What the OSH Amendment Act 2022 Means for Psychosocial Risk

The OSH (Amendment) Act 2022 is the law that updated Malaysia's Occupational Safety and Health Act 1994 (Act 514), in force since 1 June 2024. It extends the Act to almost every workplace, adds a duty to carry out risk assessments, requires an OSH coordinator for employers with five or more staff and raises maximum fines to RM500,000.

For HR and People leaders, the change that matters most is the risk assessment duty. DOSH has made clear, through its 2024 psychosocial guidelines, that this duty covers psychosocial risks such as excessive workload, bullying and poor support. This article explains what changed, how mental health fits into the law and the steps employers should take now. It is general guidance, not legal advice.

What is the OSH (Amendment) Act 2022?

The Occupational Safety and Health (Amendment) Act 2022, Act A1648, amends the Occupational Safety and Health Act 1994. The Minister appointed 1 June 2024 as its commencement date through a notice gazetted as P.U. (B) 128 on 2 April 2024, published on the DOSH website. The whole Act came into force on that single date.

The Department of Occupational Safety and Health (DOSH, also known as JKKP) enforces it. DOSH sits under the Ministry of Human Resources (KESUMA).

What are the key changes for employers?

The amendments are broad. These are the changes most relevant to HR, compliance and leadership teams.

1. Wider scope: almost every place of work

Before June 2024, OSHA 1994 applied only to the industries listed in its First Schedule, such as manufacturing, mining and construction. The amended Act applies to all places of work throughout Malaysia, subject to limited exceptions. Offices, retail, technology firms and professional services are now covered, and existing duties such as the written safety and health policy under section 16 reach most employers.

2. Duty to carry out risk assessments (section 18B)

New section 18B requires employers to assess the safety and health risks to anyone affected by their work and to implement control measures where the assessment shows they are needed. Breach is punishable under the amended section 19 with a fine of up to RM500,000, up to two years' imprisonment, or both.

3. Duties of principals (section 18A)

Principals must take reasonable steps to ensure the safety and health of contractors, subcontractors and their employees while at work. This matters for organisations that rely on outsourced staff, agency workers or facilities contractors.

4. OSH coordinator (section 29A)

Employers with five or more employees must appoint an employee as an occupational safety and health coordinator, unless they already have a safety and health officer appointed under section 29. Failure to appoint carries a fine of up to RM50,000, up to six months' imprisonment, or both.

5. Employee right to remove themselves from danger (section 26A)

Employees gain a right to remove themselves from work where they have reasonable grounds to believe there is imminent danger.

6. Higher penalties and wider personal liability

According to a Herbert Smith Freehills Kramer briefing, the main penalty changes are:

• General duties to employees and the safety and health policy: maximum fine raised from RM50,000 to RM500,000.
• General penalty under section 51: raised from RM10,000 to RM100,000.
• Failure to comply with an improvement or prohibition notice under section 48: raised from RM50,000 to RM500,000.
• Failure to establish a safety and health committee: fine raised from RM5,000 to RM100,000.

Liability also extends beyond directors to compliance officers, partners and anyone who manages or helps to manage the company's affairs. They may be presumed liable unless they show the offence happened without their knowledge and that they exercised due diligence.

How do psychosocial risks fit into the amended Act?

OSHA 1994 has always aimed to promote a work environment adapted to workers' physiological and psychological needs. The 2022 amendment gave that aim teeth. The risk assessment duty in section 18B covers health risks, and DOSH's Guidelines on Psychosocial Risk Assessment and Management at the Workplace 2024 state that this includes psychosocial risks.

The guidelines, launched on 26 October 2024 and known as PRisMA, define psychosocial risk as the likelihood of exposure to a psychosocial hazard combined with the severity of harm it could cause. Hazards named include:

• Workload, such as excessive work or unrealistic deadlines.
• Low job control and lack of autonomy.
• Unclear roles and responsibilities.
• Poor communication, conflict and weak social support.
• Organisational culture problems, including bullying, harassment and discrimination.
• Poor work-life balance, such as inflexible schedules or long hours.
• Limited career development.

