DUERP in 2026: The 12 Obligations That Actually Apply

If your group has a French entity, somebody has probably told you that you are now required to file your DUERP on a national digital portal, and that the deadline has passed.

They were reading the law correctly and the reality incorrectly. The portal was created by the loi Santé au travail of 2 August 2021, with deposit deadlines of 1 July 2023 for employers of 150 or more and 1 July 2024 for everyone else. Both dates passed. The portal was never launched, and as matters stand it is still not in service with no new date announced.

That matters in both directions. Groups that panicked about the portal spent effort on an obligation that does not exist. Groups that concluded the whole reform was theoretical missed several that very much do, including one that runs for forty years. Here is what actually applies.

1. The document must exist, from the first employee

France has no small-employer exemption. Any employer with staff must have a document unique d'évaluation des risques professionnels, and a two-person sales office in Paris owned by a London parent is inside the obligation.

2. It must be organised by unit of work

The structural feature that distinguishes a DUERP from a translated UK risk assessment. The assessment is built around unités de travail, meaning groupings of workers exposed to similar risks, rather than around a list of hazards applied to the whole site.

A group template organised hazard by hazard can contain the right content and still be the wrong shape, which is what an inspector notices first.

3. It must be updated at least annually

An annual review is the floor, not a best practice. For employers below a certain size the annual obligation is relaxed in a limited way, but the safest working assumption for a foreign-owned entity is that the document is reviewed every year and the review is dated.

4. It must be updated on any significant change

Separately from the annual cycle. A change to working conditions, a new activity, a move of premises, new equipment, or the arrival of information bearing on the evaluation of a risk all trigger an update. INRS, the national prevention institute, is the authoritative technical reference on how the exercise should be conducted.

5. Every version must be kept for at least forty years

This is the obligation from the 2021 reform that did take effect, and the one most often missed.

Article R.4121-5 of the Code du travail requires successive versions of the DUERP to be kept for at least forty years, on paper or in digital form. The purpose is traceability: if an occupational illness is recognised decades later, the record should show what the worker was exposed to and when.

Forty years outlasts most corporate structures. It survives a change of adviser, a change of software and a sale of the entity, which makes it a diligence item as well as a compliance one. Any group whose French assessments live in a consultant's system rather than its own has a problem that will surface at the worst moment.

6. Superseded versions must be retained, not replaced

The consequence of the previous point, and worth stating separately because document management systems default the other way.

The obligation is to keep each version, not the current one. A platform that overwrites the DUERP on update, or a shared drive where the file name stays the same, destroys exactly what the forty-year rule exists to preserve.

7. It must be accessible to a defined list of people

Not just to management. The DUERP must be available to employees, to staff representatives, to the occupational health and prevention service and to the labour inspectorate. Former employees are able to access the versions covering their own period of employment.

That last point is the one that catches groups keeping the document in an internal system with no external access route. The duty is not satisfied by a file somebody could in principle produce.

8. It drives a prevention programme or an action list

The assessment is not the output. What follows from it is, and the form depends on size: larger employers produce an annual prevention programme, while smaller ones produce a list of actions. Our note on PAPRIPACT covers the programme itself and what UK organisations can take from it.

Either way the actions are part of the instrument rather than an optional follow-up, which is the same design principle as the Dutch plan van aanpak.

9. The CSE must be consulted

Where a comité social et économique exists, it is consulted on the DUERP and its updates and delivers a formal opinion. This is consultation with procedural consequences rather than a courtesy.

An unconsulted DUERP is procedurally defective, which is a different and more awkward problem than a disagreement about content. Groups that treat the French entity as a recipient of a group document discover this at the point they want to rely on it.

10. Psychosocial risk belongs in it

French practice treats psychosocial risk as a subject the assessment addresses, alongside physical, chemical and organisational risk. For professional, legal and technology employers this is where group templates are thinnest, because UK practice has historically handled workload as a wellbeing initiative rather than an assessed hazard.

