Saudi Arabia occupational safety and health regulations sit across a national ministry, a social-insurance body, sector-specific technical authorities and, increasingly, client and giga-project contractual requirements layered on top of the legal minimum. Employers that treat compliance as a single checklist against one law usually miss the layered reality: a factory floor, a construction site and a process plant in the Kingdom each answer to a different mix of these sources. This guide charts the core controls a Saudi employer should map into a practical OSH compliance program, from risk assessment and training through to records, contractor duties and a working legal register.
Saudi Arabia occupational safety and health regulations are set primarily through MHRSD labour and OSH obligations, GOSI's occupational-injury social insurance requirements, HCIS industrial-security expectations for certain high-hazard sectors, and, frequently, additional client HSE specifications — a compliant employer program maps risk assessment, training, records and site controls against all applicable sources, not the labour law alone.
Saudi OSH regulatory landscape
Authority and source hierarchy
The Ministry of Human Resources and Social Development (MHRSD, sometimes still referenced by its earlier name HRSD) is the primary regulator for labour and occupational safety and health obligations on employers operating in the Kingdom, and publishes official OSH guidance including a documented hazard/risk-management guide for employers. The General Organization for Social Insurance (GOSI) administers the occupational-injury branch of social insurance, which is closely tied to how workplace injuries are reported, classified and compensated, and GOSI's contribution and inspection activity gives employers a second compliance thread to manage alongside MHRSD's labour-law obligations. For process industries and certain high-hazard industrial facilities, the Higher Commission for Industrial Security (HCIS) provides an additional layer of industrial-security and process-safety expectations; confirm whether HCIS requirements apply to your specific facility type and sector, since applicability and current requirements are sector-specific and should be verified directly with HCIS or a Saudi HSE legal SME before being treated as settled.
On top of these national sources, large Saudi clients — national oil and gas companies, giga-project developers, petrochemical operators — commonly impose their own HSE specifications as a condition of contract, which frequently exceed the statutory minimum. A Saudi Arabia occupational safety and health compliance program that only tracks the labour law and ignores client specifications will pass a desk audit and still fail a site pre-qualification. Treat MHRSD's official published guidance, GOSI's current requirements, HCIS's sector scope where applicable, and named client specifications as four separate, live sources that each need their own tracked reference in the legal register, and confirm current Arabic-language legal text with a qualified Saudi legal source before relying on any specific clause.
Employer and worker responsibilities
The general duty structure recognizable across Saudi OSH guidance mirrors the pattern seen in most GCC and international systems: employers must provide a workplace and work methods that do not expose workers to unnecessary risk, supply and maintain PPE and safety equipment appropriate to the hazard, train workers in the hazards of their job and the controls provided, and investigate and record occupational injuries and illnesses. Workers, in turn, are expected to follow instructions and safe-work procedures, use PPE and safety equipment as provided, and report hazards, near misses and defective equipment rather than working around them.
Where this responsibility structure most often breaks down in practice is at the contractor and labour-supply boundary — a host employer assumes a staffing or subcontracted firm is training and equipping its own workers, and the subcontractor assumes the host site induction covers it. A compliance program should assign, in writing, which party owns training, PPE, medical fitness and incident reporting for every category of worker on a multi-employer site.
A useful way to test whether responsibilities are actually assigned, rather than assumed, is to pick a single high-risk task performed by a subcontracted crew and trace every duty back to a named owner: who wrote the task risk assessment, who verified the workers were trained for it, who issued and checked the PPE, who authorized the permit if one was required, and who would investigate if something went wrong. If more than one of those answers is "the client will handle it" and more than one is "the subcontractor will handle it" for the same duty, the program has an unresolved gap that an audit or, worse, an incident will expose.
Workplace risk assessment
Hazard identification and control
A documented risk assessment is the foundation MHRSD's published hazard-management guidance and most Saudi client HSE specifications expect employers to maintain: a systematic identification of workplace hazards, an assessment of the risk each presents, and a recorded set of controls following the standard hierarchy — elimination, substitution, engineering controls, administrative controls and PPE, in that order of preference. The assessment should be task- and area-specific rather than a single generic company-wide document, cover routine and non-routine activities (maintenance, confined-space entry, work at height, hot work), and be reviewed when a process, material or workforce changes, not left static between annual audits.
For sites building their first structured risk-assessment program, pairing a recognized identification method with the Saudi-specific hazard set below gives auditors and clients a program they can actually verify evidence against, rather than a narrative policy statement. Himaya's guide to stages-wise hazard analysis and identification techniques sets out the underlying method in more depth.
Two practical failures show up repeatedly when a Saudi risk-assessment program is audited. First, the assessment is written once at project mobilization and never revisited, so it no longer reflects the equipment, materials or workforce actually on site months later. Second, the control column lists PPE against almost every hazard because it is the fastest control to write down, when an engineering or administrative control higher in the hierarchy was available and would have been more effective. An auditor reading the control column for elimination, substitution and engineering entries before PPE entries is a fast, reliable way to judge whether a risk-assessment program is genuinely being used to drive control selection or is being completed as paperwork.
