How to Do a Legally Compliant Workplace Risk Assessment — Step by Step (2026)

What is a workplace risk assessment — and who needs one?

The obligation comes from the EU Framework Directive on occupational safety and health (89/391/EEC), which every member state has written into national law: if you employ anyone, you must assess the risks to their safety and health and keep documentation of that assessment. In Denmark this is the APV under the Working Environment Act, in Germany the Gefährdungsbeurteilung, in the Netherlands the RI&E — the names differ, but the core duty is the same across the EU.

It applies from your very first employee, including part-timers, temps and young workers. The assessment must be in writing (paper or digital), it must be available to employees, and employees must be involved in producing it.

How often must it be updated?

Most national rules combine two triggers:

• A fixed cycle: a full review at regular intervals — in Denmark at least every 3 years, and several other countries use similar rhythms or require it "regularly".
• Change-driven updates: whenever something changes that affects working conditions — new premises, new machinery or chemicals, reorganisations, or new knowledge about a risk, for instance after an accident.

A risk assessment that sits untouched in a drawer does not meet the intent of the law. It has to reflect the work as it is done today.

The five phases

Most member states give you freedom of method, as long as the result covers hazard identification, risk evaluation, sickness absence where required, an action plan and follow-up. A proven approach — recommended by the Danish Working Environment Authority and mirrored in EU-OSHA guidance — is five phases:

1. Mapping: Identify working conditions across the whole business. Use questionnaires, walk-throughs or dialogue meetings — and cover both physical factors (noise, ergonomics, chemicals, indoor climate) and the psychosocial work environment.
2. Description and evaluation: Describe the problems you found and assess how serious they are. What is the cause, who is affected, and how big is the risk?
3. Sickness absence: Consider whether anything in the work environment may be contributing to absence. You are not analysing individuals — only whether work could be part of the explanation.
4. Prioritisation and action plan: Decide what to fix first, who is responsible, and by when. The written action plan is the heart of the assessment.
5. Follow-up: Agree how and when you check that actions were actually completed. Follow-up is the phase most companies forget — and one of the first things an inspector asks about.

Do not skip the psychosocial risks

Psychosocial risks must be assessed on equal footing with physical ones — this is explicit in EU-level guidance and increasingly in national rules. Your mapping should cover, among other things:

• Workload and time pressure
• Unclear or conflicting demands
• High emotional demands (for example in work with people)
• Offensive behaviour, including bullying and sexual harassment
• Violence and threats

In practice this means your questionnaire needs questions about wellbeing, cooperation, management and offensive behaviour — not just chairs, screens and noise.

What do labour inspectorates look for?

Inspectorates do not approve your risk assessment in advance; they check it during inspections. Typical questions:

• Does it exist? A written assessment, available at the workplace.
• Is it current? Within the national review cycle and updated after significant changes.
• Does it cover the actual work? All relevant conditions, including psychosocial risks and any chemical hazards.
• Is there an action plan? With priorities, named owners and deadlines — and evidence of real follow-up.
• Were employees involved? Inspectors often ask employees directly.

If the assessment is missing or inadequate, the usual first step is an improvement notice with a deadline; ignoring that can lead to fines. More importantly, a good risk assessment genuinely prevents accidents, attrition and sickness absence — which is why the duty exists.

A realistic way to get started

1. Appoint an owner and tell employees what is happening and why.
2. Send out a short questionnaire covering physical and psychosocial conditions.
3. Review the answers, supplement with a walk-through, and consolidate the findings into one list.
4. Prioritise, write the action plan, and put names and dates on every action.
5. Put a recurring follow-up date in the calendar — every six months works well.

Expect the first full cycle to take a few weeks from questionnaire to finished action plan. After that, keep the assessment alive continuously instead of starting from scratch every cycle.

How Verkta helps

Verkta's risk assessment module gives you ready-made questionnaires covering physical and psychosocial risks, automatic collection of responses, and an action plan where owners and deadlines are followed up with reminders. The system tracks your review cycle so the assessment never silently expires. You can try it free for 14 days.