COMPLIANCE IS NOT CARE: WHAT BRAZIL’S NR-1 AND LAW 15,377/2026 REVEAL ABOUT WHAT WAS ALWAYS A CHOICE

NR-1 and Law 15,377/2026 set the minimum floor — not the ceiling. What no regulation will ever resolve about health, outsourcing, and real organizational culture. – By Marcello de Souza

Imagine you lead a team. Or a department. Or an entire company. You know people’s names, you know who delivers more, who is overwhelmed, who smiles less than they did six months ago. Now answer honestly — with the honesty this text deserves: did you know that because you built an environment where it is possible to be seen — or because someone reached their limit and could no longer hide it?

This is not an accusation. It is a diagnostic question. And most organizations have not yet been able to answer it with clarity — a reality that two recent regulations have made impossible to ignore.

In 2025, the updated Brazilian Regulatory Standard NR-1 formally included psychosocial risks as a mandatory management object within organizations. In 2026, Law No. 15,377 was enacted, making it a legal duty for companies to inform their employees about vaccines, breast, cervical and prostate cancers, HPV — and to guarantee paid leave for preventive exams. Two regulations. One single message: the human being who generates value for your organization was being treated as if they had no body that gets sick and no mind that fractures.

The first reaction to this message tends to be defensive. And understandable. Because for many organizations — especially medium and small-sized ones, operating under tight margins, predatory competition, and managers promoted for technical competence rather than the ability to lead people — the problem was never a lack of will. It was a lack of structure. Of parameters. Of a minimum floor from which care could be built.

This is precisely where the law fulfills its deepest role: it is not the antithesis of ethics. Sometimes it is the translation of ethics into a verifiable commitment. The foundation from which organizational consciousness can finally begin to rise.

The problem is not needing the law to begin. The problem is stopping there.

The Body as Invisible Infrastructure

There is a silent logic that governs most organizations: the worker’s body is infrastructure. It is assumed. It is there. It functions. And as long as it functions, no one needs to think about it. When it stops functioning — when it gets sick, when it collapses, when it simply does not show up — it becomes an operational problem. A number in the absenteeism index. A red line on the productivity dashboard.

What Law 15,377/2026 does, at its deepest level, is not merely create an obligation to communicate about vaccination campaigns. It names something organizations have always preferred to leave unnamed: that care for employee health was rarely a spontaneous cultural choice. At best, it was a benefit. A competitive differentiator. A line item in a compensation package. Something offered as an incentive — not as a fundamental human responsibility.

There is a real difference between offering health insurance as a benefit and building an organizational culture in which health is a non-negotiable value. The benefit can be taken away. The value cannot. The benefit lives on the payroll. The value lives in the decisions made at three o’clock on a Tuesday afternoon, when someone needs to leave early for an exam and the manager decides, in that second, what that organization truly is.

What the Updated NR-1 Forces You to See

The inclusion of psychosocial risks in NR-1 is perhaps the most challenging regulatory move for Brazilian organizations in recent decades. Not because it is technically difficult to implement — though it is. But because it demands that the company look at itself as a possible agent of illness.

This is structurally different from mapping ergonomic or physical safety risks. When we talk about psychosocial risk, we are talking about pressure for results that has become a culture of exhaustion, about role ambiguity that no one has the courage to clarify, about leaders who intimidate without ever raising their voice, about targets that grow every quarter while teams shrink, about meetings that end with everyone certain that nothing that truly mattered was said.

The updated NR-1 does not ask companies to eliminate stress — that would be naive. It asks companies to recognize what they themselves produce in terms of illness, to assess the extent of that illness, and to build real control processes. It does not demand moral heroism. It demands process. It demands that care stop depending on the goodwill of an enlightened manager and start existing as structure — with clear responsibilities, defined flows, measurable evidence.

And here is a point that the debate around organizational health rarely names with precision: leaders alone rarely change culture. Systems change culture. The conscious leader inside a poorly designed system will, at best, slow down illness — not prevent it. What NR-1 demands is not that each manager become a guardian of their team’s mental health through force of character. It is that the organization build the systems that make that care possible, traceable, and sustainable — regardless of who is in the leadership role.

The Convergence No One Is Reading

When you look at the updated NR-1 and Law 15,377/2026 in isolation, what you see are two legal obligations. One about mental health and workplace risk. Another about physical health and disease prevention. Comply with one, comply with the other, file the documentation, move on.

When you look at both in convergence, what you see is something entirely different: the first legislative affirmation that the human being at work is whole. That they do not leave their body at home when they enter the company. That they do not suspend their psyche when the workday begins. That what happens in the work environment — the relationships, the pressures, the culture, the silence, the excess — crosses the imaginary membrane separating the professional from the human and affects the real, biological, living organism sitting at that desk.

