Workplace well-being regulations in France: DUERP, QVCT and psychosocial risks

French labour law does not treat workplace well-being as a perk or a culture initiative. It imposes a reinforced duty of care: employers must protect workers' physical and mental health, assess every occupational risk, put prevention measures in place and keep documented proof. Failure to do so exposes the business — and the director personally — to criminal liability, civil damages and administrative penalties.

For small and medium-sized businesses, the question is not whether these rules apply. They apply from the very first employee. The question is what they require in practice, and how to meet those requirements without turning compliance into a full-time project.

Direct answer: under Articles L4121-1 and L4121-2 of the French Labour Code (Code du travail), every employer must avoid occupational risks, assess those that cannot be eliminated, train their teams and implement proportionate protective measures. The DUERP (document unique d'évaluation des risques professionnels — single occupational risk assessment document) is compulsory from the first employee, must be kept for 40 years and updated at least once a year in companies with 11 or more employees. Preventing psychosocial risks (risques psychosociaux, or RPS) is an integral part of that obligation, as is the QVCT (qualité de vie et des conditions de travail) approach.

Article L4121-1 of the Labour Code sets out three categories of measures every employer must implement:

1. Actions to prevent occupational risks, including those referred to in Article L4161-1;
2. Information and training actions;
3. The establishment of an appropriate organisation and adequate resources.

The law also requires employers to adapt those measures over time as circumstances change and to work towards continuous improvement. The obligation is not a one-off box-ticking exercise: it is continuous and evolving.

Article L4121-2 sets out the nine general principles of prevention on which this obligation rests:

The standard applied to employers is described as a reinforced duty of means (obligation de moyens renforcée): they must demonstrate that all necessary steps were taken, not merely assert good intentions.

Our read: the companies that come through a labour inspection or employment tribunal claim without serious damage are almost always those that kept contemporaneous records. Having acted is not enough — you need to be able to prove it with dated documents.

Yes, with no size threshold and no sector exemption. The DUERP is compulsory from the first employee under Article R4121-1 of the Labour Code. It must list all occupational risks to which workers are exposed and provide collective traceability of those exposures.

The essential rules are as follows:

In companies with 50 or more employees, the works council (CSE — comité social et économique) must be consulted on the DUERP and its updates.

For companies with fewer than 50 employees, the planned prevention actions are recorded directly in the DUERP. Above 50 employees, those actions take the form of an annual occupational risk prevention and working conditions improvement plan (PAPRIPACT — programme annuel de prévention des risques professionnels et d'amélioration des conditions de travail), submitted to the CSE for an opinion.

The underestimated risk: many directors believe they have a DUERP because one was drawn up when the business was set up. A document that has not been updated for several years, or one that no longer reflects actual working conditions, offers no legal protection in a dispute. The DUERP must evolve with the business.

QVCT (qualité de vie et des conditions de travail — quality of working life and working conditions) is the current reference framework for organisational well-being at work. It replaced the older QVT (qualité de vie au travail) label following the national inter-professional agreement (ANI) of 9 December 2020, which explicitly integrated working conditions and risk prevention into the broader well-being approach.

QVCT does not create a single uniform obligation identical for all businesses. Its implementation is driven by social dialogue and collective bargaining. That said, QVT and QVCT topics form part of the mandatory bargaining agenda under the Labour Code for companies that have trade union delegates.

In practice, the QVCT approach covers four dimensions:

1. Work organisation and content (autonomy, workload, purpose, role clarity)
2. Working conditions (ergonomics, working hours, physical environment)
3. Workplace relationships (management quality, cooperation, recognition)
4. Health and safety (risk prevention, medical monitoring, psychosocial risks)

A pattern we see regularly in client files: QVCT is often presented as a "compassionate" initiative with no link to compliance. That framing is a mistake. A credible QVCT policy starts with the DUERP, field-level feedback and social KPIs — not with yoga sessions or a games room.

Psychosocial risks (RPS) — chronic stress, burnout, workplace harassment, internal violence, isolation — are occupational risks in every legal sense. They fall squarely within the scope of Article L4121-1 and must appear in the DUERP alongside physical risks.

