Your EAP is not a risk assessment

I work in this field, so I include myself in that.

On Tuesday 13th October, the European Agency for Safety and Health at Work (EU-OSHA) launched its 2026 to 2028 Healthy Workplaces campaign in Brussels. It is called Together for mental health at work, and its first big moment, European Week for Safety and Health at Work, started on Monday 19 October.

The campaign site puts its core message in one line: “Preventing and managing work-related psychosocial risks is the cornerstone of good mental health at work.”

Not support. Not awareness. Prevention.

Last issue I wrote about Employee Assistance Programmes. This one picks up where that left off. Support matters. But support sits downstream of the hazard, and the law points upstream.

What the law already says

This isn’t new. Section 19 of the Safety, Health and Welfare at Work Act 2005 says every employer “shall identify the hazards in the place of work under his or her control, assess the risks presented by those hazards and be in possession of a written assessment”.

The Act doesn’t use the word psychosocial. It doesn’t need to. The Health and Safety Authority’s Managing Psychosocial Hazards in the Workplace (2023) is clear that employers have a responsibility to manage known psychosocial hazards, to identify them through a risk assessment, and to put control measures in place for the hazards they find.

And then there is the line that should be printed on every wellbeing strategy in the country. The HSA notes that an EAP “is a mitigating measure, but of itself is not enough to make for a control.”

Not a control. A mitigation.

An EAP helps a person cope with what work is doing to them. A control changes what work is doing to them. Both have a place. Only one of them is a risk assessment.

What Irish workers are telling us

In September 2025 EU-OSHA published country factsheets from its OSH Pulse 2025 survey, a Flash Eurobarometer of 25,688 workers across the EU27, including 1,009 in Ireland, carried out between 31 March and 14 April 2025.

27% of Irish workers said stress, depression or anxiety had been caused or made worse by their work in the previous 12 months. Across the EU the figure was 29%. Roughly the same story, here and across Europe.

The more interesting numbers are about what workplaces offer in response. Irish workers reported these as available where they work:

• Awareness raising, information or training on wellbeing and coping with stress: 70% (EU 53%)
• Consultation of workers about stressful aspects of work: 53% (EU 45%)
• Access to counselling or psychological support: 51% (EU 40%)
• Other measures to address stress at work, such as changes in work organisation, setting priorities or better communication: 42% (EU 35%)

On paper, Ireland is ahead of the EU on every line. And yet the gap inside our own numbers is the story. Seven in ten workers can find information about coping with stress. Around four in ten see changes to how the work itself is organised.

We are good at helping people cope with work. We are less good at changing it.

The same survey points to where to look. One in three Irish workers (35%) reported severe time pressure or work overload. That is lower than the EU’s 44%, which is worth saying. But 33% reported poor communication or cooperation within the organisation, higher than the EU’s 29%. And 19% reported violence or verbal abuse from customers, patients or pupils, against 16% across the EU.

For a sense of scale when someone counts the cost, look next door. The Health and Safety Executive in Great Britain estimates that 964,000 workers there suffered work-related stress, depression or anxiety in 2024/25, with 22.1 million working days lost. That accounted for 52% of all work-related ill health. Different country, different survey, different method, so I won’t pretend it maps onto Ireland. But it shows what this looks like when it is measured as an occupational health problem rather than a wellbeing one.

Five hazards I would put on a register tomorrow

This part is my view, shaped by the HSA guidance rather than lifted from it. The HSA groups the main stressors under six headings: demands, control, support, relationships, role and change. If I were starting a psychosocial register from a blank page on Monday, these are the five I would write down first.

Workload. The type and amount of work, and the time people are given to do it. A control is a decision about staffing, deadlines or priorities. A time management webinar is not.

Role clarity. Conflicting demands, two managers asking for two different things, nobody sure who owns what. The control is a clear answer to “what is my job?”, written down.

Control. How much say people have over how and when they do their work. Only 10% of Irish workers in OSH Pulse reported a lack of autonomy, against 17% across the EU. That is a strength worth protecting. In the same survey, 63% of Irish workers said digital technology determines the speed or pace of their work (EU 48%).

Conflict. Bullying, poor relationships between colleagues, and abuse from customers or the public. The HSA already has a Code of Practice on bullying. The control is a policy people trust and managers who act on it.

Change. Restructures, new systems, new reporting lines. The HSA names poorly managed organisational change as a hazard in its own right. The control is timely notice, real consultation and a plan for the people, not only the process.

Support, the sixth HSA heading, belongs on the register too. It means support from managers and colleagues. It does not mean the EAP.

Why the wellbeing team should not own the register

I’ve come to believe this, and I know it will not be a popular view in my own profession.

The person who owns a hazard needs the authority to change it. Workload is controlled by whoever sets headcount and deadlines. Role clarity is controlled by line managers. Change is controlled by whoever runs the change programme. Very few wellbeing leads hold any of those levers.

When the wellbeing team owns the register, something predictable happens. Hazards turn into programmes. Workload becomes a resilience workshop. Conflict becomes a mindfulness course. Change becomes a webinar on adapting to change. Each one is well meant. None of them is a control.

This is not about stepping back. It’s about standing in the right place. The register belongs with whoever owns your safety statement, with line management accountable for the controls and senior leadership signing it off. The wellbeing team brings what it is good at: employee voice, data on what people are telling us, and tools like the HSA’s free, confidential Work Positive psychosocial risk assessment. And it holds one line firmly: the EAP goes on the register as a mitigation, never as the control.

EU-OSHA is about to spend three years saying this. We could get there a little sooner.

If someone asked to see your psychosocial risk assessment tomorrow, would you hand them a register, or a phone number?

What I’m reading or listening to

Picked up a copy of Amy Morin’s latest book, The Mental Strength Playbook, that offers us 50 tools to cope with stress, thrive under pressure, and gain a competitive advantage in the workplace. Loving this book so far, it’s a series of plays that are easily implemented into daily life when needed.

Stat of the month

27% of Irish workers said stress, depression or anxiety had been caused or made worse by their work in the last 12 months.

Source: EU-OSHA, Ireland: OSH Pulse 2025, Mental health and digitalisation at work (23 September 2025). 1,009 interviews in Ireland, fieldwork 31 March to 14 April 2025. EU27 figure: 29%.

One thing to try this week

Ask to see your organisation’s risk assessment and safety statement. Search it for “stress”, “psychosocial”, “workload” and “bullying”. If nothing comes up, or the only control listed is the EAP, you have found your first conversation with your health and safety colleagues. Take the HSA’s 2023 guidance with you. It is six pages long.