ISO 14001 compliance obligations: building the legal register site by site and evaluating compliance

What are ISO 14001 compliance obligations?

They are the requirements your environmental management system must meet because a law, a permit or a commitment says so. Typically: permit conditions, licences held by the site or its waste carriers, the environmental laws that apply at each location, and requirements accepted from customers, the parent group or the organisation's own policy.

The standard does not hand you a list. It asks you to find the obligations that relate to your environmental aspects, understand how each one applies to you, and keep that knowledge current. The legal register, sometimes called the compliance obligations register, is where that work is recorded.

Two points shape everything that follows. First, obligations attach to aspects: an effluent discharge, a boiler stack or a chemical store brings its own requirements, so the register cannot be written before the aspects and impacts register exists. Second, obligations attach to places: two plants of one company can sit under different permits, authorities and, across countries, legal systems.

Where compliance obligations sit in ISO 14001

Clause 6.1.3 is the named home of the topic, but obligations run through the whole system. The table maps the clauses of ISO 14001:2026 where they carry weight, at the level of clause titles.

Building the ISO 14001 legal register, site by site

The method works for one plant and scales to a group; the order matters more than the format.

1. Start from the site list and the aspects

Take the sites inside the certified boundary, agreed in the scope guide, and the significant and non-significant aspects for each.

2. Collect the documents the site already holds

Permits, licences, registrations, authority correspondence, inspection reports and conditions attached to planning or building approvals. Often a permit turns up in a head-office file whose conditions the operators have never read.

3. Identify the laws that apply to each aspect at each location

Work from the aspect to the requirement. For each entry, record the source, the specific requirement that applies to you, and why.

4. Add the other requirements you have accepted

Customer supply terms, group environmental standards, industry codes the organisation has signed up to and commitments made to neighbours or the community.

5. Translate each entry into what it means in practice

A regulation's title tells nobody what to do. State the limit, the frequency, the report due or the condition to keep, in terms a supervisor would recognise.

6. Assign an owner and a way of keeping it current

Each entry needs a named role accountable for meeting it and a route by which new or amended requirements reach the register, such as a legal update service, the regulator's notices or local advisers.

A worked example: two sites, one register

A company coats metal parts at one plant and stores finished goods at a separate warehouse. Sources are described generically here; a real register cites the actual permit and legal references for each location.

The warehouse adds few entries, but real ones; dropping it as "only storage" would leave the fuel tank with no owner and no evidence.

The evaluation of compliance under clause 9.1.2

Clause 9.1.2 asks you to evaluate whether you are actually meeting them, at a frequency you decide, and to keep a record of the result.

A sound evaluation works through the register entry by entry and reaches a conclusion for each: compliant, not compliant, or not yet determinable with the reason. The inputs are the same evidence a certification auditor will ask to see: monitoring data for emissions, effluent, waste, energy and water set against the applicable limits, calibration records for the meters that produced it, waste manifests, contractor licences, authority inspection reports and your own site checks.

Frequency should follow risk. A monthly-sampled discharge limit deserves monthly attention; a registration renewed every few years needs far less. What auditors test is whether the chosen frequency makes sense for each obligation and whether it has been kept.

When the evaluation finds a failure, the organisation corrects it, informs the authority where the permit or law requires, and runs it through clause 10.2 as a nonconformity. Findings from the evaluation, and the overall compliance position, are also material for the management review.

Your internal audit checks that the evaluation happened and was sound; it does not replace it.

Mistakes that weaken the legal register

• A national list with no link to aspects. Pages of statute titles, half irrelevant, none saying what the site must do.
• One register for a group, with no site column. Permit conditions differ by location; a shared list hides which plant owns which limit.
• No evaluation record. The register exists, the monitoring exists, but no one has recorded a conclusion against each entry.
• Laboratory results filed unread. An exceedance goes unnoticed until the regulator asks.
• No route for change. A register dated at the start of the project and never touched again is out of date within the year.

Compliance obligations and the legal register: questions buyers ask