OSH management: legal duties and compliance

Introduction

The European Framework Directive^[1] attributes the responsibility for safety and health at work in the company to the employer. The Framework Directive also defines precise obligations that the employer has to fulfil. The employer can delegate tasks that contribute to the fulfilment of the obligations to management representatives, for example, by installing a safety management system. However, the employer maintains the general responsibility and must select, instruct and supervise persons of the safety management carefully.

The responsibility of the employer as a basic principle

With Framework Directive 89/391 EEC, the European legislator has established a fundamental law on occupational safety and health which defines common principles of prevention in the company and for the protection of the workers^[2]. It is essential to know that EU legislation does not mention the responsibility of management, but rather only the obligations and the responsibility of the employer with regard to safety and health at work: “The employer shall have the duty to ensure the safety and health of the workers in every aspect related to the work"^[1] .

The employer is legally defined as “any natural or legal person who has an employment relationship with the worker and has responsibility for the undertaking or establishment"^[1]. This legal definition has to be interpreted in light of the European and national laws on corporate organisation and companies. In forms of sole proprietorship or partnerships, shop owners are also the persons responsible in the sense of the “employer". In corporate companies, the acting organ or managing board of the legal entity acts as employer in the sense of the European Framework Directive.

Neither third persons entitled by the employer nor any obligation attributed to a worker have any influence on the basic principle of employers’ responsibility^[1]. This means that the employer can only delegate tasks that contribute to the fulfilment of the duties and obligations but cannot delegate responsibility for safety and health at work in general. The delegation must be specific and precise and the employer is responsible for selection, instruction and supervision of any third person^[3].

The declaration of responsibility in the Framework Directive must not be misunderstood as a harmonisation of national rules concerning financial liability^[4]. Rules of financial compensation for workers suffering from ill-health or accidents follow national regulation, as well as rules concerning the liability of the employer in penal or tort law (see also below: Aspects of liability).

Obligations of the employer

The European legislative framework on occupational safety and health (OSH) is rather target oriented and therefore requires high standards from OSH management in the company in order to meet the aims and obligations set out by the different regulations^[5]. The basic principle of target orientation is set out in art.6 of the Framework Directive that obliges the employer to constantly guarantee a better level of protection of workers’ health and safety and aim at a permanent improvement of working conditions. In this context, the employers have to keep themselves informed about latest developments and state of the art technological improvements and workplace design. They also have to develop a prevention policy that covers all aspects of safety and health at work^[6].

The Framework Directive defines a bundle of measures that the employer has to carry out in order to fulfil his legal responsibility for the safety and health of the workers. The most important ones are^[1]:

• Carry out safety and health risk assessments at the workplaces in the company and provide documentation of the results. This includes the obligations of implementing preventive measures based on the results of the risk assessment, in accordance to the principles of prevention as laid down in art.6 of the Framework Directive;
• Inform the workers about safety and health risks as well as about adequate measures of protection and prevention (art. 10);
• Provide appropriate safety and health training measures and ensure that each worker can participate in accordance to the rules laid down in art.12, which declares that training must take place on recruitment, in the event of a transfer or a change of job, in the event of the introduction of new work equipment or a change in equipment, in the event of the introduction of any new technology. This must be repeated whenever necessary;
• Take care of measures of emergency response (incl. evacuation procedures, fire fighting and medical services (art. 8);
• Consult workers and their representatives and allow them to participate in the decision making process concerning safety and health at work as foreseen in the EU-Directives;
• Ensure the health surveillance of the workers in accordance with the national laws on occupational medical services (art. 14).

The employer can use the organisation in the company or further experts to comply with the rules: art.7 of the Framework Directive allows employers to delegate tasks for fulfilling obligations to their own staff or to external service providers under certain limitations. They can designate one or more workers to carry out activities related to protection of workers and prevention of occupational risks (art.7, No.1) and they can contract competent external service providers if the measures cannot be carried out by their own staff (art.7 No.3).

In any case, the employer must ensure that the designated workers or service providers have the required capabilities, means, resources, expertise and information to successfully organise and carry out the designated prevention measures. If the employer does not comply with these provisions, it may be possible to accuse him/her of organisational negligence, a charge that could be substantiated with respect to personal responsibilities as per the national rules in penal or tort law (also see below).

Managing occupational safety and health compliance

Challenges of managing occupational safety and health compliance

The European legislation on safety and health at work is influenced by the Scandinavian tradition of regulating occupational safety and health and by the definition of the working environment laid down in the international conventions of the International Labour Organisation^[7]. The European legislation is based on a dynamic, holistic and preventive concept of safety and health at work, which obliges the employer to constantly improve for the benefit of the workers^[8][4].

