NR-1 Is Now Enforced: What Your Risk Program Must Include to Avoid Penalties

Brazil’s NR-1 update is now enforceable. Companies without psychosocial risk controls in their PGR face fines from May 26.

This article was produced with AI assistance and reviewed for factual accuracy, editorial consistency, and argument integrity before publication. All content reflects the author’s independent analysis and judgment.

Brazil’s Norma Regulamentadora nº 1 (NR-1) entered full enforcement on May 26, 2026. The update, established by Ministerial Order MTE nº 765/2025, ended a 12-month adaptation period and made psychosocial risk management a mandatory component of every occupational risk program (PGR) for companies governed by Brazilian labor law.

The practical implication is straightforward: psychosocial risk factors such as workload overload, moral harassment, excessive performance targets, exhausting schedules, and deteriorating organizational climate must now be formally identified, assessed, and controlled within the PGR. Not as a policy statement. As a documented process with action plans, defined controls, responsible parties, deadlines, and monitoring records.

This distinction carries operational weight. A PGR that rigorously documents physical, chemical, biological, and ergonomic risks while leaving the psychosocial dimension blank or covered by a generic template is already non-compliant. Labor inspectors can issue violations without requiring any declared incident. The absence of the process is itself the infraction.

The legal dimension extends beyond administrative penalties. The updated NR-1 establishes the standard of employer diligence that Brazilian labor courts will reference in cases involving work-related mental health conditions. A company without an updated PGR that explicitly addresses psychosocial factors will face significant difficulty demonstrating absence of liability if an employee develops an occupational mental health disorder. In 2025, Brazil recorded more than 546,000 workplace disability leaves attributed to mental disorders, representing approximately 13% of all temporary incapacity benefits, according to the Ministry of Social Security.

For organizations already certified under ISO 45001, the adjustment is primarily one of scope. The standard already requires occupational risk management with a broad mandate that includes psychological risks. Achieving compliance with the updated NR-1 in this context is largely a documentation and scoping exercise: ensuring that psychosocial risk factors are explicitly named, assessed, and controlled within the existing PGR structure, without creating a parallel system.

What the PGR must contain now is specific: a sector- and role-level mapping of psychosocial risk factors; a probability and severity assessment for each identified factor; control measures with assigned owners and deadlines; and a periodic monitoring mechanism with verifiable records. Claiming that the company has a mental health policy is not equivalent to demonstrating that the required process exists and operates.

The organizational implications are immediate. The window for transitional preparation closed on May 25. Companies that have not updated their PGR must do so now, with priority given to sectors with high psychosocial exposure: healthcare, education, retail with high turnover, call centers, and construction. The enforcement is active, and the fine is applicable from May 26 onward.

What the NR-1 update does not require is perfection. It requires process. Organizations that have mapped risks, assessed severity, defined corrective actions, and maintain monitoring records are in compliance even if implementation is still ongoing. Organizations with no documentation, or with generic templates disconnected from their actual operating reality, are exposed.

The sectors with the highest psychosocial risk exposure share a common structural pattern: high operational pressure combined with limited individual control over work conditions. Healthcare workers managing patient loads without adequate staffing, call center agents subject to continuous performance monitoring, construction teams operating under compressed deadlines, and retail workers in high-turnover environments all present risk profiles that regulators and labor courts are now trained to identify. For organizations in these sectors, the absence of a documented PGR addressing psychosocial factors is not a procedural gap. It is a liability with quantifiable legal and financial consequences.

One practical implication that organizations tend to underestimate is the documentation standard that labor courts apply when evaluating employer liability in mental health-related cases. The existence of a PGR that includes psychosocial risk factors does not by itself eliminate liability. What matters is whether the program reflects the actual working conditions of the organization, whether control measures are proportionate to identified risk levels, and whether there is verifiable evidence that the program is monitored and updated. A document that mirrors a generic template without adaptation to the organization’s real risk profile carries limited legal weight. Courts increasingly distinguish between formal compliance, having the document, and substantive compliance, demonstrating that the process operates as documented.

The enforcement cycle that begins in May 2026 is not a one-time compliance checkpoint. The NR-1 requires that organizations maintain and update their PGR on an ongoing basis, incorporating new risk information as it emerges and revising control measures when prior actions prove insufficient. This means that organizations which achieve initial compliance by documenting their psychosocial risk inventory still carry the obligation to demonstrate, in subsequent audits and in any labor proceedings, that the program remained active and responsive to actual workplace conditions. The standard of diligence is continuous, not episodic. An annual review cycle with documented findings and updated action plans is the minimum credible evidence of an operating program. Organizations that treat the initial documentation as a permanent artifact rather than a living instrument will find themselves in the same vulnerable position at the next audit that they occupied before May 26.

Credits

This article draws on publications by Brazil’s Ministry of Labor and Employment (MTE) regarding NR-1 and Ministerial Order MTE nº 765/2025, and on technical content from the American Society for Quality (ASQ) on occupational risk management systems.

Sources

Ministry of Labor and Employment (MTE), Ministerial Order MTE nº 765/2025, official publication. Available at: gov.br/trabalho.

Ministry of Social Security, Disability Benefits Bulletin, 2025. Available at: gov.br/previdencia.

American Society for Quality (ASQ), Risk Management in Quality Systems. Available at: asq.org.