EU Directive 89/391/EEC: the OSH Framework Directive explained

Structure of the directive: section and article map

The directive is organised in four sections containing 19 articles. Unlike ISO standards following PDCA, it follows a legal structure: scope, employer obligations, worker obligations, and miscellaneous provisions. Its content maps naturally to PDCA for implementation.

Section	Articles	Focus	PDCA equivalent
I — General provisions	1–4	Object, scope, definitions	Context / Plan
II — Employers' obligations	5–12	Risk assessment, prevention, information, training, consultation	Plan / Do
III — Workers' obligations	13	Worker duties and self-protection rights	Do
IV — Miscellaneous provisions	14–19	Health surveillance, risk groups, reporting	Check / Act

The directive functions as a coherent legal system. Section II creates a cascade: the general duty (Art. 5) is operationalised through prevention principles (Art. 6), delivered through protective services (Art. 7), information (Art. 10), consultation (Art. 11), and training (Art. 12).

Practical guide: article by article

This guide translates the directive's legal language into operational requirements, with evidence expectations and compliance failures identified by labour inspectorates across EU Member States.

Article 5 — General employer duty

The employer has a comprehensive, non-delegable duty to ensure safety and health in every aspect related to work. External services do not discharge responsibility.

Key requirement	Evidence expected	Common compliance gap
Duty to ensure safety and health in every aspect of work	Documented OSH policy signed by top management; evidence of resource allocation (budget, personnel, time)	Treating OSH as delegated entirely to a single safety officer without management accountability
Non-delegable responsibility even when using external services	Contracts with competent services specifying advisory role; management review records	Assuming external consultants absorb the legal duty
Workers' obligations do not affect employer's responsibility	Evidence that worker non-compliance triggers corrective action, not blame-shifting	Using worker behaviour as defence for systemic organisational failures

Article 6 — General obligations (prevention principles)

The directive's operational core: employers must take measures for safety including prevention, information, training, and organisation. It establishes the nine principles and mandates risk assessment and coherent planning.

Key requirement	Evidence expected	Common compliance gap
Apply general principles of prevention (Art. 6.2)	Risk assessments demonstrating hierarchy followed; documented justification when higher controls not practicable	Jumping to PPE without documenting why elimination or engineering controls were ruled out
Evaluate risks that cannot be avoided	Written risk assessments for all activities, updated after incidents or changes	Static risk assessments not reviewed since initial creation
Integrate prevention into all activities	OSH considerations in procurement, design, project planning, operational procedures	OSH treated as parallel silo disconnected from operational decisions
Adapt work to the individual	Ergonomic assessments; task rotation; adjustments for vulnerable workers	One-size-fits-all procedures ignoring worker capabilities
Give collective measures priority over individual	Engineering controls before PPE; LEV before RPE; guarding before safe systems	Defaulting to PPE as primary control measure
Give appropriate instructions to workers	SOPs, toolbox talks, site-specific briefings; comprehension checks	Generic safety instructions not tailored to specific hazards

Article 7 — Protective and preventive services

The employer must designate competent persons for prevention activities. Where internal capacity is insufficient, external competent services must be enlisted.

Key requirement	Evidence expected	Common compliance gap
Designate competent persons for prevention	Appointment letters; competence records; defined scope	No formal appointment or unclear scope of authority
Provide necessary capabilities, means, and time	Training records; allocated budget; time in job descriptions	Safety role as add-on without dedicated time
Enlist external services where internal capacity insufficient	Contracts with verified competent providers; clear deliverables	Using external services without verifying competence

Article 8 — First aid, fire-fighting, evacuation

Employers must take measures for emergencies, designate trained workers, and liaise with external services, adapted to establishment size and hazards.

