Author: Administrator

Posted on

Does COSHH Apply to My Business?

Short answer: almost certainly, yes. If anyone at your workplace uses, makes, handles or is exposed to substances that could harm their health, the Control of Substances Hazardous to Health Regulations 2002 (COSHH) apply to you. That covers far more businesses than most owners expect, from building sites and factories to salons, schools, care homes and offices.

This guide explains what COSHH covers, who must comply, what is excluded and what you need to do.

What is COSHH?

COSHH is the main piece of Great Britain’s health and safety law governing hazardous substances at work. It requires employers to prevent or adequately control exposure to substances that can cause ill health, whether through breathing them in, skin contact, swallowing or contact with the eyes.

The regulations are enforced by the Health and Safety Executive (HSE) and, for some sectors, local authorities.

Which substances does COSHH cover?

COSHH applies to a wide range of substances hazardous to health, including:

  • Chemicals and products containing them, such as cleaning products, paints, solvents, adhesives, de-greasers and disinfectants
  • Fumes, such as welding or soldering fumes
  • Dusts, such as wood dust, flour dust, silica dust from cutting stone or concrete, and cement
  • Vapours, gases and mists, such as spray mists and exhaust fumes
  • Biological agents, such as bacteria, viruses and fungi, including Legionella in water systems
  • Germs that cause diseases, such as leptospirosis (Weil’s disease) or hepatitis, where work brings people into contact with them
  • Nanotechnology materials, where hazardous
  • Asphyxiating gases, which displace oxygen

Many everyday products carry hazard warning pictograms on the label. These are a good first clue that COSHH is relevant. The supplier’s safety data sheet gives the detail you need for your assessment.

Who does COSHH apply to?

COSHH places duties on employers, but it also protects others affected by your work. You must consider:

  • Your employees and agency or temporary workers
  • Contractors working on your premises
  • Visitors, customers and members of the public who could be exposed
  • Self-employed people, who have duties for their own protection and that of others

Business size doesn’t matter. A sole trader with one employee has the same duties as a large organisation, although the paperwork and controls should be proportionate to the risk.

Does COSHH apply to offices and low-risk workplaces?

Yes, although the risks are usually lower. Offices use cleaning products, toner and printer consumables, and some have air conditioning or water systems that need managing for Legionella. You still need to consider whether any substances could cause harm. In many cases a short, sensible assessment will show that risks are low and existing controls are enough.

What does COSHH not cover?

Some hazards have their own specific regulations, so COSHH does not apply to them:

  • Asbestos, covered by the Control of Asbestos Regulations 2012
  • Lead, covered by the Control of Lead at Work Regulations 2002
  • Radioactive substances and ionising radiation, covered by the Ionising Radiations Regulations 2017
  • Substances hazardous only because they are explosive, flammable, or are at extreme temperature or pressure, which are covered by other legislation such as the Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR)

Even where COSHH doesn’t apply, you will normally still have duties under these other regulations and under the Health and Safety at Work etc. Act 1974.

COSHH bucket

Do you know what chemicals are used in your business?

What do I need to do to comply with COSHH?

In practice, COSHH compliance comes down to these steps:

  1. Assess the risks. Identify which hazardous substances are present, who could be exposed, how and how much. Record your significant findings if you employ five or more people.
  2. Prevent or control exposure. Where you can, eliminate the substance or substitute something safer. Otherwise use engineering controls such as enclosure or local exhaust ventilation, safe working systems, and personal protective equipment (PPE) only as the last line of defence.
  3. Make sure controls are used and maintained. Local exhaust ventilation must be thoroughly examined and tested at least every 14 months, and records kept.
  4. Monitor exposure where needed. Compare exposure against the workplace exposure limits in HSE’s EH40 guidance.
  5. Provide health surveillance where required. This applies where there is a risk of identifiable ill health, such as dermatitis or occupational asthma.
  6. Inform, instruct and train your people. Workers need to understand the risks, the controls and what to do if something goes wrong.
  7. Plan for emergencies. Have procedures for spills, accidents and incidents involving hazardous substances.
  8. Review regularly. Revisit your assessment whenever processes, substances or work methods change.

What happens if I don’t comply?

Poor COSHH compliance can lead to serious occupational illness, including occupational asthma, dermatitis, cancers and lung disease, often with effects that appear years later. The HSE can issue improvement or prohibition notices and prosecute, with unlimited fines for serious breaches. Beyond enforcement, you face the cost of civil claims, sickness absence and reputational damage.

Does COSHH apply in Northern Ireland and the Republic of Ireland?

COSHH itself applies in Great Britain. Northern Ireland has its own equivalent, the Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003, and the Republic of Ireland regulates chemical and biological agents under separate legislation. The core principle is the same: assess, control and review. If you operate across more than one jurisdiction, check the requirements for each.

Not sure where you stand?

If your business uses any chemicals, dusts, fumes or biological agents, assume COSHH applies and start by listing the substances you use. If you’re unsure whether your assessments are adequate, our health and safety consultants can help you review your hazardous substances, carry out COSHH assessments and put practical controls in place.

This article is general guidance and not legal advice. Requirements depend on your specific work activities and location.

Posted on

Does the Environmental Permitting Regulations apply to my business?

If your business handles waste, discharges to water or air, runs industrial plant, or stores certain materials, the answer may well be yes. The Environmental Permitting (England and Wales) Regulations 2016 (EPR) are among the most widely applicable environmental laws in the UK, and many businesses are caught by them without realising it. Operating a regulated activity without the right permit or exemption is a criminal offence, so it’s worth checking before the regulator asks.

