Health and Safety in Spain: 12 Duties and the Choice That Triggers an Audit
A UK group opens in Madrid or Barcelona. Thirty people, growing to ninety, doing software, legal support or claims. Somebody asks what Spain requires, and the gestoría answers with a quote from a servicio de prevención ajeno, which gets signed because it is the cheapest line on the setup budget.
That is usually the right answer, but not for the reason anybody thinks. Spain requires you to organise prevention through one of four prescribed forms, and the form you choose determines who does your risk evaluation, what your committee must debate, and whether you are legally obliged to commission an external audit of your own system.
Choose the external service and that audit obligation does not arise. Choose to do it in house and it does. Most groups stumble into the right answer and never learn they made a choice at all, which becomes a problem the day somebody decides to bring the work internal to save money.
Here are twelve duties under Spanish law, starting with the one that governs the rest.
The choice that comes first
1. Pick one of four prevention models. Article 30 of Ley 31/1995, the Ley de Prevención de Riesgos Laborales, requires the employer to designate one or more workers to handle prevention, to constitute a prevention service, or to contract that service with a specialised entity external to the company. Article 31 adds that where designating workers is insufficient given the size of the company, the risks or the dangerousness of the activities, the employer must use one or more prevention services, internal or external. The detail sits in the Reglamento de los Servicios de Prevención.
This is a formal election, not a management preference. The modalidad organizativa is a thing your Spanish entity has, and it should be written down.
2. Know whether you can do it yourself. Article 30.5 permits the employer to assume the functions personally in companies of up to ten workers, provided the employer habitually carries out their activity at the workplace and has the necessary capability given the risks and the dangerousness of the activities. The same possibility extends, on the same conditions, to an employer with up to 25 workers where the company has a single workplace.
For a UK group this route is almost always unavailable in practice, because the person who would assume it sits in London rather than habitually at the Spanish workplace.
3. Understand what in-house triggers. Article 30.6 is the provision nobody reads and the reason this post exists. An employer that has not contracted its prevention service with an external specialised entity must submit its prevention system to the control of an external audit or evaluation. Article 30.7 adds that the auditing bodies require a single authorisation from the labour authority, valid throughout Spain.
So the cost comparison most groups run is wrong. Bringing prevention in house does not remove an external cost, it swaps a service fee for a mandatory audit obligation, and it adds the work of being audited.
What has to exist
4. A prevention plan integrated into how the business is run. Article 16 requires prevention to be integrated into the company's general management system, across all its activities and all hierarchical levels, through a plan de prevención de riesgos laborales. The plan must include the organisational structure, the responsibilities, the functions, the practices, the procedures, the processes and the resources needed.
Read that as written. It is not a safety document sitting beside the business, which is how a translated UK policy reads when it arrives in Spain.
5. An initial risk evaluation, with defined triggers for revisiting it. Also article 16. The employer must carry out an initial evaluation taking account of the nature of the activity, the characteristics of the posts and of the workers who will occupy them, and must evaluate again when choosing work equipment, chemical substances or preparations, or fitting out the workplace. The evaluation must be updated when working conditions change and must be reconsidered, and revised if necessary, when harm to health has occurred.
6. A planning document with deadlines, owners and resources. The second essential instrument under article 16 is the planificación de la actividad preventiva. Where the evaluation reveals risk, the preventive activities must be planned, and for each one the plan must state the deadline, the designation of those responsible, and the human and material resources for carrying it out. The employer must then ensure effective execution through continuous follow-up.
A plan without named owners and dates is not the document the article describes, which is the most common defect we find in Spanish entities running on a group template.
What every worker gets
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
7. Training on hiring, whatever the contract, at the employer's cost. Article 19 requires sufficient and adequate theoretical and practical training in prevention at the moment of hiring, whatever the type or duration of the contract, and again when the worker's functions change or new technology or work equipment is introduced. It must be specific to the post, adapted as risks evolve, and repeated periodically where necessary. It must be delivered within working hours where possible, or otherwise with that time deducted from working hours, and its cost may in no case fall on the workers.
The phrase "whatever the type or duration of the contract" is the one that catches groups using fixed-term and agency staff for peaks.
8. Information on the risks and the measures. A separate duty from training, under article 18, covering the risks, the protective and preventive measures and the emergency measures. Groups routinely treat a training completion record as discharging both. It does not.
9. First aid and emergency plans. Article 31.3 lists what the prevention service must be able to support, and first aid provision and emergency plans appear there explicitly, alongside risk evaluation, planning, information and training, and health surveillance. If your contract with an external service does not cover emergency planning, the duty has not gone anywhere.
