to use the code and Step 4: review risk controls |
| Australia, model WHS jurisdictions. Division 11 of Part 3.2 of the model WHS Regulations, regs 55A to 55D | Binding in each jurisdiction that has made them | A psychosocial hazard is one arising from the design or management of work, the work environment, plant, or workplace interactions or behaviours that may cause psychological harm. The business must manage these risks under the general rules of Part 3.1: identify hazards, eliminate risks so far as reasonably practicable or else minimise them through the hierarchy of controls, and review the controls. In choosing controls it must weigh, among other matters, the duration, frequency and severity of exposure, how hazards combine, job demands, how work is organised and supported, the workplace and any workers' accommodation, workplace behaviours, and the training and supervision given (reg 55D) | Neither Division 11 nor Part 3.1 requires a written risk assessment. Queensland goes further for sexual harassment and sex- or gender-based harassment: a written prevention plan, reviewed after a report, at the request of a health and safety committee or representative, and otherwise every three years (s 55H) | Commonwealth WHS Regulations 2011 and the amending regulations made on 15 December 2022; Queensland WHS Regulation 2011 |
| Great Britain. Management of Health and Safety at Work Regulations 1999, regulation 3; HSE's Management Standards for work-related stress | Regulation 3: binding. Management Standards: guidance. HSE says that following them correctly is an approach it considers suitable and sufficient, and that an organisation may use an equivalent approach of its own | A suitable and sufficient assessment of the risks to employees and to others affected by the work, reviewed when it may no longer be valid or after a significant change. HSE applies this duty to stress in the same way as to other risks; the Standards cover demands, control, support, relationships, role and change | An employer with five or more employees must record the significant findings and any group identified as especially at risk (reg 3(6)). HSE adds that its completed Management Standards workbook can be kept as evidence for an inspector | legislation.gov.uk; HSE, stress risk assessment and What are the Management Standards? |
| European Union. Framework Directive 89/391/EEC; European Parliament resolution of 6 October 2026 on psychosocial risk, stress and mental health at work, procedure 2026/2023(INL) | Directive: binds the Member States, and employers through national law. Resolution: a request to the Commission, not law, and no duty for any employer | Directive: avoid risks, evaluate those that cannot be avoided, adapt the work to the individual, and develop a prevention policy that takes in the organisation of work, working conditions and social relationships (Art. 6). Resolution: asks the Commission for an impact assessment with a competitiveness and SME test and then, depending on the result, a proposal on work-related psychosocial risks; its annex recommends regular psychosocial risk assessments followed by an action plan | Directive: the employer must be in possession of a risk assessment (Art. 9(1)(a)), and each Member State decides what documents different categories of undertaking must draw up (Art. 9(2)). Resolution: its annex recommends that the assessment and action plan be documented and communicated to workers, which binds nobody unless a later law says so | EUR-Lex consolidated text; Parliament's Legislative Observatory file and text adopted T10-0326/2026 |
| International standard. ISO 45003:2021 | Voluntary guidelines, not a requirements standard | Guidance on managing psychosocial risk inside an occupational health and safety management system based on ISO 45001. ISO's page lists the 2021 edition as published, with its five-year review at stage 90.60 (close of review) | None of its own. What has to be recorded comes from the law that applies and from the management system it is used in | iso.org |
Which jurisdictions have made the model provisions. Read on 21 October 2026: the Commonwealth's own WHS Regulations contain regs 55A to 55D, inserted by amendments the Commonwealth headed "model WHS law amendments" and in force since 1 April 2023. The current Queensland reprint (from 29 March 2026), the Australian Capital Territory's republication effective 29 November 2025 and the Northern Territory's regulations as in force at 17 July 2026 contain provisions numbered 55A to 55D on the same subjects; Queensland's versions add the harassment duties described in the table. SafeWork NSW describes a duty to manage these risks, the hierarchy of controls and the same list of matters under the NSW Work Health and Safety Regulation 2025. Western Australia, South Australia and Tasmania were not checked on that date; see "What we could not verify" below.
Read together, the binding rows ask for hazards to be identified and for risk to be controlled, and Victoria ranks changes to the work above information and training. A survey can help find a hazard; it does not control one. When you write the assessment down, the site's psychosocial risk assessment template is one starting point; check its fields against the rule that applies to your sites.
