Psychosocial risk assessment in Spain: what the law requires

Is a psychosocial risk assessment mandatory in Spain?

Yes. Spain has no law written specifically for psychosocial risks, but the Prevention of Occupational Risks Act covers them. Its Article 4.7 defines a working condition as any feature of the work that influences risk, and expressly names those relating to how work is organised and arranged. Its Article 16 requires an initial assessment, an update whenever conditions change, and a plan for the preventive measures that turn out to be necessary.

The guide on psychosocial factors published by Spain's State Labour and Social Security Inspectorate (OEITSS) in September 2025 is direct about it: the general duties to assess and to plan apply as they stand, without waiting for a specific regulation. The table sums up the duties the guide highlights and what happens when they are not met.

• Psychosocial risk assessment with iPPA
• Pricing

What are psychosocial risk factors?

They are working conditions that can harm people when they are badly designed. The inspectorate's guide uses a European classification as an example, with these groups: job content, workload and pace, working time, participation and control, organisational culture, environment and equipment, relationships at work, role, career development, and the interaction between personal life and work.

What sits outside the assessment matters just as much. A psychosocial assessment looks at how work is designed, organised and managed, which is the employer's responsibility. Anything that concerns one person on their own belongs to their private life and, according to the same guide, is only dealt with through health surveillance, which is voluntary and confidential, or through voluntary workplace health schemes.

That is why a sound assessment never answers the question of how a particular person is doing. It answers a different one: which conditions in this role, this team or this shift should change.

Which assessment method can you use?

One that gives confidence in its result. That is the test in Article 5.2 of the Prevention Services Regulation, which adds that when in doubt the most protective preventive measures should be chosen. There is no technical guide from Spain's national occupational safety institute (INSST) and no UNE standard setting a method for psychosocial risks, so Article 5.3.d applies: guides from bodies of recognised standing or other documented methods that offer equivalent confidence.

The inspectorate's guide explains what it looks for in a questionnaire: a theoretical basis, evidence of reliability and validity, items that can tell different degrees of risk apart, and norms to interpret the scores. It also warns against common mistakes, such as changing a published questionnaire on your own initiative or using one that leaves out factors that matter for that particular organisation.

The most frequent mistake is a different one: running an engagement or satisfaction survey and presenting it as the assessment. According to the guide, those scales can be useful as additional information, but they are not suitable for assessing risks.

• Organisational culture and engagement
• For companies

How do staff take part?

At two points: when the method is chosen and when the data is collected. The choice of assessment procedure is put to the workers' representatives or, where there are none, to the staff themselves, as Article 3.2 of the Prevention Services Regulation requires.

On data collection, the inspectorate's guide is specific. An assessment based only on the company's objective data is not acceptable: it needs people's direct answers. Staff must be told in advance when and how it will happen, what it is for and how anonymity is protected. The prevention service collects the data, not management. And the general rule is that everyone who wishes to take part can do so; sampling is the exception.

Except in very simple structures, the guide does not accept a single assessment for the whole company without separating groups, roles or units. That separation must not break anonymity: a group so small that you could tell who answered should not be shown on its own.

What has to happen after the assessment?

The measures have to be planned and carried out. Article 16.2.b of the Prevention of Occupational Risks Act requires every preventive activity to have a deadline, a person in charge and the resources it needs, and requires the company to follow up its delivery continuously. An assessment that ends as a filed report does not meet the law.

The inspectorate's guide asks for a measure for every risk identified and gives priority to those that act at the source, that is, on how work is organised: sharing out the workload better, clarifying roles, giving people more say over how a task is done, sorting out working hours. Prevention delegates must have access to the assessment and be consulted on the measures.

Nor is an assessment done once and for all. It is reviewed when working conditions change, when harm occurs or when checks show the measures are not enough, and at the intervals agreed between the company and the workers' representatives (Article 6 of the Regulation). One of the things inspectors look for is exactly that: an old assessment that was never updated after changes in the organisation.

What changes with remote work?

The focus changes, not the duty. Article 16 of Law 10/2021 on remote work requires the assessment of these roles to pay particular attention to psychosocial, ergonomic and organisational factors, and in particular to how working hours are spread, availability time, and making sure breaks and disconnection are respected during the working day.

In practice, the questionnaire is the same, but it helps to be able to see the results of remote staff separately, as long as the group is large enough to keep answers anonymous, and to review the measures on working hours and availability.

What is a psychosocial assessment not?

It is not an assessment of people. It is not a way to find out who performs less, who is about to leave or how someone feels, and it must not be used for any of that. Nor is it a personality profile or a selection test, which are different tools, for different purposes, with their own data protection rules.

It is not an engagement survey, even if both can live on the same platform. And it does not replace the prevention service: the technical reading of the results and the proposed measures belong to the people qualified to produce them. A tool provides data organised by factor; the company decides the measures with its prevention service.

Sources

• Law 31/1995 on the Prevention of Occupational Risks, Arts. 4.7, 16 and 33 (BOE, in Spanish)
• Royal Decree 39/1997, Prevention Services Regulation, Arts. 3 to 9 (BOE, in Spanish)
• Royal Legislative Decree 5/2000 (LISOS), Arts. 12 and 40.2 (BOE, in Spanish)
• Law 10/2021 on remote work, Art. 16 (BOE, in Spanish)
• OEITSS: inspection guide on psychosocial factors, September 2025 version (in Spanish)