ISO 45003 in practice
Written by Nicolai Bjerknes Slinning, Founder, Sydera.io Technologies AS. Last reviewed .
ISO 45003 is a guidance standard on psychosocial risk at work. It cannot be certified against. It is often used alongside an occupational health and safety management system. Here is what it is, and how psychosocial risk can be written into governance documents so that the text holds up professionally and respects data protection.
What ISO 45003 is
It is guidance. It describes how psychosocial conditions can be identified and managed within an occupational health and safety management system. It comes in addition to the legal requirements and cannot be certified against. The standard is licensed and sold by ISO, so it is not quoted here.
What psychosocial risk looks like on paper
It is conditions in the work: workload and pace, unclear roles and conflicting demands, lack of influence, poor information, shift patterns that do not allow rest, lack of managerial support, unacceptable behaviour. All of this can be described, assessed and followed up without a single detail about a named person's health.
The mistake that keeps recurring
The most common mistake is to turn psychosocial risk into a measurement of how people feel. That creates three problems at once: the answers are hard to act on, the information may become special category data under data protection law, and the measures end up as individual follow-up. Describe what changes in the work. Describe the conditions in the work.
What a routine that holds up looks like
It states what is available to everyone, how something is triggered without a person having to explain themselves, who owns follow-up, where concerns are raised, what the limit is on what a manager may write down, and when the routine was last reviewed. It ties measures to conditions in the work, and it leaves evidence an outsider can read.
How it relates to ISO 45001 and to reporting
Where an organisation runs a management system to ISO 45001, psychosocial risk belongs inside that system. Where sustainability reporting applies, the same descriptions serve as the basis. The point is that the documentation exists once, at system level, and gets reused.
Test your own routine
Use the guide «The Body Comes to Work» to see what you can arrange in advance, and what your procedures should say. It is open online and as a PDF. For groups, we prepare an Executive Brief, free of charge,, built only on published sources.
The guide is open online and as a PDF. The Executive Brief is built only on published sources.
Sources
Frequently asked questions
- Can we be certified to ISO 45003?
- No. ISO 45003 is a guidance standard. Certification is against ISO 45001, where an organisation chooses it.
- Is ISO 45003 a legal requirement?
- No. Legal requirements come from occupational health and safety legislation. ISO 45003 is guidance alongside them.
- Do we have to assess employees' mental health?
- No. Psychosocial risk concerns conditions in the work. Assessing individuals' health raises questions about a lawful basis under data protection law and is rarely necessary to describe the risk.
- How do we measure psychosocial conditions without surveys?
- By measuring what is controllable: staffing against workload, role clarifications completed, share of concerns closed, how many people actually get breaks and rest, and what changed after the last review.
- How much text is needed?
- Less than most people think. One page stating what applies, who owns it and how it is triggered governs more than twenty pages describing good intentions.