Psychosocial risk at work is now the law in Malaysia. Here is what to do about it.

The short version

What the law says

Section 19 sets the penalty: a fine of up to RM500,000, imprisonment of up to 2 years, or both. Section 52 extends liability to directors and managers where the offence is committed with their consent or connivance, or is attributable to their neglect.

The duty is triggered by having a workplace, not by receiving a complaint. If you are waiting for a DOSH directive, you are already late.

Why it moved from advice to duty

Two numbers explain the whole thing. In August 2026 DOSH put on record 48 psychosocial complaints nationwide, of which 11 were substantiated. Separately, NODiP, the Ministry of Human Resources workplace screening programme, covered roughly 100,000 workers and found 16.91% at risk, close to 16,900 people in a single programme.

Complaints measure confidence in the complaint channel. Screening measures prevalence. The gap between those 2 numbers is why the law now requires employers to go and look rather than wait to be told.

Malaysia's own health survey, NHMS 2023, found 1 million adults living with depression, 4.6% of the adult population and double the 2019 figure, and that nearly half of them had thoughts of self harm. The World Health Organization estimates that depression and anxiety cost the global economy about US$1 trillion a year in lost productivity. None of this is invisible on a profit and loss statement. PRisMA simply makes it visible unit by unit.

What PRisMA actually is

• Identify hazards with LEO26. A 26 item employee screening scored on 3 components: job control, work demand and job support.
• Assess existing controls with EPC23. A 23 point employer practice checklist, required wherever LEO26 returns high risk.
• Prioritise by setting exposure against practice.
• Manage with an action plan naming the risk, the unit, the control, the owner and the date.
• Reassess after 12 months where any component scored high, otherwise after 2 years, or sooner on triggers such as rising absenteeism, turnover or complaints.
• Keep records for at least 7 years, compliant with the Personal Data Protection Act 2010, one report per work unit.

A work unit is a shift, a line, a depot or an outlet. The assessment is never run at the level of the individual, and it is not a diagnosis. It measures the job, not the person. More detail in what PRisMA 2024 actually says.

Where most assessments fail

Not on the survey. On 3 things around it.

• Language. An assessment a Nepali guard or a Bengali harvester cannot read is not an assessment of that worker's risk. Every language spoken by 5% or more of a unit has to be covered, in the briefing and in the instrument.
• Confidentiality people believe. A survey tool that can re-identify respondents kills the next cycle before it starts, because the second round is answered defensively or not at all.
• Nothing after the score. Posters, a wellness day and a hotline number are not controls. The action plan has to match the component that scored high: job design for control, staffing and rosters for demand, manager capability and a real support pathway for support.

What your industry's risk usually looks like

• Manufacturing. Coping people inside punishing job design. The first published PRisMA field study, run in Perak in 2025, found individual distress largely within normal range but unit level scores for job control and work demand that the authors themselves called alarming.
• Logistics. Isolation plus time pressure set by a screen. Job support is the component that scores lowest most often. Singapore's heat stress framework, mandatory for outdoor work from 1 December 2026, adds a heat stress training duty on top.
• Plantation. Predominantly migrant, division level crews with no route above the mandore. This is the sector where the language test is hardest to pass.
• Retail and food service. Emotional labour on a roster that changes weekly, in the age group where NHMS 2023 found depression most prevalent, 16 to 29.
• Head office and hybrid teams. Not exempt. DOSH requires management units to be assessed too, and the 2026 guidance on flexible work arrangements extends the duty of care to people working from home.

After the score: what the evidence supports

The World Health Organization's 2022 guidelines on mental health at work were the first global guidelines on the subject, and manager training is the single organisational intervention they chose to headline, above awareness programmes. That is a finding about job design and supervision, not about any product.

On access, a 2026 systematic review in npj Digital Medicine pooled 39 randomised trials of mental health chatbots and found statistically significant reductions in depressive symptoms and in anxiety, larger among people already showing clinical or subclinical symptoms than in the general population. A separate 2026 meta-analysis limited to Asian populations found a larger effect again. The effects are small to moderate: a first step rather than a substitute for a therapist, which is exactly how a stepped pathway should use them.

Set that against the thing every HR team already knows: traditional hotline led EAPs are used by a small minority of the workforce, and utilisation is widely reported in low single digits. A chat entry point that answers at 3am in the worker's own language removes most of the friction that keeps it there, and a licensed therapist one tap behind it provides the depth a chatbot cannot. That stepped model is how eve & ai is built. The guide sets it out neutrally, with the questions you should put to any provider, including us.