NOM-035: what your company needs to know about psychosocial risks in Mexico

NOM-035 requires every workplace in Mexico to look after its people's mental health, regardless of size. It isn't a recommendation or a wellness trend: it's an Official Mexican Standard in force since October 2019, and the Ministry of Labor (STPS) can inspect compliance.

Its full name is NOM-035-STPS-2018, “Psychosocial risk factors at work – Identification, analysis and prevention.” It was published in the Official Gazette (Diario Oficial de la Federación) on October 23, 2018, with a clear goal: to give employers the tools to identify, analyze and prevent psychosocial risk factors, and to promote a favorable organizational environment.

Put simply: chronic stress, harassment, endless work hours or hostile leadership are no longer “just part of the job.” They are occupational risks, just like a slippery floor or an unguarded machine.

Two key concepts: psychosocial risk and a favorable environment

The standard defines psychosocial risk factors as those that can lead to anxiety disorders, non-organic sleep disturbances, and severe stress and adjustment disorders. They stem from the nature of the job, the type of work schedule, and exposure to severe traumatic events or workplace violence. Specifically, it asks employers to review seven factors:

• Work environment conditions: dangerous, unsafe or unhealthy spaces that demand extra effort to adapt.
• Workloads that exceed a person's capacity: quantitative, mental, emotional, high-responsibility or contradictory demands.
• Lack of control over work: little autonomy, few growth opportunities or insufficient training.
• Work hours and shift rotations beyond what the Federal Labor Law allows, especially night shifts without rest.
• Work–family interference: constantly handling work tasks during personal time.
• Negative leadership and relationships: aggressive or imposing managers, unclear roles, no recognition, no teamwork.
• Workplace violence: psychological harassment, bullying and repeated mistreatment.

The flip side is a favorable organizational environment. The standard describes it as a workplace that fosters a sense of belonging, proper training for assigned tasks, clearly defined responsibilities, communication and participation, fairly distributed workloads within legal hours, and performance evaluation and recognition.

One point worth highlighting: the standard also requires employers to identify anyone who experienced a severe traumatic event at work (robberies, serious accidents, kidnappings, homicides, fires) and refer them for care. From a clinical perspective, this is one of the most important requirements and one of the most overlooked.

What applies to you, by company size

NOM-035 applies to every workplace in the country, but obligations scale with the number of people who work there. A small company doesn't have to run questionnaires, but it still has obligations.

• Every company, even with 15 people or fewer: a written psychosocial risk prevention policy that is shared with staff; prevention measures; a safe, confidential channel for complaints and reports of workplace violence; identifying and referring anyone who experienced a severe traumatic event; and informing staff about all of the above.
• 16 to 50 people: in addition, identify and analyze psychosocial risk factors with a questionnaire applied to all staff; arrange medical exams and psychological evaluations when there are signs or complaints; implement a control program if results call for it; and keep records.
• More than 50 people: all of the above, plus an evaluation of the organizational environment. Here, the assessment can use a representative sample.

The assessment must be repeated at least every two years, and its results must be available for staff to consult. Records can be printed or electronic and must be kept for at least one year.

The standard took effect in two stages: the policy, prevention measures and care after traumatic events on October 23, 2019; questionnaires, exams, control programs and records on October 23, 2020. Today, all of it is fully in force.

Employees have obligations too

NOM-035 isn't only on the employer. Workers must also:

• Follow the prevention measures the workplace sets.
• Refrain from practices that undermine a favorable environment and from acts of workplace violence.
• Take part in identifying risks and evaluating the environment, when applicable.
• Report negative practices and workplace violence through the established channels.
• Report in writing if they witnessed or experienced a severe traumatic event.
• Attend information sessions and undergo the exams the standard requires.

This makes NOM-035 a shared agreement: the company creates the conditions and the team sustains them.

The five reference guides

The standard includes five guides to make compliance easier. They aren't mandatory, but if you use Guides II or III as written, your assessment method is considered compliant. If you prefer your own questionnaire, it must be statistically validated with Mexican working populations.

• Guide I: a questionnaire to detect people who experienced a severe traumatic event and need clinical assessment. For all companies.
• Guide II: a 46-question questionnaire to identify psychosocial risk factors. For workplaces with up to 50 people.
• Guide III: a questionnaire for risk factors and organizational environment. For workplaces with more than 50 people.
• Guide IV: a sample psychosocial risk prevention policy. For all companies.
• Guide V: a worker general-information form, for those applying Guides II or III.

Applying the questionnaires has rules: explain the purpose, guarantee confidentiality, ask people to consider the last two months, and never steer answers. Results go into a report with conclusions, recommendations and the details of the person responsible for the assessment, including their professional license number when applicable.

From assessment to action: prevention at three levels

Running a questionnaire isn't the same as complying with NOM-035. The standard calls for real action in specific areas: leadership and conflict management, fair workload distribution, staff participation in decisions, social support, work–family balance, performance recognition, workplace violence prevention, communication and training. This includes, for example, training and raising awareness among managers and supervisors.

When results show risk, the company must build a program that defines the areas or people involved, actions, dates, who is responsible, and a follow-up evaluation. Actions are organized at three levels:

1. 1Organizational level: changes to policy, work organization and the conditions that create the risk. This level has the greatest impact because it addresses the cause.
2. 2Group level: information, awareness and work with teams (conflict management, teamwork, leadership, assertive communication and time management), plus strengthening social support.
3. 3Individual level: when there are signs or symptoms of health effects. This is where clinical or therapeutic interventions come in, which the standard requires to be delivered by a physician, psychologist or psychiatrist.

This third level is key: a wellness workshop is no substitute for psychological care when someone is already experiencing anxiety, insomnia or post-traumatic stress symptoms.

Common mistakes and how to get started

• Thinking “we're too small, it doesn't apply”: with 15 people or fewer you still need a policy, prevention measures, a complaints channel and care after traumatic events.
• Leaving it on paper: a policy no one knows about or a questionnaire with no action plan doesn't reduce risk.
• Breaking confidentiality: if the team fears retaliation, the answers won't reflect reality.
• Forgetting follow-up: the assessment repeats at least every two years, and measures need review.

If you're just starting, this order works well:

1. 1Confirm how many people work at your workplace and which obligations apply to you.
2. 2Write and share your policy, using Guide IV as a starting point.
3. 3Set up a safe, confidential channel for complaints and reports.
4. 4Apply Guide I to detect traumatic events and refer anyone who needs care.
5. 5If you have 16 or more people, apply Guide II or III, write the report and share the results.
6. 6Design an action program across the three levels and follow up on it.

Complying with NOM-035 protects your company during an inspection, but its real value lies elsewhere: teams that trust each other, get to rest, and don't burn out.

If you'd like support with burnout prevention workshops, awareness training for leaders, or psychological care for your team, in English or Spanish, feel free to reach out.