What are the Environmental Permitting Regulations?

The environmental permitting regulations bring several previously separate regimes under a single permitting system. Rather than applying for different licences for waste, industrial emissions and water pollution, operators deal with one framework, overseen by the Environment Agency (EA) in England, Natural Resources Wales (NRW) in Wales, or the local authority for certain lower-risk activities.

The core rule is simple: if you carry out a “regulated facility” activity, you need an environmental permit, or you must qualify for an exemption or exclusion.

Do the Environmental Permitting Regulations Apply to You?

Does your business require an environmental permit?

Which activities are regulated?

The regulations cover a broad range of activities. The main categories are:

  • Installations: industrial processes with the potential to pollute air, water or land, such as chemical manufacture, metal processing, intensive farming, food and drink production above certain thresholds, and waste incineration.
  • Waste operations: treating, storing, recovering or disposing of waste, including scrap metal yards, skip hire, vehicle dismantlers, waste transfer stations and composting sites.
  • Mobile plant: equipment used to treat or recover waste on different sites, such as mobile crushers.
  • Water discharge activities: releasing trade effluent or other liquids to surface water, sewers in some circumstances, or groundwater.
  • Groundwater activities: discharges or activities that could pollute groundwater.
  • Medium combustion plants and specified generators: boilers, engines and generators within certain thermal-input ranges, including standby generators used for grid services.
  • Solvent emission activities: processes using organic solvents above set thresholds, such as printing, coating and dry cleaning.
  • Radioactive substances activities: keeping or using radioactive materials, or disposing of radioactive waste.
  • Mining waste operations: managing waste from mineral extraction.

Do I need a permit, an exemption, or nothing at all?

Being in a regulated sector doesn’t automatically mean a full permit. There are usually three outcomes.

1. A bespoke permit. Higher-risk or complex sites typically need a tailored permit with site-specific conditions, monitoring and reporting requirements.

2. A standard rules permit. For lower-risk, well-understood activities, the regulator publishes fixed sets of conditions. These are quicker and cheaper to obtain, but you must be able to meet every rule.

3. An exemption or exclusion. Some low-risk activities, such as certain types of waste storage, reuse or recovery, don’t need a permit but may need to be registered, and must stay within strict limits on waste type, quantity and how it’s handled. Exceeding those limits can take you out of the exemption and into unpermitted operation.

A common mistake is assuming an exemption applies without checking the conditions. Quantity limits, storage time limits and waste codes all matter.

Common situations where businesses get caught out

  • A manufacturer storing or treating waste on site beyond exemption limits
  • A builder or groundworks firm processing or crushing waste soil or rubble
  • A site with a large boiler or generator that reaches medium combustion plant thresholds
  • A business discharging site drainage or process water to a watercourse or soakaway
  • A company taking over a site and assuming the previous permit transfers automatically
  • Businesses that only use a waste carrier and assume permitting isn’t their concern, without checking the duty of care and whether the receiving site is permitted

What if I’m not in England or Wales?

Environmental permitting is devolved, so the rules differ:

If you operate across more than one jurisdiction, you can’t assume one approach fits every site.

What are the consequences of getting it wrong?

Operating a regulated facility without a permit, or breaching permit conditions, is a criminal offence. Penalties can include an unlimited fine and, in serious cases, imprisonment. The regulator can also issue enforcement or suspension notices, require remediation, and pursue cost recovery. Beyond the legal risk, non-compliance can affect insurance, contracts, funding and your reputation with customers who ask about environmental credentials.

How to check whether the EPR apply to you

  1. List your activities. Include not just your main process, but storage, treatment of waste, drainage, heating and power plant.
  2. Check the thresholds. Many activities only become regulated above a certain quantity, capacity or thermal input.
  3. Identify your waste streams. Know what you produce, how much, how long it’s kept, and where it goes.
  4. Check for existing permits or exemptions. Confirm they are current, cover what you actually do, and that you’re meeting every condition.
  5. Get an independent view. A competent adviser can spot gaps you may not see from the inside.

How we can help

Working out whether the EPR apply is rarely as simple as ticking a box. Our team can review your operations, identify regulated activities, advise on whether you need a permit or qualify for an exemption, and support you through applications and ongoing compliance. Get in touch for an initial conversation about your site.

This article is general guidance and not legal advice. Requirements depend on your activities, location and circumstances.

Posted on

What an Auditor Looks for in an ISO 14001 Compliant Legal Register

Just as ISO 45001 places the legal register at the centre of an Occupational Health and Safety audit, ISO 14001 auditors treat the environmental legal register the same way. Clause 6.1.3 requires organisations to identify and have access to legal and other requirements related to their environmental aspects, and clause 9.1.2 requires ongoing evaluation of compliance against them. As an auditor with over 10 years experience, I am often asked what I look for when auditing a legal register. In this article I will explain what makes a compliant legal register. A weak legal register is often the first sign an auditor uses to question the rest of the environmental management system.

Here’s what they actually look for.