Safety organization, competency and training
MHRSD's guidance and most client specifications expect a defined safety organization scaled to site risk: a nominated safety officer or HSE function for higher-risk sites, documented competency requirements for anyone conducting risk assessments, permit approvals or incident investigations, and a training matrix that maps job role to required induction, task-specific and refresher training. Confirm any specific mandated ratio of safety officers to workforce size, or any mandated qualification for a Saudi safety officer role, against current MHRSD requirements or the applicable client specification — do not assume a fixed number without verification.
Training records should show what was delivered, to whom, by whom, and when refresher training is due; a training matrix with expiry tracking is one of the first documents a client or MHRSD inspection typically asks to see, and gaps here are a frequent and avoidable finding.
Physical, chemical and industrial hazards
Industrial-hazard guidance
Saudi worksites span light manufacturing, heavy industry, petrochemicals and construction, so the hazard set a compliance program must cover is broad: mechanical and machine-guarding hazards, electrical hazards, noise and heat exposure (a materially significant factor given regional climate and outdoor/industrial work), chemical handling and storage, confined spaces, and process-safety hazards in oil, gas and petrochemical operations where HCIS-aligned industrial-security expectations may apply. Each hazard category needs its own control standard referenced in the risk assessment, not a single generic "hazardous materials" line item covering everything from cleaning chemicals to process feedstocks.
Heat stress deserves particular attention in a Saudi program given the climate; a working-in-heat control plan — hydration, acclimatization, work/rest scheduling and monitoring during the hottest months — should be a standing element of the physical-hazard section, reviewed annually rather than assumed unchanged. New workers and those returning from extended leave need a documented acclimatization period before being assigned full-intensity outdoor work, since unacclimatized workers carry materially higher heat-illness risk in their first days on site.
Chemical hazards deserve their own sub-program rather than a line in the general risk assessment: a current chemical inventory, safety data sheets held and accessible for every product on site, and storage/segregation controls that reflect what the SDS actually specifies for that product rather than a generic assumption. Confined-space work — tanks, vessels, pits, sewers — needs a permit system with atmospheric testing, rescue arrangements and attendant requirements documented before entry, not treated as a routine maintenance task. For petrochemical, refining and other process-safety-relevant operations, layered process-safety controls (process hazard analysis, management of change, mechanical integrity) sit alongside the occupational-safety hazards above and are where HCIS-aligned industrial-security expectations are most likely to apply.
PPE and emergency arrangements
PPE provision should be hazard-matched and documented: what PPE is required for each task, the standard it is certified to, replacement/inspection intervals and evidence that workers were trained in its correct use and limitations, not just issued an item. A common finding on Saudi sites is PPE issued at induction and never reassessed against the actual task a worker is later reassigned to — a worker moved from a general labour role to grinding or chemical-handling duties needs the PPE matrix rechecked, not the original induction issue assumed to still be adequate.
Emergency arrangements should cover fire, medical emergency, chemical release and, where relevant, process-safety emergency scenarios, with a documented emergency response plan, trained first-aiders/emergency response team members, and drills conducted and recorded on a defined cycle. The plan should name who calls external emergency services, who accounts for personnel at the assembly point, and how contractors and visitors — who do not know the site layout — are accounted for during an evacuation. Himaya's emergency response training for ERT content sets out what a competent emergency response team program looks like in practice.
Occupational health and incident records
Inspection and corrective action
Occupational health records — pre-placement and periodic medical fitness where relevant to the job, exposure monitoring where applicable, and injury/illness records — sit alongside GOSI's occupational-injury reporting requirements as a parallel record set. Internal inspection and audit findings should be tracked to closure with an owner and a due date, not simply logged; MHRSD and client audits both look for evidence that a previous finding was actually corrected, not just documented as raised. Confirm current GOSI occupational-injury reporting timelines and classification criteria directly with GOSI or a qualified Saudi HSE/legal advisor before publishing them as fixed rules, since reporting requirements can be updated.
Trend analysis matters as much as individual record-keeping: reviewing injury and near-miss records quarterly to identify a repeating location, task or contractor lets a site act before a pattern becomes a serious incident, rather than only reacting after one. Investigation records should distinguish immediate causes from underlying management-system causes, since a corrective action that only fixes the immediate cause tends to see the same incident type recur.
Construction and contractor considerations
Client and sector requirements
Construction sites and contracted work carry additional duties in most Saudi compliance frameworks: contractor pre-qualification on HSE competency and track record, a site-specific construction HSE plan, permit-to-work control for high-risk activities (excavation, work at height, lifting, hot work, confined space), and defined lines of authority between principal contractor and subcontractors for safety supervision. Large developers and national oil and gas clients typically layer their own contractor HSE specification on top of the statutory minimum, covering everything from mandatory reporting formats to minimum safety-staffing ratios; these client specifications should be tracked in the legal register alongside statutory sources because contract non-compliance can stop work independently of any regulatory action.
