NOM-035: the guide HR needs, no lawyer required

What NOM-035 is, and what it is not

NOM-035-STPS-2018 requires workplaces to identify, analyze and prevent psychosocial risk factors: severe work stress, sleep-destroying schedules, unfair workloads, workplace violence. It is not a psychological exam for your employees nor a happy-company certification: it is a documented process of diagnosis and prevention.

It is not optional either. It applies to every workplace in Mexico, from a three-person shop to a plant with thousands.

What it requires by company size

Obligations grow with headcount, in three tiers:

• Up to 15 workers: a prevention policy, measures against workplace violence and support for victims of severe traumatic events.
• 16 to 50: all of the above, plus psychosocial risk questionnaires (Reference Guide II) and actions on the findings.
• More than 50: all of the above, plus the organizational environment evaluation (Reference Guide III) and a documented intervention program.

The fines for non-compliance

The labor authority can inspect at any time, and penalties run from 250 to 5,000 UMA per violation: accumulated fines can exceed half a million pesos. The inspection does not ask whether your employees are happy; it asks for documents: the policy, the questionnaires applied, the results and the action plan.

The most common mistake is not ignoring the norm but half-complying: applying questionnaires and never documenting what was done with the results. Without written evidence, to an inspector it is as if nothing happened.

Compliance in three deliverables

Healthy compliance boils down to three pieces every inspector expects:

• Diagnosis: reference-guide questionnaires applied to the right sample, with results read per workplace.
• Action plan: concrete measures prioritized by risk level, with owners and dates.
• Evidence: the signed and distributed policy, the results, the follow-up. The file that answers for you in an inspection.

How often it repeats

The evaluation refreshes at least every two years, sooner if something big changes: a merger, layoffs, a new site. Treating it as a one-off project is the recipe for being out of compliance two years later without knowing it.