1. Coverage: Does It Match Your Environmental Aspects?

Auditors will cross-check your register against your aspects and impacts register, looking for gaps such as:

  • Legislation tied to specific activities — waste production and disposal, trade effluent, emissions to air, water abstraction or discharge, storage of hazardous substances
  • Permits and licences (environmental permits, waste carrier licences, discharge consents) and the conditions attached to them
  • Jurisdiction-specific law where you operate across multiple regions — for example, differences between Great Britain, Northern Ireland, the Isle of Man, and the Republic of Ireland
  • Producer responsibility obligations (packaging waste, WEEE, batteries) where relevant

If your register lists only headline legislation (Environmental Protection Act 1990, Environmental Permitting Regulations) without the specific conditions and secondary regulations that actually apply to your sites, auditors will flag it as incomplete.

2. Currency: Is It Actively Monitored?

This is the most common nonconformity raised against environmental legal registers. Auditors will ask:

  • What process identifies new, amended, or revoked environmental legislation?
  • How often is the register reviewed, and who is accountable for it?
  • Can you evidence the last review — version history, revision log, sign-off dates?

A register that hasn’t changed in years, despite known regulatory activity in your sector, signals there’s no active horizon-scanning process. Subscribing to a legislation-update service or newsletter is strong, tangible evidence here.

ISO 14001 Legal Register: What Auditors Look For

Is your ISO 14001 legal register compliant?

3. Evaluation of Compliance: Beyond the List

ISO 14001 clause 9.1.2 requires evaluation of compliance, not just identification of requirements. Auditors will look for:

  • A compliance status against each requirement (compliant / partially compliant / non-compliant)
  • Evidence supporting that status — permit conditions met, monitoring data, waste transfer notes, inspection records
  • A defined frequency for compliance evaluation, distinct from the general register review

Registers where every entry is simply marked “compliant” with no supporting evidence are a red flag, especially for permitted activities where conditions carry monitoring or reporting obligations.

4. Traceability Into Operational Control

Auditors will sample specific legal requirements and trace them through the system to confirm they’re operationally embedded, not just listed. Expect questions like:

  • Is this requirement reflected in an operational control procedure, permit condition tracker, or monitoring schedule?
  • Do the people responsible for the activity know the legal requirement applies to them?
  • Is evidence of compliance readily retrievable — not just asserted?

A legal register that exists in isolation from operational procedures and permit management is a common weak point.

5. Ownership and Process

Auditors assess the process behind the register as much as the document itself:

  • Who is responsible for monitoring legislative and permit changes?
  • What’s the escalation route when a new requirement is identified, and how quickly is it actioned?
  • Is legal compliance status reviewed at management review, per clause 9.3?

A register maintained informally by one person, with no visibility at management review, suggests the requirement is being satisfied on paper rather than in practice.

6. Format Doesn’t Matter — Function Does

ISO 14001 doesn’t specify a register format. Auditors care whether it functions as a live compliance tool, not what it’s built in. A well-structured register typically includes:

AspectPurpose
Legislation/permit referenceIdentification
JurisdictionApplicability
Summary of requirementInterpretation
Related environmental aspectRelevance
Compliance statusEvaluation
Evidence/referenceTraceability
Date reviewed / next reviewCurrency
OwnerAccountability

Getting Audit-Ready

To strengthen your environmental legal register ahead of an ISO 14001 audit or surveillance visit:

  1. Cross-check the register against your current aspects and impacts assessment
  2. Add or refine a compliance-status column with linked evidence
  3. Establish and evidence a documented review cycle
  4. Ensure the register connects visibly to permit management, monitoring schedules, and management review minutes

An environmental legal register that’s actively maintained, evidenced, and embedded in operational decisions is one of the clearest signs of a mature EMS — and one of the fastest wins ahead of an audit.

If you need a bespoke legal register or you want your existing register reviewed, please contact one of our team.

Posted on

What an Auditor Looks for in an ISO 45001 Compliant Legal Register

As an auditor with over 10 years experience, I am often asked what do I look for in a legal register? Your legal register is one of the first documents an ISO 45001 auditor will ask to see — and one of the easiest places to lose points if it isn’t maintained properly. Clause 6.1.3 requires organisations to identify and have access to the legal and other requirements relevant to their occupational health and safety management system, and to keep this information up to date. In practice, auditors treat the legal register as a litmus test for the whole management system: if it’s weak, they’ll assume other processes are too.

Here’s what auditors actually check, and how to make sure your register holds up.

1. Coverage: Is It Actually Complete?

Auditors will cross-reference your register against your organisation’s activities, sites, and hazards. They’re looking for gaps such as:

  • Legislation relevant to specific plant, equipment, or processes (e.g. LOLER for lifting equipment, PUWER for work equipment, DSEAR if flammable substances are present)
  • Jurisdiction-specific law where you operate across multiple regions — for example, differences between Great Britain, Northern Ireland, the Isle of Man, and the Republic of Ireland
  • Sector-specific regulations, not just generic Health and Safety law
  • Environmental legislation where it overlaps with Occupational Health and Safety risk (waste, emissions, COMAH)

A register that only lists headline Acts (Health and Safety at Work etc. Act 1974, Management of Health and Safety at Work Regulations 1999) without the supporting regulations underneath will be flagged immediately.

ISO 45001 Legal Register

ISO 45001 Legal Register: What auditors look for

2. Currency: Is It Kept Up to Date?

This is the single most common nonconformity auditors raise. They will ask:

  • What is your process for identifying new, amended, or revoked legislation?
  • How often is the register reviewed, and who owns that review?
  • Can you show evidence of the last update (version control, revision log, sign-off)?