The guidelines themselves are framed as guidance that workplaces are encouraged to adopt. The underlying duty to assess and control risk, however, is statutory. In May 2026, the New Straits Times reported that DOSH is moving to frame psychosocial wellbeing explicitly as a legal duty under the Act, linked to the OSH Master Plan 2026 to 2030 (OSHMP30). Employers should treat psychosocial risk assessment as part of compliance, not as an optional wellbeing extra.

What does the PRisMA process involve?

PRisMA follows three stages and 11 steps, with record keeping throughout.

• Stage I, hazard identification: employees complete LEO26, a 26-item screening tool covering job control, work demand and job support, and the organisation's risk status is calculated.
• Stage II, risk assessment: where LEO26 results are high risk, the employer completes EPC23, a 23-point employer practice checklist, and risks are prioritised.
• Stage III, risk control: the employer sets out actions in a Psychosocial Risk Management Plan of Actions and reassesses later.

The guidelines recommend appointing a Psychosocial Trained Person to run the process and keep information confidential. The report goes to the employer within 30 days. Reassessment is due after 12 months if any LEO26 component is high risk, or after two years if none is. Records should be kept for at least seven years for DOSH audit, with personal data handled under the Personal Data Protection Act 2010.

For a full walkthrough of the tool and how an external assessment works, see ThoughtFull's DOSH-compliant PRisMA psychosocial risk assessment, which uses LEO26 and EPC23 and provides a report from a certified assessor.

What must Malaysian employers do now? A step-by-step plan

Use these steps to move from awareness to evidence of compliance.

1. Confirm the Act applies to you. If you previously sat outside the First Schedule, assume you are now covered and check for any exception that might apply.
2. Appoint an OSH coordinator. If you have five or more employees and no safety and health officer, appoint and train a coordinator and record the appointment.
3. Update your written safety and health policy. State explicitly that psychosocial hazards are within scope and name who is accountable.
4. Carry out a risk assessment that includes psychosocial risks. Use PRisMA's LEO26 and EPC23 so your method matches DOSH guidance, and keep the data anonymised.
5. Put controls in place. Address root causes such as workload, role clarity and bullying first, then add support measures such as an employee assistance programme and manager training.
6. Brief principals and contractors. Make sure contractors know their obligations and that your controls cover outsourced staff on site.
7. Document everything. Keep assessments, action plans, training records and review dates for at least seven years.
8. Review on schedule. Reassess at 12 months for high-risk areas or two years otherwise, and after major changes such as restructuring.

Which controls reduce psychosocial risk at work?

ISO 45003:2021, the international guidance on psychological health and safety at work that the PRisMA guidelines draw on, treats the way work is designed and managed as the main source of psychosocial risk. In practice, combine three levels of control.

Organisational controls

• Realistic workload planning and staffing levels.
• Clear job descriptions and decision rights.
• Anti-bullying and anti-harassment policies with a trusted reporting channel.
• Flexible working where operations allow.

Manager and team controls

• Training for managers to spot early signs of distress and respond safely. ThoughtFull's Mental Health First Responders at Work course is HRD Corp claimable in Malaysia.
• Regular one-to-ones that cover workload and wellbeing, not just targets.

Individual support

• Confidential counselling through an EAP in Malaysia that offers support in employees' own languages.
• Crisis support and clear referral routes for urgent cases.

Support for individuals is valuable, but it does not replace fixing the hazard. A workplace that offers counselling while ignoring chronic overload has not controlled the risk.

OSH Amendment Act 2022 compliance checklist

• Applicability of the amended Act confirmed and documented.
• OSH coordinator or safety and health officer appointed.
• Safety and health policy updated to cover psychosocial hazards.
• Psychosocial risk assessment completed using LEO26 and EPC23.
• Action plan with owners and deadlines agreed.
• Contractors briefed on principal duties.
• Manager training delivered and recorded.
• Confidential support available to all employees.
• Records stored for at least seven years.
• Reassessment dates in the calendar.

How can ThoughtFull help?

ThoughtFull is a regional mental health provider working with employers across Asia Pacific. In Malaysia, we support the full cycle: PRisMA assessment, manager training, an EAP and aggregated reporting so you can show progress over time. For more background on the state of workplace mental health locally, read our overview of employee mental wellbeing in Malaysia.

If you want to plan your first psychosocial risk assessment or review your current approach, speak to our team about what a compliant, practical programme looks like for your organisation.