NOM-035 Compliance Guide for Mexican Employers 2026

NOM-035-STPS-2018, commonly known as NOM-035, is a Mexican Official Standard that requires all employers with workers in Mexico to identify, analyze, prevent, and control psychosocial risk factors in the workplace. Since its full implementation in October 2020, it has become one of the most important compliance requirements for companies operating in Mexico.

Yet many organizations — particularly multinational companies with Mexican operations — still don't fully understand what it requires or how to implement it effectively. This guide breaks it down clearly.

What is NOM-035?

NOM-035 was issued by Mexico's Secretariat of Labor and Social Welfare (STPS) to address the growing problem of work-related psychosocial risks. These include excessive workloads, workplace violence, harassment, discrimination, and organizational factors that damage employee mental health.

The standard applies to all employers and employees in Mexico, regardless of company size or industry. However, the specific requirements vary by company size:

• Up to 15 workers: Distribute a reference guide on psychosocial risk factors and implement a violence prevention policy
• 16 to 50 workers: All of the above, plus conduct an organizational environment assessment and implement corrective measures
• More than 50 workers: All of the above, plus establish a monitoring mechanism and keep records of results

What are psychosocial risk factors?

NOM-035 defines psychosocial risk factors as conditions found in the work environment that, when present for a prolonged period, can cause stress, anxiety, burnout, and other health damage. The standard identifies six categories:

• Work conditions: Excessive workload, monotonous tasks, lack of rest periods
• Work organization: Unclear roles, poor communication, lack of participation in decisions
• Leadership style: Authoritarian management, lack of support, micromanagement
• Workplace violence: Harassment, bullying, sexual harassment, discrimination
• Work-family interface: Imbalance between work demands and personal life
• Traumatic events at work: Exposure to accidents, violence, or high-stress situations

What does NOM-035 actually require you to do?

1. Implement a prevention policy

Companies must establish a written policy for preventing psychosocial risks and workplace violence. This policy must be communicated to all employees, posted in visible areas, and updated regularly.

2. Conduct organizational environment assessments

Companies with more than 15 employees must conduct periodic assessments to identify psychosocial risk factors. These assessments use validated questionnaires approved by STPS and must be conducted confidentially.

3. Establish reporting mechanisms

Employees must have a clear, accessible way to report psychosocial risks and workplace violence — including a confidential channel where they can do so without fear of retaliation. This is where anonymous reporting becomes not just useful but specifically required by the standard.

4. Implement corrective measures

Based on assessment results, companies must implement specific corrective actions — training programs, workflow changes, management coaching, or other interventions — and document that these actions were taken.

5. Keep records

Companies with more than 50 employees must maintain documented records of their NOM-035 compliance activities, including assessment results, corrective actions taken, and their effectiveness. In the event of an inspection by STPS, these records are your evidence of compliance.

The penalties for non-compliance

STPS inspectors can visit any workplace unannounced. Non-compliance with NOM-035 can result in fines ranging from 250 to 5,000 times the daily minimum wage per violation — which at current rates translates to roughly MXN $6,000 to $120,000 per infraction. Multiple violations can compound rapidly.

Beyond fines, the more serious risk is civil liability. An employee who experiences harassment or psychosocial harm and demonstrates that the company failed to comply with NOM-035 has a significantly stronger case in labor court.

How anonymous reporting supports NOM-035 compliance

NOM-035 explicitly requires a confidential reporting mechanism where employees can report psychosocial risks and workplace violence without fear of retaliation. An anonymous reporting platform like Integri-Line satisfies this requirement directly — and goes further by providing the documentation trail that STPS inspectors look for.

Specifically, Integri-Line supports NOM-035 compliance by:

• Providing a confidential, anonymous intake channel that meets the standard's reporting requirement
• Automatically categorizing incoming reports by type (harassment, discrimination, safety risk, etc.)
• Generating a tamper-proof audit trail of every case — exactly the records STPS requires
• Producing board-ready reports that document your compliance activities
• Operating in Spanish — ensuring all employees can report in their primary language

Getting started: a practical NOM-035 checklist

• ✓ Draft and publish your psychosocial risk prevention policy
• ✓ Post the policy in visible areas and distribute to all employees
• ✓ Implement an anonymous reporting channel that employees can access confidentially
• ✓ Conduct your baseline organizational environment assessment
• ✓ Identify specific psychosocial risk factors present in your organization
• ✓ Implement corrective measures and document them
• ✓ Set a calendar reminder for annual reassessments
• ✓ Train managers on psychosocial risk recognition and prevention

NOM-035 is not a checkbox exercise. An STPS inspector looking at your compliance documentation wants to see evidence that you actually identified risks, actually addressed them, and actually gave employees a safe way to report. That evidence doesn't exist if you haven't documented it.

Conclusion

NOM-035 represents a meaningful shift in how Mexican labor law treats employee wellbeing. For companies with operations in Mexico, compliance is not optional — but it's also not as complex as it might seem. The foundation is straightforward: identify the risks, give employees a safe way to report them, address what you find, and document everything.

Integri-Line was built with exactly this kind of compliance in mind — bilingual, anonymous, documented, and deployed in 48 hours.