12 working psychosocial hazard categories (our synthesis)
This list is our own working taxonomy, not a list published by ISO or HSE. Categories 1 to 6 follow the six areas of the HSE Management Standards (demands, control, support, relationships, role and change); categories 7 to 12 are hazards we add so that each can be assessed and tracked on its own:
- Demands (workload, work pace, deadlines)
- Control (autonomy over how and when work is done)
- Support (line-manager and peer support)
- Relationships (interpersonal conflict, bullying, harassment)
- Role clarity (conflicting or unclear responsibilities)
- Change (poorly managed organisational change)
- Isolation (lone working, remote working)
- Violence and aggression (third-party threats, customer-facing roles)
- Work-life balance (always-on culture, shift design)
- Job insecurity (precarious contracts, restructuring exposure)
- Recognition and reward (perceived fairness)
- Exposure to traumatic events (first responders, healthcare, frontline)
A 2026 programme assesses each category, not just the top three.
Where the data already exists
QHSE leaders often assume psychosocial-risk programmes need a brand-new data pipeline. Most of the data already exists, scattered across:
- Pulse surveys (engagement platforms): demands, control, support, recognition
- Incident management: violence-and-aggression events, bullying-and-harassment reports
- HRIS: absence patterns, turnover, exit-interview themes, overtime exposure
- EAP / occupational health: case-mix trends (anonymised aggregate)
- Lone-worker platform: welfare-check completion, panic events, after-hours exposure
- Time and attendance: shift-pattern compliance, rest-period violations
- Helpline / whistleblowing: substantiated complaint themes
The 2026 programme aggregates these into a single psychosocial dashboard — not a new survey.
Leading vs lagging indicators
Do not rely on lagging indicators (sickness absence, turnover, claims) alone. A balanced scorecard pairs them with leading indicators:
Leading
- Pulse-survey scores against the 12 categories
- Manager 1:1 completion rate
- Welfare-check completion (lone-worker)
- Training coverage on bullying / harassment / mental-health first aid
- Rest-period compliance
Lagging
- Work-related stress absence days
- Turnover by manager / team
- Substantiated bullying / harassment cases
- Violence-and-aggression incident rate
- EAP case volume (aggregate)
Track both monthly. At management review, compare leading-indicator improvement with lagging-indicator outcomes later on (this guide suggests a 6–12 month lag).
Turning psychosocial data into action
Three intervention layers move the needle:
- Job design — workload modelling, decision-latitude expansion, rest-period redesign, shift-pattern reform.
- Manager capability — training line managers in psychosocial-risk conversation, 1:1 quality, early-warning recognition.
- Individual support — EAP, mental-health first aid, occupational-health pathways. Necessary but not sufficient — and never a substitute for job design.
A worked example: from survey scores to a decision
This example is constructed for illustration. A distribution depot has four teams, and a pulse survey shows low "demands" and "support" scores in the night shift team of 14, while overtime hours in that team have risen for three months and two supervisors have left. The steps below show how the data sources above turn into a record that an auditor could follow.
| Step | Record | Check |
|---|---|---|
| 1. Identify | Hazard categories "demands" and "support" flagged for the night shift team | Is the group at or above the minimum reporting size (this guide uses 10)? If not, report at depot level or over a rolling 12 months |
| 2. Corroborate | Overtime, absence and leaver data from the HRIS for the same team and period | Do two independent sources point the same way, without naming individuals? |
| 3. Assess | Risk entry in the shared register, with the controls in place and who owns them | Does the entry say which layer of intervention applies: job design, manager capability or individual support? |
| 4. Act | Rota change and a staffing review (job design) before any wellbeing offer | Is the action dated, owned and linked to the hazard? |
| 5. Review | Same survey item and overtime measure 6 to 12 months later, as this guide suggests | Did the leading and lagging indicators move, and was the outcome discussed at management review? |
The point is the chain from data to hazard to control to review. A dashboard that stops at step 1 is a measurement, not a management system. On paper, step 3 fits the site's risk register template, which asks for each scenario as cause, event and consequence, the existing controls, an owner and a review date, and leaves the rating scale to you.
Questions to ask a vendor of psychosocial or wellbeing software
These are demonstration prompts. The answers are claims until you see them work, and none of them is a statement about a particular product. The site's psychosocial risk software page lists what the reviewed profiles document and does not rank them.
- What is the smallest group for which results are shown, and can an administrator lower it?
- Which data does the product hold about individuals, and who can see it? The GDPR guide for EHS data covers the questions a data protection officer will ask.
- Does it connect to the incident, lone-worker and HR systems you already run, and which connections are included in the quoted price?
- Does it produce a risk-register entry and an action, or only a score?
