PPE control in outsourcing: what NR-6 requires and how to avoid liability

In outsourcing, personal protective equipment (PPE) is not kept in a single storeroom: it is spread across dozens of sites, clients and shifts. When a labor inspector, a client or a labor lawsuit asks "where is the proof that this PPE was delivered, replaced and used?", the answer must be available in minutes — not depend on a paper form forgotten at the site. This article covers Brazilian legislation, in particular NR-6 (Norma Regulamentadora nº 6, Brazil's regulatory standard on PPE): we summarize what it requires, how missing records turn into labor liability and how to organize digital control per site.

Why PPE is a sensitive issue in outsourcing

For security, cleaning, facilities and maintenance companies, PPE control comes with its own challenges:

• Dispersion: each site has its own stock, risks and routine.
• Turnover and coverage: relief workers and substitutes rotate across sites and need the right PPE at each one.
• Distance from management: supervisors visit sites periodically, not every day.
• Paper that gets lost: forms filled out at the site rarely reach the archive intact.

There is also the client's perspective. Under Lei nº 6.019/1974, the contracting company is responsible for ensuring workers' safety, hygiene and health conditions when the service is performed on its premises or at a location agreed in the contract (art. 5-A, § 3). It makes sense, then, that more structured clients ask for evidence of PPE delivery — and providers who have it organized get ahead.

What NR-6 requires from the employer

The legal basis is in the CLT, Brazil's Consolidated Labor Laws: companies must provide, free of charge, PPE suited to the risk and in perfect condition (art. 166), and equipment may only be sold or used with a Certificado de Aprovação — the CA, the government approval certificate for PPE (art. 167). NR-6 details the organization's duties in item 6.5.1:

Duty (NR-6, item 6.5.1)	What it means in practice
a) purchase only approved PPE	Check the CA in the public lookup of the CAEPI system, run by the Ministry of Labor and Employment, before buying
b) instruct and train employees	Record instructions and training, with date and content
c) provide it free of charge, suited to the risk and in perfect condition	Follow what was defined in risk management, respecting the hierarchy of prevention measures
d) record its delivery	Logbooks, forms or an electronic system, including biometric
e) require its use	Supervise at the site and document the supervision
f) handle cleaning and maintenance, when applicable	Follow the manufacturer's or importer's instructions
g) replace it immediately when damaged or lost	Keep stock and a fast replacement process
h) report irregularities	Notify the national occupational safety and health authority

Two details are often overlooked. If the company uses an electronic system, it must allow reports to be extracted (item 6.5.1.1). And PPE selection must be recorded and may be part of the PGR (Programa de Gerenciamento de Riscos, the occupational risk management program), with the participation of the company's occupational health and safety service (SESMT), where there is one, after hearing the workers who use the equipment and the internal accident and harassment prevention committee (CIPA) or the designated representative (items 6.5.2.1 and 6.5.2.2).

What about the worker's duties?

Employees must use the PPE provided, only for its intended purpose, take care of its cleaning, storage and conservation, report loss or damage and follow the instructions on proper use (item 6.6.1). The CLT treats an unjustified refusal to use the PPE provided as misconduct (art. 158, sole paragraph, "b"). But to apply any disciplinary measure, the company must prove it delivered, instructed and enforced — which, once again, depends on records.

CA, expiry and replacement: three different controls

These deadlines are often mixed up, but each one needs its own attention:

• CA: PPE must be sold with a valid CA (item 6.9.2.1), so the check happens at purchase.
• Equipment expiry: once purchased, PPE must be provided in line with the storage conditions and expiry date set by the manufacturer or importer (item 6.9.2.1.1).
• Replacement: besides immediate replacement when damaged or lost, some items have a service life limited by the number of cleanings, information the manufacturer must provide (item 6.8.1.1).

Since all PPE must be marked with the manufacturer's or importer's name, the manufacturing lot and the CA number (item 6.9.3), it is worth recording this data at delivery. That is what makes it possible, for example, to trace who received a defective lot.

How missing records become labor liability

The key point lies in the case law of the TST, Brazil's Superior Labor Court. Súmula 80 do TST (a consolidated precedent) states that eliminating unhealthy conditions through approved protective equipment excludes the unhealthy-work premium (adicional de insalubridade). Súmula 289 do TST adds the decisive caveat: merely providing the equipment does not exempt the employer from paying the premium; the employer must take measures to reduce or eliminate the harm, including those related to the employee's effective use of the equipment.

In operational terms: to avoid the premium (CLT, arts. 191 and 192), the company must demonstrate a complete chain — PPE that is suitable and has a CA, delivered, replaced on time and actually used. A company that cannot prove delivery, replacement and supervision of use loses its main argument.

And that proof may be demanded years later. Workers can claim amounts from the last five years, in a lawsuit filed up to two years after the end of the employment contract (Federal Constitution, art. 7, XXIX). In other words, records must remain retrievable even after the site or the client contract has ended.

PPE in eSocial: event S-2240

In eSocial, the Brazilian government's digital system for reporting labor and social security obligations, event S-2240 (Workplace Environmental Conditions – Harmful Agents) reports the worker's exposure to harmful agents and, when there is exposure, declares the collective protective equipment installed and the PPE provided. For each item of PPE, the CA number (or evaluation document) is reported, along with whether the equipment is effective in neutralizing the exposure. The event must be sent by the 15th of the month following the worker's hiring or a change in the reported conditions.