This convergence creates an opportunity that few organizations are seeing: the opportunity to turn compliance into culture. Because it is possible to comply with NR-1 and Law 15,377/2026 in a purely bureaucratic way — and many will. Draft the psychosocial risk identification document that no one will use. Send the email about vaccines that no one will read. Register the leave policy for exams that will generate friction every time someone tries to exercise it.

Or it is possible to use this moment as a turning point. As the question that finally forces the organization to answer what it truly believes about the people who sustain it.

And there is still a question this debate rarely asks — and that may be the most important one: what happens when the company complies with everything? When NR-1 is implemented, the psychosocial risk mapping is done, the preventive exams are guaranteed — and the environment still makes people sick? What is missing? In many cases, what is missing is what no regulation can legislate: the real power of workers to influence the targets that consume them, the schedules that exhaust them, the leaders who diminish them. Compliance without voice is not culture. It is control with different packaging.

HR at the Center of a Territory That Is Not Merely Operational

HR’s role in this scenario is simultaneously the most visible and the most misunderstood. Visible because HR will bear the responsibility of implementing, documenting, communicating, and monitoring everything both regulations require. Misunderstood because that — and only that — is not enough.

What both regulations together demand from HR is not just management. It is leadership of an agenda that is, above all, systemic and cultural. And culture does not change through policy. Culture changes when the systems that govern daily life begin to be different — when the performance evaluation process stops ignoring the human cost of targets, when the criteria for promoting leaders starts including the health of the teams they build, when absence for a preventive exam generates no friction because the process was designed so that it does not.

For this, HR needs something no regulation provides: a deep behavioral and systemic reading of the organization. It needs to understand which relational dynamics are producing the identified psychosocial risks. It needs to distinguish between the stress that is inherent to work and the suffering produced by the way the organization functions. It needs to build leaders capable of sustaining conversations that most companies still do not know how to have.

This is the territory where regulation reaches its limit and where human and organizational development begins.

Care as Strategy — Without the Purity Trap

It is tempting, in the face of all this, to draw a moral dividing line: on one side, organizations that care because they believe in the intrinsic value of people; on the other, those that care only because absenteeism is costly. And to condemn the latter to contempt.

That would be intellectually easy. And practically useless.

Because many organizations start from the instrumental — caring because it reduces turnover, improves engagement, protects against labor liability — and only later, as systems mature and leaders develop, arrive at the intrinsic. At the care that exists regardless of the spreadsheet. To dismiss that path is to expel from the process precisely those who most need to be invited to advance.

What matters is not the starting point. It is the direction. An organization that begins caring because the law required it, but uses that obligation as leverage to build something real, is doing something that another — which complies only to file — will never do. The difference is not in the initial motivation. It is in what you do with it.

The real warning sign is not caring for instrumental reasons. It is using legal compliance as a substitute for care. It is confusing conformity with culture. It is treating the psychosocial risk mapping as a project delivery — rather than the beginning of a conversation the organization needed to have years ago.

Outsourcing and the Limit Where Ethics Begins

There is a question this text cannot avoid — and that most compliance, labor law, and people management specialists sidestep with surgical precision: what happens to all those who produce inside your organization, carry your targets, breathe your culture — and are not employees?

In Brazil, the practice known as ‘pejotização’ — hiring workers as legal entities rather than employees — has become one of the most normalized movements in the market over recent decades. Normalized to the point of acquiring its own name, tacit acceptance, and even a certain aura of modernity: the narrative of the autonomous professional, the self-entrepreneur, contractual freedom as an evolution of labor relations. And to be fair: for many skilled professionals, this arrangement is a genuine choice — for real autonomy, flexibility, or a tax structure that makes sense for their moment in life and career.

That exists. And it needs to be said, because ignoring that dimension weakens any serious critique of the issue.

What cannot be ignored — and is structurally different — is the use of this arrangement as an architecture of exemption. When an organization contracts someone not because the nature of the work genuinely requires real autonomy, but because this format allows it to extract full contribution from a human being without assuming any obligation of care toward them, we are facing something that has a name: exploitation dressed in contractual language.

The outsourced worker is, by legal definition, outside the scope of NR-1 and Law 15,377/2026. The company has no legal obligation to map the psychosocial risks they experience. It does not need to inform them about disease prevention. It does not guarantee paid leave for exams. From a legal standpoint, they simply do not exist as a subject of protection.

From a human standpoint, they exist completely. They work in the same environment. They meet the same targets. They are subject to the same pressures, the same management model, the same culture — or the absence of it. They get sick the same way. And often, they get sicker — because they operate without the minimum safety net that a formal employment relationship still provides, carrying alone the weight of what the company decided not to assume.