Key requirement	Evidence expected	Common compliance gap
Designate trained workers for first aid, fire-fighting, evacuation	Appointment records; valid certificates; sufficient numbers for shift coverage	Insufficient trained personnel on night shifts or remote sites
Adapt measures to size and specific hazards	Emergency plans referencing specific risks; scenario drills	Generic emergency plans not tailored to site risks
Liaise with external emergency services	Evidence of contact with fire, ambulance, poison centre	No documented communication with emergency services

Article 9 — Documentation obligations

Employers must possess risk assessments, determine protective measures, keep accident lists (>3 days incapacity), and prepare reports for authorities.

Key requirement	Evidence expected	Common compliance gap
Possess assessment of risks	Written risk assessments covering all activities, accessible to inspectors	Risk assessments not documented or not accessible
Determine protective measures and equipment	Link between risks and documented controls; PPE selection based on assessment	Disconnect between assessment findings and measures implemented
Keep list of occupational accidents (>3 days)	Accident register with dates, descriptions, lost time, corrective actions	Incomplete recording, especially for temporary workers
Prepare reports for competent authorities	Copies of national reports (RIDDOR equivalent); evidence of timely submission	Late reporting or failure to report qualifying events

Article 10 — Worker information

Each worker must receive adequate information on risks and protective measures, both general and specific to their workstation. External workers included.

Key requirement	Evidence expected	Common compliance gap
Inform workers of general and specific risks	Induction records; site-specific risk communication; multilingual materials	Information only at induction, never updated; not in workers' languages
Inform on protective measures	Documented SOP distribution; toolbox talk registers; digital acknowledgements	Information exists but no evidence workers received it
Inform workers from external undertakings	Contractor management procedures; pre-task briefings	Contractors excluded from safety communication systems

Article 11 — Consultation and participation

Employers must consult workers on all OSH questions and allow balanced participation. Representatives cannot be disadvantaged.

Key requirement	Evidence expected	Common compliance gap
Consult workers on all OSH questions	Safety committee minutes; evidence worker input influenced decisions	Committees meet but no evidence of influencing outcomes
Balanced participation	Worker representatives in risk assessments, investigations, training planning	Consultation as one-way briefing, not two-way dialogue
Representatives cannot be disadvantaged	No reduced hours, blocked promotion, or disciplinary action linked to role	Informal penalties for representatives who raise concerns

Article 12 — Training

Adequate training at recruitment, on change, on new equipment, repeated periodically, adapted to risks, at no cost to workers, during working hours.

Key requirement	Evidence expected	Common compliance gap
Training at recruitment and change of function	Induction records; role-specific training before unsupervised work	Workers starting tasks before completing safety training
Training on new equipment or technology	Records linked to equipment introductions; competence assessments	New equipment installed without operator safety training
Training repeated periodically, adapted to new risks	Refresher schedules; training needs analysis after changes	Static programmes not evolved with workplace changes
Training at no cost, during working hours	Training scheduled within paid hours	Training on workers' personal time

Article 13 — Workers' obligations

Workers must take care of own and others' safety, use equipment correctly, and report dangers. These obligations do not reduce employer responsibility.

Key requirement	Evidence expected	Common compliance gap
Workers must take care of own and others' safety	Behavioural observations; safety culture surveys; disciplinary framework	No system to identify unsafe behaviour before incidents
Correct use of machinery, equipment, PPE	Competence records; PPE fit-testing; tool inspections	Workers self-selecting PPE without training verification
Report imminent dangers and shortcomings	Near-miss reporting system; evidence reports acted upon; non-punitive culture	Low reporting rates indicating fear of reprisal

Article 14 — Health surveillance

Workers must receive health surveillance appropriate to workplace risks, with results used to improve prevention.

Key requirement	Evidence expected	Common compliance gap
Health surveillance appropriate to risks	Risk-based programme (audiometry for noise, spirometry for dust)	Generic checks not linked to workplace exposures
Results used to improve prevention	Findings feed back into risk assessments and controls	Data collected but not analysed for trends

General principles of prevention

Article 6(2) establishes nine principles in priority order. This hierarchy is the legal backbone of risk management and must be applied in sequence, not selectively.