Two points from the official eSocial Guidance Manual deserve attention. First, PPE information in S-2240 does not replace the obligation to record the delivery of the equipment. Second, occupational health and safety events are how employers fulfill the obligation to prepare and update the PPP (Perfil Profissiográfico Previdenciário, the worker's occupational exposure history used by social security), which has been electronic since January 1, 2023. Declaring effective PPE in eSocial without supporting delivery records creates an inconsistency that is hard to explain in an inspection or a lawsuit.

Uniforms need control too

A regular uniform is not PPE, which is a device designed to protect against occupational risks and requires a CA (NR-6, items 6.3.1 and 6.4.1). Still, uniforms create obligations and costs. The CLT allows employers to set the dress code, including logos, and assigns uniform cleaning to the worker, unless procedures or products different from those used for ordinary clothing are required (art. 456-A). Controlling sizes, quantities, replacements and returns upon termination prevents losses and disputes. Also check what the applicable collective bargaining agreement says on the subject.

Digital delivery with electronic signature

NR-6 expressly allows PPE delivery to be recorded in an electronic system. A well-designed digital workflow works like this:

1. The supervisor selects the employee and the items delivered, with CA, lot, size and quantity.
2. The employee confirms receipt and signs electronically in the app, with date, time and location recorded.
3. The record goes into the employee's and the site's history, ready for reports.
4. The system calculates the next replacement for each item and sends an alert before it is due.

As for legal validity, Medida Provisória nº 2.200-2/2001 accepts means of proving the authorship and integrity of electronic documents other than ICP-Brasil certification (Brazil's public key infrastructure), provided the parties accept them (art. 10, § 2). That is why it is worth providing for electronic signatures in the employment contract or in a specific agreement.

In TIRVU+, the delivery of uniforms and PPE is recorded with the employee's digital signature in the app, with ICP-Brasil legal validity, and the system issues expiry and replacement alerts. Stock is visible per site — including disposables: when individual records are not feasible, NR-6 requires them to be available in their original packaging, in sufficient quantity and with immediate replenishment (item 6.5.1.2).

Paper vs. digital control

Aspect	Paper form	Digital control
Delivery record	Depends on the form reaching the archive	Immediate, with date, time and location
Signature	Handwritten, can be lost	Electronic, linked to the employee
Replacement deadlines	Manual or nonexistent control	Automatic alerts per item
Stock per site	Outdated spreadsheets	Visible in real time
Reports	Assembled by hand	Extracted in minutes
Evidence for the client	Copies sent on request	Available for consultation

PPE compliance checklist

• PPE selection recorded and integrated into the PGR
• CA checked in CAEPI before every purchase
• Individual delivery record with item, CA, lot, quantity, date and signature
• Instructions and training documented
• Expiry and replacement deadlines set per item, according to the manufacturer
• Supervision of use at the site, recorded in checklists
• Minimum stock per site, including disposables
• S-2240 consistent with what is actually delivered
• Records stored and retrievable for years
• Evidence organized to present to the client

Frequently asked questions

Is providing PPE enough to avoid paying the unhealthy-work premium?

No. Under Súmula 289 do TST, merely providing the equipment does not exempt the employer from paying the premium: it must also take measures to reduce or eliminate the harm, including those related to the employee's effective use of the PPE. In practice, the company has to prove that suitable PPE with a CA was delivered, replaced on time and actually used.

Can the PPE delivery record be digital, with an electronic signature?

Yes. Brazil's NR-6 allows PPE delivery to be recorded in an electronic system, including a biometric one, as long as the system allows reports to be extracted (item 6.5.1.1). As for the signature, Medida Provisória nº 2.200-2/2001 accepts ways of proving the authorship and integrity of electronic documents other than ICP-Brasil certification if the parties agree to them, so it is worth providing for electronic signatures in the employment contract or in a specific agreement.

Does the eSocial S-2240 event replace the PPE delivery record?

No. According to the eSocial Guidance Manual, PPE information in S-2240 does not replace the obligation to record the delivery of the equipment. Declaring PPE as effective in eSocial without delivery records to back it up creates an inconsistency that is hard to explain in an inspection or a lawsuit.

Conclusion

In outsourcing, PPE control is at once a legal obligation, a way to protect workers and a commercial argument. NR-6 makes clear what must be done, and Súmula 289 do TST shows that delivering is not enough: you must prove delivery, replacement and effective use. Companies that digitize these records reduce liability, respond quickly to inspections and can even share the evidence with the client, as we show in our article on the client portal in outsourcing.

Want to organize PPE and uniform delivery across your operation with ICP-Brasil digital signatures, replacement alerts and stock per site? Talk to the Tirvu team and see TIRVU+ working in your own operation.

Sources

• Planalto: Lei nº 6.019/1974 (temporary work and outsourcing)
• MTE: NR-6, updated text
• MTE: public CA lookup (CAEPI)
• Planalto: Medida Provisória nº 2.200-2/2001

This content is for informational purposes only and does not replace specialized legal advice.