Auditors are wary of registers that look identical year to year — it signals no active monitoring process exists. A dated revision history, or a subscription to a legislation-update service, is strong evidence here.

3. Evaluation of Compliance: Not Just a List

ISO 45001 doesn’t just require you to identify legal requirements — clause 9.1.2 requires you to evaluate compliance against them. Auditors will look for:

  • A clear compliance status against each legal requirement (compliant / partially compliant / non-compliant)
  • Evidence linking each requirement to how compliance is demonstrated (a policy, procedure, permit, inspection record, or training log)
  • A defined frequency for compliance evaluation, separate from the register review itself

A register with no compliance column, or one where every line simply says “compliant” with no supporting evidence, will draw scrutiny.

4. Traceability and Accessibility

Auditors will trace a sample of legal requirements through your system to check they’re not just sitting in a spreadsheet nobody uses. Typical questions:

  • Is this requirement referenced in a risk assessment, procedure, or work instruction?
  • Do relevant staff know this requirement applies to their role?
  • Is the register accessible to those who need it — not locked away with one person?

This is where many organisations fall down: the register exists, but there’s no visible link between it and day-to-day operational control.

5. Ownership and Process

Beyond the document itself, auditors assess the process behind it. Expect questions such as:

  • Who is responsible for monitoring legislative change?
  • What’s the escalation route when a new legal requirement is identified — how does it get actioned, and by when?
  • Is legal compliance a standing item in management review, per clause 9.3?

A register maintained by one person with no documented process, and no visibility at management review, suggests the requirement is being met on paper only.

6. Format Doesn’t Matter — Function Does

ISO 45001 doesn’t mandate a specific format for the legal register. Auditors don’t care whether it’s a spreadsheet, database, or software module — they care whether it functions as a live compliance tool. That said, a well-structured register typically includes:

AspectPurpose
Legislation title & referenceIdentification
JurisdictionApplicability
Summary of requirementInterpretation
Applicability to the organisationRelevance
Compliance statusEvaluation
Evidence/referenceTraceability
Date reviewed / next reviewCurrency
OwnerAccountability

Getting Audit-Ready

If you’re preparing for an ISO 45001 audit (or surveillance visit), the fastest way to strengthen your legal register is to:

  1. Run a gap analysis against your current activities and sites
  2. Add a compliance-status column if you don’t already have one
  3. Establish a documented, evidenced review cycle
  4. Make sure the register is referenced in risk assessments and management review minutes

A legal register that’s actively maintained, evidenced, and embedded in operational decisions is one of the strongest signals of a mature management system — and one of the quickest wins in an audit.

If you need a bespoke legal register or you would like your existing register reviewed, please contact one of our team.

Posted on

What UK Waste Laws Apply to Small Businesses?

If you run a small business in the UK, you might assume that waste regulations are something only large industrial operators need to worry about. That assumption is both common and costly. Recent enforcement data suggests that 90% of organisations currently breaking waste law are SMEs with 0 to 50 employees. Whether you are a sole trader, a home-based business, or a limited company with a handful of staff, the legal duty of care for waste applies to you from the moment your business produces its first bag of rubbish.

This article breaks down the core UK waste laws that apply to small businesses, explains what has changed recently, and outlines the practical steps you need to take to stay compliant.

The Foundation: Duty of Care Under the Environmental Protection Act 1990

The cornerstone of UK waste law is Section 34 of the Environmental Protection Act 1990, which imposes a legal “duty of care” on anyone who produces, imports, keeps, stores, transports, treats, or disposes of controlled waste. This duty is not limited to large corporations. It extends explicitly to landlords, home-based businesses, sole traders, and small and medium-sized enterprises.

In practical terms, the duty of care requires you to take all reasonable steps to ensure your waste is stored safely and securely and is only transferred to an authorised person or business. You must not dump trade waste at household recycling centres or in domestic bins. You must use a licensed waste carrier, and you must complete and retain a Waste Transfer Note (WTN) for every transfer of non-hazardous waste. These records must be kept for a minimum of two years and can be inspected by council or Environment Agency officers at any time.

Failure to comply is not a minor administrative matter. Councils across the UK are actively issuing Fixed Penalty Notices and Section 34 enforcement notices. In one recent four-month campaign in Northamptonshire, 55 formal warning notices and 16 Fixed Penalty Notices were issued for offences including duty of care breaches.

Simpler Recycling: New Separation Requirements

From 31 March 2025, new rules under the Separation of Waste (England) Regulations 2025 require businesses in England to separate recyclable materials into distinct waste streams. The core materials that must be segregated are paper and card, metal, plastic, and glass. Food waste must also be collected separately.

There is some flexibility built into the system. Metal, glass, and plastic may be collected together in a combined stream if your waste contractor offers that option, and food waste can be collected alongside garden waste.

Crucially, micro-firms with fewer than 10 full-time equivalent employees are temporarily exempt from these separation requirements until 31 March 2027. If your business has 10 or more employees, however, you should already be compliant. The Environment Agency has also introduced a cost-recovery charging scheme of £118 per hour for regulatory work connected to non-compliance, meaning that an inspection finding you in breach could result in a direct bill for the time the regulator spends investigating you.

Hazardous Waste: Stricter Rules, Even for Tiny Quantities

If your business produces any hazardous waste, the regulatory burden increases significantly. Hazardous waste includes items such as waste chemicals, fluorescent light tubes, used solvents, asbestos, waste oils, batteries, and certain electrical equipment.

