Psychosocial risks at work: what Spanish law requires, what fines apply and how to run the assessment

Workplace wellbeing 2026: why psychosocial risk assessment has stopped being optional

Spain’s Labour and Social Security Inspectorate (ITSS) has placed psychosocial risks among its explicit enforcement priorities in the 2023-2027 National Strategy on Occupational Safety and Health. Since 2022, citations for missing assessments or planning have grown by 42% (ITSS 2024 memoria), and the average fine for serious breaches now stands at €8,400 in the same report.

For an HR director, a health & safety officer or a CEO, this stops being theory: it is a legal contingency with rising frequency. A few years ago it was enough to keep “a psychosocial PDF” on file. That window has closed. Today inspectors demand validated methodology, an executed action plan, documentary records and timely reassessment.

This article is a practical, grounded guide to the 2026 compliance framework in Spain: what the regulation actually says, what inspectors look for in each sector, what real fines courts are imposing, and how a medium or large company can turn the psychosocial assessment into a real workplace wellbeing lever rather than a bureaucratic file. Inside that engine, the Employee Assistance Programme (EAP) —also called Programa de Apoyo al Empleado (PAE) or Programa de Apoyo Emocional in Spain— is the piece that turns the assessment from a report into a service employees can actually use.

The legal framework: what Spanish regulation actually requires

Psychosocial compliance in Spain rests on five regulatory pillars worth knowing by name:

Law 31/1995 of 8 November on Occupational Risk Prevention (LPRL). Article 14: general duty to protect against all work-related risks. Article 16: duty to assess and plan prevention. Article 22: confidential and specific health surveillance.
Royal Decree 39/1997, Regulation on Prevention Services. Procedures and mandatory inclusion of organisational and psychosocial factors in any assessment.
LPRL, Article 4.7. Defines working conditions as including “all features of work, including those relating to its organisation and structuring, that influence the magnitude of risks”. Explicit legal anchor for psychosocial risks.
NTP 926 from INSST (National Institute for Occupational Safety and Health). Routinely referenced by inspectors. Complemented by NTPs 703, 704 and 854 on specific factors.
Law 10/2021 on remote work (Art. 18) and Organic Law 3/2018 (Art. 88) on the digital disconnection right. Inspectors check whether the disconnection policy is written and applied.

On top of this, the Workers’ Statute (Art. 4.2.d and 4.2.e): right to physical integrity, to adequate occupational safety and to respect of privacy and dignity.

Recent Supreme Court rulings (STS 4th Chamber, 13/07/2023) have equated missing psychosocial assessments to a serious breach of prevention regulations, with benefit surcharges in cases of sick leave recognised as occupational contingency.

The 5 psychosocial dimensions inspectors check, by sector

The INSST’s operational definition groups psychosocial risks in five dimensions. What changes between sectors is not the dimensions, but their score. Concrete examples of what each inspector checks in Spain:

Healthcare (hospitals, primary care, nursing homes): continuous emotional load, “second victim”, 12-24h shifts, chronic understaffing. Usual instrument: CoPsoQ-istas21 long version.
Tech, software development, IT consulting: double presence (remote work + family life), chronic technical debt, 24/7 on-call, digital disconnection. Inspectors ask for the written disconnection policy.
Retail banking and commercial branches: sustained sales pressure, accelerated digitalisation, conflictive client contact, aggressive individual targets.
Call centres and customer service: tight metric-based control (AHT, NPS), rigid scripts, internal turnover, emotional load. High mental health leave rates.
Education (secondary and VET): family conflicts, student/teacher ratio, documentary burden. INE EPA 2024 documents mental health absence rates 22% above the average.
Logistics and warehouse: system-imposed pace (picking, pick-to-light), monotony, night shifts, physical load combined with stress.
Shift-based industry: altered circadian rhythms, distant supervision, cognitive monotony, production pressure.

In all these sectors, the three factors that typically accumulate the most risk are emotional demands, double presence and leadership quality. An EAP with a clinical psychologist available within 48h addresses the first and second. The third requires structural intervention (manager coaching, role redesign).

