The psychosocial risk report left Google Forms and now comes out with AI writing inside the methodology

NR-1 put psychosocial risk on the same footing as physical, chemical and ergonomic risk: it has to be identified, assessed, classified and managed inside the company's risk-management programme. That created demand which organisational psychology already knew how to meet in method — but not at scale. The assessment requires hearing dozens or hundreds of workers under real anonymity, reading the result by sector, classifying risk factor by factor and delivering a report that survives an audit.

The bottleneck was double. In collection: the instrument ran on Google Forms, and the assessed companies simply would not accept it — identifiable psychosocial data about workers travelling through a generic form, with no access control and no guarantee of anonymity, gets past nobody's legal team. In analysis: each report consumed two to three days of manual work, compiling the spreadsheet, crossing factor with sector and writing the technical text by hand. One report at a time, one company at a time.

• Collection on Google Forms was blocked by the companies — no access control, no guaranteed anonymity, no audit trail.
• Two to three days of manual work per report, which caps any growth.
• Sensitive worker mental-health data in a shared spreadsheet — direct exposure under Brazil's data-protection law.
• The open-ended question, where the nuance lives, required reading and summarising everything by hand.
• No standardisation: two reports from the same consultancy could come out with different structures.

Epicora treated the problem as two chained systems, not as a text generator. The first is collection: each programme has its own questionnaire built in a form builder — the current standard is DRPS 50, 50 questions plus two for identification, with direct and reverse scoring —, answered through a public link, with no individual identification, aggregated only collectively. That is the difference between a generic form and an instrument: the sector identification question is what later allows risk to be read by area of the company instead of an average that says nothing.

The second is the report. The DRPS spreadsheet comes in one per sector, with all-or-nothing import — if any spreadsheet is off-standard, none is imported. The system extracts the 13 risk factors and builds the risk matrix, which is a table rendered from the data, with no AI at all. Only then does the AI come in, to write the five sections that require technical interpretation.

And the writing is not a single call. It is five independent calls to Claude, via AWS Bedrock, run in parallel — technical analysis, action plan, conclusion, monitoring recommendations and methodological notes —, each returning its own structured JSON. A failure in one does not invalidate the others, and each section can be regenerated on its own. All of them start from the same input: the 13 extracted factors, the reference material and a few-shot sample of the consultancy's standard report.