What is VCA?
VCA (VGM Checklist Aannemers, the Dutch Safety, Health and Environment Checklist for Contractors) is a Dutch certification scheme by which contractors demonstrate that they carry out high-risk work safely, healthily and with care for the environment, complemented by personal diplomas that test the basic knowledge of their staff. The scheme has been managed since 1994 by the Stichting Samenwerken Voor Veiligheid (SSVV), a partnership of 26 industry associations. VCA is not legislation, but clients in the process industry, energy, construction, infrastructure and building services almost always require it before you may work on their site.
VCA is not a legal obligation but a contractual entry requirement: without a diploma or certificate you will not get past the gate at many industrial clients.
For the OT world, VCA matters more than it may seem. System integrators, PLC programmers, instrumentation technicians and network specialists working on a production site fall under the same rules as the fitter on the aerial work platform.
🧠 How is VCA structured?
VCA has two layers that are often confused: company certificates and personal diplomas. A company is certified against a checklist of questions on policy, risk control, training, inspections and incident registration. An employee obtains a diploma by passing an exam at an approved exam centre.
The content of the checklist is set by the Central Board of Experts VCA (Centraal College van Deskundigen, CCVD). Clients and contractors sit on it in equal numbers, so the requirements reflect what both sides need in practice. Certification bodies carry out the audits, and SSVV cooperates with the Dutch Accreditation Council (RvA).
Besides VCA, SSVV manages related schemes:
- VCU - the checklist for staffing agencies that supply personnel to high-risk environments
- VCO - the checklist for clients, showing that they select and manage contractors safely
- VCA-MAX - a VCA certificate combined with the optional VCA Behaviour Module (VCA-MG), focused on safety culture and behaviour
- SOG-P - personal qualifications for specific high-risk tasks in the petrochemical industry, such as gas testing and manhole watch
VCA-MAX is gaining weight in construction and infrastructure. From 1 July 2026, the Dutch Governance Code for Safety in Construction (GCVB) requires demonstrable safety awareness at safety culture level 3 (step 3) in tenders by its participating clients. The GCVB accepts VCA-MAX as evidence, for now only for companies with up to 250 employees; larger companies need other evidence, such as a certificate on the Safety Culture Ladder.
VCA came to Belgium in 1999, where it was originally managed by BeSaCC-VCA; SSVV now works there with its Belgian partner CSM, whose certification bodies have recently also started offering VCA-MAX. Internationally, the same scheme is known as SCC (Safety Certificate Contractors). In the Netherlands the Dutch Accreditation Council (RvA) oversees the certification bodies; in Belgium BELAC does so.
🧱 Which VCA certificates exist for companies?
A company certificate is valid for three years. The certification body returns every year for an interim audit, and shortcomings must be resolved within the term it sets, or the certificate is suspended or withdrawn. A VCO certificate can be valid for one or three years. The client decides which level is required.
| Level | For whom? | Characteristic |
|---|---|---|
| VCA* (one star) | Contractors without subcontractors | Basic level, focused on their own work on site |
| VCA** (two stars) | Contractors working with subcontractors | Extra requirements for policy, organisation and managing subcontractors |
| VCA Petrochemie | Contractors in the (petro)chemical industry | Strictest level, with additional requirements for work on process plants |
| VCU | Staffing agencies | Requirements for selecting, informing and supervising temporary workers |
| VCO | Clients | Requirements for how a client selects and supervises contractors |
Since 1 July 2026, VCA 2026/6.1 applies as the successor to VCA 2017/6.0. From that date all new and ongoing certifications are audited against the new scheme. The revision clarifies the wording, aligns more closely with current practice and integrates leadership skills (previously LEI-VCA) into the scheme. The new version affects only company certification, not personal diplomas.
🎓 Which VCA diplomas exist for employees?