Even a couple of batteries or a single tube of adhesive falls within the scope of strict legal requirements. You must keep hazardous waste separate from non-hazardous waste and must not mix different types of hazardous waste together. You must complete a hazardous waste consignment note when the waste is removed from your premises, and you must keep consignment notes for three years.

If your business produces, holds, or removes 500kg or more of hazardous waste in any 12-month period, you must register your premises with the Environment Agency (or the relevant devolved regulator). Some premises are exempt if they produce less than 200kg in a year. Fines for producing or holding hazardous waste from unregistered premises can reach £5,000.

Packaging Waste: The Extended Producer Responsibility Regime

The Producer Responsibility Obligations (Packaging and Packaging Waste) Regulations 2024—commonly referred to as pEPR—came into force on 1 January 2026 and have significantly widened the scope of packaging waste obligations.

Under the previous regime, only businesses with a turnover above £2 million that handled more than 50 tonnes of packaging were caught. Under pEPR, the threshold has dropped. Small businesses with an annual turnover of over £1 million that imported or supplied over 25 tonnes of packaging in the last calendar year are now classified as “small producers” and must register with the relevant regulator and submit annual data on their packaging volumes.

Businesses with a turnover below £1 million and packaging tonnage below 25 tonnes are exempt from data collection and reporting obligations. Those with a turnover between £1 million and £2 million and packaging tonnage between 25 and 50 tonnes must register and report, but they are currently exempt from paying waste disposal fees and buying Packaging Recovery Notes (PRNs).

If your business sells packaged goods online, distributes empty packaging, or imports packaged products, you should check whether you meet the “producer” definition under pEPR.

Digital Waste Tracking: What Is Changing

The UK is moving away from paper-based duty of care records towards a mandatory Digital Waste Tracking (DWT) service. The mandatory roll out was originally scheduled for April 2027 but has been delayed by six months to October 2027 to give operators, particularly SMEs, more time to prepare.

Phase One of the service, which applies to waste received at permitted facilities, began in October 2026. Phase Two will extend the system to waste carriers, brokers, and dealers who arrange or transport waste movements. In the interim, you must continue to maintain robust paper or digital duty of care records. These remain legally required until DWT becomes mandatory.

Waste laws apply to small businesses

Waste laws apply to small businesses as well as large companies.

Devolved Differences: Scotland, Wales, and Northern Ireland

Waste policy is devolved, which means the rules vary depending on where your business operates.

Scotland: The Waste (Scotland) Regulations 2012 require all businesses to separate glass, metal, plastics, paper, and cardboard for recycling. Food businesses producing more than 5kg of food waste per week must present it for separate collection, and disposing of food waste into the sewer via a macerator is illegal in most areas.

Wales: Since 6 April 2024, all workplaces in Wales have been required to separate paper and card, glass, metal, plastic, cartons, food waste (where 5kg or more is produced per week), small waste electrical and electronic equipment (sWEEE), and unsold textiles for collection. The Welsh regulations apply regardless of business size, with no micro-firm exemption.

Northern Ireland: Businesses in Northern Ireland are subject to the duty of care under the Environmental Protection Act 1990 and must use registered waste carriers. Digital Waste Tracking will also apply across Northern Ireland as part of the UK-wide roll out.

Practical Steps for Compliance

If you run a small business, the following checklist will help you stay on the right side of the law:

1. Confirm you have a licensed waste carrier. Ask to see their waste carrier registration number and verify it with the Environment Agency or SEPA.

2. Retain Waste Transfer Notes. Keep them for at least two years for non-hazardous waste and three years for hazardous waste consignment notes.

3. Separate your recyclables. If you have 10 or more employees, you must already be segregating paper, card, metal, plastic, glass, and food waste.

4. Check your packaging obligations. If your turnover exceeds £1 million and you handle more than 25 tonnes of packaging annually, register as a small producer under pEPR.

5. Store waste securely. Prevent waste from escaping, causing litter, or attracting pests.

6. Never use household waste services for business waste. This is a common breach that councils are actively enforcing.

7. Compile a register of legal obligations for your business so you know what you have to do.

How a Consultancy Can Help

Waste compliance is not static. The regulatory landscape is shifting rapidly, with Simpler Recycling, pEPR, and Digital Waste Tracking all phasing in over the coming years. For small businesses without a dedicated compliance team, keeping track of these changes can feel overwhelming.

A specialist consultancy can help you audit your current waste arrangements, identify gaps in your duty of care documentation, advise on separation requirements, and prepare your business for the transition to digital tracking. The cost of getting it wrong—whether through Fixed Penalty Notices, Environment Agency cost-recovery charges, or reputational damage—far outweighs the cost of getting it right.

Posted on

The Difference Between Generic and Bespoke Legal Registers

Why a one-size-fits-all approach to legal compliance leaves organisations exposed — and what a register built around your actual operations gives you instead.

If your organisation is subject to health, safety, or environmental law — and almost every organisation is — you need a legal register. It’s the document that tells you which legislation applies to your operations, what it requires of you, and whether you’re actually compliant. But not all legal registers are built the same way, and the difference between a generic template and a bespoke register isn’t cosmetic. It’s the difference between a document that looks like due diligence and one that actually protects your organisation.

What Is a Legal Register?