This is not a legal question. The law has already answered — and the answer is that they are outside. This is a question of fundamental ethical principles. And fundamental ethical principles have no exception clause for contract type. They do not apply only to those with a formal employment contract. They apply to any human being under the influence of your leadership, your culture, your management model.

An organization that structures its processes to extract maximum contribution from a human being while simultaneously architecting its contractual relationship to bear no obligation of care toward that same human being is not being creative from a legal standpoint. It is being deliberately negligent from an ethical standpoint. And deliberate ethical negligence is not a management gap — it is a choice. Made consciously. Sustained daily. Protected by a language that makes it palatable.

When a practice of exploitation becomes so widespread that it is seen as a market standard, it stops being questioned. It gets replicated without reflection. And what was once a conscious ethical choice begins to be treated as an operational inevitability — as if the market demanded it, as if there were no alternative, as if responsibility belonged to the system rather than to whoever decides, inside each organization, how to treat the human beings who sustain it.

The question every leader must ask is not: what does the law require me to do for this outsourced worker? The question is: what do my principles prevent me from ignoring?

What Is at Stake Beyond Compliance

There is something that legal specialists and compliance analysts do not say — not because they do not know, but because it is not their territory: the greatest risk that the updated NR-1 and Law 15,377/2026 create for organizations is not the labor risk. It is not the fine. It is not the lawsuit.

The greatest risk is continuing to be the kind of organization that needed a law to start caring — and that, after complying with the law, believes it does.

Because people perceive this. Not in documents. Not in communications. They perceive it in the texture of relationships. In the quality of conversations. In the presence — or absence — of leaders who genuinely care about whoever is on the other side of the table. They perceive it in the moment something goes wrong and the organization decides whether it will treat that human being as a resource or as a person.

And when they perceive that it is only compliance — that the vaccine email went out because the law required it, that the psychosocial risk mapping was done for filing — what dies is not engagement. It is trust.

Trust does not appear in any dashboard. It has no line in the compliance report. It generates no alert in the HR system. It is built in silence, through decisions no one records — and disappears the same way. When it is gone, what remains in its place is not disengagement. It is empty presence. People who are there, but have already left.

And empty presence has no regulation that fixes it. No vaccination campaign that recovers it. No psychosocial risk mapping that reverses it. Because the damage is not operational. It is relational. And relational damage can only be repaired with time, consistency, and the genuine decision to be different — not to appear different.

Where to Begin — For Real

This is the question that remains after everything that has been said: I lead an organization that treats mental health like a spreadsheet and outsourced workers like faceless labor. Where do I start tomorrow?

There is no answer that fits in one paragraph. But there is a direction.

You start by stopping to confuse compliance with care. The NR-1 document is not the destination — it is the starting point of a conversation the organization needs to have about what it is producing in terms of illness, and why. That conversation does not happen in a compliance meeting. It happens when someone with real authority decides that people’s health matters more than the elegance of the processes that describe it.

You start by reviewing systems — not by demanding more from managers. The question is not: which leaders need to be more empathetic? The question is: which organizational systems are producing behaviors no one would consciously choose? Targets that incentivize sacrificing others. Promotion criteria that reward delivery and ignore how it was generated. Cultures of silence where speaking about your own limits is read as lack of commitment.

In the case of outsourced workers, you start with an honest question: is this person here as an outsourced contractor because the nature of the work genuinely requires autonomy — or because this arrangement exempts us from responsibilities we should have? If the answer is the latter, the next step is not necessarily to change the contract. It is to change the relationship. It is to decide that care does not end where the formal employment contract ends.

And above all, you start by understanding that real organizational transformation is not a project with a delivery date. It is a choice that renews itself in every decision — about who you promote, about how you respond when someone asks for help, about what you tolerate in the name of results, about what you protect even when it costs something.

The law has arrived. That is good. But the law is the floor. What gets built above it still depends on whoever decides that building is worth it.

If you want to understand how to design organizational systems that do not depend on the goodwill of an enlightened leader — systems that make care traceable, sustainable, and real — there are hundreds of articles on human and organizational cognitive behavioral development, culture, and leadership waiting for you at marcellodesouza.com.br. For those who know that the difference between complying and transforming is not in the regulation. It is in the choice.

#OrganizationalCulture #MentalHealth #WorkplaceWellbeing #HR #Leadership #Ethics #Outsourcing #PsychosocialRisk #OrganizationalDevelopment #HealthAtWork #HumanDevelopment #ConsciousLeadership #NR1 #BrazilianLabourLaw #marcellodesouza #marcellodesouzaoficial #coachingevoce

Marcello de Souza | Coaching & Você marcellodesouza.com.br © All rights reserved