The revision of NR-1 consolidated the requirement that Occupational Risk Management (ORM) expressly cover risks arising from physical, chemical, and biological agents, accidents, ergonomic factors—and, now with explicit emphasis, psychosocial risk factors related to work. The standard also refers to the working conditions foreseen in NR-17 (Ergonomics), determining that the organization consider them in the context of its ORR.

From a legal standpoint, this structure reinforces a performance-based regulatory model — the so-called duty of care with a requirement for evidence of due diligence. NR-1 imposes the expected result: a documented process for identifying, evaluating, and classifying risks, an action plan, monitoring of controls, worker participation, and evidentiary documentation. What it deliberately fails to do is define, in a closed list, what would constitute "psychosocial risks.".

This openness is intentional, as psychosocial risk varies substantially depending on the sector, work organization model, leadership style, goal structure, work schedule, occurrence of harassment, organizational changes, remote work, and the nature of customer service. The practical challenge, therefore, is evidentiary: how to demonstrate that the mapping carried out was technically consistent and that the measures adopted are proportionate and traceable?

This is where international technical standards function as parameters for soft law technical. Its adoption contributes to: (i) giving objective content to the duty to prevent; (ii) creating an auditable documentary trail; (iii) reducing the asymmetry of criteria in inspection or litigation processes; and (iv) demonstrating the best practices available for civil and labor liability purposes.

It is worth noting that the Ministry of Labor and Employment itself communicated the express inclusion of psychosocial risks and the educational treatment foreseen for the initial implementation phase, with a deadline for compliance indicated by the agency.

ISO 45003:2021: The method for managing psychosocial risks within a structured system.

ISO 45003:2021 is a guideline focused on the management of psychosocial risks within the context of an occupational health and safety management system based on ISO 45001. Its focus is on preventing harm and promoting well-being at work, and it organizes these objectives within the classic management cycle (PDCA).

In practice, the standard offers operational criteria structured in steps that directly align with the requirements of NR-1. The mapping begins with defining the context and scope—identifying exposed groups, remote workers, shifts, and critical areas—and progresses to the dimension of leadership and participation, defining roles, responsibilities, and mechanisms for consulting workers. Next, it guides the identification of psychosocial hazards from organizational and work-related sources: emotional workload and demands, role conflicts, lack of autonomy, interpersonal relationships, situations of harassment or violence, structural changes, isolation, and similar conditions.

The risk assessment phase considers the probability and severity of events, taking into account existing controls and their effectiveness—exactly what NR-1 requires to be documented with clear criteria. Control planning follows the logic of the hierarchy of controls applied to the psychosocial field: job redesign, organizational management, internal policies, communication channels, training, and support. Finally, the cycle is completed with monitoring, indicators, event investigation, internal audits, and management review.

As a legal parameter, ISO 45003 helps to "close" the open-ended NR-1 standard, offering vocabulary, methodology, and a governance structure that demonstrate how the organization systematically and continuously identifies, assesses, and controls psychosocial risks.

CSA Z1003: Operational taxonomy with 13 psychosocial factors

CSA Z1003 is a voluntary Canadian standard focused on developing and sustaining a psychologically healthy and safe work environment through a documented and systematic approach. One of its most widely adopted practical contributions is the set of 13 psychosocial factors, which functions as a structured taxonomy for diagnosis and action planning.

These 13 factors encompass: organizational culture; psychological and social support; clear leadership; civility and respect; psychological needs; growth and development; recognition and reward; involvement and influence; workload management; engagement; balance; psychological protection; and physical safety protection.

For risk management purposes, this taxonomy is particularly useful because it transforms the abstract concept of "psychosocial risks" into traceable and verifiable categories. It facilitates establishing a link between organizational causes and preventive measures—such as the relationship between goal management and overload, or between leadership style and exposure to harassment—and improves the quality of the risk inventory, allowing for justification of the non-applicability of a given factor when supported by concrete evidence.

Comparative table: where each standard contributes

An integrated reading of these three references reveals complementary and well-defined roles. NR-1 establishes the legal obligation: it requires process and documentation — hazard identification, risk level assessment, classification, implementation of measures, monitoring of controls, and worker involvement. It is a performance standard that, in short, imposes: "do it well and prove it".

ISO 45003 answers the question "how to do it," structuring the process in management system language (PDCA) and integrating governance, competence, communication, controls, and continuous improvement.

The CSA Z1003 and its 13 factors, in turn, answer the question "what to map," offering a straightforward operational framework for diagnosis, with categories that connect organizational causes to measurable actions and metrics.

The recommended legal reading is therefore: use NR-1 as a source for... duty, ISO 45003 as method and the CSA Z1003 as minimum structuring content of the inventory and the action plan.

Best practices for psychosocial mapping in the PGR (Program for the Reduction of Risks).

Incorporating psychosocial risks into the Risk Management Plan (RMP) does not require reinventing the Risk Management Plan (RMP) — it requires applying the same risk management discipline already used for other hazards, with tools appropriate to the nature of this type of risk.

Governance and evidentiary trail These are the starting point. This implies internal policy with sponsorship from senior management, a clear definition of roles between HR, occupational health and safety, legal, compliance and leadership, and a responsibility matrix with a schedule for periodic review — at least annually or in the face of relevant organizational changes.

THE psychosocial inventory It should combine the 13 factors of CSA Z1003 as a data collection framework with diverse data sources: interviews, focus groups, analysis of actual work according to NR-17, absenteeism and turnover data, records of harassment incidents, overtime, and organizational climate surveys — provided they are conducted with methodological rigor.

THE risk assessment It needs to be documented with explicit criteria of severity and probability, ensuring traceability of the chain between identified risk, measure adopted, responsible party, deadline, control indicator, and verification of effectiveness.

To the control measures Organizational interventions should be prioritized—controls at the source. Job and goal redesign, workload management, role clarity, leadership training, anti-harassment mechanisms, protocols for critical events, change management, structuring of schedules, and support for remote work are prime examples. In the psychosocial field, PPE or isolated training rarely constitute effective control.

Finally, indicators and continuous improvement They should consider both metrics. leading — such as risk level by area, compliance with the action plan, coverage of leadership training, and response time to complaints — as well as metrics lagging, such as absenteeism, sick leave, turnover, and incidents. Periodic review with worker participation is an express requirement of NR-1 and must be formalized in the process.

Conclusion

In legal and regulatory terms, NR-1 creates the duty to manage psychosocial risks in the PGR (Risk Management Program), but leaves technical space open regarding what these risks are and how to measure them. The adoption of international parameters such as ISO 45003:2021 — as a management method — and CSA Z1003 with its 13 factors — as an operational taxonomy — strengthens the demonstration of due diligence, reduces the asymmetry of criteria in inspection processes, and substantially improves the technical defense in labor and civil litigation related to mental health and work organization.