ISO 45001 clause 6.1.3: determine applicable legal and other requirements
ISO 45001:2018 clause 6.1.3 requires processes to determine and access up-to-date legal and other requirements applicable to hazards, OH&S risks and the management system. The organisation determines how they apply and what needs to be communicated, takes them into account throughout the system and maintains and retains documented information that is updated for changes.
What clause 6.1.3 requires in practice
Clause 6.1.3 asks the organisation to run a working process, not to keep a one-off list. The process has three jobs. First, it finds the legal requirements and other requirements that relate to the organisation's hazards, its OH&S risks and its management system, and keeps access to the current versions. Second, it works out how each requirement applies to the organisation and what has to be communicated to whom. Third, it feeds those requirements into the way the system is established, run, maintained and improved.
The output is documented information on the requirements that apply, kept up to date as they change. The clause also notes that requirements can themselves create risks and opportunities, which links this work to the planning that comes before it. The clause says nothing about a particular register layout or subscription; the test is whether the people who control the work know what applies to them.
Translate sources into applicable duties
Identify the relevant source, scope and requirement. A title in a register may help locate a document, but operating managers need to understand what applies to a particular activity, location or work arrangement. Obtain appropriately qualified advice when interpretation exceeds internal competence.
Other requirements can arise from contracts, collective arrangements or commitments the organisation has to or chooses to fulfil. Distinguish these from legal duties while preserving their relevance. A requirement does not become unimportant merely because its source is contractual rather than legislative.
Connect requirements with implementation
Determine how relevant duties affect planning, controls, competence, procurement, communication and evaluation. Assign practical ownership to the people who control the affected process. A central legal-information service can support updates, but it cannot by itself establish local applicability or implementation.
Consider changes in the source and changes in the organisation. A new location, material, contractor arrangement or activity can alter applicability even if the law has not changed. The process should recognise both routes.
Why knowing your legal duties protects the business
Most serious OH&S failures that reach regulators, insurers or courts involve a duty the organisation did not realise applied to a particular activity, site or worker arrangement. A clear picture of applicable requirements lets management price a new contract properly, brief supervisors accurately and answer a client's site rules without improvising. It also separates what the law demands from what a customer or the organisation itself has chosen to commit to, so nothing is quietly dropped. For an auditor, a live process for requirements is one of the quickest signs that the rest of the system is anchored in reality rather than in generic text.
How to implement clause 6.1.3
One way Sterling's teams approach this is to start from the activities and locations rather than from a list of laws. Keep the result short enough that an operating manager can read it.
- Map the organisation's activities, sites, materials and worker arrangements, including contractors and home or client-site working.
- Identify the sources of requirements for each: legislation, regulator guidance, permits, client contracts, industry commitments and any collective arrangements.
- Obtain qualified interpretation where internal competence runs out, and note who gave it.
- Record in plain language what applies to which activity, who owns the affected process and what must be communicated.
- Link each requirement to the planning, control, competence and procurement decisions it touches, so owners can act on it.
- Set triggers for review: a source changes, a new site opens, a material or contractor changes, or an incident exposes a gap.
- Check at the next audit or review that the record still matches the work actually being done.
Two illustrative applicability decisions
A construction contractor begins work in a new jurisdiction. It uses a common corporate method but obtains suitable local interpretation of requirements relevant to the project and worker arrangements. The team identifies which duties affect work planning and coordination and who will provide evidence. It does not assume that the previous project’s register applies unchanged.
A software business accepts a client’s site-access and reporting requirements for staff working at the client’s premises. The responsible team determines the actual obligations, communicates relevant instructions and identifies the interface with the client. It separates those accepted requirements from its own internal preferences and from applicable legal duties.
Keep applicability separate from compliance status
Clause 6.1.3 establishes what applies and how it enters the system. Clause 9.1.2 evaluates whether requirements are fulfilled. Updating a register is not the same as evaluating actual compliance, and holding a copy of a requirement is not evidence that the affected work meets it.
Where applicability or status is uncertain, make the uncertainty visible and assign a route for resolution. Avoid an unsupported “compliant” label that hides missing evidence. Certification does not remove the organisation’s legal responsibilities or replace specialist interpretation.
Required evidence and common mistakes
Maintain and retain documented information on legal and other requirements and ensure it reflects relevant changes. The standard does not prescribe one register layout or a particular subscription service. Useful information may include source, applicability, affected process and responsibility, but those are practical fields rather than mandatory column names.
Common mistakes include copying requirements between countries, overlooking accepted contractual commitments and sending updates to people who cannot act on them. Another is treating risk scoring as a basis for disregarding a duty. Applicable requirements need to inform decisions regardless of a preferred score.
Frequently asked questions
Is a legal update subscription sufficient?
No. It can supply information, but the organisation still determines applicability, communicates requirements and integrates them into its system.
Do client requirements count?
Relevant accepted requirements can be other requirements. Determine their actual meaning and applicability.
Does certification prove full legal compliance?
No. It assesses a management system within scope and does not provide a legal guarantee.
Clarify one duty from source to evidence
Discuss OH&S requirement management with Sterling, with local legal or technical advice scoped where necessary. The ISO 45001 Awareness course explains why duties affect daily work. Effivity ISO & GRC automation software can be considered for agreed processes and audit evidence. See planning and the guide.