ISO 45001 legal register: tracing legal duties from your hazards and evaluating compliance

What is an ISO 45001 legal register?

It is the working record of every occupational health and safety requirement your organisation has to meet: the laws and regulations in force where you operate, the conditions of any licences or approvals you hold, and the other requirements you have taken on, such as a client's safety prequalification terms or your parent group's safety rules. ISO 45001:2018 places the task in clause 6.1.3, titled "Determination of legal requirements and other requirements", and checks the outcome in clause 9.1.2, "Evaluation of compliance".

The standard prescribes no format. It expects you to know which requirements apply, how they apply to your activities, and to keep that knowledge current. Your OH&S policy also has to commit the organisation to meeting its legal requirements and other requirements, so an out-of-date register undermines a promise top management has signed.

Two features make the OH&S version different from a general compliance list. Its entries follow hazards: working at height, lifting, confined spaces, hazardous substances, noise, driving and lone working each bring their own duties. And its entries follow people: a worker in ISO 45001 is anyone doing work under the organisation's control, which pulls agency staff and many contractors inside the boundary.

Where legal requirements sit in ISO 45001

Clause 6.1.3 is the formal home, but legal duties reach across the system. The main connections, at clause-title level in ISO 45001:2018:

How to build the register, from hazards to duties

The sequence suits a single office or a contractor on many client sites; the tool can be a spreadsheet or software.

1. List the jurisdictions and workplaces

Take every site and type of workplace inside the scope agreed in the ISO 45001 scope guide: your own premises, client sites, temporary works, vehicles used for work and places where people work from home. Note the country, state or free zone of each, because duties and authorities change at those borders.

2. Start from the hazard register

For each activity already assessed under the hazard identification and risk assessment guide, ask which duties govern it. General duties of care, risk assessment and consultation usually apply everywhere; specific rules attach to particular hazards, equipment and substances.

3. Gather what the organisation already holds

Licences, registrations, equipment inspection certificates, authority inspection reports, improvement notices and correspondence.

4. Add the other requirements you have accepted

Client safety rules and prequalification terms, parent-group standards, industry codes you have signed up to and any voluntary commitments in your policy.

5. Write what each entry demands

Record the source, the specific requirement, why it applies, and the practical action: the inspection interval, the training to hold, the record to keep, the report to submit. A title alone tells a supervisor nothing.

6. Name an owner and a route for updates

Each entry needs the manager accountable for meeting it. The register as a whole needs a maintainer and a defined source of change, such as a legal update service, the enforcing authority's notices or local advisers.

A worked example: a maintenance contractor

An engineering firm runs a workshop and sends crews to service equipment at client plants. Sources are generic here; a real register cites the actual law and licence for each jurisdiction.

Notice the third row: the duty sits at a client's plant, under the client's rules as well as the law, and it still belongs in the contractor's own register because its workers carry the risk.

Evaluating compliance under clause 9.1.2

The evaluation works through the register and reaches a conclusion for each entry: compliant, not compliant, or not yet known, with the reason and the next step.

Its inputs are records the system already produces: inspection and examination certificates, exposure monitoring with calibrated instruments, training and licence records, permits to work, drill reports, contractor documents checked at prequalification, incident investigations and the findings of any visit by the authority.

You set the frequency, and it should follow the risk and the rhythm of each duty. A monthly inspection requirement deserves attention every month; a registration renewed every few years does not. Auditors ask why you chose each interval and whether you kept it.

When the evaluation finds a gap, fix it, notify the authority where the law requires, and handle it under clause 10.2 with root cause and corrective action. The overall compliance position is a natural input to the management review, and your internal audit checks that the evaluation was done and done well, without replacing it.

The IAF rules for OH&S certification allow a special audit after a serious incident or serious breach of regulation, and legal proceedings can lengthen audit time.

Common weaknesses in OH&S legal registers

• Statute titles with no applicability. A long list copied from a subscription, with nothing saying what any site must do.
• One jurisdiction for many. Head-office law applied to every site; local duties go unrecorded.
• Contractors left out. Duties for agency staff and subcontractors assumed to be someone else's problem.
• No evaluation record. Inspections happen, certificates exist, but nobody has concluded, entry by entry, whether the organisation complies.
• A register frozen at project start. No update route, no review when a site, process or law changes, and within a year it no longer matches the operation.

ISO 45001 legal register: questions buyers ask