The general prevention concept is primarily based on describing the aims and objectives rather than giving concrete prescriptions on thresholds, measurements or means. On the one hand, this provides autonomy and flexibility enabling employers to pursue best practice^[9] and to decide on the most adequate method to apply to the business. On the other hand, it requires a higher level of knowledge of how the goals can be achieved to comply with legislation. In practice, this open approach seems to favour large organisations that have a specialised staff, while small companies are more likely to benefit from more concrete regulations and requirements. 

Data from ESENER (European Survey of Enterprises on New and Emerging Risks – EU-OSHA) suggest that the main reason for workplaces to manage OSH is the fulfilment of legal obligations^[10].

Figure: Reasons given by workplaces for addressing safety and health, 2014 and 2019, based on ESENER

Source^[10]

The EU-OSHA project on supporting OSH compliance (2021-2024)^[11] focuses on identifying the factors that influence compliance with OSH standards. Research has shown that external factors have a strong influence on OSH compliance:

• legal enforcement of regulations
• supply chain influences
• external OSH services
• social or sectoral norms
• financial support.

Models of OSH management

The EU Directives on safety and health at work do not establish any strict regulatory framework on OSH management. It is up to the employers to decide on how to organise their business. Traditional OSH management used to set the focus on the avoidance of punishment and experts’ knowledge. The main goal was establishing a regulatory compliance. In contrast, modern management aims to improve performance, activate workers and reach goals beyond legal prescriptions. Health and safety management is seen as a part of the general company’s management. Therefore, OSH experts strongly recommend some basic elements that should be taken into account:^[12][6]

• Measurable objectives for safety and health should be set and be part of the company’s policy. Objectives and policy are transparent and supported by management and the workers;
• Measures should be implemented following defined processes and responsibilities. Workers and their representatives should be involved;
• Actions shall be based on a risk assessment and not only cover corrective, but also preventive measures;
• Performance in safety and health at work should be checked on a regular basis with the of measurable performance indicators;
• Lessons should be learned and be mainstreamed in an improvement cycle. Results of the lessons learned should be promoted in training sessions for management and workers.

At the current time, many companies use management systems to ensure that regulatory prescriptions are met. The big advantage of OSH management systems is that they provide a clear description of how processes concerning safety and health can be organised in the company. ISO Standard 45001 Occupational health and safety management systems — Requirements with guidance for use defines a management system as “a set of interrelated or interacting elements of an organisation to establish policies and processes to achieve those objectives. An OSH management system is a management system or part of a management system used to achieve the OSH policy to prevent work-related injury and ill-health to worker(s) and to provide a safe and healthy workplace”^[13].

The systems are usually based on industrial standards and can be implemented separately or as part of an integrated management approach together with quality management and/or environmental management systems. Some standards and guidelines are developed by International Organisations; national standards exist in various EU Member States. Some of them are industry specific or especially designed for use in small and medium enterprises. They are often promoted by labour inspectorates, accident insurance bodies, or other prevention services.

Internationally established guidelines and standards of OSH management system are ILO-OSH 2001, a guideline for OSH management developed by the International Labour Organisation^[14] and ISO 45001. ISO 45001 has also become a European standard (EN ISO 45001:2023) and can be certified worldwide. The ISO 45001 standard is based on the harmonised structure that is used for all ISO management system standards making it easier for organisations to develop an integrated management system. The ISO management system standards specify steps that organisations can implement to improve their performance based on a continuous cycle of self-evaluation, correction and improvement and on employee commitment and management leadership^[15]. All management system standards have a common, harmonised structure.
Additionally, there are various national standards for some of them, especially for small and medium enterprises or for certain industries which are promoted by national institutes or prevention services^[6].

OSH management systems usually based on the “Plan-do-check-act" (PDCA) model and aim to implement a continuous improvement process in the company. So, generally speaking, management systems fit well to the aim of European OSH Directives for permanently improving the level of prevention in the company. However, one should keep in mind that the goals of improvement are in line with the enhancement of the prevention level in the company, which is the aim of the EU legislation.

OSH management systems are designed for supporting the management in complying with legal requirements. The ISO 45001 standard for example requires the employer to have an overview available, compiling all OSH legislative requirements relevant for the company. Such an overview should include all specific and detailed requirements, even from the EU legislation on machinery and on chemical substances (for example REACH - Regulation (EC) No 1907/2006 on the Registration, Evaluation, Authorisation and Restriction of Chemicals^[16]). It can then be used to check where adequate measures are already in place, where plans for improvement (and compliance) are still necessary, and to develop a strategy for assuring compliance.

Even though all OSH management systems serve for implementing the company’s OSH policy and for managing safety and health risks, the employer should always need to adapt it to the situation in the company. This means that each employer has to ensure that all relevant safety processes, working conditions and specific risks are covered in order to meet legal requirements.

