How often must the safety and health programme be updated?

At least once a year (NOM-030-STPS-2009, point 4.4). In workplaces with fewer than one hundred workers, the list of preventive and corrective actions is also updated at least once a year (point 4.4.1).

Who can be the safety and health officer?

The employer or a person the employer appoints, internal or external (points 3.11 and 4.1). In workplaces with fewer than one hundred workers, the employer may carry out the preventive functions personally (point 4.1.1).

What must the programme contain?

At least the preventive or corrective action for each issue identified, health promotion and addiction prevention actions, emergency and health contingency actions, start and end dates and the person responsible for each action (point 7.1). The list of actions for workplaces with fewer than one hundred workers does not need the person responsible for each action (point 7.2).

How long must the records be kept?

At least two years (points 4.8 and 9.3). They may be shown on paper or in electronic form (point 9.4).

MX · Expiry & renewal tracking

Never let the safety and health programme go a year without an update

Every workplace in Mexico must have a safety and health diagnosis and a programme, or a list of actions where there are fewer than one hundred workers, updated at least once a year (NOM-030-STPS-2009, points 4.3 and 4.4). The person designated by the employer prepares it and reports in writing (point 5.7).

NOM-030-STPS-2009, Preventive occupational safety and health services - Functions and activities (DOF 22/12/2009), applies throughout Mexico and in every workplace (point 2). Its purpose is to set the functions and activities that preventive safety and health services must carry out to prevent occupational accidents and illnesses (point 1).

The employer must appoint an occupational safety and health officer, internal or external (point 4.1); in workplaces with fewer than one hundred workers, the employer may take on these functions personally (point 4.1.1). The employer must also have a diagnosis of the workplace's safety and health conditions, either for the whole site or by work area (point 4.3).

The diagnosis identifies at least the hazardous or unsafe physical conditions, the physical, chemical and biological agents in the working environment, surrounding hazards where possible, and the applicable regulatory requirements (point 6.1). In workplaces with fewer than one hundred workers it may cover the whole site and contain at least those regulatory requirements (point 6.2).

Based on the diagnosis, the employer must have an occupational safety and health programme, which must be updated at least once a year (point 4.4). Workplaces with fewer than one hundred workers prepare a list of preventive and corrective actions instead, which must also be updated at least once a year (point 4.4.1). The officer reports progress to the employer in writing at least once a year (point 5.7).

Start free

At a glance

Who it applies to	Every workplace in Mexico (NOM-030-STPS-2009, point 2)
Safety and health programme	Based on the diagnosis; updated at least once a year (point 4.4)
Fewer than one hundred workers	List of preventive and corrective actions, updated at least once a year (point 4.4.1)
Progress report	In writing to the employer, at least once a year (point 5.7)
Diagnosis	Whole site or by work area, with the content of point 6.1 (points 4.3 and 6.1)
Minimum programme content	Actions, start and end dates and the person responsible for each action, among others (point 7.1)
Record keeping	At least two years (points 4.8 and 9.3)
Verification unit opinion (optional)	Valid for two years if the conditions it was based on do not change (point 8.5)

The standard sets a yearly update for the programme or list of actions and for the progress report, but sets no separate frequency for redoing the diagnosis; the officer must check that the programme achieves its purpose and, where needed, adjust both the diagnosis and the programme (point 5.9).

Who is responsible?

The employer appoints the safety and health officer and gives them access, information and resources (points 4.1 and 4.2); with fewer than one hundred workers the employer may take on the functions personally (point 4.1.1). The officer prepares the diagnosis and the programme or list of actions, tracks progress and reports it to the employer in writing (points 5.1, 5.2 and 5.7). The employer shares the diagnosis and programme with the safety and hygiene committee and/or the workers (point 4.5) and may, optionally, hire an accredited and approved verification unit (point 8.1).

If the deadline passes

Enforcement of NOM-030-STPS-2009 is the responsibility of the Ministry of Labour and Social Welfare (STPS) (point 10). In the conformity assessment, the employer complies by showing a programme or list of actions updated at least once a year (point 9.2). Employers must comply with the official standards on occupational safety and health (Federal Labour Law, Article 132, section XVII), and there are sanctions for employers who do not observe safety and hygiene standards (Federal Labour Law, Articles 992 and 994, section V).

What expires each year is the programme, not a certificate

NOM-030-STPS-2009 does not issue a certificate with an expiry date: what must be updated at least once a year is the occupational safety and health programme or the list of preventive and corrective actions (points 4.4 and 4.4.1). Record the date of the last update plus twelve months as the expiry date. If you hire a verification unit, its opinion has a different validity of two years (point 8.5).

Tracking it with ExpirySuite

Add a record for each workplace and enter the date of the last programme or action-list update plus twelve months as the expiry date.
Email reminders arrive 60, 30, 14, 7 and 1 day before the expiry date and on the day, giving time to review the diagnosis, update the actions and prepare the progress report.
An external safety and health officer can upload the updated programme through a secure link that is valid for 14 days and needs no account.
Assign a responsible person, such as the safety team; if the date passes without an update, managers get further reminders 3, 7 and 14 days later.

Frequently asked questions

How often must the safety and health programme be updated?: At least once a year (NOM-030-STPS-2009, point 4.4). In workplaces with fewer than one hundred workers, the list of preventive and corrective actions is also updated at least once a year (point 4.4.1).
Does the diagnosis also have to be redone every year?: The standard sets no separate frequency for the diagnosis. The officer must check that the programme achieves its purpose and, where needed, adjust both the diagnosis and the programme or list (point 5.9).
Who can be the safety and health officer?: The employer or a person the employer appoints, internal or external (points 3.11 and 4.1). In workplaces with fewer than one hundred workers, the employer may carry out the preventive functions personally (point 4.1.1).
What must the programme contain?: At least the preventive or corrective action for each issue identified, health promotion and addiction prevention actions, emergency and health contingency actions, start and end dates and the person responsible for each action (point 7.1). The list of actions for workplaces with fewer than one hundred workers does not need the person responsible for each action (point 7.2).
How long must the records be kept?: At least two years (points 4.8 and 9.3). They may be shown on paper or in electronic form (point 9.4).

Sources

Last checked: Oct 11, 2026 · This page summarises official sources for general information and is not legal advice. Check the linked sources for current rules and fees.

Made for OHS programme, annual update (NOM-030) (Mexico)

A ready template for OHS programme, annual update (NOM-030) (Mexico) with sensible validity defaults, so you enter less and track more.

Reminders on time

Email alerts at 60, 30, 14, 7 and 1 day before each OHS programme, annual update (NOM-030) (Mexico) expires, plus overdue escalation to managers.

Assign an owner

Give each OHS programme, annual update (NOM-030) (Mexico) an owner and let employees update their own via a secure link — no login needed.