GRI 403-9 and ESRS S1: Reporting Safety Data for ESG

Why safety data now sits in the ESG report

For years, group safety numbers lived in the EHS department: a monthly dashboard, a slide for the board, a few lines in the annual report. Sustainability reporting has changed that. Fatalities, recordable injuries, rates and lost days are now published next to emissions and financial results, read by investors and customers, and checked by assurance providers who ask how every number was compiled.

For a multinational or a large industrial group, this creates a new problem. The head of sustainability needs one set of numbers for the whole group, built to an external standard. The sites produce numbers in their own way, often to local legal definitions. This guide explains what the two most used frameworks, the GRI Standards and the European Sustainability Reporting Standards (ESRS), ask for on occupational health and safety (OH&S), where they differ, and how to build the data once so both can be answered from the same records.

What changed in 2026

2026 was a big year for EU sustainability reporting. Check the current texts before you rely on any of the points below, but this is where things stood in October 2026:

Change	What it means
Omnibus I Directive (EU) 2026/470	Published in the EU Official Journal on 26 February 2026 and in force since 18 March 2026. The Corporate Sustainability Reporting Directive (CSRD) now applies to EU undertakings with more than 1,000 employees on average and net turnover above EUR 450 million (tested on a consolidated basis for groups). Non-EU groups are in scope when the ultimate parent has EU turnover above EUR 450 million and an EU subsidiary or branch has turnover above EUR 200 million.
Timing	According to DLA Piper's summary, EU companies in scope report in 2028 on financial years starting on or after 1 January 2027; non-EU parents report in 2029 on financial years from 1 January 2028.
Revised ESRS	Adopted by the European Commission on 3 July 2026 and, according to Linklaters, published in the Official Journal on 21 September 2026 as Delegated Regulation (EU) 2026/1563. They apply to financial years beginning on or after 1 January 2027, with early use possible for 2026. The Commission says mandatory datapoints fall by more than 60%.
Voluntary standard and value chain cap	A voluntary standard for undertakings outside mandatory reporting was published at the same time. From financial years beginning on or after 1 January 2027, it also limits what reporting companies can ask of smaller value chain partners (1,000 employees or fewer) for their own CSRD reporting.

Fewer datapoints overall does not mean less safety data. Health and safety metrics stay in the own workforce standard (ESRS S1), and they still need definitions, hours and scope that hold up across every country.

What GRI 403-9 asks for

GRI 403: Occupational Health and Safety 2018 is the GRI topic standard most groups already use. Disclosure 403-9 covers work-related injuries. For employees, and separately for workers who are not employees but whose work and/or workplace the organization controls, it asks for:

the number and rate of fatalities as a result of work-related injury;
the number and rate of high-consequence work-related injuries (excluding fatalities): injuries from which the worker cannot, does not, or is not expected to recover fully to pre-injury health status within six months;
the number and rate of recordable work-related injuries;
the main types of work-related injury and the number of hours worked.

It also asks which work-related hazards pose a risk of high-consequence injury, what is being done about them using the hierarchy of controls, whether any workers are excluded and why, and how the rates were calculated. GRI lets organizations calculate rates per 200,000 or per 1,000,000 hours worked. Disclosure 403-10 covers work-related ill health in the same way. GRI 403 is not part of GRI's current revision of its labour standards, so the 2018 text remains the reference.

What the revised ESRS S1 asks for

The health and safety metrics of the own workforce standard were simplified, not removed. In EFRAG's technical advice of November 2025, on which the revised standards are based, the health and safety metrics disclosure (S1-13 in that draft) asks for:

the percentage of the own workforce covered by an occupational safety and health management system based on legal requirements and/or recognised standards or guidelines;
fatalities from recordable work-related accidents among the own workforce and among other workers on the undertaking's sites, plus fatalities from recordable work-related ill health among employees;
the number and rate of recordable work-related accidents, with the rate calculated per 1,000,000 hours worked;
the number of cases of recordable work-related ill health among employees;
the number of days lost to recordable work-related accidents and ill health among employees, counted in calendar days including the first and last day of absence.

Where non-employees in the own workforce are material, their accidents and fatalities are included and, where applicable, broken down from employees. Work-related musculoskeletal disorders count as ill health, not injury. Paragraph numbers and details may differ in the final delegated regulation, so check Regulation (EU) 2026/1563 before you finalise your reporting manual.