A legal register is a structured record of the laws, regulations, and codes of practice that apply to an organisation, typically covering health and safety, environmental, and related compliance obligations. It’s a cornerstone requirement of recognised management system standards, including ISO 9001, ISO 45001 and ISO 14001, and it’s usually the first document an auditor or regulator asks to see. On paper, every legal register looks similar: a list of legislation, a summary of requirements, a compliance status. In practice, how that list is built determines whether the register is a genuinely useful management tool or a box-ticking exercise.

The Trouble With Generic Legal Registers

Generic legal registers are typically off-the-shelf templates or subscription database exports, built to cover an entire sector or industry in one document. They’re inexpensive, quick to obtain, and easy to see the appeal of — but that convenience comes at a real cost:

  • They list legislation that may have nothing to do with your actual activities, sites, or risk profile, burying the requirements that genuinely matter under dozens that don’t.
  • They rarely reflect the specific jurisdictions, licences, or permits your organisation holds, particularly for organisations operating across Great Britain, Northern Ireland, the Isle of Man, or the Republic of Ireland, where legal frameworks diverge significantly.
  • They’re built for updating on a fixed schedule rather than in response to your organisation’s changes — a new site, a new process, a new piece of equipment — so they drift out of date the moment your operations move.
  • They describe legal duties in abstract terms, without translating them into what compliance actually looks like for your sites, your equipment, and your people.
  • They offer no meaningful gap analysis — you’re left to work out for yourself whether you actually comply with each requirement.

The result is a register that satisfies the letter of the audit requirement — “yes, we have a legal register” — without doing the job a legal register exists to do: giving your organisation a clear, current, accurate picture of its legal exposure.

Bespoke vs generic legal register, which is best? Photo courtesy of Pixabay tumisu-audit

A bespoke legal register demonstrates to auditors that you actually know your legal obligations.

Why a Bespoke Legal Register Is the Only Register Worth Having

A bespoke legal register is built from the ground up around your organisation: your sites, your activities, your industry sector, your jurisdictions, and your risk profile. Rather than starting from a generic list and hoping it fits, it starts from your operations and identifies exactly which legislation applies — and, critically, what that legislation actually requires you to do about it. The advantages compound quickly:

  • Relevance: every entry has a direct line to something your organisation actually does, so nothing important gets lost in noise that doesn’t apply to you.
  • Accuracy across jurisdictions: legislation is mapped to the specific jurisdiction — GB, NI, Isle of Man, or ROI — that each site operates under, rather than treated as a single homogeneous “UK law” list.
  • A genuine compliance status: each requirement is assessed against evidence from your organisation, so you know — not guess — where you stand, and where the gaps are.
  • Built-in gap analysis and action planning: a bespoke register doesn’t just flag non-compliance, it gives you a prioritised route to closing it.
  • Living, current content: as legislation changes or your organisation changes — a new site, a new process, an amended regulation — the register is updated to reflect it, so it never becomes a snapshot of a moment that’s already passed.
  • Audit and due diligence confidence: a bespoke register demonstrates, to auditors, regulators, insurers, and clients, that your organisation understands and manages its legal obligations — not that it purchased a document that says it does.

In short: a generic register tells you what the law says. A bespoke register tells you what the law means for you — and whether you’re meeting it.

FEATURES

Generic Legal Register

Bespoke Legal Register


Identifies only relevant laws

Focused on the actual business

Relevant and easy to understand

A practical management tool

Includes sector specific requirements

Demonstrates that you understand your obligations

The Bottom Line

A legal register is only as valuable as its accuracy and relevance to your organisation. A generic template can create a false sense of security — the appearance of compliance without the substance of it — and that gap tends to surface at the worst possible moment: during an incident investigation, a regulatory visit, or a client’s due diligence review. A bespoke legal register, developed and maintained by health and safety professionals who understand your sector and your sites, is an investment in genuine legal certainty, not just a document for the audit file.

If your organisation is currently relying on a generic register — or doesn’t have one at all — talk to us about building a bespoke legal register tailored to your operations, sites, and jurisdictions. It’s the foundation every other part of your compliance management sits on, and it’s worth getting right.

Posted on

Do Small Businesses Need an Environmental Legal Register?

A clear look at environmental obligations, business size, and why proportionate compliance matters.

It is a question we hear often from small business owners: “Do I really need an environmental legal register? Surely that’s something only for large industrial companies with dedicated environmental teams.” It’s an understandable assumption, but it is not correct. Environmental legal obligations are not switched on by company size — they are triggered by what a business actually does, what it produces, discharges, or stores, and where it operates. A small print shop and a large logistics depot may face entirely different environmental duties, regardless of which one employs more people.

In this article, we look at why the size of a business is the wrong starting point for thinking about environmental compliance, and why a well-designed environmental legal register — far from being a burden reserved for large organisations — can be one of the most practical and cost-effective tools a small business ever puts in place.

What Is an Environmental Legal Register?

An environmental legal register is a structured record of the environmental legislation, regulations, permits, and approved codes of practice that apply to a specific organisation. Rather than listing every environmental law in existence, it identifies the ones that are actually relevant to that business’s operations, sites, and activities, and sets out what needs to be done to remain compliant with each one.

Done properly, an environmental legal register becomes a single point of reference that tells a business owner or manager, at a glance: which environmental laws apply to us, what each one requires, how we currently meet that requirement, and where any gaps exist.

