Skip to content

DUERP — the single occupational risk assessment document

The single occupational risk assessment document (document unique d'évaluation des risques professionnels, DUERP) is MANDATORY in every company AS SOON AS THE FIRST EMPLOYEE IS HIRED. The employer first identifies and assesses the risks present in the company, then records in the DUERP the result of that assessment of the health and safety risks to which employees may be exposed. The document contains two items: the INVENTORY of hazards and the result of the assessment of the risks identified, and the LIST of risk prevention and employee protection actions. NO MODEL IS IMPOSED by the Labour Code, and the employer chooses the medium — paper or digital. Three figures to remember: the DUERP, in its successive versions, must be kept for 40 YEARS from the date it was drawn up; it must be updated AT LEAST ONCE A YEAR from 11 employees (below 11, only on a decision to alter working conditions or when new information is gathered); and its absence or failure to update exposes the employer to the fine for fifth-class petty offences — up to €1,500 for an individual and €7,500 for a legal entity, doubled on repeat. A separate ADMINISTRATIVE fine of up to €4,000 may also be applied AS MANY TIMES AS THERE ARE WORKERS affected by the breach.

Up to date for 2026 — verified on September 12, 2026ActioFin templateGuide: about 90 min

Deadlines

As soon as the first employee is hired — drawing it up
The DUERP is mandatory in every company as soon as the first employee is hired. It is the hiring that triggers the obligation, not a headcount threshold or turnover figure.
Fewer than 11 employees — event-driven updates
The DUERP is updated on any decision to alter working conditions or affecting employee health or safety (use of a new hazardous chemical, for example), and when additional information relevant to assessing a risk in a work unit is gathered (appearance of occupational diseases, for example). NO annual obligation at this headcount.
11 to 49 employees — at least once a year
Same update triggers as above, PLUS an update at least once a year. The CSE, where it exists, is consulted on updates, and the employer sends the DUERP on each update to the occupational prevention and health service it belongs to.
Retention: 40 years
The DUERP, in its SUCCESSIVE versions, must be kept by the employer for 40 years from the date it was drawn up. It is not the latest version that is kept, it is the history.

Documents to prepare

  • The list of hazards present in the company, classified by your own criteria of exposure frequency and severity
  • The result of the assessment of the risks identified, by work unit
  • The list of risk prevention and employee protection actions
  • The six assessment areas: manufacturing processes, work equipment, chemical substances or preparations, workplace layout, work organisation, definition of workstations
  • The collective data tracing exposure to occupational risk factors, to be annexed
  • The proportion of employees exposed beyond Labour Code thresholds, for the occupational prevention account (C2P) declaration
  • The teleworking risk assessment, where teleworking is in place
  • The chosen medium, paper or digital — no model is imposed
  • The notice displaying the consultation rules, placed at the same location as the internal rules where they exist
  • The earlier successive versions, to be kept 40 years from the date the document was drawn up
See the procedure on the official site

No form is attached to this procedure: the link leads to the official page that describes it.

What this page gives you

The guide above and the link to the official site. ActioFin does not produce any document for this page: whatever you fill in or file is done on the official medium.

Who this applies to

  • ALL companies, as soon as the first employee is hired — there is no minimum headcount below which the DUERP is not required
  • The employer, who bears the general duty to take the measures necessary to ensure safety and protect the physical and mental health of employees
  • The employee involved in occupational risk protection and prevention activities, where designated by the employer: they contribute to the assessment
  • The occupational prevention and health service the employer belongs to, which contributes to the assessment and to which the DUERP is sent on each update from 11 employees
  • The works council (CSE) and its health, safety and working conditions committee, where they exist — the CSE is consulted on updates from 11 employees
  • External contributors: Carsat, MSA for example
  • Companies using TELEWORKING: introducing it also requires an occupational risk assessment by the employer, for example on the physical layout of the workstation and employee isolation
  • Workers, former workers and any person or body able to show an interest in accessing it, to whom the document must be made available