GRI and ESRS side by side

Topic	GRI 403-9 / 403-10	ESRS S1 (EFRAG technical advice)	What to capture once
Rate basis	200,000 or 1,000,000 hours (state which)	1,000,000 hours	Hours worked per site and month, by worker type
Who is counted	Employees and non-employee workers whose work or workplace is controlled	Own workforce; other workers on site for fatalities; non-employees when material	Worker type on every case and every hours line
Severity	High-consequence injury (not recovered within 6 months)	Fatalities, recordable cases, days lost	Outcome, recovery status and absence dates per case
Ill health	Fatalities and recordable cases of ill health (403-10)	Recordable ill health cases and fatalities (employees)	Case type: injury or ill health, with MSDs as ill health
Management system	Coverage of workers by the OH&S management system (403-8)	% of own workforce covered	Which sites are covered or certified, with headcount

Rates on the two bases differ only by a factor of five. A site with 3 recordable cases in 1,200,000 hours has a rate of 0.5 per 200,000 hours and 2.5 per million hours. Print the basis next to every rate, and never add or average rates from different bases (our playbook for standardizing HSE reporting across countries explains how to set one group basis).

Where group numbers go wrong

Hours are guessed. A rate is only as good as the hours behind it. If sites estimate hours, use the same method everywhere (ESRS technical advice points to normal or standard working hours, adjusted for paid leave) and explain it in the report.
Contractors disappear. Contractor cases are often kept in a separate log or not at all. Both frameworks expect them, at least for fatalities. Record them in the same system and flag the worker type (see our guide to contractor safety management across many sites).
Local definitions leak in. “Recordable”, “lost time” and “serious” mean different things in different countries. Keep local legal fields for local reports, and a group definition for the ESG report.
Days lost are counted differently. Working days at one site, calendar days at another, with or without the day of the accident. Fix one rule and let the system count from absence dates.
Cases change after year end. An injury is reclassified, a worker does not recover within six months, a case turns out not to be work-related. Keep the change history, so you can explain why last year's number moved.
Only lagging numbers. Injury rates describe the past. Pair them with leading indicators and potential-severity reporting, as described in our guides to leading vs lagging safety KPIs and SIF and potential-severity reporting.

Groups and suppliers outside the EU

Many groups headquartered in South Asia or the Gulf are not directly in CSRD scope, or will only be in scope through a large EU business. They are still affected in two ways. First, EU customers that report under ESRS may ask for safety data from their value chain; from 2027 the value chain cap limits what they can require from partners with 1,000 employees or fewer for their own CSRD reporting. Second, many investors, lenders and buyers ask for GRI-based data regardless of the EU rules. In both cases, the answer is the same: one set of definitions, hours and case records that can produce a GRI table and an ESRS table without re-collecting data from the sites.

One record, many reports

The practical solution is to capture each case once, with enough fields to answer every framework, and let reports do the rest.

Field on every case	Why the ESG report needs it
Site, country and legal entity (from the group hierarchy)	Consolidation and scope by entity
Worker type: employee, contractor, other worker on site	Separate and combined totals in GRI and ESRS
Case type: injury or ill health	GRI 403-9 versus 403-10; ESRS accidents versus ill health
Outcome: fatality, recordable, first aid only	Counts and rates
Absence start and return dates	Days lost on one counting rule
Expected recovery beyond six months	GRI high-consequence injuries
Potential severity	Hazards with a risk of high-consequence injury
Change history with reasons	Restatements and questions from assurance providers

Hours worked should be entered monthly per site and worker type, with the estimation method recorded where hours are not measured.

Checklist: OH&S data ready for the ESG report

#	Check	Done?
1	Confirm which frameworks apply to each reporting entity (ESRS, GRI, customer requests)	☐
2	Group definitions for recordable, high-consequence, ill health and days lost written down	☐
3	One rate basis for internal dashboards, with conversion for each framework	☐
4	Hours worked collected monthly per site and worker type, method documented	☐
5	Contractor and other on-site worker cases recorded in the same system	☐
6	Coverage of the OH&S management system recorded per site with headcount	☐
7	Change history kept for every reclassified case	☐
8	Year-end cut-off and sign-off by site, country and group	☐
9	Reporting manual checked against the final ESRS text and GRI 403	☐
10	Sustainability and EHS teams agree one owner for each number	☐

Making it work across every site

ESG-grade safety numbers are hard to produce from spreadsheets sent in by email. AccelSafety, our enterprise HSE software, puts every site on one hierarchy from group to region, country, cluster and site, with access scoped to each person's part of it and enforced on the server. Incidents are reported from phones with photos, investigated and followed by corrective actions; group KPIs such as lost days, near misses, hazard reports, recordable injuries and training manhours are calculated from the same records, and every dashboard number drills back to auditable source records with their history. Sustainability and environmental records sit in the same system. Book a free demo and we will set it up with a structure like yours.

General information, not legal or accounting advice. Check the original texts and take professional advice on the reporting obligations that apply to your group.

Safety data for ESG reports: GRI 403 and the revised ESRS S1 for multi-site groups