Workplace risk assessment — a legal obligation for every employer

The workplace risk assessment (Akt o proceni rizika) is a written document in which the employer sets out, for every job, the hazards and harmful factors involved, the level of risk of injury and damage to health, and the measures that remove or reduce that risk. Every employer in Serbia must have one — regardless of sector or number of employees. The obligation is laid down in Article 16 of the Law on Safety and Health at Work (Zakon o bezbednosti i zdravlju na radu, Official Gazette of the Republic of Serbia, No. 35/2023).

Who must have a workplace risk assessment

Every employer. The law makes no exception for company size or sector: the obligation covers every job in the working environment. A company with two people in an office has the same obligation as a plant with two hundred — what differs is the amount of work, not whether the obligation exists.

A risk assessment is also needed where it is most often overlooked:

  • for jobs where students do professional placements, practical training or work-based learning in dual education
  • for people who work away from your premises — on the road or at clients’ sites, which still count as a working environment

Working from home and remote work are covered too: the employer must set the conditions and preventive measures for safe work, and may adopt a written risk assessment for this work with the employee’s involvement. The employee must then report whether the conditions for safe work are met and notify any later change.

Who may prepare it

Not just anyone. As a rule, health and safety work may only be done by someone who has passed the professional exam and holds a licence — an OHS adviser (savetnik) or OHS associate (saradnik), depending on the sector. The employer must appoint that person in writing.

The law allows three ways to meet this obligation:

  • A licensed employee. The employer employs an OHS adviser or associate. In higher-risk sectors, a company with 251–500 employees must have at least two full-time advisers, and one with over 500 employees at least three.
  • Engaging a licensed company or sole trader. If the employer has no employee who meets the requirements, it may — as an exception provided for by law — engage an external licensed company. This is how the work is done in most cases.
  • The employer in person. This is only possible in specifically listed sectors — retail; accommodation and food service; information and communication; finance and insurance; real estate; professional, scientific, innovation, administrative and support services; compulsory social security; education; arts, entertainment and recreation; and other service activities — and only up to 20 employees. Even then the employer must pass the professional exam, although no licence is needed.

Hence the most common mistake: a template downloaded from the internet, filled in with job titles, signed and filed away. Such a document isn’t a risk assessment — it wasn’t prepared by an authorised person, it isn’t based on an actual survey of the jobs, and that shows immediately at the first inspection.

What the process looks like

The method and procedure are set out in a separate regulation issued by the labour minister, so the risk assessment isn’t free-form. In practice it goes like this:

  1. Surveying the jobs. Visiting the sites and listing the jobs, work equipment, chemical substances and the work people actually do — not what the job descriptions say.
  2. Identifying hazards and harmful factors. For each job: mechanical hazards, work at height, electricity, noise, chemical and biological agents, physical strain and posture, psychosocial strain.
  3. Assessing the risks. For each identified hazard, the risk of injury and damage to the employee’s health is assessed.
  4. Measures, methods and deadlines. The law requires all three — it isn’t enough to write what needs to be done; you must also say how and by when.
  5. Jobs with increased risk. If there are any, the assessment sets the specific health requirements employees in those jobs must meet, based on an impartial evaluation by an occupational health service.
  6. Adoption and application. The risk assessment is adopted in writing. The law also explicitly requires its measures to be built into all of the employer’s activities at every level — an assessment sitting in a cupboard is as much an offence as one that doesn’t exist.

When the risk assessment must be updated

The risk assessment isn’t a one-off job. The law lists the cases in which the employer must amend it:

  • any new hazard or harmful factor
  • a change in the level of risk in the work process
  • a new job role
  • new technology
  • a change in working conditions

So in practice almost every major change in a company affects it: a new machine, moving to new premises, a new service, a new shift, a new job role in the organisation chart. And that is why a workplace injury almost always triggers an update: if someone has been injured, either a hazard arose that the assessment didn’t identify, or a risk was rated lower than it really was.

What the labour inspectorate checks

Employers had until 7 May 2025 to bring their business into line with the 2023 Law. The separate deadline for bringing risk assessments and records into line with the new regulations issued under it has been postponed several times — most recently, in June 2026, to 1 January 2027. The postponement doesn’t cover the basic obligation: a written risk assessment for every job is required now, and inspectors check it.

Inspectors usually ask to see:

  • the written risk assessment, covering every job
  • the written decision appointing the OHS adviser or associate, or the contract with a licensed company
  • evidence that employees have had health and safety training, and the training programme
  • the prescribed records — of jobs with increased risk, trained employees and workplace injuries
  • medical examinations for jobs with increased risk
  • evidence that the measures in the risk assessment have actually been applied, not just written down

What the fines are

The penalty provisions are in Article 100 of the Law. It lists the offences for which an employer that is a legal entity is fined RSD 1,500,000 to 2,000,000, and four of them concern the risk assessment directly: it hasn’t been adopted in writing for every job, with the method, measures and deadlines set; its measures haven’t been built into the employer’s activities; it hasn’t been amended when there was reason to; or it doesn’t set the health requirements for jobs with increased risk.

For each of these offences, the fines are:

  • employer that is a legal entity — RSD 1,500,000 to 2,000,000
  • employer that is a sole trader — RSD 400,000 to 500,000
  • director or other responsible person at the employer — RSD 50,000 to 150,000
  • employer that is a natural person — RSD 50,000 to 150,000

The same fines apply to an employer that doesn’t adopt a training programme and give employees health and safety training, and to one that doesn’t appoint an OHS adviser or associate. These three obligations go together and are checked together.

How it relates to ISO 45001

The workplace risk assessment is a legal obligation, while ISO 45001 is a voluntary standard. But they rely largely on the same work: both start from identifying hazards, assessing risks, deciding on measures and checking that the measures work.

The practical consequence: if your company has to do the risk assessment anyway and is also considering ISO 45001 for tenders or at a customer’s request, the two can be done together, for less than doing them separately. The same survey of jobs, the same hazard register, the same training — the standard just adds the management system part: objectives, internal audits and management review.

More on everything an employer is obliged to do: occupational health and safety.

What we do

The work is led by a person licensed to carry out health and safety work, in line with Article 46 of the Law. We take care of the whole process:

  • surveying the jobs at all your sites
  • preparing the risk assessment and the accompanying decisions
  • the training programme and training employees, with records
  • setting up the prescribed records
  • updating the risk assessment when there is reason to
  • preparing for labour inspections

We prepare the risk assessment in Serbian — the official language, and the one labour inspectors work in. If your management works in English, we can also give you an English translation.

What the price depends on

There is no single price for a risk assessment, because the work isn’t the same in every company. It depends on:

  • the number of jobs — not the number of employees; ten people in two jobs is less work than five people in five different jobs
  • the number of sites — each one is visited separately
  • the sector — an office, a factory, a construction site and a kitchen are not the same amount of work
  • whether there are jobs with increased risk — then medical examinations are needed too, which are a separate cost charged by the occupational health service
  • whether you need only the risk assessment, or training, records and ongoing updates as well

Send us the basic details — your sector, number of employees and number of sites — and you’ll get a quote with a clearly defined scope. We reply to written enquiries within one working day at the latest; if you call us, we respond straight away.

Request a quote