What is an RI&E?
The RI&E (risico-inventarisatie en -evaluatie, or risk inventory and evaluation) is the mandatory written document in which a Dutch employer records which health and safety risks the work poses to its employees, how serious those risks are, and which measures and deadlines it sets to deal with them. The obligation is laid down in Article 5 of the Working Conditions Act (Arbowet) and applies to every employer with staff, regardless of organisational size. By law, the action plan is part of the RI&E. That makes the RI&E the foundation for the safety policy, for procedures such as work permits and Lock-out Tag-out, and for the choice of personal protective equipment.
Every employer with staff needs an RI&E, even with a single employee, agency worker or intern. If the RI&E is missing, the Netherlands Labour Authority (Nederlandse Arbeidsinspectie) can impose a fine straight away.
🧠 What does the law require an RI&E to contain?
Article 5 of the Arbowet sets the minimum content. In practice it translates into four parts:
- Inventory - all risks of the work, including those for particular groups of workers such as young people, pregnant employees and employees who are breastfeeding. For example:
- Physical: noise, heat, vibration, lifting, moving machine parts
- Electrical: work on or near a control cabinet or MCC
- Chemical: hazardous substances, vapours and explosion risk (ATEX)
- Psychosocial: workload, aggression, harassment, discrimination and unclear tasks
- Evaluation - an estimate of likelihood and severity for each risk, so it is clear what comes first. Many companies use a risk matrix or the Fine and Kinney method.
- Action plan (plan van aanpak, PvA) - which measures you will take, who is responsible and by when. The law makes the action plan part of the RI&E; an RI&E without one is incomplete.
- Updating and access - the RI&E must be revised whenever experience, changed working methods, changed working conditions or the state of the art call for it. Every employee must be able to read the RI&E.
The RI&E must also state how employees can reach the prevention officer, the company doctor and the occupational health service or certified expert. If you hire agency workers, you must give the relevant parts of the RI&E to the agency before the work starts, so it can pass them on to the worker.
🔍 Who reviews the RI&E, and when are you exempt?
Under Article 14 of the Arbowet, the RI&E must be reviewed (getoetst) by a certified core expert (safety expert, occupational hygienist, work and organisation expert or company doctor) or by a certified occupational health service. The reviewer checks whether the RI&E is complete, current and reliable, and advises on the action plan.
| Situation | Review required? | Notes |
|---|---|---|
| More than 25 employees | Yes | Even when you use a sector instrument |
| Up to 25 employees, recognised sector instrument | No | Exemption under Article 14(12); the RI&E itself remains mandatory |
| Up to 25 employees, own method | Yes | The exemption only applies with a recognised instrument |
| All employees together work at most 40 hours a week | No | For example one full-time or two half-time employees |
The headcount is the actual number of people, so part-timers, agency workers and interns count too. Recognised sector instruments are offered by industry associations and through the Steunpunt RI&E (rie.nl), the national RI&E support centre. The prevention officer required by Article 13 helps to draw up and implement the RI&E; with up to 25 employees the employer may take on that role personally. Under Article 12 of the Arbowet, employer and employees work together in carrying out the health and safety policy, and under Article 27 of the Works Councils Act (WOR) the works council has a right of consent on arrangements concerning working conditions.
🏭 What does an RI&E look like in industrial automation?
In factories, process plants and technical service companies the RI&E deals directly with technology. Typical topics in industrial automation are:
- Electrical installations - work under NEN 3140 with designated installation managers and work supervisors, and de-energised work on control cabinets.
- Machinery - risks during operation, changeovers and breakdowns; new machines carry CE marking under the Machinery Directive, and from 20 January 2027 under the Machinery Regulation.
- Maintenance - work on PLCs, variable frequency drives and soft starters, with energy isolation through Lock-out Tag-out and an emergency stop that actually works.
- Explosion risk - under the Dutch Working Conditions Decree (Arbobesluit), the explosion protection document for ATEX zones is part of the RI&E.
- Special workplaces - a confined space, work at height or hot work, usually under a work permit.
- Safety functions - bypassed safety PLCs or altered parameters undermine the functional safety the RI&E relies on.
The outcomes of the RI&E feed into work instructions, toolbox meetings and training, into the selection of PPE, and into emergency and in-house emergency response (BHV) plans.
🔐 Does cybersecurity belong in the RI&E?
The Arbowet does not mention cybersecurity, but the employer’s duty of care is risk-based: any risk that can endanger employees belongs in the RI&E. In automated plants that link is real. An unauthorised change to control software, an attack through remote access, or a machine that starts unexpectedly after a network failure can cause injury directly.
A practical approach is to have the RI&E refer to the technical risk assessment of the OT environment and to the change management process. The RI&E stays an occupational health and safety document, while cyber risks with consequences for people are still visible and prioritised. From 20 January 2027 the Machinery Regulation also requires new machinery to be protected against corruption of its control software, which strengthens the link between machine safety and cybersecurity.