The 4 concrete obligations to prove before an inspector

The regulation does not ask for good intentions: it asks for documented evidence. These are the four minimum duties every Spanish company must be able to demonstrate, regardless of headcount or sector:

1. Assess. Identify and measure with a scientifically validated instrument (no homemade survey, no “internal consultation”). Coverage: entire workforce or a statistically representative sample with minimum 60% participation (ideally >75%). The three most accepted methodologies with no discussion:

CoPsoQ-istas21 (Spanish version of the Danish CoPsoQ, adapted by ISTAS). Short version (30 items, ~10 min) for SMEs; long version (70 items, 25-30 min) for medium and large companies. De facto standard in public administrations and multinationals.
FPSICO from INSST, version 4.1 (2023). 9 factors, 44 items. Free, official, traceable. Inspectors accept it without objection.
MBI-GS (Maslach Burnout Inventory — General Survey). Specific to burnout, habitual complement. Does not replace a complete psychosocial assessment.

2. Plan. Based on results, action plan with concrete measures, deadlines, owners and allocated resources. Without a plan, the assessment has no legal effect. In practice it is structured in three layers: organisational (redesign), collective (culture, training) and individual (psychological support, accompaniment).

3. Execute and document. Implement the measures and register execution. If the assessment flagged a “social support” problem and the company did nothing for 18 months, there is liability. This is where a PAE’s aggregated anonymised reports (sessions consumed per department, consultation motives, quarterly evolution) are first-tier documentary evidence.

4. Review. Minimum update every 3 years, and whenever conditions change significantly: reorganisation, merger, M&A, site change, remote work rollout, major headcount change, CNAE change.

Additionally, since 2023 the assessment must be integrated into the overall Prevention Plan and available for consultation by worker representatives (prevention delegates, H&S Committee when applicable).

Real fines Inspectors and Courts are imposing

Fines under Spain’s Law on Infringements and Sanctions in the Social Order (LISOS), updated to 2026:

Minor infringement (Art. 11 LISOS): €45 to €2,450. Formal deficiencies in the assessment.
Serious infringement (Art. 12 LISOS): €2,451 to €49,180. Not assessing, not planning, not informing, not consulting representatives.
Very serious infringement (Art. 13 LISOS): €49,181 to €983,736. Acts or omissions with serious and imminent risk.

In real litigation, the most expensive items are usually:

Social Security benefit surcharge (Art. 164 LGSS): 30-50% on top of any temporary or permanent disability payment when a sick leave is proven to originate in a non-assessed and untreated psychosocial situation. In permanent disability cases, it can exceed €150,000.
Civil liability under Art. 1902 Civil Code: compensation to the worker that can reach six figures, especially if proven moral damage.
Reputational damage: relevant in sectors with ESG exposure (investor funds, public tenders with social responsibility criteria).
Director disqualification in severe, repeated cases (Capital Companies Law).

Anonymised examples from published 2023-2024 cases:

TSJ Madrid ruling (2024): €40,200 fine to call centre company for missing psychosocial assessment + 40% surcharge on two leaves.
TSJ Basque Country ruling (2023): €18,400 serious fine to financial institution for failing to consult representatives in the psychosocial assessment; 30% surcharge.
Osalan inspection (Basque Country, 2024): 3-month compliance requirement to a 180-person logistics company for insufficient planning after the assessment.

Step by step: how to run a psychosocial assessment that withstands inspection

For a 100-500 workforce, a defensible process fits into 6 steps over 4-6 months:

Committee setup. Company, prevention service (internal or external SPA) and worker representatives. Initial minutes with scope, chosen methodology and timeline. If the company has an H&S Committee, channel through it.
Communication to the workforce. Explain what, why, how anonymity is guaranteed (encryption, aggregation >5 people) and when results will be shared. Without this, participation drops below 40% and statistical validity is lost.
Data collection. Online questionnaire (preferred) with technical anonymity guarantees. Target: minimum 60% participation, ideally >75%. Units with fewer than 5 people are grouped to prevent identification.
Analysis and report. Process with the instrument’s official software. Analyse by organisational units, identify dimensions in high or very high risk zone. Executive report + technical report + department annexes.
Action plan. Organisational measures (role redesign, meeting patterns, leadership), collective measures (culture, internal communication, digital disconnection, training), individual measures (psychological support via EAP, specific programmes for red-zone cases). Deadlines, owners, KPIs and budget.
Monitoring and reassessment. Quarterly KPI reviews, full reassessment every 2-3 years, adjustments after any relevant organisational change.