- What security and privacy evidence is published? The security and trial evidence study sets out what the reviewed profiles document about security, and the SOC 2 and ISO 27001 study explains how to read an assurance claim.
The glossary entries on ISO 45001 and management review set out the terms used in the steps above, and the workplace violence prevention page covers category 8 in more depth.
Integration with EHS, HR and EAP
The 2026 architecture treats psychosocial risk as a shared service:
- EHS / QHSE owns the management system, the risk register, the ISO 45003 audit, the violence-and-aggression incident pipeline, the lone-worker data feed.
- HR owns survey instruments, absence and turnover data, manager training, EAP contract.
- EAP / OH owns anonymised case-mix reporting back to the programme.
- A joint steering committee reviews the dashboard monthly and the ISO 45003 management review quarterly.
CSRD S1 audit readiness
ESRS S1 disclosures to prepare for (our ESRS disclosures guide covers the wider standard):
- Quantitative metrics on workforce composition, training hours, work-life balance, health and safety, social dialogue (S1-6 to S1-15 in the 2023 ESRS; S1-5 to S1-14 in the revised ESRS from financial year 2027)
- Process descriptions for how risks and impacts on the workforce are identified and managed (i.e. your ISO 45003-aligned programme)
- Engagement with workers and their representatives (S1-2 in both versions)
Build the disclosure data set from your existing HRIS, EHS and psychosocial dashboard — not from a parallel reporting workstream.
FAQ
Is ISO 45003 certifiable? ISO publishes ISO 45003 as guidelines for managing psychosocial risk within an OH&S management system based on ISO 45001, not as a set of requirements. ISO 45001 is the requirements standard organisations certify to. Ask your certification body how it treats psychosocial hazards and ISO 45003 in an ISO 45001 audit.
Do we need a separate platform? Not necessarily. You can combine an EHS platform (incident, audit, risk), an engagement-survey platform, and a lone-worker platform, with a BI overlay for the dashboard.
How do we handle small-team confidentiality? Set a minimum reporting group size before reporting (this guide uses 10+). Use rolling 12-month windows for smaller teams. Never identify individuals from anonymised data.
What's the relationship to wellbeing initiatives? Wellbeing initiatives (yoga, mindfulness apps) are layer-3 interventions. They are part of the toolkit but cannot substitute for job-design and manager-capability work.
How do we get the CFO on board? CSRD S1 disclosure exposure, turnover cost, absence cost, and litigation risk.
How does this connect to ISO 45001? ISO 45003 is written for use within an ISO 45001-based management system. The same risk register, the same audit cycle, the same management review — with psychosocial hazards added as a named family.
What we could not verify
Checked 21 October 2026.
- ISO 45003's review. ISO's stage history records the close of review on 3 September 2026 but none of the three stages that would show the outcome (to be revised, confirmed, or withdrawal proposed). ISO 45003 and ISO 45001 were read only through ISO's public pages, not their full text.
- The ESRS and CSRD details. The three EU acts were read on 21 October 2026 in the Official Journal versions that the Publications Office serves from its Cellar repository, because EUR-Lex itself was only partly available that day (2023/2772, 2026/1563, 2026/470). The S1 numbering in both versions, AR 92, the revised ill-health definition, the 2026/1563 dates and the 2026/470 thresholds, entry into force and transposition date read as stated above. How each Member State transposes 2026/470 was not checked.
- The twelve categories and the thresholds. Categories 7 to 12, the minimum reporting group of 10 and the 6–12 month lag between leading and lagging indicators are our own choices. HSE's Management Standards, re-opened today, cover only the first six areas, and no source we opened sets the other figures.
- The EU campaign and consultation. EU-OSHA's campaign page names the 2026–2028 campaign but gives no launch date. The Commission's July 2026 consultation was re-read today and says what the legal-baseline paragraph reports; what the Commission does next is not known.
- The Australian adoption list. Safe Work Australia's website returned "503 Service Temporarily Unavailable" on every attempt on 21 October 2026, so the model regulations, the model Code of Practice on psychosocial hazards and Safe Work Australia's own account of which jurisdictions have adopted them were not read there; regs 55A to 55D were read in the Commonwealth texts instead. The NSW legislation website showed an automated-access check, so for New South Wales only the SafeWork NSW page was read, not the regulation itself. Western Australia, South Australia and Tasmania were not checked: South Australia's authorised PDF refused the request (HTTP 403), and the other two sites' searches could not be run. Commencement dates outside the Commonwealth were not read, and none of the table is a statement about these three states either way.
- Victoria's code in full. Of WorkSafe Victoria's compliance code, only the opening page and Part 3, Step 4 were read; its appendices and the prevention plan template it mentions were not opened.