Worked example

Example: a craftsman hiring his first employee, and what his DUERP must contain

Karim is a plumber and heating engineer operating as a sole trader and is hiring his first employee. The DUERP obligation arises on that hiring: while working alone he was not subject to it. He starts by IDENTIFYING the hazards, then CLASSIFIES them according to criteria specific to his business — frequency of exposure and severity, for example. The official source gives the distinction to observe: stairs and electricity are a HAZARD in the business; electrocution while changing a bulb or falling down stairs are the RISKS. Karim assesses the risks of his activity in particular in the areas the text lists: choice of manufacturing processes, choice of work equipment, choice of chemical substances or preparations, layout or re-layout of workplaces or installations, work organisation, definition of workstations. His assessment takes into account the differentiated impact of exposure to risk according to the employee's sex. He then records two things in the document, and only those two as regards mandatory content: the inventory of hazards with the result of the assessment of the risks identified, and the list of prevention and protection actions. No model is imposed on him — his industry sector, such as construction, offers tools to help draw up the document, and he chooses whichever medium, paper or digital, suits him. He annexes the collective data needed to trace employees' exposure to occupational risk factors and states the proportion of employees exposed beyond the thresholds set by the Labour Code: that information will enable him to make the declaration of the employee's exposures on their occupational prevention account (C2P). Finally, he displays the rules for consulting the document in a suitable and easily accessible place. As he has fewer than 11 employees, he has no annual update obligation: he will update on a decision to alter working conditions or when new information becomes relevant to assessing a risk. He will keep the successive versions for 40 years. Had he drawn up nothing, he would have risked the fine for fifth-class petty offences — up to €1,500 as an individual — and, in the absence of criminal penalties, a warning or an administrative fine of up to €4,000, applicable as many times as there are workers affected.

How to fill it in, step by step

  1. Draw up the DUERP as soon as you hire your first employee: it is the hiring that triggers the obligation.
  2. First IDENTIFY the risks present in the company, then CLASSIFY them according to criteria specific to your business — frequency of exposure and severity, for example.
  3. Distinguish hazard from risk: stairs and electricity are hazards; falling down stairs and electrocution while changing a bulb are the risks.
  4. Assess the risks of your activity in particular in these areas: choice of manufacturing processes, choice of work equipment, choice of chemical substances or preparations, layout or re-layout of workplaces or installations, work organisation, definition of workstations.
  5. Take into account the differentiated impact of exposure to risk according to the employee's SEX — the text requires this expressly.
  6. If you have introduced teleworking, assess the risks it entails too: physical layout of the workstation, employee isolation.
  7. Record in the DUERP the INVENTORY of hazards and the result of the assessment of the risks identified in the company.
  8. Record the LIST of risk prevention and employee protection actions: that is the second mandatory content item.
  9. Choose the medium freely, paper or digital: no model is imposed by the Labour Code, but some industry sectors — cleaning and construction, for example — offer tools to help draw it up.
  10. Annex to the DUERP the collective data needed to trace employees' exposure to occupational risk factors, and state the proportion of employees exposed beyond the thresholds set by the Labour Code: that information is used to make the declaration of exposures on the occupational prevention account (C2P).
  11. Make the document available to those entitled to it, and DISPLAY the rules for consulting it in a suitable and easily accessible place in the workplace — at the same location as the internal rules if there are any.
  12. Update according to your headcount: event-driven below 11 employees; event-driven AND at least once a year from 11 to 49 employees, consulting the CSE where it exists and sending the document to the occupational prevention and health service on each update.
  13. Keep the SUCCESSIVE versions of the DUERP for 40 years from the date it was drawn up.

The template, item by item

Inventory of hazards and result of the assessment
The first of the two mandatory content items. The inventory covers the HAZARDS identified in the company, and the result covers the assessment of the RISKS arising from them.
List of prevention and protection actions
The second mandatory item. Identifying, analysing and classifying the risks serves precisely to define and PRIORITISE those actions, across technical, human and organisational dimensions.
Consistency, convenience, traceability
The three requirements the transcription of results must meet. Consistency: bringing together on a SINGLE medium the data from the risk analysis. Convenience: gathering in one document the results of the various risk analyses, to make the prevention process easier to follow. Traceability: results must be systematically recorded so that everything analysed appears on a paper or electronic medium.
Exposure traceability annex
Collective data needed to trace exposure to occupational risk factors — significant physical strain, aggressive physical environment, particular work rhythm — and the proportion of employees exposed beyond the thresholds set by the Labour Code: mechanical vibration, extreme temperature, repetitive movements, for example.
Medium
Paper or digital, at the employer's choice. No model is imposed by the Labour Code; some sectors (cleaning, construction) offer supporting tools.
Display of consultation rules
The employer must display the rules for consulting the document in a suitable and easily accessible place in the workplace. In companies with internal rules, that notice is displayed at the same location as the one reserved for the internal rules.
Retention period
40 years from the date it was drawn up, and for the SUCCESSIVE versions — not only the latest one.