10. Health surveillance, on the worker's consent. Article 22 is where British expectations diverge most sharply. The employer must guarantee periodic surveillance of workers' health according to the risks inherent in the work, and that surveillance may only be carried out with the worker's consent. The exceptions, which require a prior report from the workers' representatives, are where examinations are indispensable to evaluate the effects of working conditions on health, or to verify whether a worker's state of health may constitute a danger to themselves or others, or where a legal provision establishes it for specific risks and especially dangerous activities.
The confidentiality rule matters just as much. Access to personal medical information is limited to medical personnel and the health authorities, and cannot be given to the employer without the worker's express consent. The employer and those with prevention responsibilities are informed only of the conclusions on the worker's fitness for the post and on whether protective measures need introducing or improving. Surveillance may also have to continue beyond the end of the employment relationship where the risks require it.
A UK group expecting medical reports on its Spanish staff will be told no, correctly.
Who participates, and what they must be asked
11. Prevention delegates, and a committee at fifty. Article 38 requires a Comité de Seguridad y Salud in all companies or workplaces with 50 or more workers. It is a joint body, made up of the prevention delegates on one side and the employer or their representatives in equal number on the other. Union delegates and the company's technical prevention staff attend with a voice but no vote. It must meet quarterly, and whenever either side asks. Companies with committees at several workplaces may agree an inter-centre committee.
Below fifty workers there is no committee, and the competences the law gives it are exercised by the prevention delegates instead.
Then the detail that closes the loop with duty one. Article 39 requires the committee to debate, before implementation, the choice of the company's organisational modality and the performance of any external entities engaged to carry out preventive activities. The decision you made in duty one is a matter the committee must be consulted on.
12. Coordination where you share a workplace, including monitoring contractors. Article 24 requires companies whose workers operate in the same workplace to cooperate and establish the necessary means of coordination. The employer that is titular of the workplace must ensure the other employers receive adequate information and instructions on the risks there, the corresponding protective and preventive measures and the emergency measures, for onward transmission to their own workers. And companies that contract or subcontract work or services corresponding to their own activity, carried out in their own workplaces, must monitor those contractors' compliance with prevention legislation.
That monitoring duty is materially stronger than its British equivalent. Receiving a contractor's paperwork is not monitoring compliance.
The twelve, grouped
| Group | Duties | Where UK practice misses |
|---|---|---|
| The choice | Modality, self-assumption thresholds, the audit consequence | Nobody records that a choice was made |
| What exists | Prevention plan, risk evaluation, planned activity with owners and dates | A group policy translated, with no named owners or deadlines |
| Every worker | Training at hiring, information, first aid and emergency plans, health surveillance | Training treated as discharging the information duty too |
| Participation | Delegates, committee at 50, consultation on the modality | No committee where headcount passed fifty quietly |
| Shared sites | Coordination, and monitoring contractors' compliance | Collecting documents instead of monitoring |
Holding a modality election, a plan with owners, quarterly committee minutes, per-post training records and a contractor monitoring trail for one country, while running a dozen other regimes that ask for different artefacts, is where health and safety consultants and software are worth more in combination than either alone. Our existing Spanish LPRL guide covers the framework in more general terms, and the INSST publishes the technical guidance behind it.
Why the audit point matters beyond Spain
The Spanish structure is worth understanding because the same logic appears, differently dressed, across Europe, and it defeats the instinct that bringing compliance in house always saves money.
The Netherlands requires a risk inventory to be tested by an externally certified expert above defined thresholds, so the external check attaches to the document rather than the organisational model. Germany requires defined appointments and, for certain installations, inspection by an approved body rather than a contractor of your choosing. Italy requires a named prevention and protection service manager. In each case the state has decided something must be verified by somebody outside the organisation, and picked a different hinge to hang it on.
The UK has no equivalent hinge. You appoint competent assistance, in any form, and nobody verifies it unless something goes wrong. That is why British groups export an in-house model confidently and discover it carries a statutory audit in Spain, a certified test in the Netherlands and an approved inspection in Germany.
The workable pattern is the familiar one: one methodology, with the local organisational form, verification requirement and participation threshold attached per country. Periodic health and safety audits of your own then serve a second purpose in Spain, because for an entity on the in-house route the external audit is not optional and is better prepared for than discovered.
Where Arinite fits
Arinite has spent 15+ years setting up Spanish entities for UK and US groups, and the first question we ask is which modality the company has elected, because the answer is usually that nobody knows. We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention. Our health and safety consultants work extensively with legal, insurance, IT and software and office-based clients, which is the profile of most UK operations in Madrid and Barcelona.
Our global health and safety consultants work with locally qualified practitioners so the plan and the evaluation are Spanish documents rather than translations, and our international health and safety consultants can tell you which entities have crossed a participation threshold without noticing. Our Spain page sets out how we support groups operating there.
Ask your Spanish entity two questions this week: which of the four models have we elected, and has anyone counted whether we have passed fifty workers. Then book a free gap analysis and we will tell you in one call whether your Spanish compliance is a document or a system.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
