ISO 14001 compliance obligations: make applicability clear

What clause 6.1.3 requires in practice

Clause 6.1.3 asks the organisation to do three things about its compliance obligations. It must determine the obligations related to its environmental aspects and have access to them. It must determine how those obligations apply to the organisation. And it must take them into account when establishing, running, maintaining and improving the environmental management system.

Compliance obligations include legal requirements and other requirements the organisation must meet or has chosen to meet. Examples in the standard's definitions include permits, regulations, contract terms, industry codes and agreements with community groups. A note in the clause points out that obligations can themselves create risks and opportunities.

The obligations must be available as documented information. The standard does not require a particular register, but it does require that the organisation can show what applies, to what activity, and with what consequence for the system.

Understand what belongs in the obligation set

Compliance obligations include legal requirements and other requirements the organisation must or chooses to meet. Their sources can differ: a permit, a contract or a voluntary commitment may create different duties and evidence needs. The important decision is what applies to the organisation and its environmental aspects.

Do not assume that every interested-party preference automatically becomes a binding commitment. Equally, do not omit an adopted customer commitment merely because it is not legislation. Keep the basis for inclusion clear so that the business understands the responsibilities it has accepted.

Translate a reference into an applicable requirement

Identify the relevant source and version, establish access and determine how it affects activities within the EMS. Practical supporting information may include the location, process, owner and evidence needed. These fields are suggested ways of making the requirement usable, not a prescribed ISO register format.

A reference to an entire regulation may help locate the source but can leave the operating requirement obscure. An informed reviewer should identify the relevant duty and its applicability without altering the source's meaning. Where the position is uncertain, record the issue and obtain suitable advice rather than assigning an unsupported “compliant” status.

Bring obligations into planning and operation

Take the obligations into account when establishing, implementing, maintaining and improving the EMS. That connection can affect operating criteria, purchasing, competence, monitoring, communication or objectives. A requirement that stays in the register but never reaches the process owner has not become an effective management arrangement.

Maintain the documented information and review relevant changes. A changed activity can alter applicability even when the source requirement itself is unchanged. A new site, different material or revised customer commitment should trigger consideration of the obligations affected. The appropriate review method depends on the nature and pace of change.

Why compliance obligations matter to the business

Failure to meet an obligation can lead to enforcement action, stopped operations, damage claims, lost contracts and reputational harm. These consequences usually arrive suddenly, so knowing which requirements apply before an inspector or customer asks is one of the cheapest forms of protection available to a business.

The clause also covers commitments the organisation chose, such as customer clauses on equipment disposal. Treating these seriously avoids the situation where sales teams promise something operations cannot deliver. A clear understanding of applicability helps managers prioritise controls, avoids duplicated effort across sites in different jurisdictions and gives top management a realistic picture of the legal and contractual landscape in which the organisation works.

How to implement clause 6.1.3

Obligations become useful when they reach the people who carry out the work. Take these steps to make that happen. Involve the managers who control each activity, as they often know about permit conditions and customer commitments that never reached the central file.

1. Draw on permits, contracts, correspondence, regulator communications and the interested-party decisions made under clause 4.2.
2. Identify the source and the current version of each requirement, and make sure the people who need it can reach it.
3. For each, state in plain words what is required, which activity or site it affects and who is responsible.
4. Obtain qualified legal or technical advice where interpretation is unclear, and note the position instead of assuming compliance.
5. Feed each obligation into operating criteria, purchasing, competence needs, monitoring and communication where relevant.
6. Set triggers to revisit applicability when sites, materials, activities or customer commitments change.
7. Keep the information as documented information and review it alongside the evaluation of compliance under clause 9.1.2.

Evidence an auditor expects for clause 6.1.3

Auditors usually select an obligation and trace it to operations. Evidence that supports a convincing trace includes the following.

• The documented obligations covering legal requirements and the other requirements the organisation accepted.
• Access to the source documents in their current version, whatever medium is used.
• Records showing how each obligation applies to specific activities, sites and responsible people.
• Examples of obligations carried into operational controls, training or purchasing requirements.
• Interviews in which managers explain, without prompting, which obligations affect their area.
• Evidence that a change prompted a review of applicability.

Common nonconformities with clause 6.1.3

Findings on obligations usually concern gaps between a list of requirements and what operations know. Common examples appear below.

• Obligations are documented as titles of laws only, with no statement of how they apply to the organisation's activities.
• A permit condition or customer commitment that affects an aspect is absent from the determined obligations.
• Source documents are out of date, or the people who need them cannot access them.
• Applicability was decided once for one site and reused elsewhere without checking local conditions.
• Obligations are held by a central coordinator and never communicated to the managers who control the activity.

Illustrative construction example: temporary site arrangements

Illustrative BPO example: customer commitments on equipment

A hypothetical BPO company accepts a customer's requirement for evidence about the destination of retired computing equipment used in the service. Procurement translates that commitment into the provider arrangement. Facilities records the transfers, and an assigned owner checks whether the evidence meets the accepted requirement.

The organisation separates that contractual commitment from applicable legal duties and from broader aspirations about circularity. It avoids claiming verified recycling or reuse merely because equipment has left its premises. The obligation becomes useful because the required evidence and review responsibility are understood.

Connect applicability with compliance evaluation

Clause 6.1.3 determines obligations and applicability. Clause 9.1.2 evaluates whether the organisation is fulfilling them. The first establishes what needs to be done; the second examines the actual position. Keeping the relationship clear prevents a register update from being misreported as a compliance evaluation.

An auditor may select an obligation and follow it into operational responsibilities and evaluation results. Evidence should support the connection, not just show that someone subscribed to an update service. Common problems include inaccessible source documents, old applicability decisions and responsibilities assigned to a central coordinator who cannot control local work.