Priority	Principle	Practical meaning	Example
1	Avoiding risks	Eliminate the hazard entirely	Remove toxic substance; automate dangerous task
2	Evaluating unavoidable risks	Conduct formal risk assessment	Assess noise levels, ergonomic strain, chemical exposure
3	Combating risks at source	Control where hazard originates	Install LEV at emission point, not at worker
4	Adapting work to the individual	Design for human variability	Adjustable workstations; task rotation; account for experience
5	Adapting to technical progress	Adopt safer technologies available	Replace solvent-based with water-based processes
6	Replacing dangerous with less dangerous	Substitution	Replace carcinogen with less hazardous alternative
7	Coherent overall prevention policy	Integrated approach	OSH management system integrated into operations
8	Collective over individual measures	Collective controls before PPE	Guardrails before harnesses; ventilation before respirators
9	Appropriate instructions to workers	Effective communication	Task-specific SOPs; multilingual safety briefings

When a higher-order principle is not applied, the assessment must explain why. This documented justification is what inspectorates examine.

Documentation and record-keeping requirements

The directive requires specific documented information. National transpositions typically expand these. Digital EHSQ platforms enable structured, accessible documentation.

Document	Article	Mandatory/Recommended	Description
Risk assessment	Art. 9(1)(a)	Mandatory	Assessment of risks covering all activities and workstations
Protective measures	Art. 9(1)(a)	Mandatory	Record of protective measures based on risk assessment
Accident list (>3 days)	Art. 9(1)(c)	Mandatory	Register of occupational accidents with incapacity >3 days
Reports to authority	Art. 9(1)(d)	Mandatory	Reports on accidents as required by national law
OSH policy	Art. 6(3)(a)	Mandatory (implied)	Coherent prevention policy covering technology, organisation, conditions
Emergency procedures	Art. 8(1)	Mandatory	Documented first aid, fire-fighting, evacuation measures
Training records	Art. 12	Mandatory (implied)	Evidence training obligations met at all trigger points
Consultation records	Art. 11	Mandatory (implied)	Evidence of consultation with workers on OSH matters
Health surveillance	Art. 14	Mandatory	Individual and aggregate surveillance data
Information records	Art. 10	Recommended	Records that risk information was communicated effectively

National laws expand these: UK requires written policy for 5+ employees; France requires DUERP; Germany requires Gefährdungsbeurteilung regardless of size.

Implementation and transposition

Unlike voluntary ISO standards, the Framework Directive is mandatory legislation transposed into national law. Implementation means integrating obligations into daily operations.

Phase	Duration	Key activities	Resources	Milestone
1. Gap analysis	2–4 weeks	Compare current OSH vs directive article by article; identify national requirements	Competent person; national legislation access	Gap report with prioritised actions
2. Policy and governance	2–3 weeks	Draft/update OSH policy; define responsibilities; allocate budget	Senior management; legal review	Signed policy; defined accountabilities
3. Risk assessment programme	4–12 weeks	Conduct assessments for all activities; document prevention hierarchy; link controls	Trained assessors; worker input; measurement	Complete risk assessments with linked controls
4. Operational controls	8–16 weeks	Implement preventive measures; install engineering controls; develop procedures; source PPE	Capital budget; technical expertise	Controls operational and verified
5. People and culture	4–8 weeks	Train workers (Art. 12); consultation mechanisms (Art. 11); information systems (Art. 10); designate competent persons	Training resources; communication tools	All trained; committees active; persons appointed
6. Emergency preparedness	2–4 weeks	Emergency plans (Art. 8); train personnel; liaise with services; conduct drills	Equipment; liaison with fire/ambulance	Tested plan; trained first aiders
7. Monitoring and review	Ongoing	Health surveillance (Art. 14); accident recording (Art. 9); audits; management review	OH services; audit competence	Annual review; updated assessments