Multi-tier subcontracting is common on Saudi giga-projects and industrial expansions, and it is where safety accountability most easily gets diluted — a third-tier subcontractor's workforce may never see the principal contractor's induction or safety officer directly. A compliance program should require every tier to flow down the same minimum HSE requirements contractually, and the principal contractor's audit program should sample lower-tier subcontractors directly rather than relying on the first-tier contractor's self-reported assurance.
Build a Saudi HSE legal register
Evidence and document retention
A working legal register for Saudi operations should record, for every applicable requirement: the requirement itself in plain language, its source (MHRSD guidance, GOSI requirement, HCIS scope where applicable, client specification, or a specific law/regulation once verified), the applicability to the specific site or activity, the evidence that demonstrates compliance, the responsible owner, and the last verification date. Because much of the primary legal text exists in Arabic, the register should record both the Arabic source reference and an English working translation, with a note on who verified the translation and when — do not rely on a single unverified translation as the compliance basis for a live requirement.
| Register field | Purpose |
|---|---|
| Requirement (plain language) | What the employer must actually do or provide |
| Source | MHRSD guidance / GOSI / HCIS (where applicable) / client specification / verified law reference |
| Applicability | Which site, activity or worker category the requirement applies to |
| Evidence | Document, record or system output that demonstrates the requirement is met |
| Owner | Person or role accountable for maintaining the evidence |
| Last verified / effective-date check | Date the source and translation were last confirmed current |
Keeping this register current is exactly the kind of ongoing, evidence-linked task a legal-register workflow tool is built for, rather than a static spreadsheet that goes stale after the first update to a source document.
A legal register only proves what it says if the underlying program has actually been tested by an independent safety audit rather than only self-assessed against the register itself. Reviewing that register, and the evidence behind it, is precisely what Himaya's Saudi/GCC HSE compliance gap assessment is built to do: a source-by-source review against MHRSD guidance, GOSI requirements, applicable HCIS scope and named client specifications, translated and verified against current Arabic legal text. Request a Saudi HSE compliance review by writing to info@himpre.com, and ask about a legal-register workflow demo on HSEFQ.com to keep the register live between formal reviews.
Compliance audit checklist
Use this as a Saudi employer OSH compliance checklist for a self-audit or pre-client-audit review.
- Legal register built and current, with source, applicability, evidence, owner and last-verified date for each requirement
- Site-specific, task-level risk assessments in place and reviewed after any process/material/workforce change
- Safety organization defined and scaled to site risk, with competency evidence for assessors, permit approvers and investigators
- Training matrix current, with induction, task-specific and refresher training tracked to expiry
- Hazard-specific control standards documented for mechanical, electrical, chemical, confined-space, heat and (where relevant) process-safety hazards
- PPE matrix hazard-matched, with inspection/replacement intervals and training evidence
- Emergency response plan current, with drills conducted and recorded on a defined cycle
- Occupational health and injury records maintained, GOSI reporting obligations tracked separately and confirmed current
- Inspection and audit findings tracked to closure with owner and due date
- Contractor pre-qualification, site HSE plan and permit-to-work controls in place for construction/high-risk activity
- Client HSE specifications (where applicable) tracked alongside statutory requirements, not assumed identical
- Arabic source text and English working translation both recorded, with translation verification noted
Frequently asked questions
Which authority regulates OSH in Saudi Arabia?
The Ministry of Human Resources and Social Development (MHRSD) is the primary labour and OSH regulator, GOSI administers occupational-injury social insurance, and the Higher Commission for Industrial Security (HCIS) provides additional industrial-security expectations for certain high-hazard industrial sectors. Confirm which of these applies to your specific facility and sector with a qualified Saudi HSE/legal source.
Is a workplace risk assessment required?
Yes — documented, task- and area-specific risk assessment following a standard hazard-identification and control-hierarchy method is expected under MHRSD's published OSH guidance and is near-universal in client HSE specifications, even where a specific clause number is not being quoted here.
What records should employers keep?
At minimum: risk assessments, training records with expiry tracking, PPE issue and inspection records, incident/injury records, GOSI-related reporting evidence, emergency-drill records, and audit/inspection findings tracked to closure, all referenced back to the legal register.
Do construction sites have additional duties?
Yes — contractor pre-qualification, a site-specific construction HSE plan, permit-to-work control for high-risk activities, and clear lines of safety supervision authority between principal contractor and subcontractors are standard additional expectations, often reinforced by client HSE specifications.
How often should compliance be reviewed?
Risk assessments and the legal register should be reviewed whenever a process, material, workforce or regulatory source changes, with a routine periodic review in between; confirm any specific mandated review interval against current MHRSD guidance or the applicable client specification rather than assuming a fixed cycle.
0 Comments