A VCA diploma is valid for ten years and the exam centre registers it in the Central Diploma Register (CDR). Clients and employers check there, using surname and date of birth, whether someone holds a valid diploma. According to SSVV, more than 1.5 million people hold a VCA diploma and there are over a thousand exam locations.
| Diploma | For whom? | Notes |
|---|---|---|
| B-VCA (basic safety) | Everyone doing high-risk work or working in a high-risk environment | 40 multiple-choice questions in 60 minutes, language level A2; also modular in four parts |
| VOL-VCA | Operational supervisors and self-employed contractors working as subcontractors | 60 multiple-choice questions in 60 minutes, language level B1; B-VCA material plus leadership and supervision |
| VIL-VCU | Recruitment consultants and supervisors at staffing agencies | 60 multiple-choice questions in 60 minutes; belongs to the VCU scheme |
A self-employed professional working as a subcontractor for a VCA-certified company generally needs VOL-VCA, because they organise their own work. A self-employed professional who is hired in and works under the direction of the hiring company can in principle make do with B-VCA. The modular B-VCA exam has existed since 2023 and was developed with Dutch entry-level vocational education: anyone passing all four modules within one year receives the B-VCA diploma. Most exams are taken on screen with an immediate result; besides Dutch, versions exist in English, German and French, among others. Holders of a Dutch intermediate or higher safety science diploma (MVK/HVK) or MoSHE are exempt from B-VCA and VOL-VCA. SSVV is renewing the exams in 2026: new exam specifications (ETT 3.1) apply from 1 September 2026. Existing diplomas remain valid until their expiry date.
🎯 Which topics does VCA assess?
The checklist and the exams revolve around the same practical themes:
| Topic | What it means in practice |
|---|---|
| Risk inventory | Task risk analyses (TRA), the RI&E and an LMRA just before each task starts |
| Work permits | A work permit for hot work, confined spaces and work on installations |
| Isolating energy | Lock-out Tag-out and de-energised work in line with NEN 3140 |
| Personal protection | Choosing, using and maintaining the right PPE |
| Hazardous substances and explosion risk | Gas testing, ATEX zones and labelling |
| Inspections and tests | Tools, climbing equipment, lifting gear and vehicles |
| Incidents | Reporting and investigating accidents and near misses |
| Safety culture | Toolbox meetings, work consultations and a speak-up culture |
The legal foundation underneath remains the Dutch Arbowet (Working Conditions Act): VCA makes the duty of care of employer and client concrete and auditable.
🏭 What does VCA mean for IT/OT work on site?
Anyone working on OT systems enters the same high-risk environment as other contractors. In practice, a chemical site or power plant asks every visitor who carries out work for at least B-VCA, often supplemented by a site-specific safety induction.
| Situation | What VCA requires |
|---|---|
| Downloading PLC software during a shutdown | Work permit, coordination with the operator and an LMRA before loading the new code |
| Installing a network cabinet in an ATEX zone | Gas-free certificate, suitable tools and supervision by a VOL-VCA-qualified supervisor |
| Replacing instruments during a turnaround | Energy isolation with LOTO, PPE and registration of all contractors involved |
| SAT and commissioning of a new line | Agreements on who may start installations and how interlocks are bypassed |
| Hiring a self-employed automation specialist | VOL-VCA when working as a subcontractor, B-VCA when hired in |
Importantly, a programming change can be just as dangerous as a loosened flange. A modified control strategy or a bypassed function in the SIS therefore belongs in the same permit and change management process as mechanical work. At Seveso sites (see Seveso and Cybersecurity), safe maintenance is also part of the safety management system.
🔧 How do you arrange VCA as an IT/OT service provider?
A system integrator or OT consultancy working at client sites typically goes through these steps:
- List your clients’ requirements - ask each client which level is needed: personal diplomas only, VCA*, VCA** or VCA Petrochemie, plus any site-specific inductions.
- Arrange the diplomas - B-VCA for every employee working on site, VOL-VCA for project managers, commissioning engineers and engineers working independently. Check expiry dates in the CDR and schedule re-exams well before the ten years run out.
- Build the SHE system - an RI&E, an SHE policy statement, task risk analyses for typical jobs (cabinet work, cable pulling, work in ATEX zones), toolbox meetings and incident registration.
- Choose a certification body - it performs the initial audit against VCA 2026/6.1 and returns every year afterwards.
