If you own benefits or people programs, two standards from the health and safety side now shape what “supporting employee mental health” is expected to mean. One is Canadian, one is international, and neither was written for a general reader. Here’s what each one says, what it asks of an employer, and where the law has already caught up.
The idea underneath both
For most of the last century, workplace safety meant physical safety. Guard the machine, label the chemicals, stop the fall. Mental health, where it showed up at all, sat in HR as a wellness benefit.
A team buried in workload needs the workload fixed before it needs a resilience webinar.
Both standards change it. They treat psychological harm as a risk that comes from how work is designed, managed and experienced, and they ask employers to handle it with the same cycle used for any other hazard: identify it, assess it, control it, then check if the controls worked. Put plainly, a team buried in workload needs the workload fixed before it needs a resilience webinar.
CSA Z1003: Canada’s standard
The National Standard of Canada for Psychological Health and Safety in the Workplace launched in January 2013. Its full designation is CAN/CSA-Z1003-13/BNQ 9700-803/2013. The Mental Health Commission of Canada commissioned it, and CSA Group and Quebec’s Bureau de normalisation du Quebec developed it together. The MHCC describes it as the first standard of its kind in the world. It’s voluntary, and you can download it free from the MHCC.
The edition in force is still the 2013 text, reaffirmed in 2022. A second edition finished public review on December 16, 202, and the MHCC has said it expects to publish it in 2026.
As employer, you have to run a documented, systematic psychological health and safety management system
Z1003 asks organizations to run a documented, systematic psychological health and safety management system. It’s best known for 13 workplace factors, adapted from Guarding Minds at Work, a framework built by researchers at Simon Fraser University:
Psychological and social support
Organizational culture
Clear leadership and expectations
Civility and respect
Psychological demands (the fit between a job’s demands and a person’s skills)
Growth and development
Recognition and reward
Involvement and influence
Workload management
Engagement
Balance\psychological protection
Protection of physical safety
This list turns a vague duty into something you can check. Pick any factor and ask what evidence you have, beyond anecdote, about how your organization is doing on it. If the honest answer is “the annual engagement survey”, you are reading the signal months after it mattered.
ISO 45003: the international guide
ISO 45003 was polished in June 2021 under the title Occupational health and safety management: Psychological health and safety at work: Guidelines for managing psychosocial risks. BSI, which led its development, calls it the first international standard on managing psychosocial health and safety at work. It was written by a committee of experts from 40 countries.
Three things to keep in mind about this document:
It’s guidance, not a requirements standard. Nobody can be certified to ISO 45003 on its own. Its job is to show how psychological risk fits inside an occupational health and safety management system built on ISO 45001, the certifiable standard many safety teams already run. If you have a 45001 system, psychosocial risk goes into the same registers, assessments, corrective actions and management reviews. If you don’t, the guidance still works as a reference.
It sorts psychosocial hazards into three groups. The first is how work is organized: role clarity, workload, say over decisions, hours, job security, how change is handled. The second is social factors: relationships, leadership, recognition, harassment, the balance between work and home. The third is the work environment, equipment and hazardous tasks.
It’s under review. ISO opened its periodic review of the 2021 edition in April 2026, the routine checkpoint that decides whether a standard is confirmed, revised or withdrawn. Nothing changes for users until that review concludes.
Where your EAP fits
An EAP, a wellness app, a yoga subscription and a block of therapy sessions all help someone who is already struggling. None of them tells you which team’s workload or culture has become unsustainable, and none of them changes it. Safety practitioners describe this with the hierarchy of controls: changing how the work is designed comes first, and support for individuals comes last.
Counselling and EAP services respond to harm that has already occurred, instead of preventing it, and they don’t meet an employer’s duty to eliminate or minimize psychosocial risk
Both standards point the same way. ISO 45003 tells organizations to understand the underlying sources of harm before choosing controls, and Z1003 is organized around workplace factors rather than personal coping. Support programs belong in the system, they just sit at the end of it.
Australia’s national regulator puts it in writing. Safe Work Australia’s guidance says counselling and EAP services respond to harm “that has already occurred, instead of preventing it,” and that they don’t meet an employer’s duty to eliminate or minimize psychosocial risk. That's the logic and auditor, inspector or adjudicator applies anywhere. “We offer an EAP” answers a question about support. It doesn’t show that you identified the risk or controlled it.
There is a measurement trap here too. BSI’s own guidance on ISO 45003 lists EAP usage and sick leave among the common lagging indicators. Both tell you harm has already happened. A system built on prevention needs at least one signal that moves before they do.
Voluntary today, required in more places every year
In Canada, Z1003is voluntary, and ISO 45003 is guidance everywhere. The law is moving faster than either.
Quebec is the clearest Canadian example. Amendments to its occupational health and safety law, passed in 2021, made psychosocial risk an explicit employer duty on October 6, 2025. Quebec employers now have to identify and assess psychosocial risks and act to eliminate or reduce them, and their prevention programs or action plans must cover those risks. For most establishments that existed on October 1, 2025, that program or plan was due by October 2026.
Elsewhere in Canada, psychological hazards sit under general occupational health and safety duties alongside specific harassment and violence rules. In Ontario, labour groups including the Ontario Federation of Labour argue that the Occupational Health and Safety Act’s general duty to take every reasonable precaution already covers psychosocial hazards.
Australia has gone furthest. Amended model regulations make managing psychosocial risk an explicit duty, adopted across nearly every state and territory by 2024, and Victoria’s Psychological Health Regulations took effect on December 1, 2025. Australian courts can treat an approved code of practice as evidence of what an employer could reasonably have done.
What you should be able to show
You don’t need to wait for your province to legislate. The useful test is whether you could hand someone evidence on four points:
Which psychosocial hazard you’ve identified, by team or site, and how you found them.
How you assessed them, and how often you look again.
What you changed in the work itself, separate from the support you offer.
Whether those changes worked, measured by something that moves before sick leave and EAP claims.
If your evidence for the third point is a benefit booklet, that’s the gap.
_______________________________________________________________________________________________________________
PRA-Pulse™ gives HR teams a leading indicator for the first and fourth points. Employees answer a short pulse every two weeks, and PRA-Pulse tracks how anxiety, burnout and workplace conflict trend overtime, team by team, so rising strain shows up before it turns into leave ot a clam. PRA-Pulse doesn’t diagnose anyone or replace a hazard assessment. It shows you where to look first. [See how it works]