Brazil’s updated NR-1 now expressly includes work-related psychosocial risk factors in Occupational Risk Management. Here is what companies need to identify, assess, control and document.
Harassment, excessive workloads, constant pressure, lack of support and problems in the way work is organized are no longer issues that should be addressed only from an HR or workplace-culture perspective.
Since May 26, 2026, Brazil’s updated NR-1 expressly requires work-related psychosocial risk factors to be included in the country’s Occupational Risk Management framework, known as GRO — Gerenciamento de Riscos Ocupacionais.
In practice, the logic is similar to the one already applied to other occupational risks: companies need to identify hazards, assess the risks they create, implement preventive measures and monitor the results.
And they need to be able to show that this process actually exists.
That is an important distinction.
It is not enough for a company to say that it “cares about mental health.” The focus of the regulation is on working conditions and organizational factors that may create occupational risks, as well as the actions taken to prevent or reduce them.
What is a psychosocial risk factor?
The term may sound abstract, but the examples are very concrete.
Common factors may include:
chronic work overload;
harassment and workplace violence;
excessive pressure;
lack of managerial or organizational support;
low levels of autonomy;
unclear roles and responsibilities;
unrealistic demands or goals;
poorly designed work processes.
One distinction is particularly important: the assessment is not meant to identify which individual employee is “more stressed” or to diagnose workers.
The focus is the work itself.
Companies need to look at the conditions, management practices and organizational characteristics that may act as stressors or contribute to work-related harm.
For example, a team showing signs of persistent overload does not automatically mean there is an occupational illness.
But it may be a reason to examine workload, staffing, deadlines, targets, working hours and how responsibilities are distributed.
What does the company need to do?
The process can be understood in four broad stages.
Identify
The first step is to understand where potential psychosocial hazards exist.
This may involve observation of work activities, employee participation, interviews, analysis of work organization and internal indicators.
Turnover, absenteeism, aggregated leave data, internal complaints, conflicts, employee surveys and reports submitted through whistleblowing or reporting channels may all provide useful signals.
But they are signals.
They are not the entire assessment.
A department with turnover far above the company average, for example, deserves attention. The cause may be poor leadership, workload, compensation, a difficult routine or several factors combined.
The data tells you where to look.
Assess
Once a hazard has been identified, the associated risk needs to be evaluated according to criteria such as probability and severity, using the methodology adopted by the organization.
Not every situation has the same level of risk.
A temporary workload increase during an exceptional month is different from chronic understaffing.
A single conflict between colleagues is different from recurring harassment involving a manager.
The analysis needs context.
Prevent and control
Finding the problem is not the end of the process.
Measures need to be proportional to the risk identified.
Depending on the situation, this may involve:
revising targets;
redistributing tasks;
increasing staffing;
changing internal processes;
training managers;
adjusting working hours or responsibilities;
reviewing management practices.
The important point is that the process cannot stop at the diagnosis.
Document and monitor
This is where many organizations may run into difficulties.
The company should be able to reconstruct what happened.
What was identified?
How was the risk assessed?
What action was decided?
Who was responsible?
What was the deadline?
Was the measure implemented?
Did it work?
For organizations required to maintain a PGR — Brazil’s Occupational Risk Management Program — the documentation includes at least the Occupational Risk Inventory and the Action Plan.
Keeping this information organized as the process happens is far easier than trying to rebuild the history after a regulator asks for it.
Can an employee climate survey be used for NR-1 compliance?
It can help.
But it is not enough on its own.
An anonymous survey can reveal patterns that may never appear in an individual conversation.
If an entire department scores poorly on leadership, workload or psychological safety, that is a useful signal.
But applying a questionnaire does not automatically mean the company has completed its psychosocial risk management process.
The information still needs to be interpreted, connected to working conditions, evaluated and followed by appropriate action when necessary.
A survey is a source of evidence.
It is not a compliance certificate.
Where does a whistleblowing or reporting channel fit in?
A reporting channel provides a different type of information.
While a survey can reveal patterns, a reporting channel can expose specific situations.
Recurring misconduct by a manager.
Harassment.
Workplace violence.
Retaliation.
Other problems that employees may not feel comfortable raising publicly.
The two tools answer different questions.
A survey may show that there is smoke.
A report may help identify where the fire started.
But neither tool replaces the broader risk-management process required by NR-1.
The regulation does not say that companies must use a specific survey platform or reporting system to manage psychosocial risks.
These tools can support a larger strategy for listening, detection and monitoring.
They are part of the process, not the process itself.
The assessment is not about finding “who is mentally unwell”
This distinction is worth repeating.
Managing psychosocial risks does not mean applying a test and classifying employees according to their mental-health status.
The question should not be:
“Who is stressed?”
It should be:
“What is it about the way this work is organized that may be creating or increasing risk?”
That change in perspective matters.
It moves the discussion away from individual blame and toward working conditions, management practices and organizational design.
What should the company be able to document?
The strongest evidence is not a single report prepared just before an inspection.
It is the ability to demonstrate the process over time.
For example:
which hazards were identified;
how the associated risks were assessed;
which groups of workers were exposed;
what preventive measures were chosen;
who was responsible for them;
when they were supposed to be implemented;
whether the measures were reviewed afterwards.
The goal is to show that psychosocial risk management is part of the company’s occupational-risk process rather than an isolated initiative.
The challenge is not simply collecting data. It is acting on it.
The explicit inclusion of psychosocial risks in NR-1 brings together areas that many companies still manage separately.
Occupational health and safety sees the occupational risk.
HR sees turnover, engagement and leadership issues.
Compliance receives reports.
Management decides how work is organized.
If those pieces of information never meet, important signals can remain invisible.
A whistleblowing channel and an employee climate survey do not replace Occupational Risk Management.
But they can help companies identify problems earlier, understand recurring patterns and make better-informed decisions.
In the end, the most useful question may not be:
“Do we have a psychosocial risk policy?”
It may be:
“If a problem is developing inside our company today, can we identify it, act on it and show what we did?”