Good to know

  • The obligation arises on hiring the FIRST employee: a sole trader working alone is not subject to it, and becomes so the day they hire.
  • There is no official form to fill in: the Labour Code imposes none. What is imposed is the CONTENT (inventory of hazards and result of the assessment, list of prevention actions) and the three requirements of consistency, convenience and traceability.
  • The ANNUAL update obligation only starts at 11 employees. Below that, updating is event-driven: a decision to alter working conditions, or additional information relevant to assessing a risk.
  • The 40-year retention applies to the SUCCESSIVE versions: it is the document's history that is kept, not only its current version.
  • The DUERP is not a confidential internal document: it must be made available to workers, former workers, any person or body showing an interest in accessing it, members of the CSE staff delegation, the occupational prevention and health service, the labour inspectorate, Carsat prevention officers, occupational health, safety and working conditions bodies, and radiation protection inspectors.
  • Teleworking is within scope: introducing it requires an occupational risk assessment covering, for example, the physical layout of the workstation and employee isolation.
  • The assessment must take into account the differentiated impact of exposure to risk according to the employee's SEX: an explicit requirement of the text, often overlooked.
  • The annexed data serve a purpose beyond the DUERP itself: they enable the declaration of the employee's exposures on their occupational prevention account (C2P).
  • Two penalties may combine: the fifth-class petty offence (criminal) and the administrative fine under article L8115-1, the latter applicable AS MANY TIMES AS THERE ARE WORKERS affected by the breach.

Common mistakes

  • Believing a very small company with one or two employees is exempt: the DUERP is mandatory in every company as soon as the first employee is hired.
  • Looking for an official form or model to fill in: none exists, the Labour Code imposes no model.
  • Confusing hazard and risk: the staircase is the hazard, the fall is the risk — the classification of risks depends on it.
  • Recording only the inventory of hazards and leaving out the LIST OF ACTIONS for prevention and protection: both items are mandatory.
  • Updating once a year below 11 employees in the belief it is required, or — more seriously — NOT updating between 11 and 49 employees, where the annual obligation does exist.
  • Forgetting to consult the CSE on updates where it exists, and to send the DUERP to the occupational prevention and health service on each update.
  • Keeping only the latest version: it is the SUCCESSIVE versions that must be kept, for 40 years from the date it was drawn up.
  • Keeping the document to yourself: it must be made available to a specific list of people and bodies, and the consultation rules must be DISPLAYED.
  • Forgetting to assess teleworking risks where teleworking has been introduced.
  • Overlooking the differentiated impact of exposure according to the employee's sex, which the text requires to be taken into account.
  • Underestimating the administrative fine: it may be applied as many times as there are workers affected, which makes it far larger than the petty-offence fine even on a modest headcount.
  • Not making the DUERP available to the CSE: that is an obstruction offence, punishable by up to 1 year's imprisonment and a €7,500 fine.

Frequently asked questions

From when is the DUERP mandatory?

As soon as the first employee is hired, and in every company. There is no headcount threshold below which the obligation would not apply.

What must the DUERP contain?

Two items: the inventory of hazards and the result of the assessment of the risks identified in the company, and the list of risk prevention and employee protection actions. The results must be transcribed so as to meet three requirements: consistency, convenience and traceability.

Is there an official model?

No. No model is imposed by the Labour Code. Some industry sectors — cleaning and construction, for example — offer tools to help draw up the document, and the employer chooses the medium, paper or digital.

How often must it be updated?

It depends on headcount. Below 11 employees: on any decision to alter working conditions or affecting employee health or safety, and when additional information relevant to assessing a risk is gathered. From 11 to 49 employees: the same cases, plus at least once a year, with consultation of the CSE where it exists and transmission to the occupational prevention and health service on each update.

How long must the DUERP be kept?

40 years from the date it was drawn up, in its successive versions.

Who may consult the DUERP?

Workers and former workers, any person or body able to show an interest in accessing it, members of the CSE staff delegation, the occupational prevention and health service, labour inspectorate officers, Carsat prevention officers, officers of occupational health, safety and working conditions bodies, and radiation protection inspectors for workers exposed to ionising radiation. The employer must display the consultation rules in a suitable and easily accessible place.

What penalties apply where there is no DUERP?

Criminally, the fine for fifth-class petty offences: up to €1,500 for an individual (€3,000 on repeat) and up to €7,500 for a legal entity (€15,000 on repeat). In the absence of criminal penalties, a warning or an administrative fine of up to €4,000, applicable as many times as there are workers affected by the breach — raised to €8,000 on repeat within 2 years of notification of a fine of the same nature, and to €6,000 on repeat within 1 year of a warning of the same nature. Failing to make the DUERP available to the CSE is also an obstruction offence, punishable by up to 1 year's imprisonment and a €7,500 fine.

Does teleworking change anything?

Yes: introducing it also requires an occupational risk assessment by the employer, covering for example the physical layout of the workstation and employee isolation.

Go further

Related forms

Official sources

Read in French

Guide and document provided for information purposes only; they do not constitute personalised legal or tax advice. Check the recipient organisation's requirements and consult a professional if needed.