Strategies for improving occupational safety and health management performance

Among the most common errors that occur is the inadequate response to new and emerging risks at the workplace. The most prominent example is the issue of psychosocial risks. Despite the fact that psychosocial risks belong to the most important OSH risks factors, data from ESENER suggest that awareness is still not high enough and that organisations often regard them as more difficult to manage than other OSH) risks^[10]. 

Further frequent points of non-compliance with legal provisions are^[6]:

• Focusing on accident prevention only instead of ill-health prevention in general
• Not including external service providers (e.g. maintenance workers or cleaners)
• Not including workplaces of temporary workers
• Not meeting “formalities" (e.g. documentation of risk assessments)
• Not involving workers or their representatives.

In practice, the quality of OSH management is highly dependent on the prioritisation of the topic in the management culture and to the management commitment for safety and health at work. In other words, OSH management can only be successful if it is handled with the same commitment as any other field of management in the company. This can be ensured by setting clear and measurable objectives that are followed with equal priority to other key data in the company, defining processes and responsibilities, ensuring monitoring and improving safety culture and awareness of workers and management representatives^[17].

Especially in the context of safety culture, a crucial point is the motivation of the workers and ensuring that no-one is left behind. Studies show that OSH management is more successful when it is converted from a “functional system" into a “social system" that builds on all the stakeholders in company, including managers and workers[18].

For a more holistic approach that includes the promotion of the health of the workers, it is recommended that OSH management be combined with measures of workplace health promotion or health management. Concepts exist that combine classical OSH aims like the reduction of sick leave costs with the promotion of productivity as well as with the promotion of individual resources^[19].

When the employer lacks expertise, it is advantageous to contact external specialists in order to improve OSH management performance. Such services do not have to be cost-intensive. In many EU Member States, governmental institutes, insurance bodies or sector organisations provide services for improving OSH management, in particular for small and medium enterprises. ESENER data indicate that various forms of specialist support are provided by both internal and external services and that respondents found this support helpful, especially for supporting risk assessment processes. At the same time, it suggests that companies are certainly in need of expertise to assist them in managing OSH, especially for more complex matters such as psychosocial risks^[20].

Consequences of non-compliance and aspects of liability

The principle of being responsible for complying with the legislation on safety and health at work finds its expression in the rules of liability for the employer. These rules are established by national law and can include financial liability for workers’ compensations in the case of ailment, fines in cases of administrative offences, and also personal sanctions in criminal law. 

Financial compensation of workers

If the employer does not comply with the duties and obligations laid down in the European and national laws on safety and health at work, workers who become ill or get involved in accidents due to negligence can claim for indemnification and financial compensation for non-material damages. The procedure depends on the national systems for workers’ compensation and hence, on the company’s insurance status.

If the company is insured by law (“statutory accident insurance") or by private contract, the worker will usually receive compensation from the body of insurance. In an act of gross negligence by the employer, the body of insurance might have the right to reject the payment or to claim for regress^[3]. If the company does not dispose of any insurance coverage, the employer might be sentenced to compensate the worker from company resources.

However, differences in national legal systems and workers' compensation schemes mean that there are also differences in the extent to which these systems act as a form of deterrent, or conversely, that they provide an incentive to encourage good practice9^[9].

Personal criminal liability and tort law

Single board members or management representatives might also be individually responsible in cases of gross negligence, depending on the national rules in criminal or tort law. This can be the case if they did not comply with the designated duties on safety and health at work or if they neglected duties of selection and supervision of a designated person.

This personal responsibility can include convictions because of negligence, homicide or bodily harm. The personal criminal liability might be threatened with imprisonment depending to national legislation. The tort law might constitute personal financial compensation^[3].

Fines for non-compliance

Below criminal liability, the national rules might foresee fines for administrative offences. They include cases of not complying with OSH legislation. Even without any consequences for workers’ health, employers can be fined by labour inspectorates. The fines depend on national legislation and the systems of labour inspection, which can vary from case to case. Labour inspectors can issue fines to companies, both as punishment and deterrent for future activities. Some countries, such as Greece, have formulas for calculating fines that take into account company size, sector and previous involvement^[21]. Fines vary widely from country to country, and, as shown in EU-OSHA’s overarching review on improving compliance^[22], research does not identify specific fine amounts for safety violations that correlate with better company compliance^[21].

Labour inspectorates in some EU Member States take account of certified management systems when planning their inspection schemes in a way that sees them controlling them less frequently or only in re-active inspections (responding to complaints or accidents). This takes account of the fact that a certified OSH management probably contributes to the better organisation of safety and health in the company^[23]. However, labour inspections can still control the fulfilment of the legal obligations and can impose fines for non-compliance.