The employer's obligations include:

• Assessing RPS as part of the overall risk evaluation process (DUERP)
• Implementing preventive measures that address the root cause of the risk
• Planning prevention to cover social relations, working conditions and work organisation
• Training line managers to identify early warning signs
• Maintaining an accessible, confidential reporting channel
• Taking disciplinary action when harassment is established

Two national inter-professional agreements provide additional structure:

• The stress at work agreement (2008, extended 2009): requires identifying stress indicators and implementing preventive action plans in consultation with staff representatives.
• The harassment and violence at work agreement (2010): mandates a clear anti-harassment policy, complaint procedures, confidentiality and respect for those involved.

Steps to build RPS compliance in practice:

1. List the risk factors present in your business (workload, management style, autonomy, interpersonal relations, meaning at work, job insecurity)
2. Enter those factors in the DUERP with a risk severity rating
3. Define priority actions (manager training, reporting procedure, reorganisation where necessary)
4. Present the plan to the CSE, if you have one
5. Review at 6 and 12 months and update the DUERP accordingly
6. Keep records at every stage: meeting minutes, training records, alerts handled

The service de prévention et de santé au travail (SPST) — formerly the occupational medicine service (service de médecine du travail) — is a statutory interlocutor for employers, not only a provider of employee medical check-ups.

Its remit covers:

• Advising the employer on occupational risk prevention
• Contributing expertise to the preparation and updating of the DUERP
• Conducting individual health monitoring for each employee (pre-employment, periodic, return-to-work and on-request appointments)
• Alerting the employer to risks identified within the business

Employers are legally required to register with an approved SPST. The updated DUERP must be transmitted to the SPST at each revision. For roles with specific risks — night work, high-risk positions, workers with disabilities — the monitoring regime is intensified and the intervals between medical appointments are shortened.

Every employer is subject to the same prevention principles. What varies is the degree of formality required and certain triggering thresholds.

A practical trade-off for small businesses: a simple DUERP updated every year is worth more than a comprehensive document written once and never touched again. For a business with fewer than 10 employees, a few clear pages covering all genuine risks — falls, posture, mental load, digital tools, working relationships — is a proportionate and defensible approach, provided all real risks are addressed.

In the SME files we support on social compliance, four recurring sticking points stand out.

The first is the absence of any DUERP update following an organisational change or the introduction of new tools. The document reflects a past reality that no longer matches the actual work being done.

The second is a confusion between internal communications about well-being — team-building events, management messaging — and genuine prevention. One does not substitute for the other.

The third is an under-assessment of RPS in the DUERP. Physical risks are identified properly, but stress factors, role conflicts and cognitive load go undocumented.

The fourth is the absence of any trace of actions taken: training not recorded, alerts handled informally, meetings with no written record. In a dispute, that evidentiary gap is very difficult to fill retrospectively.

1. Verify that your DUERP exists and is current (date, content, signature)
2. Identify risks not yet documented: RPS, digital tools, organisational pressures
3. Define for each risk a concrete preventive measure and a named person responsible
4. For companies with 11 or more employees: schedule the annual review in your HR calendar
5. Transmit the revised DUERP to your SPST
6. If you have 50 or more employees: prepare the PAPRIPACT and submit to the CSE before year-end
7. Retain all successive versions for a minimum of 40 years
8. Train your managers to detect early warning signs of overload and RPS
9. Put in place a reporting channel — even a simple one — that is accessible and confidential

See also our approach to payroll and social compliance management for businesses

The law of 2 August 2021 (Loi n° 2021-1018) to strengthen occupational health prevention introduced several changes that are still working through in 2026:

• The DUERP must now aim to "guarantee the collective traceability of exposures" (Article L4121-3-1), which goes beyond simply listing hazards.
• The 40-year retention obligation has been in force since 31 March 2022.
• The digital portal deposit obligation is phased by company size — the rollout calendar depends on implementing decrees; check with your SPST for your specific situation.
• The prevention passport (passeport de prévention), which tracks health and safety training for each worker, was opened to employers in March 2026.

These procedural developments do not alter the substance of the obligation. They do change how evidence is stored and how compliance is demonstrated. A business still managing its prevention documents entirely on paper should plan a transition.

Outsourcing payroll and social compliance management can also free up time for these compliance matters, which often fall to the bottom of the to-do list.

Updated 2026-05-26. This article is for information purposes and does not replace personalised professional advice. For your specific situation, consult a chartered accountant (expert-comptable) registered with the Ordre des experts-comptables.