Factors that accelerate implementation

Existing ISO 45001 or OHSAS 18001 system (most requirements already met)
Strong senior management commitment and visible leadership
Digital EHSQ platform enabling structured documentation and automation
Mature worker consultation culture with active representatives
Competent internal OSH professionals with sectoral experience
Prior experience with regulatory audits by national inspectorates

Factors that delay implementation

Multiple sites across Member States with varying transposition requirements
High workforce turnover requiring continuous training cycles
Complex contractor arrangements with unclear duty boundaries
Paper-based systems making documentation retrieval impractical
Cultural resistance to worker participation and consultation
Lack of dedicated OSH budget competing against production priorities

Most common compliance gaps

Labour inspectorates consistently identify recurring patterns. This table synthesises findings from national enforcement bodies and EU-OSHA ESENER survey results.

Article	Common non-compliance	Root cause	Resolution
Art. 6 — Hierarchy	PPE as first-line control; hierarchy not documented	Misunderstanding of hierarchy; lack of engineering competence	Require documented justification for each control level in risk assessments
Art. 6 — Risk assessment	Assessments outdated, generic, or missing psychosocial risks	No review triggers; insufficient competence; psychosocial not in scope	Establish triggers (incidents, changes, periodic); expand to all hazard types
Art. 7 — Competent persons	Designated persons lack time, authority, or competence	Safety added as secondary duty; no CPD; insufficient support	Formalise time; define authority; require annual CPD
Art. 10 — Information	Not in workers' languages; given at induction only	Migrant workforce not considered; no ongoing system	Translate safety-critical info; implement digital communication
Art. 11 — Consultation	Committees exist but do not influence decisions	Box-ticking; no agenda-setting power; no feedback loop	Give committees defined powers; publish outcomes
Art. 12 — Training	Not repeated after changes; no competence verification	Cost pressure; no training needs analysis; no tracking	Training matrix with automated refreshers; competence assessment
Art. 9 — Documentation	Accident register incomplete; near-misses not recorded	Under-reporting culture; paper-based; no feedback loop	Digital incident management; near-miss encouraged; auto risk-assessment trigger
Art. 14 — Surveillance	Not matched to exposures; results not used for prevention	Generic programme; OH disconnected from OSH management	Risk-based protocol; trend reporting; action triggers

The transversal pattern: organisations create systems for documentation without embedding them into operational decision-making. When inspectorates find repeated non-compliance, they look for CAPA evidence.

Comparison with related standards and legislation

Framework Directive vs. ISO 45001:2018

Aspect	EU Directive 89/391/EEC	ISO 45001:2018	Practical implication
Nature	Mandatory EU legislation	Voluntary international standard	Directive is legal minimum; ISO 45001 goes beyond
Scope	All EU/EEA employers and workers	Any organisation worldwide	Directive applies by law; ISO by choice
Certification	Not certifiable; enforced by inspectorates	Certifiable by third-party bodies	Directive compliance is legal duty; ISO is competitive differentiator
Structure	4 sections, 19 articles (legal)	10 clauses, HLS/Annex SL	ISO provides management structure; directive provides legal requirements
Risk approach	General principles with defined hierarchy	Actions to address risks and opportunities	Directive hierarchy is prescriptive; ISO more flexible
Worker participation	Art. 11: balanced participation required	Clause 5.4: consultation at all levels	Both require it; directive gives legal force
Continual improvement	Implied (adapt to technical progress)	Clause 10.3: explicit requirement	ISO makes improvement formal; directive implies it

Organisations implementing ISO 45001 meet and exceed directive requirements. The reverse is not always true. The directive provides the legal floor; ISO 45001 the management architecture.

