What Is NOM-035?
NOM-035-STPS-2018 is a mandatory Mexican workplace standard, issued by the Secretaria del Trabajo y Prevision Social (STPS), that requires employers to identify, analyse and prevent psychosocial risk factors at work. Formal risk-factor identification is required from 16 employees upward, and employers must be able to show documented evidence that they did it.
The standard in plain terms
NOM-035-STPS-2018 is a Mexican Official Standard (Norma Oficial Mexicana) issued by the Secretaria del Trabajo y Prevision Social (STPS). Its full name translates as "psychosocial risk factors at work — identification, analysis and prevention". It came into force in stages, and it is now a routine part of what Mexican labour inspectors look at.
Two ideas sit at the centre of the standard. The first is that some workplace hazards are organizational rather than physical: unmanageable workloads, hostile relationships, chaotic shift patterns and unsupportive leadership can damage health just as a missing machine guard can. The second is that identifying those hazards is not optional goodwill — it is a documented employer obligation with defined cadences, records and follow-up.
NOM-035 also requires employers to promote a favourable organizational environment and to have a plan for what happens after a traumatic event at work, such as a serious accident, an act of violence, or a death.
Who NOM-035 applies to
The standard applies to every workplace in Mexico, but the obligations scale with headcount:
- All employers, regardless of size. Publish a written psychosocial risk prevention policy, communicate it to workers, adopt preventive measures, and document a protocol for responding to traumatic workplace events.
- 16 to 50 employees. Formal identification of psychosocial risk factors begins here. Employers apply Reference Guide I, evaluate the results, act on them, and keep the records.
- More than 50 employees. Employers apply the fuller validated instruments — Reference Guide II or III — and repeat the evaluation on the standard's recurring cycle rather than once.
In other words, a ten-person company still has real duties under NOM-035; what changes at sixteen employees is that the formal risk-factor questionnaire becomes mandatory.
What employers must actually do
- Write and publish the policy. A short, signed document stating that the organization prevents psychosocial risk, prohibits workplace violence, and supports a favourable environment. It has to be visible to employees, not filed away.
- Identify and analyse the risk factors. Administer the correct reference guide for your headcount, confidentially, and analyse results by domain rather than only as one overall score.
- Act on what you find. Domains that come back at medium, high or very high risk need a written intervention plan with specific actions, named owners and dates.
- Communicate results back to workers. Employees are entitled to know the aggregate findings and what the organization intends to do about them.
- Keep the records. Questionnaires, results, action plans and evidence of communication all form part of the compliance file.
The domains NOM-035 measures
The standard groups psychosocial risk factors into nine categories: conditions in the work environment; workload; lack of control over work; working hours; interference between work and personal life; deficient leadership; workplace relationships; violence; and inadequate recognition of performance. Each is scored separately, which is deliberate — an organization can look healthy on average while one domain, such as workload or leadership, is quietly in the red.
What an STPS inspection expects to see
Inspectors are checking for a paper trail, not a mood. In practice that means:
- The written prevention policy, dated and disseminated.
- The completed questionnaires and the reference guide used, with the date, the number of participants and the response rate.
- Results broken down by domain, with the risk level for each.
- An intervention plan for every priority domain, with owners and deadlines — plus evidence that the actions actually happened.
- Proof that results were communicated back to workers.
- The traumatic-event protocol and, for larger employers, the named person responsible for follow-up.
Record-retention periods differ by company size: employers in the 16–50 band keep records for a shorter window than employers above 50, who are expected to hold them for several years.
What non-compliance looks like
NOM-035 is enforceable. STPS can impose administrative fines calculated per affected worker and per infraction, so exposure grows with headcount and with the number of obligations missed. Beyond the fine itself, an undocumented psychosocial risk program weakens an employer's position in labour disputes and IMSS proceedings, because there is no evidence the company knew about or acted on a condition an employee later cites.
The most common failure mode is not skipping the survey. It is running the survey, filing the results, and doing nothing. Under NOM-035 the evaluation is the starting point, not the deliverable — an organization that documents high workload risk and takes no action is out of compliance even though the questionnaire was administered correctly.
How continuous listening helps
NOM-035 is usually treated as a periodic project: administer the guide, produce a report, wait for the next cycle. That satisfies the letter of the standard but tells you nothing between cycles, which is where risk actually builds.
Bloomder distributes NOM-035-aligned questions across regular pulse surveys, so the same risk domains are monitored continuously while the compliance record builds itself: timestamps for every send, response rates, aggregated results by domain, and exports formatted for an audit file. Responses are anonymous by design — one-time tokens are discarded on submission and are never stored with the answers, so managers only ever see aggregates. See NOM-035 compliance software for how the workflow maps to each obligation, or work through the NOM-035 compliance checklist to audit where you stand today.
Common questions
Is NOM-035 mandatory for every employer in Mexico?
The standard applies to all workplaces, but the obligations scale with size. Every employer must publish a psychosocial risk prevention policy, adopt preventive measures and have a traumatic-event protocol. Formal identification of psychosocial risk factors becomes mandatory from 16 employees, and employers with more than 50 employees apply the fuller validated reference guides on a recurring cycle.
How often does the NOM-035 evaluation have to be repeated?
Larger employers repeat the formal evaluation on the standard's recurring cycle rather than treating it as a one-off. Many organizations also monitor the same risk domains continuously with short pulse surveys between formal cycles, so that emerging risk is visible before the next evaluation rather than after it.
Do anonymous surveys satisfy the NOM-035 confidentiality requirement?
NOM-035 requires that individual responses be handled confidentially. Systems that store answers without any identity link meet that expectation structurally: because no individual response record exists, it cannot be produced, and employees have no reason to soften their answers. Aggregate results by domain are what the compliance file needs.
Monitor psychosocial risk continuously
NOM-035-aligned templates, anonymous responses and audit-ready exports. 14 days free, no credit card.
Start Free Trial →