Is a written risk assessment mandatory in Saudi Arabia, and how often must it be reviewed?

Yes, for establishments with 50 or more workers: the OSH Management Regulation (لائحة إدارة السلامة والصحة المهنية), approved by Ministerial Decision No. 161238 of 10/8/1439 AH (26 April 2018), requires them to identify and assess the risks to workers and to document the results and an action plan. No fixed review interval is set: controls must be reviewed regularly and whenever work changes, and the OSH policy at least every two years.

Short answer

• All employers: Labor Law Articles 122 and 123 require precautions against the hazards of the work and informing workers of them before they start, which in practice means identifying the hazards of each job; a written record is not expressly required below 50 workers but is the only way to show compliance.
• 50 or more workers: the OSH Management Regulation requires an initial review that identifies and evaluates risks, a written action plan with priorities, deadlines, resources and responsible persons, and regular review of the controls.
• Inspection: MHRSD inspectors ask for the hazard register, the document of hazards facing the work environment and the corrective actions taken. Under the violations table of February 2026 (Ministerial Decision No. 112377), each requirement of the regulation not met is fined SAR 300.
• Review: no statutory period such as one or two years; review on change, after incidents and on the establishment's own schedule. The OSH policy must be reviewed at least every two years.
• Higher level: management of change applies only at the higher level of the regulation.

What the OSH Management Regulation requires

The regulation has three levels. The decision applies the intermediate level to establishments with 50 or more workers in listed high-risk activities (construction, oil and gas, electricity, water and gas, health services, mining and quarrying, cement, petrochemicals and listed manufacturing) and the minimum level to establishments with 50 or more workers in all other activities.

At both levels, the establishment must:

1. Carry out an initial review, by its own competent people or an experienced external party, covering legal compliance, identification and evaluation of the risks arising from the work environment and organisation, and whether existing or planned controls are adequate.
2. Turn the findings into a written action plan: prioritise shortcomings, set timetables, allocate human and financial resources and name responsible persons; tell workers the results.
3. Apply prevention and control measures in order: redesign processes where the hazard cannot be removed, substitute less hazardous tasks, tools, machines or substances, and provide suitable PPE.
4. Review, monitor and update the agreed measures regularly so that activities, processes and equipment, including new ones, remain safe.
5. Tell all workers they are expected to identify and report hazards.

The intermediate level adds documented objectives, performance monitoring (proactive monitoring is suggested, for example twice a year), accident investigation and management review at intervals such as quarterly, six-monthly or yearly.

How often to review: a practical approach

Because the texts set no fixed period, a defensible routine is:

The yearly check is good practice, not a Saudi legal requirement. Workers in high-risk occupations also need the task-specific training and licences of the 2025 NCOSH regulation, which relies on the risk assessment to classify jobs.

Common mistakes

• Assuming small firms need nothing. Below 50 workers the regulation does not apply, but Articles 122 and 123 still require hazard precautions and worker information.
• Quoting a legal review period. Saudi texts do not fix one; state the establishment's own interval and its triggers.
• Listing hazards without an action plan. The regulation requires priorities, timetables, resources and named owners.

Related on excodex

• Occupational safety and health in Saudi Arabia: law, authorities and employer duties
• What OSH training must employers provide to workers in Saudi Arabia?
• Workplace risk assessment: process, team, records and review
• Is a safety committee or a worker safety representative required in Saudi Arabia?

Standards and further reading

• Ministerial Decision No. 161238 of 10/8/1439 AH approving the OSH Management Regulation (minimum, intermediate and higher levels): ncosh.gov.sa
• MHRSD OSH inspection mechanism (November 2019): ncosh.gov.sa
• MHRSD violations and penalties table, Ministerial Decision No. 112377 of 21/8/1447 AH (9 February 2026): hrsd.gov.sa
• ISO 45001, OSH management systems, requirements (risk and opportunity assessment).

This article is general occupational safety and health information prepared by the excodex editorial team. It does not replace the applicable legislation, standards, manufacturers' instructions or the assessment of a competent OSH professional or occupational physician.