NOM-035-STPS-2018 is not an annual climate survey or a tool to diagnose illnesses. Its purpose is to identify, analyze and prevent psychosocial risk factors, address severe traumatic events and promote a favorable organizational environment. The obligations change according to the number of people at the workplace, so a copied policy or a questionnaire without follow-up do not, by themselves, evidence compliance. In 2026, it is advisable to integrate results, control measures, communications and evidence of implementation into a verifiable cycle.
Obligations according to the size of the workplace
All workplaces must have a prevention policy, adopt measures against workplace violence and have mechanisms to identify people exposed to severe traumatic events and refer them. In workplaces of 16 to 50 workers, psychosocial risk factors are identified and analyzed; with more than 50, the organizational environment is also assessed. The standard establishes methods, frequency and questionnaire options, including proprietary instruments that meet validation requirements. The number is determined per workplace, not necessarily for the entire company. The segmentation must be documented because it defines which sections and evidence the labor authority will review.
From results to the control program
Results must be translated into actions when they indicate levels that require it. The causes may relate to workloads, lack of control, working hours, work-family interference, leadership, negative relationships or violence. An effective measure may involve redesigning tasks, clarifying responsibilities, adjusting communication, training managers or activating confidential complaint mechanisms. Giving a general talk is not enough if the finding is structural. The program must assign owners, dates and follow-up criteria. When there are signs or symptoms and the standard requires it, referral to clinical evaluation by competent professionals or institutions is appropriate, avoiding that human resources make diagnoses or access medical information indiscriminately.
Privacy and the compliance file
The file may contain the policy, dissemination, the workplace population, methodology, questionnaires or protected databases, aggregate results, analysis, the action program, training records and follow-up evidence. Individual responses and health data require confidentiality and limited access; management reports must favor trends and not expose individuals. It is also advisable to link the findings with absenteeism, turnover, accidents and complaints, without turning correlations into diagnoses. A subsequent review makes it possible to know whether the measures changed the risk. This article is informational and does not replace the technical assessment of the workplace or clinical intervention when necessary.
Key points
- NOM-035 applies to all workplaces, with obligations differentiated by size.
- From 16 people, factors are identified and analyzed; with more than 50, the environment is also assessed.
- The questionnaire is a means of organizational diagnosis, not full compliance.
- The results must produce controls, owners, follow-up and data protection.
What to review
- Confirm the number of people per workplace and the applicable section of the standard.
- Review that results and risk levels are linked to concrete measures.
- Restrict access to individual responses and keep aggregate reports and follow-up evidence.