11. The occupational health service has a role, and so does its own document

French entities sit within a service de prévention et de santé au travail, which maintains its own record of the workplace and its risks. That document and your DUERP should describe the same organisation. Where they diverge, the divergence is visible to the inspectorate, and reconciling them is usually quicker than defending the difference. EU-OSHA's overview of the French system explains where the medical function sits and why it is confidential from management.

12. The digital portal deposit is not in force

Finally, the obligation everyone has heard about and nobody owes.

The 2021 law provided for deposit of the DUERP and its updates on a national portal, operated under the auspices of national employer organisations. The timetable was 1 July 2023 for employers of 150 or more and 1 July 2024 below that. Neither happened. The ministry has pointed to practical obstacles including long-term hosting, authentication and the protection of commercial confidentiality, an official cost-benefit assessment was unfavourable, and alternative routes are under discussion with the social partners, possibly linked to the occupational health services.

So the position today is that there is no portal to file on. The retention duty is live, the filing duty is not, and the two are frequently conflated in commentary. Treat this as a thing to re-check rather than a settled answer, because the legal provision still exists and could be activated.

What applies, and what does not

Obligation	Status	Where groups go wrong
Document exists from first employee	In force	Assumed a small-entity exemption
Organised by unit of work	In force	Hazard-based group template used
Annual review	In force	Reviewed when something prompts it
Update on significant change	In force	Premises move not treated as a trigger
Forty-year retention of each version	In force	Current version only
Superseded versions retained	In force	Overwritten on update
Accessible to a defined list	In force	Internal system, no access route
Prevention programme or action list	In force	Treated as optional follow-up
CSE consultation	In force	Group document circulated, not consulted
Psychosocial risk addressed	In force	Handled as a wellbeing programme
Occupational health service record aligned	In force	Two documents, different stories
Deposit on national digital portal	Not in force	Effort spent on an obligation that does not exist

Eleven live obligations and one that is not. If your French compliance work over the past three years concentrated on the twelfth row, the first eleven are worth revisiting.

How this sits alongside the rest of Europe

The DUERP is one of a family of national instruments that all descend from the EU Framework Directive 89/391/EEC and none of which substitute for each other.

A German entity needs a documented Gefährdungsbeurteilung within the framework overseen by the DGUV institutions. A Dutch entity needs an RI&E, which above certain thresholds must be tested by an externally certified expert. An Italian entity needs an appointed RSPP. France needs a DUERP structured by unit of work with forty-year retention. Four countries, four instruments, one directive behind all of them.

The pattern that works is one methodology and one register for the group, with each country's instrument produced properly and its own version history held where the group controls it. For France specifically that version history is the forty-year obligation, which is why health and safety consultants and software are worth more in combination than either alone: the advice decides what the document must contain, and the system is what still holds version four in 2061. Periodic health and safety audits then verify each entity against its own national test rather than a translated standard.

Where Arinite fits

Arinite has spent 15+ years producing the right instrument in each country rather than translating one. We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention. Our health and safety consultants work extensively with IT and software, legal and office-based clients, and for French entities the two findings we see most are a hazard-shaped document and a retention arrangement that holds only the current version.

Our global health and safety consultants work with locally qualified French practitioners so the document satisfies the French test rather than resembling it, and our international health and safety consultants can tell you how your France entity compares with the rest of the group.

Check two things today: whether your DUERP is organised by unit of work, and whether you still hold every previous version. Then book a free gap analysis and we will tell you in one call which of the eleven live obligations you are meeting.

Related Articles

• DUERP Explained: 7 Things US, UK and International Businesses Must Know
• DUERP : les 5 questions essentielles que se pose chaque employeur (French language, for local teams)
• Health and Safety in France: 4 Headcount Thresholds That Change Your Duties
• DGUV and UVV Explained: 8 Things UK and International Businesses Must Know