🔄 How does an RI&E differ from other risk documents?
| Document | Legal basis | Scope | Drawn up by |
|---|---|---|---|
| RI&E | Arbowet Article 5 | Organisation-wide, ongoing, per site | Employer |
| H&S plan (V&G-plan) | Arbobesluit, construction processes section | One construction or installation project | Client, through H&S coordinators for the design and execution phases |
| Machine risk assessment | Machinery Directive / ISO 12100 | One machine or installation | Manufacturer or integrator |
| HAZOP | Voluntary method, widely used for the Seveso safety report | Process design and deviations | Multidisciplinary process team |
| Risk management (ISO 31000) | Voluntary standard | All business risks | Management and risk manager |
A health and safety plan (V&G-plan) is required for construction projects that must be notified to the Labour Authority, such as work expected to take more than 500 person-days or lasting more than 30 working days with more than 20 people on site at once, and for work involving particular hazards. The RI&E is structural; the H&S plan is temporary and focused on carrying out one project.
🔧 How do you draw up an RI&E?
- Choose an instrument - a recognised sector instrument via rie.nl or your industry association, or your own method with a certified expert.
- Inventory per site and per job - walk the workplaces and consult employees, accident records, absence figures and maintenance reports. Include machines, control cabinets, ATEX zones and confined spaces.
- Evaluate - determine likelihood, severity and exposure for each risk and rank the risks.
- Draw up the action plan - follow the occupational hygiene hierarchy: tackle the source first, then collective measures, then individual measures, and PPE only as a last resort. Record an owner and deadline for each measure.
- Have it reviewed - unless an exemption applies.
- Discuss it with the works council or staff representatives and make the RI&E available to everyone.
- Implement and update - after an accident or near miss, when introducing new machines or processes, after a rebuild or reorganisation, and after findings from an audit.
Enforcement and fines. During an inspection the Netherlands Labour Authority can ask to see the RI&E and the action plan. Since July 2019 the standard fine for a missing RI&E has been €4,500 and for a missing action plan €3,000; if both are missing, it counts as a single offence. The amount is scaled to company size: an employer with fewer than five employees pays 10% of the standard amount, and the full amount applies from 500 employees. An RI&E that is out of date usually leads to a warning or an order to comply first. Insurers may also pay out less, or nothing, if there is no RI&E. A complete RI&E is therefore a core part of compliance with Dutch occupational health and safety law.
❓ Frequently asked questions
Is an RI&E mandatory for small companies?
Yes, the RI&E is mandatory for every Dutch employer with staff, even with one employee, agency worker or intern. Small companies with up to 25 employees that use a recognised sector instrument only skip the review by a certified expert. The same exemption applies when all employees together work no more than 40 hours a week.
How often must an RI&E be updated?
The Arbowet sets no fixed interval for updating an RI&E. The RI&E must be revised whenever experience, working methods, working conditions or the state of the art call for it, for example after an accident or when a new machine is installed. In practice many companies review the action plan at least once a year.
What does it cost not to have an RI&E?
A missing RI&E is an offence for which the Netherlands Labour Authority can impose a fine straight away, with a standard amount of €4,500 since 2019. A missing action plan carries a standard amount of €3,000. Insurers may also refuse cover, and the employer is in a weaker position on liability after an accident.
Who may review an RI&E?
An RI&E may be reviewed by a certified core expert, such as a senior safety expert, occupational hygienist, work and organisation expert or company doctor, or by a certified occupational health service. The reviewer checks whether the RI&E is complete and up to date and advises on the action plan. The employer remains responsible for the content.
Is an RI&E the same as a machine risk assessment?
No, an RI&E is the employer’s occupational health and safety document covering all risks of the work, whereas a machine risk assessment under ISO 12100 is made by the manufacturer for CE marking. A CE-marked machine can still pose risks in a specific layout or during maintenance. Those risks belong in the user’s RI&E.
Should cyber risks be included in an RI&E?
Cyber risks belong in an RI&E when an attack or a faulty change can endanger employees, for example because a machine starts unexpectedly or a safety function is disabled. The Arbowet does not mention cybersecurity explicitly, but the duty of care is risk-based. Referring to the OT risk assessment and the change management process is a practical way to cover this.
📌 In summary
The RI&E is the mandatory document in which every Dutch employer with staff records and evaluates the risks of the work and controls them with an action plan.
The obligation follows from Article 5 of the Arbowet; review by a certified expert is required unless you have up to 25 employees and use a recognised sector instrument, or your staff work no more than 40 hours a week in total. In industry the RI&E touches on NEN 3140, ATEX, machine safety, work permits and LOTO, and increasingly on changes to control software and remote access as well. Within broader risk management, an up-to-date RI&E prevents fines, but above all it prevents accidents.