DUERP 2026: France's mandatory workplace risk assessment

Quick answer. The single occupational risk assessment document (DUERP) is mandatory for every employer from the first employee (articles L4121-3 and R4121-1 of the Labour Code). It must be updated at least once a year in companies with at least eleven employees, and on every notable change. Each version must be kept for at least forty years. The digital filing on a national online portal, provided for by the law of 2 August 2021, is still not operational in 2026: only internal retention applies for now.

The DUERP is the cornerstone of workplace prevention. Beyond the formal obligation, it is a risk-management tool that engages the employer's liability in the event of an accident. Here is where things stand in 2026.

The DUERP transcribes, in a single document, the results of the assessment of risks to workers' health and safety (article R4121-1). The assessment covers each work unit: post, workshop, trade, situation.

The obligation applies to every employer, from the hiring of the first employee (article L4121-3). It is part of a safety obligation of result: the employer must not only assess but prevent. A missing DUERP, or a purely formal one, weakens the whole prevention chain and aggravates liability in the event of harm.

The law of 2 August 2021 introduced a distinction by headcount:

In all cases, the DUERP must be updated:

• on any major decision changing health, safety or working conditions;
• when additional information relevant to assessing a risk appears (a new process, a new product, the lessons of an accident).

Since the law of 2 August 2021, each successive version of the DUERP must be kept for at least forty years. The aim is to trace exposures, in particular for deferred risks (chemical, carcinogenic agents). The document, in its successive versions, must be made available to:

• exposed workers and former workers;
• the social and economic committee (CSE);
• the occupational physician and prevention services;
• the labour inspectorate and social security bodies.

The 2021 law provided for digital filing of the DUERP on a national online portal, managed by employer organisations, on a staggered timetable (1 July 2023 for companies with at least 150 employees, 1 July 2024 for the others).

In 2026, that portal is still not deployed. The work ran into major difficulties: hosting documents for forty years, access authentication, protection of trade secrets, funding and maintenance. An IGAS report concluded that the cost-benefit balance was unfavourable, and new consultations were launched. In practice, the online filing obligation does not apply today: the employer must keep the successive versions internally, on paper or digitally. It is wise to anticipate a future portal by structuring dated, time-stamped archiving now.

The DUERP is not enough on its own: it must lead to prevention measures, whose formalisation depends on company size.

The PAPRIPACT sets, for the coming year, the list of measures, their conditions, resources and a timetable. The DUERP and its updates are also presented to the CSE, which contributes to the assessment. Well-documented prevention also affects the cost of accidents and therefore the AT/MP rating.

A missing or un-updated DUERP is punished by the fine for fifth-class offences (1,500 euros, 3,000 euros on repeat). But the real stake lies elsewhere: in the event of a work accident or occupational illness, a missing or inadequate DUERP is a decisive factor in establishing the employer's inexcusable fault, with an increased annuity and additional compensation at stake. Drafting the DUERP thus connects with handling work accidents and unfitness situations.

The assessment is not limited to visible risks (falls, machinery). It must cover all the risk families present in the company:

• physical risks (handling, noise, falls from height or on the level);
• chemical risks and exposure to carcinogenic, mutagenic or reprotoxic agents;
• musculoskeletal disorders, the leading cause of occupational illness;
• psychosocial risks (workload, tensions, harassment);
• organisational risks (atypical hours, lone working).

Six of these factors give rise, above certain thresholds, to entitlements under the occupational prevention account (C2P): the exposed employee accrues points usable for training, a move to part-time work or early retirement. Documenting exposures precisely in the DUERP is therefore also a matter of individual traceability.

The DUERP and its updates are made available to the social and economic committee, which takes part in analysing risks. In companies with at least three hundred employees, a health, safety and working-conditions committee (CSSCT) is set up within the CSE and is delegated the examination of these issues.

The employer also relies on its occupational health and prevention service, which contributes to the assessment, carries out employees' medical monitoring and may propose prevention measures. For very small businesses, the INRS provides sector tools to assist assessment (the OiRA approach), which structure hazard identification without prior expertise.

The legal weight of the DUERP shows above all in the event of harm. When a work accident or occupational illness occurs and the risk had been neither assessed nor prevented, the employer risks a finding of inexcusable fault: the victim then obtains an increased annuity and compensation for additional losses, borne by the employer. Conversely, a serious, up-to-date DUERP followed by an action plan evidences the employer's diligence and is a central piece of its defence. The document is thus not an administrative formality: it is an instrument for controlling risk and protecting the business.

1. Break the company into coherent work units.
2. Identify, for each unit, the hazards and exposure situations.
3. Rate each risk (severity and frequency) to prioritise them.
4. Define an action plan (PAPRIPACT or action list) and schedule it.
5. Date each version, archive it for forty years and present it to the CSE.