hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
SterlingInternational Consulting Talk to a consultantTalk to us

Spain · Certification

ISO 45001 certification in Spain

Achieve ISO 45001 certification in Spain with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.

  • Accredited certification
  • Enschede office team
  • Effivity software included
  • Academy training included

Clients include

  • Allianz
  • Emirates Flight Catering
  • Etihad Rail
  • Haier
  • Whirlpool
  • Emerson
In short

ISO 45001 certification in Spain at a glance

Ley 31/1995 de Prevención de Riesgos Laborales is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Spain ask for evidence that you meet it.

Every Spanish employer already carries the duties in Ley 31/1995 on occupational risk prevention: workers are entitled to effective protection, and the employer must integrate prevention into the company's general management system through a prevention plan, risk evaluation and planned preventive activity. The Inspección de Trabajo y Seguridad Social monitors compliance. ISO 45001 is not named in the law, so certification is voluntary, but it gives employers a structured way to run those duties and gives clients independent evidence of how safety is managed. The certificate is issued by a certification body accredited by ENAC or by another body within the international recognition arrangements, not by Sterling, and it does not replace legal compliance. Sterling's Enschede office works with Spanish employers on the gap analysis, procedures and internal audits, with Effivity and Sterling Academy included with the engagement.

The need

Who needs ISO 45001 in Spain, and what happens without it

In Spain the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.

  • All Spanish employersLey 31/1995 gives workers a right to effective protection and requires employers to protect them against occupational risks.
  • Employers building the compulsory prevention planThe plan must set out the organisational structure, responsibilities, procedures, processes and resources, which a management system standard can organise.
  • Contractors and industrial suppliers asked by clients for a certified safety systemA certified system gives clients independent evidence beyond the legal minimum.
  • Groups operating across several autonomous communitiesOne system gives sites a common method while each site still meets the same national law.

Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.

Take the ISO 45001 readiness check
Requirements

ISO 45001 requirements in Spain

Strip away the vocabulary and ISO 45001 requires a company to prove six things about keeping its people safe and healthy at work.

Leadership takes responsibility for safetyTop management is accountable for preventing work-related injury and ill health, and sets a policy and objectives to do so.
Workers have a real sayWorkers and their representatives are consulted and take part in decisions on hazards, controls, incidents and the system itself.
You know the hazards and the risksHazards are identified on an ongoing basis, risks are assessed, and health and safety legal requirements are known and met.
Controls follow the right orderRisks are reduced using the hierarchy of controls, from eliminating the hazard down to protective equipment, including for contractors.
You are prepared for emergenciesEmergency situations are identified, response plans are in place, people are trained and drills are carried out.
Incidents lead to learningIncidents and nonconformities are investigated, causes are corrected, and performance is monitored, audited and reviewed.

In Spain these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO 45001 explained →

How Sterling gets a Spanish company certified

How to get ISO 45001 certified in Spain

One team from the Enschede office carries the work from scoping to certificate. Clients in Spain are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.

  1. Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
  2. Gap assessment against ISO 45001 and the Spanish requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
  3. Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
  4. Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
  5. Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
Included in every engagement
  • End to end, from one team
  • Effivity ISO & GRC software
  • Preferential Sterling Academy access, with complimentary awareness training for your people
  • Internal auditor training for your audit team, as applicable to your standard
  • Vulnerability assessment on ISMS engagements

The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.

Time

How long does ISO 45001 certification take in Spain?

There is no standard duration: it depends on your scope and on how much of the system already runs. In Spain these are the factors that set the timeline.

  • Number of sites and hazardous activities
  • State of risk evaluations and the prevention plan
  • Contractor and worker consultation records
  • Time to show incident investigation and internal audit evidence

Sterling agrees a dated plan with you on the discovery call, once the scope is known.

Cost

How much does ISO 45001 certification cost in Spain?

The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In Spain these factors move both.

