If you are working towards ISO 14001 certification, or maintaining it, the legal register is one of the areas auditors return to again and again. As with its ISO 45001 counterpart, it looks straightforward on paper — a list of environmental laws that apply to your business — but in practice it is one of the most common sources of non-conformities.
This article follows on from our piece on the ISO 45001 legal register, and covers the environmental equivalent: what a compliant ISO 14001 legal register needs to contain, why it matters, and how to keep it audit-ready.
What Is a Legal Register Under ISO 14001?
A legal register for ISO 14001 (referred to in the standard as “compliance obligations”) is a structured record of all the environmental laws, regulations, permits, consents, and other obligations that apply to your organisation’s activities, products, and services.
Clause 6.1.3 of ISO 14001:2026 requires organisations to determine and have access to up-to-date compliance obligations related to its environmental aspects, to determine how these apply to the organisation, and to keep this information current. The register is how you evidence that this has been done.
It is worth noting that ISO 14001 deliberately moved away from the term “legal register” in favour of “compliance obligations” to reflect that the scope is broader than statute law — but in practice, most organisations (and most auditors) still refer to it as the legal register, and we will use both terms here.
Why It Matters More Than It Looks
Just as with an OH&S legal register, this document is not a compliance checkbox — it is the foundation your environmental management system (EMS) is built on. It drives your aspects and impacts assessment, your operational controls, your monitoring and measurement programme, and your internal audit criteria. If the register is wrong or incomplete, everything built on top of it is at risk too.
Auditors will typically test the register in two directions:
- Top-down — picking an environmental aspect (e.g. a waste stream, an emission point, a chemical store) and checking the relevant legislation is listed.
- Bottom-up — picking an entry in the register and asking how it is being met in practice, such as through a permit condition or monitoring record.
If either direction breaks down, it is usually flagged as a non-conformity.
Core Elements Every Entry Should Include
While the exact format can vary, a robust legal register entry should contain the following information for each requirement:
- Legislation or requirement title — the specific act, regulation, permit, licence, or other obligation (e.g. environmental permit condition, corporate group standard, client contractual clause).
- Reference number or citation — the official identifier so it can be traced back to source.
- Jurisdiction — which country, state, or region it applies to, especially important for multi-site organisations with different permit regimes.
- Summary of the requirement — a plain-language description of what the law or permit condition actually requires, avoiding a copy-paste of dense legal text. This is often where expert consultants can be beneficial in interpreting the requirement for your business operations.
- Applicability — why and how this requirement applies to your specific sites, processes, or environmental aspects. Generic entries (“Environmental Protection Act applies to all businesses”) are a common audit finding.
- Compliance status — a clear statement of whether you currently comply, partially comply, or are working towards compliance. Particularly useful when first implementing ISO 14001.
- Evidence of compliance — links or references to the specific permits, monitoring data, procedures, or records that demonstrate compliance.
- Responsible person or role — who owns the register and is accountable for maintaining compliance.
- Review date and frequency — when it was last checked and when it is next due for review.
- Source of update information — how you monitor for changes (e.g. legislation update service, environmental regulator bulletin, trade body alert).
- Date of last legislative change — useful for showing the register reflects the current version of the law or permit, not an outdated one.
Beyond Statutory Law: “Other Requirements”
Like ISO 45001, ISO 14001 explicitly extends beyond legislation to other compliance obligations the organisation has to, or chooses to, meet. These are easy to miss but often specifically probed by auditors. In an environmental context, they may include:
- Environmental permits, licences, and consents (waste, water discharge, emissions to air)
- Industry codes of practice and sector environmental guidance
- Client or contractual environmental requirements
- Corporate group environmental standards (for multi-site or multinational organisations)
- Voluntary agreements, industry schemes, or accreditation body conditions
- Producer responsibility obligations (e.g. packaging, WEEE, battery regulations)
If your register only lists statutory legislation and ignores these, it will not fully meet the clause requirement.
How to Structure the Register
There is no single structure every register must follow, and it is often shaped by the size, sector, and complexity of the organisation. Most organisations use a spreadsheet, a document, or a dedicated compliance software tool. Common groupings for an ISO 14001 register include:
- General environmental legislation
- Waste management and disposal
- Water and effluent discharge
- Air emissions
- Hazardous and chemical substances
- Energy and resource use
- Sector-specific legislation (construction, manufacturing, healthcare, etc.)
- Packaging and producer responsibility
Structuring it this way makes the register easier to cross-reference against your aspects and impacts register and operational controls, and much faster to navigate during an audit.
Keeping It Live: Review and Monitoring
A legal register is only useful if it stays current. ISO 14001 requires that this information be kept up to date, so your process needs to show:
- A defined review frequency (many organisations review quarterly, with a full review annually)
- A named responsible person for monitoring legislative and permit changes — this can be an internal representative or an external consultant
- A method for capturing changes (legal update subscription services are common, as manually tracking regulator publications is unreliable)
- A record of how changes were assessed and, where relevant, action taken (updated aspects and impacts assessments, new controls, revised monitoring)
Common Mistakes to Avoid
- Treating it as a one-off exercise. Registers built once for certification and never revisited are one of the most frequent non-conformities.
- Copying generic templates without tailoring. A register that does not reflect your actual sites, processes, and environmental aspects will not withstand scrutiny.
- No link to evidence. Listing a requirement without showing how it is actually met leaves a gap between the register and reality.
- Missing permit conditions. Focusing only on primary legislation and overlooking the specific conditions attached to site permits and licences.
- No ownership. Without a named responsible person, updates tend to fall through the cracks.
Do I Need a Legal Register for ISO 14001 Certification?
Yes. A legal register (compliance obligations register) is a mandatory requirement of Clause 6.1.3 and is one of the first documents an auditor will ask to see, both at initial certification and at every surveillance audit. Without one, an organisation cannot demonstrate it has identified and is managing its environmental compliance obligations, which is a core requirement of the standard.
Final Thoughts
A well-built legal register does more than satisfy Clause 6.1.3 — it becomes a working tool that keeps your entire environmental management system grounded in what the law, your permits, and your other obligations actually require. Getting the structure right from the start, and building in a genuine review cycle, is what separates a register that passes audit from one that merely exists on paper.
If you are managing both standards together, it is worth reading this alongside our companion article on the ISO 45001 legal register — many organisations choose to maintain a single combined register covering both health and safety and environmental obligations, provided it clearly distinguishes between the two.
If you would like support building or auditing your legal register as part of your ISO 14001 journey, get in touch with our team for a consultation.