- Northern Ireland and the EU's next step. The Great Britain row does not cover Northern Ireland, whose own regulations were not checked. The Legislative Observatory listed no Commission reply to the 6 October 2026 resolution when it was read; what the Commission will do is not known.
- Whether a programme reduces harm. No source we opened measures the effect of a psychosocial risk programme, a survey platform or a wellbeing app on absence or ill health, and this guide makes no such claim.
Sources
- ISO 45003:2021, psychological health and safety at work and ISO 45001:2018 (iso.org)
- HSE: What are the Management Standards? and Work-related stress and how to manage it: stress risk assessment
- European Commission: Second-phase consultation of social partners on a possible Quality Jobs Act, C(2026) 5109 (20 July 2026)
- Commission Delegated Regulation (EU) 2023/2772, ESRS S1 and Commission Delegated Regulation (EU) 2026/1563, revised ESRS (EUR-Lex)
- Directive (EU) 2026/470 amending the CSRD scope (EUR-Lex)
- EU-OSHA: Healthy Workplaces campaign 2026–2028, Together for mental health at work
- Victoria: Occupational Health and Safety (Psychological Health) Regulations 2025, S.R. No. 103/2025 (legislation.vic.gov.au) and WorkSafe Victoria's compliance code: Psychological health
- Australia, model WHS provisions: Work Health and Safety Regulations 2011 (Cth) and the Work Health and Safety Amendment (Managing Psychosocial Risk and Other Measures) Regulations 2022 (Federal Register of Legislation); Work Health and Safety Regulation 2011 (Qld); Work Health and Safety Regulation 2011 (ACT); Work Health and Safety (National Uniform Legislation) Regulations 2011 (NT); SafeWork NSW, Psychosocial hazards
- Great Britain: Management of Health and Safety at Work Regulations 1999, regulation 3 (legislation.gov.uk)
- EU: Council Directive 89/391/EEC, consolidated text (EUR-Lex); European Parliament, resolution of 6 October 2026 on psychosocial risk, stress and mental health at work, T10-0326/2026 and the procedure file 2026/2023(INL)
Updated 21 October 2026: ISO's page for ISO 45003, the HSE pages, the EU-OSHA campaign page and the Commission's consultation were re-opened, the ISO 45003 status was moved to that date, and the two ESRS regulations and Directive (EU) 2026/470 were re-read in the Official Journal texts while EUR-Lex was not fully available. The HSE risk-assessment page and the consultation, both cited in the text, were added to the Sources, with a link to the site's risk register template and a dated "What we could not verify" section. The same day a "What the law requires, by jurisdiction" table was added for Victoria, the model WHS jurisdictions, Great Britain, the EU and ISO 45003, each row read in the primary text listed in the Sources.
Updated 4 October 2026: ISO 45003's status, the revised ESRS numbering and dates, the scope threshold in Directive (EU) 2026/470, the HSE Management Standards and the EU-OSHA campaign were re-checked against the sources. The description of the campaign and the certifiability answer were narrowed to what the sources say, and the legal baseline (including the Commission's July 2026 consultation), a worked example and vendor questions were added.
Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the standards and regulations cited now link to their official texts.
Founder of The QHSE Standard; product marketing at Tekmon
Dimitris Mitsios is the founder of The QHSE Standard and works in product marketing at Tekmon. His professional focus includes software positioning, digital workflows and user adoption.
Dimitris works at Tekmon, which pays for sponsored placements on this site.
Researched and drafted with AI assistance and published under the author's editorial responsibility (how pages are made). Found an error? Send a correction with a source.
Related software
Browse all platforms →Ordered by how closely our sources document this process, not by quality. Sponsored placements are labelled. How lists are ordered
- QHSE Management
Q-Hub
QHSE Management
Read the profile - QHSE Management
Accupoint
QHSE Management
Read the profile - EHS Management
iProtectU
EHS Management
Read the profile
Related Articles
Related guides and software
- Psychosocial Risk Software: Organisational Data, Not Apps
Software guide on psychosocial risk.
- MSD Prevention 2026: Digital RULA, REBA & NIOSH Assessments
Article on musculoskeletal disorder prevention.
- First Aid Management Software: Cover, Kit and the Record
Software guide on first aid management.
- WELL Building Standard — definition, software & FAQs
Definition of the WELL Building Standard.
- Free QHSE Tools from Regulators and Public Bodies
Article on free public tools, including stress questionnaires from HSE and CCOHS.