What is ISO 45003? A guide for UK employers

The short answer

ISO 45003 is a set of international guidelines for managing psychosocial risk at work. Its full title is ISO 45003:2021, Occupational health and safety management. Psychological health and safety at work. Guidelines for managing psychosocial risks. It was published in June 2021 by ISO/TC 283, the same technical committee that looks after ISO 45001.

The thinking behind it is simple. Workplaces have managed physical hazards for decades: identify the hazard, assess the risk, control it, review whether the control worked. ISO 45003 applies that same discipline to the hazards that harm minds rather than bodies. Unrealistic workloads. Unclear roles. Poor support from managers. Bullying.

ISO describes it as the first global standard giving practical guidance on managing psychological health in the workplace. It is guidance rather than a rulebook. Every recommendation in it says "should", never "shall", which matters a great deal when we get to certification later in this guide.

Why psychological health became a safety issue

The numbers explain why this standard exists. In November 2025 the Health and Safety Executive published its latest figures for Great Britain: 964,000 workers suffered from work-related stress, depression or anxiety in 2024/25, the largest year-on-year rise on record. Those conditions accounted for 22.1 million lost working days, more than any other category of work-related ill health, at an average of 22.9 days per affected worker.

Zoom out and the picture is the same. The World Health Organization estimates that 12 billion working days are lost globally every year to depression and anxiety, costing around US$1 trillion in lost productivity. Deloitte's 2024 research puts the cost of poor mental health to UK employers at £51 billion a year, most of it through presenteeism: people at their desks, producing far less than they could.

There is a hopeful number in there too. The same Deloitte research found employers get back an average of £4.70 for every £1 spent on mental health support, and prevention across the whole organisation pays back better than crisis response. That is exactly where ISO 45003 points.

You already have a legal duty

ISO 45003 is voluntary. Your duty to manage work-related stress is not.

Under section 2 of the Health and Safety at Work etc. Act 1974, UK employers must protect the health, safety and welfare of their employees so far as is reasonably practicable, and the HSE is clear that health includes mental health. The Management of Health and Safety at Work Regulations 1999 go further. Regulation 3 requires a suitable and sufficient risk assessment, and if you employ five or more people you must record the significant findings in writing. Stress is a hazard like any other, so it belongs in that assessment.

The HSE also publishes its own approach, the Management Standards for work-related stress, covering six areas: demands, control, support, relationships, role and change. If you have worked with them, ISO 45003 will feel familiar. The difference is scope. The Management Standards focus on stress. ISO 45003 covers the full range of psychosocial hazards and shows how to manage them inside a health and safety management system, so your existing processes do the heavy lifting.

In practice the two work well together. Many UK organisations use the Management Standards as their assessment method and ISO 45003 as the framework that connects that assessment to leadership and management review.

The three groups of psychosocial hazards

The standard groups psychosocial hazards into three categories, and it is worth knowing them because they make a practical checklist for your own risk assessment.

The first is how work is organised. This covers workload and pace, working hours and shift design, job security, how much control people have over their own work, and whether their role is clear. A support team answering to two managers with conflicting priorities lives with this category every day.

The second is social factors at work. Relationships, leadership behaviour, recognition, fairness in how decisions get made, bullying and harassment, and whether people feel safe speaking up. A high performer who goes quiet after being passed over twice is telling you something about this category.

The third is the work environment, equipment and hazardous tasks. Poor lighting or constant noise, equipment that fights you all day, lone working, and tasks that are distressing in themselves, from handling abusive customers to attending emergencies.

None of these hazards shows up on an incident report the way a ladder fall does. They show up as absence, turnover and quiet disengagement. That is why the standard asks you to go looking for them instead of waiting for the evidence to arrive on its own.

How ISO 45003 relates to ISO 45001

ISO 45001 is the certifiable international standard for occupational health and safety management systems. It defines what a good system must do. ISO 45003 is its companion: it explains how to handle psychological health and safety within that kind of system.

You do not need ISO 45001 to benefit from ISO 45003. The guidance stands on its own, and plenty of organisations use it without any formal management system behind it. If you do hold ISO 45001 certification, ISO 45003 slots straight in: psychosocial hazards join your hazard identification, their controls join your planning, and the results feed your management review through the same plan-do-check-act cycle you already run.

Can you be certified to ISO 45003?

No. There is no accredited certification to ISO 45003, and no such thing as being "ISO 45003 certified" in the way an organisation is certified to ISO 45001. The standard was written as a guidance standard. Everything in it is a "should", so there are no requirements to audit against.

Some certification bodies, including BSI and DNV, offer assessment or verification services that review your approach against the guidance. These can be useful for benchmarking and for showing stakeholders you take the subject seriously. Just be accurate about what they are: an independent opinion, never an accredited certificate.

Treat any supplier claiming it can make you ISO 45003 certified with caution. At Zen+ Health we build our product around the standard and we describe it carefully: evidence that supports your approach to ISO 45003, never a badge.

How to get started

You almost certainly have more of the raw material than you think.

Start with what you already hold. Absence data, turnover by team, exit interview themes, overtime patterns and whatever your existing surveys say. That is your baseline, and it usually points at two or three places to look first.

Then identify hazards properly, using the three categories above as your checklist and talking to the people who do the work. Worker consultation runs right through ISO 45003, and for good reason: the person doing the job can see hazards a spreadsheet never will.

Next, act on the biggest risks with organisational controls. Fix the rota, clarify the role, change how the workload lands. Resilience training and wellbeing tools have their place, and we would say that, but the standard is clear that changing the work comes before helping people cope with it.

Keep measuring after you act. Record what you changed and check whether the signal moved. That written record is also exactly what regulation 3(6) expects from an employer with five or more staff.

That is the whole loop. It is a risk assessment process you already know, applied to hazards you may never have written down before.

Five pitfalls that stall psychosocial risk programmes

The same failure patterns come up again and again, and most are avoidable.

• Treating it as an HR perk. If psychological health sits in the benefits budget next to the cycle scheme, it gets cut like a benefit. It is a safety duty and it belongs in your risk register.
• Surveying without acting. Asking people how work feels and then changing nothing is worse than not asking. Trust falls, and your next survey measures cynicism instead of risk.
• Fixing people instead of work. If a team is drowning, a mindfulness session is not the control. Address the workload, then support the people.
• Measuring once a year. A single annual snapshot misses the restructure in March and the resignation wave in June. Psychosocial risk moves, so measurement needs a rhythm.
• Ignoring confidentiality. The moment people suspect their individual answers reach a manager, honest data disappears. Aggregation and anonymity keep the signal true, which is why we publish exactly how we protect it.