Integration with daughter directives

Legislation	Focus	Link to Framework Directive	Operational synergy
Directive 89/654/EEC	Workplace requirements	Individual directive under Art. 16(1)	Workspace risk assessments integrate workplace conditions
Directive 89/655/EEC	Work equipment	Individual directive under Art. 16(1)	Equipment assessments extend Art. 6 and Art. 12
Directive 89/656/EEC	PPE	Individual directive under Art. 16(1)	PPE selection as last resort per prevention hierarchy
Directive 90/269/EEC	Manual handling	Individual directive under Art. 16(1)	Ergonomic assessments per Art. 6 principle 4
Directive 98/24/EC	Chemical agents	Individual directive under Art. 16(1)	Substitution (Art. 6.2 principle 6); health surveillance
Directive 2003/10/EC	Noise	Individual directive under Art. 16(1)	Collective controls priority; audiometry (Art. 14)
ISO 45001:2018	OHS management system	Not a daughter directive; satisfies and exceeds requirements	Provides management structure for directive obligations
REACH (EC 1907/2006)	Chemical registration/restriction	Complements Art. 6 substitution and risk evaluation	REACH data informs workplace chemical risk assessments

A digital EHSQ platform manages all interlinked obligations from a single system, ensuring chemical assessments link to substitution analysis, health surveillance, and worker information.

Industry examples

The directive applies identically across sectors, but practical compliance challenges vary significantly. The table maps how core obligations manifest across priority industries.

Sector	Priority hazards	Implementation challenges	Differentiated controls
Mining	Ground collapse; explosion; dust; heat stress; vibration	Remote locations; extreme conditions; complex geology; long shifts	Geological risk integration; blast exclusion systems; dust monitoring; fatigue management
Chemicals and Oil & Gas	Process safety (ATEX); toxic exposure; fire/explosion; confined space	Complex interactions; COMAH/Seveso sites; legacy infrastructure; simultaneous permits	Layer of protection analysis; safety-critical elements; integrated permit-to-work
Manufacturing	Machinery contact; MSD; noise; chemical exposure; workplace transport	Production pressure vs. safety; repetitive tasks; mixed automation; shift fatigue	Machine guarding per 89/655; ergonomic redesign; noise reduction at source
Healthcare	Biological agents; sharps; patient handling; violence; psychosocial risks	24/7 operations; care vs. worker safety tension; emotional demands; lone working	Sharps protocols per 2010/32/EU; safe handling equipment; violence prevention
Logistics and transport	Vehicle movements; manual handling; loading/unloading; fatigue; slips	Time pressure; diverse workforce including agency; geographically dispersed	Traffic management; fatigue monitoring; loading bay safety; agency induction
Energy and utilities	Electrical hazards; confined spaces; working at height; ATEX zones; isolation failures	Critical infrastructure constraints; live systems; permit complexity; multi-contractor	Isolation/LOTO procedures; permit-to-work systems; safety-critical task analysis

The role of technology in Framework Directive compliance

Digital EHSQ platforms transform compliance, replacing fragmented paper systems with integrated, real-time management of risk assessments, controls, training, consultation, and documentation.

Directive area	Requirement	Technology solution	Benefit
Art. 6 — Risk assessment	Evaluate all risks; update after changes	Digital risk assessment with automated review triggers and version control	Assessments always current; complete audit trail; alerts when overdue
Art. 9 — Documentation	Maintain assessments, accident register, reports	Centralised document management with structured fields and workflows	Instant retrieval for inspectors; no lost records; automated reporting
Art. 10 — Information	Adequate information for all workers including contractors	Mobile-first communication with multilingual content and read-receipts	Verified delivery; accessible in workers' language; real-time updates
Art. 11 — Consultation	Consult workers; balanced participation	Digital suggestion systems; consultation workflow with tracking	Evidence of consultation; higher participation; transparent outcomes
Art. 12 — Training	Training at recruitment, change, new equipment; periodic	Training management with competence matrix and automated scheduling	No expired training; triggers on role change; compliance evidence
Art. 14 — Surveillance	Surveillance appropriate to risks; results improve prevention	OH integration with trend analysis and automatic risk assessment triggers	Early trend detection; data-driven prevention; individual and aggregate

An integrated platform connects these elements into a coherent system mirroring the directive's architecture: risk finding triggers control, generates training requirement, communicated to worker.