Since July 1, 2026, safety culture has a number attached to it. Level 3 on the Safety Culture Ladder is now written into procurement contracts across construction and infrastructure, mandatory for any supplier with more than five employees on contracts above €100,000. Large contractors are already putting it in black and white: certify, or don't bid.
Here's what most companies get wrong about that requirement: They treat it as a certification project. Assign it to someone in the QHSE department, budget a few thousand euros, book an assessment, done. That's exactly the trap the people who wrote the standard were trying to close.
Safety Culture Ladder Level 3 (still called "step 3" by habit, but the field has moved to "level" as the umbrella term now that VCA-MAX sits alongside it) isn't measuring your paperwork. It's measuring whether your organization actually thinks differently about safety. Do people report near misses without being told to? Does a supervisor feel safe admitting a shortcut was taken? Is safety a boardroom topic or something that gets delegated downward until it lands on a foreman's desk?
That last part matters more than it sounds. Parking safety culture with a site manager or project leader is the single most common mistake advisors see. If leadership isn't visibly driving it, the certification becomes theater. Auditors know the difference between a company that behaves safely and one that has learned to perform safely for thirty minutes during an assessment.
There's a widely repeated assumption going around right now: if you have VCA-MAX, you've automatically met the Level 3 requirement. You haven't, necessarily. The governance code that created this obligation names Safety Culture Ladder Level 3 specifically. VCA Max was developed afterward, partly because the VCA world didn't want to be left out of a conversation that was growing fast without them. Whether your client accepts VCA-MAX as equivalent proof is entirely up to that client. This means the first move, before choosing any certification track, isn't calling an advisory firm. It's calling your client. Ask precisely what they require and what evidence they'll accept. Companies that skip this step end up with a completed certification trajectory that doesn't match what their tender actually demanded, and that's money and months they don't get back.
One more detail worth knowing if you subcontract heavily: the obligation isn't automatically retroactive, and it doesn't automatically cascade to your subcontractors unless your own client requires that. But if you're the main contractor carrying the risk on a project, asking your subcontractors how they think about safety culture, not just whether they wear the right boots, is the more honest question to be asking anyway.
The advisors who guide these certifications keep coming back to the same point: this isn't another toolbox meeting or another inspection round. It's whether your organization has normalized asking, after something goes wrong, what could we have done differently, rather than closing the file and moving on. That's a harder thing to build than a checklist, and it's also a harder thing to prove during an audit unless you can show it happening. This is where the meetings module earns its place: toolbox sessions, incident debriefs, and QHSE conversations get logged with who was there and what was actually discussed. Not just that a meeting happened, but that the deeper question got asked. When an auditor wants evidence of a living safety culture rather than a documented one, that record is the difference.
Level 3 was postponed more than once before it finally landed. That history should tell you something: the standard isn't going away, and it isn't going to get softer. The organizations that treat it as a genuine shift in how leadership talks about safety will clear it without much drama. The ones treating it as a paperwork exercise are the ones who'll get caught explaining, mid-audit, why the certificate doesn't match the culture.