- Link VCA to your technical processes - build the LMRA, work permit and LOTO into your procedures for FAT, SAT and on-call service, so that safety does not become a separate paper system.
| Role in an OT project | Usual diploma | Typical on-site risks |
|---|---|---|
| Service technician or instrumentation technician | B-VCA | Voltage, moving parts, process media |
| PLC or DCS engineer during commissioning | B-VCA, often VOL-VCA | Unexpected start-up of installations, bypassed interlocks |
| Project manager or site supervisor | VOL-VCA | Directing technicians and subcontractors |
| Self-employed OT specialist as subcontractor | VOL-VCA | Organising own work without a supervisor on site |
| Network specialist in a building or server room | B-VCA (if requested) | Working at height, floor hatches, electrical installations |
🔐 Does VCA also cover cybersecurity?
No. VCA covers physical safety, health and the environment, not digital security. A VCA** contractor can still bring an infected laptop or an unsecured maintenance connection on site. That side needs other frameworks:
- IEC 62443-2-4 - requirements for the security capabilities of integrators and maintenance service providers in industrial automation
- Supplier Security and Third Party Risk Management - assessing suppliers and laying down security requirements in contracts
- NIS2 - implemented in the Netherlands by the Cyberbeveiligingswet, in force since 15 August 2026, which requires essential and important entities to manage the security of their supply chain
A mature client combines both: VCA for anyone working physically on the installation, and cybersecurity requirements for anyone gaining digital access to the control system. The work permit is a logical point to bring the two together.
🔄 What is the difference between VCA and ISO 45001?
| Aspect | VCA | ISO 45001 |
|---|---|---|
| Focus | Practical safety at the contractor’s workplace | Management system for occupational health and safety across the whole organisation |
| Certification | Company certificate plus personal diplomas | Organisation (management system) only |
| Status | Private scheme, contractually required | Voluntary international standard |
| Validity | Certificate three years, diploma ten years | Certificate three years with annual audits |
| Reach | Mainly the Netherlands and Belgium | Worldwide |
Many contractors hold both. ISO 45001 requires control of contractors in clause 8.1.4, and in the Netherlands VCA is the common way to demonstrate it.
❓ Frequently asked questions
Is VCA legally required?
VCA is not a legal requirement but a private certification scheme managed by SSVV. Clients do, however, often make VCA mandatory in contracts and tenders. Without a VCA diploma or certificate you will not be admitted to many industrial sites in the Netherlands and Belgium.
How long is a VCA diploma valid?
A VCA diploma such as B-VCA or VOL-VCA is valid for ten years. After that you must pass the exam again. Validity can be checked in the Central Diploma Register (CDR).
What is the difference between B-VCA and VOL-VCA?
B-VCA is the basic diploma for everyone who carries out high-risk work. VOL-VCA is intended for operational supervisors and self-employed contractors working as subcontractors, and additionally covers topics such as giving instructions and supervising. A VOL-VCA holder does not need a separate B-VCA diploma.
What is VCA 2026/6.1?
VCA 2026/6.1 is the new version of the VCA checklist for companies, which replaced VCA 2017/6.0 on 1 July 2026. From that date all audits are carried out against the new scheme. Personal diplomas remain valid as before.
Does an OT engineer need VCA?
An OT engineer working on an industrial site in the Netherlands needs at least B-VCA for most clients. Self-employed engineers working as subcontractors, or anyone leading a team, usually need VOL-VCA. VCA does not cover cybersecurity, for which requirements such as IEC 62443-2-4 apply.
What is VCA-MAX?
VCA-MAX is a VCA company certificate combined with the VCA Behaviour Module, which assesses safety behaviour and safety culture. The Dutch Governance Code for Safety in Construction accepts VCA-MAX as evidence for safety culture level 3, for now for companies with up to 250 employees. VCA-MAX is also available in Belgium through SSVV’s Belgian partner.
📌 In summary
VCA is the Dutch safety scheme for contractors: companies obtain a certificate (VCA*, VCA** or VCA Petrochemie, valid for three years) and employees a diploma (B-VCA or VOL-VCA, valid for ten years).
VCA 2026/6.1 has applied since 1 July 2026. For IT/OT professionals, VCA is the access card to the installation, but no substitute for cybersecurity requirements: combine VCA with safety policy, work permits and supplier security in line with IEC 62443.