  • Headcount and number of sites
  • Complexity of hazards and permits
  • Remediation of gaps against the legal duties
  • Certification body fees quoted separately from consulting

Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.

Choosing a partner

ISO 45001 consultants and certification bodies in Spain

Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.

  • Check that the body’s accreditation or approval covers ISO 45001 and your sector, and that its certificates can be verified online.
  • Ask the consultant how the local requirements in Spain are mapped into the same system, so nothing runs twice.
  • Ask for client references in your sector; Sterling’s client letters are available on request.
  • Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.

Laws and regulations that drive ISO 45001 in Spain (3)

InstrumentHow it treats the standard
Ley 31/1995 de Prevención de Riesgos LaboralesThe instrument itself
Requires prevention to be integrated into the company's general management system through a prevention plan, risk evaluation and planning of preventive activity; ISO 45001 is not named.
Inspección de Trabajo y Seguridad Social — monitoring of prevention rulesRegulator
Ley 31/1995 gives the Inspección the function of monitoring compliance with occupational risk prevention rules; a certificate is not a substitute for that compliance.
ENAC — national accreditation body for certification bodiesMarket driver
Accredited certification is available through ENAC, designated by Real Decreto 1715/2010 as Spain's national accreditation body; no mandate.

Accreditation, audit language and remote audits in Spain

Use a certification body accredited for this standard by ENAC (Entidad Nacional de Acreditación, Spain's national accreditation body) or by an accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA); check that the accreditation scope covers the standard and your sector. Edition and transition details: ISO 45001 hub →

Audit language

Audits run in Spanish or English by agreement with the certification body; confirm the language of the audit, the certificate and controlled documents at application, and follow any tender or contract clause.

Remote and on-site

Remote elements are at the certification body's discretion; workplaces and operational controls are normally visited on-site.

ISO 45001 in Spain: questions clients ask

Does ISO 45001 replace the prevention plan required by Spanish law?

No. Ley 31/1995 requires a prevention plan integrated into the company's general management system, with risk evaluation and planned preventive activity. ISO 45001 can structure that work and provide audit discipline, but the legal duties stay yours. A certificate does not show that the law is met, so review your obligations with counsel or the competent authority.

Who checks compliance with occupational risk rules in Spain?

The Inspección de Trabajo y Seguridad Social, which Ley 31/1995 charges with monitoring and enforcing the prevention rules. Its function applies whether or not a company holds a management system certificate. ISO 45001 certification is voluntary and comes from an accredited certification body, not from the Inspección or from Sterling.

Is ISO 45001 named in Ley 31/1995?

No. The law speaks of a prevention plan integrated into the general management system, with risk evaluation and planning, and does not name ISO 45001. The standard is a voluntary framework that many employers adopt to run those obligations systematically and to give clients independent evidence of how they manage safety.

Which accreditation should an ISO 45001 certification body have in Spain?

Accreditation from ENAC, the national accreditation body designated by Real Decreto 1715/2010, or from another body within the international recognition arrangements. The scope should cover occupational health and safety management and your sector, so ask the certification body to show it before you agree an audit plan.

Read more

More on ISO 45001 for Spanish organisations

Explore

Other standards Spanish businesses ask Sterling for

Organisations in Spain often combine ISO 45001 with one of these, under one management system where the scopes allow.

All 22 standards Sterling delivers in Spain →

Next step

Start with a free discovery call from the Enschede office

A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.

Sources

  1. Ley 31/1995 de Prevención de Riesgos Laborales — boe.es (accessed 7 Oct 2026)
  2. Inspección de Trabajo y Seguridad Social — monitoring of prevention rules — boe.es (accessed 7 Oct 2026)
  3. ENAC — national accreditation body for certification bodies — boe.es (accessed 7 Oct 2026)
  4. Entidad Nacional de Acreditación (ENAC) — boe.es; enac.es (accessed 7 Oct 2026)

Talk to a consultant

Plan your certification with the Enschede team.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

netherlands@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice