Month: September 2026

Posted on

What Does an ISO 45001 Legal Register Need to Contain?

If you are working towards ISO 45001 certification, or maintaining it, one of the most common sticking points during audits is the legal register. It sounds like a simple document — a list of laws that apply to your business — but auditors consistently find registers that are either incomplete, out of date, or too vague to demonstrate real compliance.

This article breaks down exactly what a compliant legal register needs to contain, why it matters, and how to keep it audit-ready.

What Is a Legal Register?

A legal register (sometimes called a “legal and other requirements register”) is a structured record of all the health and safety laws, regulations, codes of practice, and other obligations that apply to your organisation’s activities, products, and services.

Under ISO 45001, Clause 6.1.3 requires organisations to determine and have access to up-to-date legal requirements and other requirements relevant to their occupational health and safety management system (OH&S MS), and to keep this information current. The register is how you evidence that you have done this.

Legal register
Is your legal register up to date?

Why It Matters More Than It Looks

A legal register is not just a compliance checkbox. It is the foundation your OH&S management system is built on — it drives your risk assessments, your operational controls, your training needs, and your internal audit criteria. If the register is wrong or incomplete, everything built on top of it is at risk too.

Auditors will typically test the register in two directions:

  • Top-down — picking an activity or hazard on site and checking the relevant legislation is listed.
  • Bottom-up — picking an entry in the register and asking how it is being met in practice.

If either direction breaks down, it is usually flagged as a non-conformity.

Core Elements Every Entry Should Include

While the exact format can vary, a robust legal register entry should contain the following information for each requirement:

  1. Legislation or requirement title — the specific act, regulation, code of practice, standard, or other obligation (e.g. industry code, insurer requirement, client contractual clause).
  2. Reference number or citation — the official identifier so it can be traced back to source.
  3. Jurisdiction — which country, state, or region it applies to, especially important for multi-site organisations.
  4. Summary of the requirement — a plain-language description of what the law actually requires, avoiding a copy-paste of dense legal text.  This is often where expert consultants can be beneficial in interpreting the law to your business operations.
  5. Applicability — why and how this requirement applies to your specific operations, sites, or activities. Generic entries (“Health and Safety at Work Act applies to all businesses”) are a common audit finding.
  6. Compliance status — a clear statement of whether you currently comply, partially comply, or are working towards compliance.  This is particularly useful when first implementing ISO 45001.
  7. Evidence of compliance — links or references to the specific procedures, records, permits, certificates, or controls that demonstrate compliance.
  8. Responsible person or role — who owns the register and is accountable for maintaining compliance.
  9. Review date and frequency — when it was last checked and when it is next due for review.
  10. Source of update information — how you monitor for changes (e.g. legislation update service, trade body bulletin, government gazette, etc.).
  11. Date of last legislative change — useful for showing the register reflects the current version of the law, not an outdated one.

Beyond Statutory Law: “Other Requirements”

ISO 45001 explicitly extends beyond legislation to “other requirements.” These are easy to miss but often specifically probed by auditors. They may include:

  • Industry codes of practice and guidance documents
  • Client or contractual health and safety requirements
  • Relevant insurance provider conditions
  • Corporate group standards (for multi-site or multinational organisations)
  • Voluntary agreements or membership scheme conditions
  • Permits, licences, and consents tied to specific sites or activities

If your register only lists statutory legislation and ignores these, it will not fully meet the clause requirement.

How to Structure the Register

There is no single structure that every register must follow, and it is often determined by the type, size or nature of the organisation itself.  Most organisations use a spreadsheet, text document or a dedicated compliance software tool. Common groupings include:

  • General health and safety legislation
  • Fire safety
  • Environmental (where it overlaps with H&S, e.g. hazardous substances)
  • Sector-specific legislation (construction, manufacturing, healthcare, etc.)
  • Equipment and machinery
  • Chemical and hazardous substances
  • Transport and vehicles
  • Welfare and employment law touching on H&S

Structuring it makes the register easier to cross-reference against your risk assessments and operational controls, procedures and much faster to navigate during an audit.

Keeping It Live: Review and Monitoring

A legal register is only useful if it stays current. ISO 45001 requires that this information be kept up to date, so your process needs to show:

  • A defined review frequency (many organisations review quarterly, with a full review annually)
  • A named responsible person for monitoring legislative changes, this can be a representative in the organisation but could also be an external consultant
  • A method for capturing changes (legal update subscription services are common, as manually tracking government publications is unreliable)
  • A record of how changes were assessed and, where relevant, actioned (updated risk assessments, new controls, revised training)

Common Mistakes to Avoid

  • Treating it as a one-off exercise. Registers built once for certification and never revisited are one of the most frequent non-conformities.
  • Copying generic templates without tailoring. A register that does not reflect your actual sites, activities, and hazards will not withstand scrutiny.
  • No link to evidence. Listing a requirement without showing how it is actually met leaves a gap between the register and reality.
  • Missing “other requirements.” Focusing only on statute law and ignoring client, insurer, or industry obligations.
  • No ownership. Without a named responsible person, updates tend to fall through the cracks.

Final Thoughts

A well-built legal register does more than satisfy Clause 6.1.3 — it becomes a working tool that keeps your entire OH&S management system grounded in what the law and your other obligations actually require. Getting the structure right from the start, and building in a genuine review cycle, is what separates a register that passes audit from one that merely exists on paper.

If you would like support building or auditing your legal register as part of your ISO 45001 journey, get in touch with our team for a consultation.

Posted on

Health & Safety Legal Register vs Compliance Audit: What is the Difference?

If you have been told you need a “legal register” and separately advised to commission a “compliance audit,” you could be forgiven for wondering whether these are two names for the same thing. They are not — and understanding the difference matters, because most organisations that fall foul of a health and safety enforcement notice have one of these two documents in place but not the other.

This article explains what each one actually does, how they work together, and which one your organisation needs first.

The short answer

A health and safety legal register identifies which legal requirements apply to your organisation. A compliance audit (or compliance evaluation) tells you whether you are actually meeting them.

One is a map. The other is a health check against that map. You need both, but they answer different questions, and confusing them is one of the most common gaps we find when we review a client’s health and safety management system.

Health and safety consultant reviewing legal register documentation

What is a legal register?

A legal register is a structured record of the health and safety legislation, regulations, approved codes of practice, and other legal requirements that apply to your organisation’s specific activities, sites, and operations.

A good legal register will typically:

  • List each applicable piece of legislation (for example, the Management of Health and Safety at Work Regulations, COSHH, the Work at Height Regulations, or sector-specific rules)
  • Summarise what that legislation requires of your organisation
  • Identify which parts of your business or which activities the requirement applies to
  • Identify the controls in place to meet the legal requirements
  • Be reviewed and updated as legislation changes or your operations evolve

Crucially, a legal register is a document of applicability. It answers the question: “What law applies to us, and what does it say we must do?” It does not, by itself, tell you whether you are doing it.

What is a compliance audit or evaluation?

A compliance audit takes the requirements identified in the legal register (or an equivalent framework) and tests them against reality. It asks: “Are we actually meeting this requirement, in practice, today?”

A compliance audit typically involves:

  • Site visits and observation of actual working practices
  • Review of documentation, records, and evidence (permits, training records, inspection logs, risk assessments)
  • Interviews with staff, supervisors, and duty holders
  • Gap analysis against each legal requirement
  • A findings report ranking non-conformities by risk and urgency
  • Recommendations and an action plan to close the gaps

Where the legal register is a snapshot of obligations, the compliance audit is a live assessment of performance. It is the difference between having a checklist and actually checking the boxes — and finding out, in evidence-based detail, which ones you cannot honestly tick yet.

Legal Register

  • Records applicable legislation for the organisation

  • Sets the bench mark for compliance

  • Must be regularly reviewed & updated

  • Identifies controls in place

  • Bespoke to the organisation

  • Can be one jurisdiction or more

Compliance Audit

  • Identifies if you actually meet the legal requirements

  • Assesses at a specific point in time

  • Site visits, observations & staff interviews

  • Review of documentation, records, etc.

  • Gap analysis

  • Recommendations & action plan

Why the difference matters

We regularly see organisations that have invested in one of these tools and assumed it covers the other. Both mistakes carry real risk.

Legal register without an audit: You know what the law requires, but nobody has verified whether it’s happening on the ground. This is common where a legal register was purchased as a subscription product or generated once and filed away. It creates a false sense of security — the document exists, so the box feels ticked, but there is no evidence of actual conformance if an inspector, insurer, or regulator asks for it.

Audit without a legal register: You get a snapshot of current practice, but without a clear, maintained baseline of what should apply, the audit scope is often built from generic checklists or the auditor’s working knowledge rather than your organisation’s specific legal exposure. Gaps in obligations you did not know applied to you can be missed entirely.

Used together, the legal register defines the scope of what to check, and the audit provides the evidence of whether you are meeting it. This combination is also what regulators, insurers, and courts expect to see when assessing whether an organisation exercised due diligence — a legal register with no corroborating evidence of compliance checking is a weak defence in an enforcement case or civil claim.

How they fit into a health and safety management system

Think of it as a three-stage cycle:

  1. Identify — the legal register captures every applicable requirement
  2. Evaluate — the compliance audit tests current practice against each requirement
  3. Act — a corrective action plan closes the gaps the audit identifies, and the cycle repeats on a review schedule

This mirrors the “Plan-Do-Check-Act” approach that underpins recognised health and safety management standards such as ISO 45001 and HSG65. A legal register alone only covers “Plan.” Without the “Check” stage — the audit — you have no mechanism to confirm the plan is working.

Which do you need first?

If your organisation does not currently have a legal register, that is the logical starting point — you cannot meaningfully audit compliance against requirements you have not formally identified.

If you already have a legal register but it has not been tested against actual site practice in the last 12 months, a compliance audit should be your next step. An out-of-date or unverified register can quietly become a liability rather than an asset.

Get a clear picture of your legal exposure and compliance status

Many organisations discover during an audit that gaps have existed for months or years without anyone noticing — often because the legal register and the audit process were never properly connected.

If you are not sure whether your current legal register is complete, whether your last audit was thorough enough, or where to start with either, we can help. We carry out legal register development, gap analysis, and full compliance audits tailored to your sector and operations, with a clear, prioritised action plan at the end of it — not just a list of problems. We have experience in a variety of sectors to meet your needs.

Get in touch to arrange a no-obligation discussion about your current legal register or compliance status, and we will tell you honestly where your priorities should be.

Posted on

How to Pinpoint Environmental Legislation for Your Business

Environmental compliance can feel like an impossible maze. Regulations pile up at the local, national, and sometimes international level. They also shift depending on your industry, your size, your location, and even the specific materials you handle. Many business owners freeze at this point, assuming they need a law degree just to figure out where to start.

The good news is that you do not. You do not need to become an environmental lawyer, but you do need to know which requirements apply to your operations. This article walks through a practical process for narrowing down the environmental legislation for businesses that actually matters to your business, so you can focus your time and resources on real compliance instead of guesswork.

Why This Matters Before You Even Start

Non-compliance with environmental law is not a minor administrative slip. Depending on jurisdiction, penalties can include significant fines, operational shutdowns, personal liability for directors, and reputational damage that outlasts any fine. On the other hand, over-compliance — spending resources chasing rules that do not apply to you — wastes money and attention that could go toward growth. Getting the scope right is the foundation of an efficient compliance program.

Step 1: Map Your Business Activities, Not Just Your Industry

Legislation is often triggered by specific activities rather than by industry labels. A “manufacturing” business might trigger air emissions rules because of a paint booth, water discharge rules because of a wash-down process, and hazardous waste rules because of solvent disposal — three separate regulatory regimes from three separate activities.

Start by listing:

  • What raw materials, chemicals, or substances you use, store, or produce
  • What waste streams your operations generate (solid, liquid, air, hazardous)
  • Whether you discharge anything to water, air, or land
  • Whether you import, export, transport, or store regulated goods
  • The physical footprint of your operations (land use, proximity to protected areas or waterways)

This activity-based map is usually far more useful than starting from your business’s official industry classification.

Environmental compliance journey

Step 2: Identify Your Jurisdictional Layers

Environmental law is rarely a single rule book. Most businesses need to check multiple layers:

  • Local rules — SSSI designations, noise, local waste collection and disposal by-laws
  • National legislation — overarching frameworks such as clean air, clean water, or waste management Acts or Statutory Instruments
  • International or trade-related obligations — relevant if you import/export goods or waste, use certain packaging, or operate across borders

A rule of thumb: start at the national level to understand the broad framework, then narrow down to local rules, which often add stricter or more specific obligations on top.

Step 3: Check for Permits and Licensing Triggers

Many environmental obligations are tied to permits rather than blanket rules. Common triggers include:

  • Emitting pollutants above a certain threshold
  • Discharging wastewater
  • Storing hazardous substances above specified quantities
  • Operating certain types of equipment (boilers, generators, refrigeration systems with regulated refrigerants)
  • Extracting or using groundwater

If any of these apply, there is likely a permitting authority you need to register with, and permits often come bundled with monitoring, record keeping, and reporting duties.

Step 4: Look at Size and Threshold Exemptions

Many environmental regulations include size-based thresholds — for example, exemptions or reduced obligations for small quantity generators of waste, or simplified reporting for smaller emitters. Do not assume a regulation applies in full just because it mentions your industry; check the thresholds carefully, since they can significantly change your compliance burden.

Step 5: Use Official Government Resources

Regulatory agencies typically publish guidance documents, compliance checklists, and industry-specific fact sheets designed for non-specialists. These are usually more current and more directly applicable than general online summaries. Useful sources include:

  • National environmental protection agency websites such as the Environment Agency in England and Wales, SEPA in Scotland
  • State or provincial environment department portals such as DEFRA and DAERA
  • Local council or municipal planning and environmental health offices
  • Industry association compliance guides

Step 6: Watch for Sector-Specific Overlays

Certain sectors carry additional layers of regulation on top of general environmental law — food and beverage, construction, agriculture, manufacturing, healthcare, and mining are common examples. If you operate in one of these sectors, check for sector-specific statutes or codes of practice in addition to general environmental legislation.

Step 7: Build a Simple Compliance Register

Once you have identified applicable legislation, do not leave it in your head or in scattered notes. Build a basic register or registers that track:

  • The specific regulation or permit requirement
  • The regulating authority
  • Renewal or reporting deadlines
  • The internal person responsible / procedure applicable
  • Evidence or records required to demonstrate compliance

This turns a one-time research exercise into an ongoing management tool.

Step 8: Know When to Bring in Outside Help

Self-assessment gets you most of the way, but some situations warrant professional input — complex permitting processes, contaminated land issues, mergers or acquisitions involving environmental liabilities, or any situation where the penalties for getting it wrong are severe.

Environmental consultants and lawyers are most valuable when used strategically and will provide real value to the process.

The Benefits of Bringing in an External Consultant

Even with a solid self-assessment process in place, an external environmental consultant can add real value. Consultants work across many businesses and jurisdictions, so they tend to spot applicable legislation and emerging regulatory changes faster than an internal team researching the topic for the first time.

Consultants can also benchmark your operations against industry-specific obligations you might not think to check, verify that thresholds and exemptions have been applied correctly, and flag overlapping requirements between local and national regulators before they become a problem.

Beyond the initial identification exercise, a consultant can help translate legislation into practical action — building or auditing your compliance register, preparing permit applications, and liaising directly with regulators on technical points. For businesses expanding into new activities, new sites, or new jurisdictions, this outside expertise often pays for itself by preventing costly missteps, reducing the time your team spends on unfamiliar regulatory research, and giving management confidence that nothing material has been missed.

Final Thoughts

Identifying which environmental legislation applies to your business is less about legal expertise and more about a structured process. Understand your activities, map the jurisdictional layers, check permitting triggers and thresholds, use official guidance, and keep a living record of what applies. Approached this way, environmental compliance becomes a manageable, ongoing part of running your business rather than an intimidating unknown.

If you would like to see how we can help you identify which environmental legislation applies to your business, please contact one of our team.

Why not download our health and safety and environmental legal register checklist for UK operations.

Checklist
Posted on

How to Identify Which Health & Safety Legislation Applies to Your Business

UK health and safety law is not a single rule book that every business follows in the same way. Instead, it’s a layered system: the Health and Safety at Work etc. Act 1974 (HSWA) sets out broad duties that apply to almost every employer, while dozens of more specific regulations — made under that Act — only apply depending on what your business actually does. Many owners and managers assume that because they have done a general risk assessment, they are covered. In practice, working out your full legal obligations means looking closely at your activities, equipment, premises and workforce, not just your industry label.

This article walks through the main factors that determine which UK regulations apply to your business, so you can build an accurate picture of your legal duties rather than relying on guesswork.

Start with the general duties under HSWA 1974

The Health and Safety at Work etc. Act 1974 is the foundation of UK health and safety law. It places a general duty on employers to ensure, so far as is reasonably practicable, the health, safety and welfare of their employees, and to protect others — such as contractors, visitors and the public — who may be affected by their work. The Act also places duties on the self-employed and on those in control of premises.

HSWA rarely tells you exactly what to do in a given situation. Instead, it is supported by a wide range of secondary legislation — mostly Statutory Instruments enforced by the Health and Safety Executive (HSE) or your local authority — that add specific, practical requirements. Identifying which of these regulations apply to you depends on several interacting factors.

Houses of Parliament, London

Factor 1: The nature of your work activities

The single biggest driver of applicability is what your business actually does day to day. UK regulations are often built around specific hazards or types of work, meaning two businesses in the same broad sector can have quite different legal obligations depending on the tasks involved. Common examples include:

Each of these activities brings its own dedicated regulations into scope, separate from the general HSWA duties.

Factor 2: The substances and materials you work with

If your business handles chemicals, dust, fumes, biological agents or other hazardous substances, the Control of Substances Hazardous to Health Regulations 2002 (COSHH) is likely to apply — regardless of your sector. This is not limited to obviously “industrial” settings; hairdressers, cleaners, print shops, laboratories and even offices using certain equipment can fall within scope. Applicability depends on the substance itself, how it is used and stored, and the level of exposure risk — not on your business type. Where lead or asbestos are involved specifically, separate dedicated regulations apply on top of COSHH.

Factor 3: Equipment and machinery in use

The Provision and Use of Work Equipment Regulations 1998 (PUWER) generally applies wherever machinery, tools or equipment are used for work — from industrial plant to a simple stepladder or a piece of office equipment. Where lifting equipment is involved (hoists, forklifts, lifts), the Lifting Operations and Lifting Equipment Regulations 1998 (LOLER) also applies, and pressure systems bring in the Pressure Systems Safety Regulations 2000. The trigger here is the presence and use of the equipment itself, not the sector you operate in.

Factor 4: Your premises and how they are used

The type of premises you occupy, and how they are used, brings separate legislation into play:

A business operating from a warehouse, a shop, a construction site or a shared office block may each face different obligations relating to the physical environment, even where their core work activity is otherwise similar.

Factor 5: The size and structure of your business

Some duties scale with headcount. Under the Management of Health and Safety at Work Regulations 1999, employers with five or more employees must record significant findings of their risk assessments in writing and have a written health and safety policy. Businesses below that threshold still carry the same underlying legal duty to manage risk — they simply have lighter documentary requirements. Separately, if you employ anyone, you are generally required to hold Employers’ Liability Insurance under the Employers’ Liability (Compulsory Insurance) Act 1969, with limited exemptions.

Factor 6: Who is affected by your work

UK legislation does not only protect your direct employees. HSWA and related regulations also require you to consider contractors, visitors, and members of the public affected by your activities. This is particularly relevant if you:

  • Invite the public onto your premises (retail, hospitality, leisure)
  • Send staff to work on other organisations’ sites
  • Manage shared workspaces where multiple employers’ activities interact

The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) also applies broadly here — requiring certain injuries, diseases and dangerous occurrences to be reported to the HSE, regardless of whether the person affected was an employee.

Factor 7: Your sector-specific regulatory regime

Certain industries carry their own dedicated regulatory frameworks layered on top of general health and safety law, including:

  • Construction — CDM Regulations 2015
  • Agriculture — regulations covering machinery guarding, livestock handling and pesticides
  • Food businesses — food hygiene regulations sit alongside (not instead of) health and safety law
  • Healthcare — additional infection control and clinical waste regulations
  • Transport and logistics — drivers’ hours rules and vehicle-specific regulations

These sector-specific rules typically sit alongside general legislation like HSWA and the Management Regulations, rather than replacing them.

Factor 8: Enforcement authority and regional variation

In Great Britain, enforcement is split between the HSE (typically for higher-risk sectors like construction, manufacturing and agriculture) and local authorities (typically for offices, retail and hospitality) — it is worth knowing which applies to your business, as this affects who you report incidents to and who may inspect your premises. Note also that Northern Ireland has its own health and safety legislative framework, enforced by the Health and Safety Executive for Northern Ireland (HSENI), which mirrors but is legally separate from GB law. Businesses operating across the UK should check they are not assuming GB regulations automatically extend to Northern Ireland.

Putting it together: a practical approach

Rather than trying to memorise every regulation that might apply, it is more effective to map your business against these factors systematically:

  1. List your work activities — every task carried out by staff, not just the “main” job.
  2. List the substances, equipment and materials involved in each activity.
  3. Map your premises types and how each is used, including shared or third-party sites.
  4. Check your headcount against the five-employee threshold for written documentation.
  5. Identify who else is affected — contractors, visitors, the public.
  6. Check for sector-specific regimes relevant to your industry.
  7. Confirm your enforcing authority (HSE or local authority) and whether Northern Ireland rules apply.

Working through this list will usually surface a shortlist of applicable regulations that goes well beyond HSWA’s general duties alone. Because legislation is periodically updated, it is worth revisiting this exercise whenever your activities, premises or workforce change significantly — and consulting a qualified health and safety adviser or solicitor if you are uncertain how a specific regulation applies to your circumstances.

Getting this right is not just about compliance for its own sake. Understanding exactly which legislation applies to your business is the foundation for building risk assessments, policies and training that address the hazards your people actually face — rather than a generic checklist that misses what matters most.

Determining which legislation is applicable in your business can be complicated and time consuming, although the Health and Safety Executive acknowledges that businesses need to identify the laws relevant to their particular industry and activities.

We identify the health & safety legislation relevant to your specific activities and produce a bespoke legislation register.  We can also provide a regular update service so that you can focus on running your business.  If you would like a quotation or more information about the services we offer, please contact us.

Would you like a free copy of our health and safety and environmental legal register checklist?