Environmental Obligations Depend on Circumstances, Not Company Size

This is the point worth dwelling on, because it is the one most often misunderstood. UK environmental legislation is largely activity-based and impact-based rather than headcount-based. Duties under legislation such as the Environmental Protection Act 1990, the Environmental Permitting (England and Wales) Regulations, and waste, water, and packaging regulations apply to any business whose activities create the relevant impact — regardless of size. The specific duties that follow are shaped by factors such as:

  • The nature of the business’s processes (for example, use of chemicals, fuel storage, vehicle fleets, or manufacturing by-products)
  • The waste the business produces and how it’s stored, transported, and disposed of
  • Whether emissions to air, land, or water are involved, even at a small scale
  • Sector-specific rules that apply regardless of business size, such as packaging producer responsibility, WEEE, or discharge consents

A single-van courier business has duties around fuel storage and vehicle emissions. A small print shop has duties under waste and hazardous substances regulations for inks and solvents. A two-person mobile car valeting business has duties around wastewater discharge. None of these obligations disappear because the business is small — in some cases, a smaller business with fewer resources to manage environmental risk may need to pay closer attention, not less.

In other words, the question is never really “is my business big enough for this to matter?” The question is “what do we actually do, and what does environmental law say about doing it responsibly?” An environmental legal register is simply the tool that answers that question clearly and keeps the answer up to date as legislation changes.

environmental legal register for small business.

An environmental legal register for small business should be proportionate.

Why Small Businesses Benefit from a Concise, Proportionate Register

Recognising that environmental duties apply regardless of size is only half the picture. The other half is that how a small business meets those duties can, and should, look very different from how a large organisation meets them. A 200-page environmental legal register modelled on a multinational’s compliance framework is not only unnecessary for a small business — it’s actively counterproductive. It gets opened once, filed away, and forgotten.

A register that is built specifically for a small business, scaled to its real activities and environmental impacts, tends to work far better in practice. This is why:

1. It Stays Usable

A concise register lists only the environmental legislation that genuinely applies to that business’s operations. Instead of an overwhelming, generic checklist, the owner or manager is left with a short, relevant list they can actually refer to — and act on — day to day.

2. It Reflects the Business as It Really Operates

A bespoke register is built around the specific sites, processes, substances, and waste streams involved, rather than a one-size-fits-all industry template. This means it captures the obligations that matter and doesn’t waste time on ones that don’t.

3. It Makes Gaps Visible

Because it is proportionate rather than padded out, a well-built register makes it far easier to spot where compliance is solid and where attention is needed — an expired waste carrier’s licence, a missing duty of care record, a permit due for renewal — without those gaps being buried in irrelevant detail.

4. It Demonstrates Due Diligence

In the event of an environmental incident, a regulator visit, or a client, landlord, or insurer asking about environmental compliance arrangements, a maintained legal register is tangible evidence that the business has identified its obligations and is actively managing them. For a small business without a dedicated environmental function, this matters a great deal.

5. It Supports Growth Without Starting from Scratch

As a small business takes on new processes, new premises, or new materials, an environmental legal register built with the right structure can be updated and expanded rather than rebuilt. This means compliance grows alongside the business instead of becoming a sudden, overwhelming project further down the line.

Building a Register That Fits Your Business

The most effective environmental legal registers for small businesses share a few common features: they are reviewed and updated regularly to reflect legislative change, they are written in plain language rather than legal jargon, they link each legal requirement to a clear action or evidence of compliance, and they are proportionate — covering what applies, in appropriate detail, without unnecessary bulk.

This is where working with a health and safety and environmental consultancy adds real value. Rather than adapting a generic template, a consultancy can assess your specific activities and premises, identify the environmental legislation that genuinely applies, and build a register that is both legally sound and genuinely usable by your team.

The Bottom Line

Environmental law does not ask how many people are on your payroll before it applies to you — it asks what impact your work creates. That means every business, regardless of size, has environmental obligations worth identifying and managing properly. For small businesses, the smart response is not to ignore this reality, nor to adopt a compliance framework built for a much larger organisation. It is to build an environmental legal register that is concise, proportionate, and tailored to how the business actually operates — one that gets used, kept current, and genuinely supports safer, more compliant, more sustainable day-to-day operations.

If you are unsure which environmental requirements apply to your business, or you would like help building a legal register that is proportionate to your size and sector, our team can help you get a clear, practical picture of your obligations.

Checklist

Posted on

Do Small Businesses Need a Health and Safety Legal Register?

A clear look at legal obligations, business size, and why proportionate compliance matters.

It is a question we hear often from small business owners: “Do I really need a health and safety legal register? Surely that’s something only for large companies with big compliance teams.” It’s an understandable assumption, but it is not correct. Legal obligations in health and safety law are not switched on by company size — they are triggered by what a business actually does, where it does it, and the risks that activity creates. A five-person joinery workshop and a five-hundred-person office may face entirely different legal duties, regardless of which one has more employees on the payroll.

In this article, we look at why the size of a business is the wrong starting point for thinking about legal compliance, and why a well-designed legal register — far from being a burden reserved for large organisations — can be one of the most practical and cost-effective tools a small business ever puts in place.

What Is a Health and Safety Legal Register?

A legal register is a structured record of the health and safety (and often environmental) legislation, regulations, and approved codes of practice that apply to a specific organisation. Rather than listing every law in existence, it identifies the ones that are actually relevant to that business’s operations, sites, and activities, and sets out what needs to be done to remain compliant with each one.

Done properly, a legal register becomes a single point of reference that tells a business owner or manager, at a glance: which laws apply to us, what each one requires, how we currently meet that requirement, and where any gaps exist.