Rough cost for a 200-person company: €5,000-€12,000 per 2-3 year cycle if outsourced to specialised consultancy. For 500+ workforces, €15,000-€40,000.

The EAP as workplace wellbeing infrastructure and compliance piece

The psychosocial assessment identifies problems. The Employee Assistance Programme (EAP) —or Programa de Apoyo Emocional— is the infrastructure that lets you treat them without building a clinical apparatus from scratch. In compliance terms, an EAP brings four assets inspectors value positively:

Evidence of active measures. When the assessment flags high risk in “social support” or “emotional demands”, the EAP is documentary proof that the company has deployed concrete treatment resources, not just a filed diagnosis.
Confidential, agile care. Clinical psychologist accessible within 48h + 24/7 anonymous line. Covers the need for rapid response without overloading internal prevention services and without leaving a trace in the employee’s record.
Legal, tax and financial counselling (Tier 2 of beLASAI’s EAP) for off-the-job stress causes the prevention plan cannot solve but which still affect performance: separations, inheritance, debt, administrative proceedings.
Aggregated anonymised reporting that feeds the formal psychosocial assessment without breaching Art. 22 LPRL. Aggregates sessions consumed, consultation motives (emotional, family, work, financial, legal themes) and quarterly evolution by department.

In workplace wellbeing terms, the EAP plays the role of confidential individual layer while the prevention plan acts on the collective layer. They are complementary. A programme without an EAP leaves prevention’s last mile uncovered; an EAP without a psychosocial assessment is an isolated service lacking strategic framework.

Differences by Autonomous Community: responsible bodies

Core regulation is state-level, but enforcement and best-practice guides vary:

Basque Country: Osalan (Basque Institute for Occupational Safety and Health). Own psychosocial assessment manual and annual sectoral campaigns.
Catalonia: ICSSL (Institut Català de Seguretat i Salut Laboral). Own guides in Catalan.
Madrid: IRSST (Regional Institute for Occupational Safety and Health). Sectoral campaigns.
Andalusia: IASST (Andalusian Institute for Occupational Risk Prevention).
Galicia: ISSGA; Valencia: INVASSAT; etc.

If your company operates across several Autonomous Communities, review each region’s guidance for the sectors with the highest headcount.

Frequently asked questions about psychosocial risk assessments

Is psychosocial risk assessment mandatory in Spain?

Yes, it is mandatory for any company with at least one employee under Arts. 14 and 16 of Law 31/1995 and Art. 4.7 of the same law. Failing to assess is a serious infringement with fines from €2,451.

How often must the psychosocial assessment be updated?

At minimum every 3 years, and whenever there are significant changes in working conditions: reorganisation, merger, site change, generalised remote work rollout or major headcount change.

What happens if the company does not carry out the psychosocial assessment?

Administrative fine (€2,451 to €49,180 for serious cases), 30-50% benefit surcharge if there are leaves recognised as occupational contingency, potential civil liability for damages to the worker, and reputational exposure.

Which methodologies does the Labour Inspectorate accept?

Without objection: CoPsoQ-istas21 (short or long), FPSICO from INSST (v. 4.1), and MBI as a specific complement for burnout. Other methodologies may be accepted if scientifically validated and published in peer-reviewed journals.

Can an EAP replace the psychosocial risk assessment?

No. The Employee Assistance Programme (EAP) is the intervention arm; the psychosocial assessment is the regulatory diagnosis. They complement each other: the EAP is not a validated assessment instrument, but its anonymised reporting does feed the formal assessment with real usage data.

How much does it cost to implement an EAP in a 200-employee company?

A well-sized EAP for a 200-person company in Spain costs between 0.3% and 0.6% of payroll, including a clinical psychologist accessible within 48h, 24/7 line and aggregated reporting. Preventing a single long-term leave per year pays for it.

The next step towards workplace wellbeing that complies and converts

If your company has not assessed psychosocial risks in the last 3 years, or the last one was a PDF with no real action plan, act before an inspection, not after.

For a first reading of your team’s risk level in 3 minutes, start with our free occupational health test, based on CoPsoQ and MBI (it does not replace the formal assessment but it orients).

To align regulatory compliance + workplace wellbeing + talent retention in a single programme, get in touch. At beLASAI we design workplace wellbeing programmes for medium and large companies with the Employee Assistance Programme (EAP) as the core service, coordinated with the prevention plan and continuously feeding the psychosocial reporting.