Health and Safety Software for Multi-Country Groups: The 8 Decisions Before You Buy
Most guidance on choosing health and safety software is written for a business operating in one country. It compares features, pricing tiers and mobile apps, and it is perfectly sound advice for a single-jurisdiction buyer.
A group operating in eight countries faces a different problem. The feature list is largely irrelevant, because every serious platform does incident logging, risk assessment and action tracking. What decides whether the implementation succeeds is configuration: whether the system can produce the document each country's law actually requires, where the data is allowed to sit, how long each record must be kept, and whether a works council will let you deploy it at all.
Those questions are rarely in the demo and almost never in the proposal. Here are the eight to settle before you sign.
1. Can it produce the local statutory instrument, not a translation?
The decision that sinks more multi-country implementations than any other.
A risk assessment is not a universal artefact. France requires a DUERP in a prescribed form, updated annually. Germany requires a documented Gefährdungsbeurteilung, sitting within the framework overseen by the DGUV institutions. Italy expects an appointed RSPP and a document structured to Italian expectations. All three descend from the general duties in the EU Framework Directive 89/391/EEC, and all three were implemented with their own documentation rules.
A platform that generates one assessment template and offers it in twelve languages has solved a translation problem, not a compliance one. Ask to see the French output and have someone who works under French law tell you whether it is a DUERP.
2. Where will the data physically sit?
Data residency is a procurement question before it is a technical one, and it is getting harder rather than easier.
Transfers of personal data out of the UK and the EEA require a lawful transfer mechanism, and the ICO's guidance on international transfers sets out what that involves. The European Data Protection Board publishes the EU position. Beyond Europe, several jurisdictions impose their own localisation or transfer conditions, and India's framework under the ministry responsible for data protection is one a group with an Indian entity needs to understand before it centralises records in London.
The practical question for the vendor is simple and often resisted: name the regions where data will be stored, processed and backed up, and tell me which of those I can control.
3. How does it handle special category data?
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
Health and safety systems accumulate health information almost immediately: accident records, absence linked to injury, health surveillance outcomes, DSE assessments noting a condition.
That is special category data under the UK GDPR and needs a lawful basis plus a separate processing condition. The configuration consequence is role-based access that actually separates clinical information from management information. A line manager should see a fitness for work outcome and any functional restriction. They should not see a diagnosis, a test result or a referral letter, and a platform where the only access tiers are user and administrator cannot deliver that.
4. What are the retention rules, country by country?
Retention is where groups discover their platform was configured by whoever ran the pilot.
Some records have very long statutory lives. In the UK, regulation 11 of the COSHH Regulations requires a health record to be kept available for at least forty years from the last entry. Other jurisdictions set different periods for different record types, and data protection law pulls the other way by requiring that personal data is not kept longer than necessary.
Reconciling those is a configuration exercise per record type and per country, not a single global setting. Ask whether retention can be set at that granularity, and what happens at the end of a period: deletion, archive, or an alert to a human.
5. Will a works council let you deploy it?
The question that costs a quarter when it is asked late.
Where a German works council exists, section 87 of the Betriebsverfassungsgesetz gives it co-determination rights over arrangements concerning health protection, and a platform that records who completed which training and when is a health and safety control to you and a performance monitoring system to them. Both readings are defensible, which is why the answer is negotiated rather than announced. Similar consent and consultation rights apply in the Netherlands and elsewhere.
Raise it during vendor selection, not during rollout, and be ready to configure monitoring features off for a jurisdiction. A platform that cannot disable a module per country has a commercial problem you will inherit.
6. Is the output comprehensible to the worker who has to rely on it?
Not a usability point. A legal one.
The duty to provide information to workers in a form they can understand runs through occupational safety law internationally, and an assessment or safe system of work that exists only in the group's working language does not discharge it for a workforce that does not read that language. This matters most where it is least visible: contracted cleaning, security and catering staff on your premises, who are frequently the population least served by a group platform and most likely to need the information.
7. Can intervals and triggers be set per jurisdiction?
Every statutory inspection regime has its own clock, and the clocks differ across borders even where the equipment is identical.
Lifting equipment that carries people is examined at a shorter interval than other lifting equipment in Great Britain, and in Germany certain installations must be inspected by an approved body rather than a competent person of your choosing. Emergency lighting duration testing follows one convention in the UK and a shorter one under the US codes. Workplace exposure limits are national, and the EU limit for asbestos is now an order of magnitude below the UK figure.
So the register needs the asset, the country, the applicable interval, the category of person who may sign, and the next date, with the ability to differ by site. A platform with one global frequency field will quietly standardise you onto whichever convention the pilot country used.
8. What happens when you leave?
Ask it before you arrive, because the answer shapes everything above.
Three things matter. What you can export, in what format, including attachments and photographs rather than only table data. Whether the audit trail survives the export, since a record without its history of who changed what and when is weaker evidence. And who holds the forty-year records after the contract ends, which is not a theoretical question for any group that changes provider every five years.
The configuration checklist
| Decision | Ask the vendor | A weak answer |
|---|---|---|
| Local statutory instrument | Show me the French output and the German one | "Fully localised in 12 languages" |
| Data residency | Name the storage, processing and backup regions | "Hosted in the cloud" |
| Special category data | Show the access tiers between clinician and manager | User and administrator only |
| Retention | Set a period per record type per country | One global retention setting |
| Works council | Can monitoring features be disabled per country | Not addressed |
| Worker comprehension | Output in the languages my workforce reads | Interface languages only |
| Intervals and signatories | Interval and approved-signatory category per site | One global frequency field |
| Exit | Full export with attachments and audit trail | "We can provide a data dump" |
Score the proposals in front of you. In our experience the cheapest platform and the most expensive platform frequently answer the first four rows identically, and the difference in price sits in features neither group will use.
Why software and advice have to arrive together
A platform is a filing system with workflow attached. It can tell you that an assessment is overdue. It cannot tell you that the assessment was the wrong kind for the jurisdiction, that the interval was taken from the wrong country's rules, or that the result sitting in a manager's queue should never have reached them.
That is the case for buying health and safety consultants and software together rather than sequentially: the configuration decisions above are legal judgements implemented in software, and a vendor cannot make them for you while a consultant without a system cannot hold them. Periodic health and safety audits then test the configuration as well as the compliance, because a platform showing green on every line is only reassuring if the lines were set correctly in the first place.
Where Arinite fits
Arinite has spent 15+ years running one coherent system across many countries, which is why these eight questions are the ones we ask first. We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention. Our health and safety consultants work extensively with IT and software, legal, insurance and office clients, and the configuration questions above come up in every multi-country implementation we see.
Our global health and safety consultants set the local instrument, interval and signatory requirements per jurisdiction so the system is right on day one, and our international health and safety consultants can tell you which of your countries will reject a configuration built around the UK position.
Take the eight rows to whichever platforms you are considering and ask for answers in writing. Then book a free gap analysis and we will tell you in one call which configuration your group actually needs.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
