Arbowet

What is the Arbowet?

The Arbowet (in full Arbeidsomstandighedenwet, the Dutch Working Conditions Act) is the Dutch law that obliges employers and employees to work together to ensure safe and healthy working conditions and the welfare of employees at work. The Act sets out the main rules, such as the employer’s duty of care and the mandatory RI&E. The detailed technical requirements are in the Working Conditions Decree (Arbobesluit) and the Working Conditions Regulation (Arboregeling). For factories, process plants and technical service providers, the Arbowet is therefore the legal basis behind every work permit, every lock-out procedure and every emergency stop.

🧠 How is the Arbowet structured?

The Arbowet works like a pyramid. The Act itself is short and general; the detail is in secondary legislation and in agreements within each sector.

Since the 2007 revision, the government mainly sets goal-oriented requirements: the level of protection to be achieved. How you achieve it is up to you, for example with a sector catalogue (arbocatalogus) or a standard. Standards are therefore not legally binding in themselves, but if you deviate from them you must be able to show that your solution is at least as safe. The European basis is Framework Directive 89/391/EEC on safety and health at work.

🧱 What duties do employers and employees have?

The key articles of the Arbowet at a glance:

The order in Article 3 is known as the occupational hygiene strategy. For a machine this means: first remove the hazard by design, then guard it with fences, light curtains or interlocks, then apply organisational measures, and only as a last step personal protection.

🏭 What does the Arbowet mean in an industrial environment?

In factories and process plants the Arbowet becomes concrete through the Arbobesluit. Several parts relate directly to automation and installation engineering:

• Electrical installations (Art. 3.4 and 3.5) - work on or near a control cabinet or MCC is in practice carried out according to NEN-EN 50110-1 with the Dutch supplement NEN 3140; the design of low-voltage installations follows NEN 1010.
• Explosive atmospheres (Art. 3.5a to 3.5f) - zoning and an explosion protection document under the ATEX workplace directive.
• Major accidents involving hazardous substances (Chapter 2, Section 2) - the occupational part of the Seveso rules; see Seveso and Cybersecurity.
• Inspections (Art. 7.4a) - work equipment whose safety depends on its installation or conditions of use must be inspected.
• Work equipment with a control system (Art. 7.12 to 7.16) - requirements for the control system and control devices, for safe starting and stopping, and for the emergency stop device.
• Display screen work (Chapter 5, Section 2) - relevant to control room operators who spend the whole shift behind an HMI.
• Confined spaces and fall hazards - work permit, standby attendant and rescue plan.

For machines you buy, product legislation governs safety at the point of supply: the Machinery Directive and, from 20 January 2027, the Machinery Regulation, demonstrated by CE marking. The Arbowet then governs safe use. If you modify machines or combine them into a new installation, you may become the manufacturer yourself and then carry both responsibilities.

🔐 How does the Arbowet relate to OT security?

The Arbowet does not mention cybersecurity, but the duty of care is risk-based. If a failure of or attack on a control system can endanger people, that risk belongs in the RI&E. In automated plants this link is real:

• Unexpected remote start-up - a PLC that is changed or started via remote access can endanger a technician working without a physical lock.
• Disabled safeguards - bypassed safety PLCs or altered parameters undermine the functional safety the RI&E relies on.
• Missed alarms - poorly designed alarm management or a failed HMI can cause an operator to intervene too late.

That is why more and more companies connect their health and safety procedures to OT security: digital changes go through change management, work permits also cover PLC changes, and security awareness is part of the safety instruction. Since 15 August 2026 the Dutch Cybersecurity Act has also applied to many energy, water and chemical companies, and the Machinery Regulation requires control systems to be protected against tampering.

🔧 How do you put the Arbowet into practice in a technical organisation?

A practical approach for a production site or maintenance department:

1. Draw up or update the RI&E - include machines, control cabinets, ATEX zones, confined spaces and also remote access and changes to control software. Use a risk assessment or HAZOP for complex installations.
2. Have the RI&E reviewed - by a certified core expert, unless you have no more than 25 employees and use a recognised sector tool.
3. Prepare an action plan - with owners and deadlines, prioritised according to the occupational hygiene strategy.
4. Document working procedures - work permits, Lock-out Tag-out, NEN 3140 designations, task risk analyses (TRA) for non-routine jobs and emergency procedures.
5. Instruct and train - operators, technicians and contractors, for example through VCA for contractors.
6. Inspect and maintain work equipment - including periodic testing of emergency stops, interlocks and safety functions.
7. Report and investigate incidents - report serious accidents immediately, record near misses and establish the cause with a root cause analysis.
8. Evaluate periodically - Article 3 requires the policy to be reviewed regularly; a management system based on ISO 45001 helps with this and builds an active safety culture of continuous improvement.

Supervision and sanctions. The Netherlands Labour Authority (Nederlandse Arbeidsinspectie) supervises compliance. It can issue a compliance order, halt work immediately in case of serious danger and, after repeated violations, suspend work for up to three months. Administrative fines go up to the fifth fine category (more than €100,000), or the sixth category for breaches of the major-accident duties in Article 6, and are doubled or tripled for repeat violations within five years (ten years for serious violations). In 2025 the inspectorate recorded 59 fatal victims of occupational accidents, received 4,807 accident reports and started 3,044 accident investigations.

❓ Frequently asked questions

Who does the Arbowet apply to?

The Arbowet applies to every employer with at least one employee, regardless of sector or size. Agency workers, interns and hired staff are also protected by the Arbowet. Self-employed people without staff have only a limited set of obligations, mainly where their work can endanger others.

Is an RI&E mandatory under the Arbowet?

Yes, Article 5 of the Arbowet requires every employer with staff to have a written RI&E with an action plan. A certified core expert must review the RI&E, except for companies with up to 25 employees that use a recognised sector tool. You must update the RI&E whenever working methods, installations or circumstances change.

When must an occupational accident be reported?

Under Article 9 of the Arbowet, the employer must report an occupational accident to the Netherlands Labour Authority immediately if it results in death, permanent injury or hospital admission. For a fatal or life-threatening accident you call 0800 51 51; other accidents are reported online. Accidents causing more than three working days of absence must also be recorded.

Are NEN standards such as NEN 3140 legally mandatory?

NEN standards are not legally binding in themselves, but the Arbowet and the Arbobesluit require a level of protection that in practice corresponds to the state of the art. NEN 3140 is therefore the accepted way to work safely on electrical installations in the Netherlands. If you choose a different method, you must be able to show that it is at least as safe.

What does a prevention officer do?

The prevention officer (preventiemedewerker) is the employee who supports the employer with health and safety tasks under Article 13 of the Arbowet, such as drawing up and implementing the RI&E and providing information. Every employer must have at least one prevention officer. With up to 25 employees, the employer may take on this role personally if sufficiently competent.

Does cybersecurity fall under the Arbowet?

The Arbowet does not explicitly mention cybersecurity, but the duty of care covers every risk that can endanger employees. An attack or faulty change that makes a machine start unexpectedly or disables a safeguard therefore belongs in the RI&E. The specific cybersecurity obligations are set out in the Dutch Cybersecurity Act and the Machinery Regulation.

📌 In summary

The Arbowet is the foundation of safe working in the Netherlands. The Act sets the main rules such as the duty of care, the RI&E, instruction and the reporting duty; the Arbobesluit works them out for electricity, explosive atmospheres, work equipment and control systems. In industry this results in work permits, LOTO, inspections and emergency stops, and increasingly also in agreements on digital changes and remote access.

The Arbowet requires employers and employees to identify risks systematically and tackle them at the source; in an automated plant that includes the risks of control systems and remote access.