Ask most employers what they do about workplace mental health and you'll get a list of support: an EAP, some therapy sessions, maybe a wellness app or a mindfulness subscription. Reasonable answers, and real spending. But they answer a different question than the one regulators and standards are starting to ask.
The standards that now define the field, ISO 45003 internationally and CSA Z1003 in Canada, are explicit on this point. Support programs alone do not discharge the duty to manage psychosocial risks at their source. Offering help is not the same as managing risk, and the gap between the two is where a lot of otherwise well-meaning employers are exposed.
Two different jobs
Managing a hazard and supporting the harmed are very separate functions. Physical safety makes the distinction obvious. A first-aid kit is support. It does nothing to identify why people keep getting injured, assess how likely the next injury is, or fix the condition causing it. No safety inspector would accept a well-stocked first-aid kit as evidence that you'd managed a hazard. The kit is what you offer after the harm; risk management is what you do to prevent it.
Psychological safety works the same way, but the equivalent of the first-aid kit gets treated as the whole program. An EAP is support offered after strain has taken place and the employee has recognized it, named it, and reached out. These are the psychological first-aid kits. They matter, and people who reach them benefit. But they sit entirely downstream of the hazard, and they activate only for the small share of people who self-identify and ask.
Risk management is the upstream job: identifying that psychological strain is rising in a part of the organization, assessing how serious it is, and acting before it becomes harm. That job is what the standards require, and it's the job a support program structurally does not do.
Why the distinction is becoming expensive
Regulators are increasingly holding employers responsible for psychosocial hazards, and the obligation is moving from voluntary guidance toward enforceable regulation. In British Columbia, WorkSafeBC has put forward proposed occupational health and safety provisions that would establish enforceable duties to identify, assess, and control psychosocial hazards. In Quebec, most employers faced an October 2026 deadline to have a prevention program or action plan in place. The pattern repeating across jurisdictions is a duty framed around identify, assess, control, the language of risk management, not the language of support.
When that duty is tested, the question won't be whether you offered help. It will be whether you identified and assessed the hazard. An employer that answers "we have an EAP" is answering a question about support while being asked a question about risk. On paper the spending looks responsible. Against the actual duty, it may show that nothing was done to detect and manage the risk at all.
The uncomfortable audit
Here's a test worth running on your own program. For each part of what you offer, ask a single question: does it help someone who has already recognized they're struggling and reached out, or does it find people who are escalating before they'd ever describe themselves as a case?
An EAP: helps those who reach out. A therapy benefit: helps those who reach out. A wellness app: helps those who choose to open it. A mindfulness subscription: same. Run down the list and, for most employers, everything falls in the first column. Every dollar is aimed at the people already looking for help, and nothing is aimed at finding the people who aren't.
That's not an argument against any of those programs. They do real work for the people who use them, and they belong in the mix. It's an argument that a program built entirely from the first column has a hole in it exactly where the duty lives. The standards ask you to manage risk at the source. A stack of support tools, however good, manages nothing at the source. It waits for people to raise their hand and acknowledge they need help..
Closing the gap
Discharging the duty means adding the part that's missing: a way to identify and assess rising psychological strain across the workforce, continuously, without depending on the employee to raise their hand first. Detection, in other words, sitting upstream of all the support you already offer.
With that layer in place, the support programs finally do their best work, because people are routed to them earlier, before strain has hardened into a leave or a claim. Without it, the support is there but the risk goes unmanaged, and the difference between those two states is precisely the difference the standards are written to enforce.
You can keep every support program you have. The question the duty puts to you is what sits in front of them.
______________
PRA-Pulse is the detection layer that sits upstream of your support programs, identifying and assessing rising psychological risk so you can act at the source. PRA Pulse™ Workplace Risk Detection