Legal Obligations Depend on Circumstances, Not Company Size

This is the point worth dwelling on, because it is the one most often misunderstood. UK health and safety legislation is largely activity-based and risk-based rather than headcount-based. The Health and Safety at Work etc. Act 1974 and its supporting regulations apply to employers and the self-employed alike, and the specific duties that follow are shaped by factors such as:

  • The nature of the work being carried out (for example, construction, food handling, manual handling, or working with hazardous substances)
  • The premises involved and who else might be affected — employees, contractors, visitors, or members of the public
  • Whether specific hazards are present, such as asbestos, fire risk, electrical systems, or work at height
  • Sector-specific rules that apply regardless of business size, such as food safety, licensing, or environmental permitting requirements

A single self-employed trades person using a ladder has duties under the Work at Height Regulations. A two-person catering business has duties under food hygiene and allergen legislation. A small manufacturer using solvents has duties under COSHH. None of these obligations disappear because the business is small — in some cases, a smaller business with fewer resources to manage risk may need to pay closer attention, not less.

In other words, the question is never really “is my business big enough for this to matter?” The question is “what do we actually do, and what does the law say about doing it safely?” A legal register is simply the tool that answers that question clearly and keeps the answer up to date as legislation changes.

Why Small Businesses Benefit from a Concise, Proportionate Register

Recognising that legal duties apply regardless of size is only half the picture. The other half is that how a small business meets those duties can, and should, look very different from how a large organisation meets them. A 200-page legal register modelled on a multinational’s compliance framework is not only unnecessary for a small business — it is actively counterproductive. It gets opened once, filed away, and forgotten.

Do small businesses need a health and safety legal register?

A legal register should be proportionate to your business activities

A register that is built specifically for a small business, scaled to its real activities and risks, tends to work far better in practice. This is why:

1. It Stays Usable

A concise register lists only the legislation that genuinely applies to that business’s operations. Instead of an overwhelming, generic checklist, the owner or manager is left with a short, relevant list they can actually refer to — and act on — day to day.

2. It Reflects the Business as It Really Operates

A bespoke register is built around the specific sites, equipment, substances, and work activities involved, rather than a one-size-fits-all industry template. This means it captures the obligations that matter and does not waste time on ones that do not.

3. It Makes Gaps Visible

Because it is proportionate rather than padded out, a well-built register makes it far easier to spot where compliance is solid and where attention is needed — an outdated risk assessment, a missing policy, a licence due for renewal — without those gaps being buried in irrelevant detail.

4. It Demonstrates Due Diligence

In the event of an incident, an inspection, or a client or insurer asking about compliance arrangements, a maintained legal register is tangible evidence that the business has identified its obligations and is actively managing them. For a small business without a dedicated compliance function, this matters a great deal.

5. It Supports Growth Without Starting from Scratch

As a small business takes on new work, new premises, or new equipment, a legal register built with the right structure can be updated and expanded rather than rebuilt. This means compliance grows alongside the business instead of becoming a sudden, overwhelming project further down the line.

Building a Register That Fits Your Business

The most effective legal registers for small businesses share a few common features: they are reviewed and updated regularly to reflect legislative change, they are written in plain language rather than legal jargon, they link each legal requirement to a clear action or evidence of compliance, and they are proportionate — covering what applies, in appropriate detail, without unnecessary bulk.

This is where working with a health and safety consultancy adds real value. Rather than adapting a generic template, a consultancy can assess your specific activities and premises, identify the legislation that genuinely applies, and build a register that is both legally sound and genuinely usable by your team.

The Bottom Line

Health and safety law does not ask how many people are on your payroll before it applies to you — it asks what risks your work creates. That means every business, regardless of size, has legal obligations worth identifying and managing properly. For small businesses, the smart response is not to ignore this reality, nor to adopt a compliance framework built for a much larger organisation. It’s to build a legal register that is concise, proportionate, and tailored to how the business actually operates — one that gets used, kept current, and genuinely supports safer, more compliant day-to-day operations.

If you are unsure which legal requirements apply to your business, or you would like help building a legal register that is proportionate to your size and sector, our team can help you get a clear, practical picture of your obligations.

Would you like a free copy of our health and safety and environmental legal register checklist for UK operations?

Checklist
Posted on

What Happens if Your Legal Register is Out of Date?

A legislation register—or legal register—serves as the compliance anchor of an organisation’s corporate governance structure and management system. Designed to identify, organise, and monitor all statutory duties and regulatory obligations applicable to an organisation’s operations, it acts as the baseline for legal adherence. However, maintaining a legal register is not a one-time administrative task; it requires active upkeep to retain its utility.

The key risk of an outdated legal register is that it gives executive management a false picture of the organisation’s true legal obligations and actual compliance level. While an outdated register may not immediately lead to criminal prosecution, relying on obsolete legal information creates subtle, compounding vulnerabilities across operational management, internal auditing, and ISO management systems.

Understanding the operational consequences of an outdated legal register highlights why static compliance documents fail to protect modern enterprises.

1. Missing Critical Legislative Changes and Statutory Amendments

Health, safety, and environmental statutory frameworks across Great Britain, Northern Ireland, the Isle of Man, and the Republic of Ireland are in constant motion. Regulators and parliaments amend existing legislation far more frequently than they enact entirely new primary Acts.

When a legal register is not updated regularly, the following issues occur:

  • Unrecorded Statutory Amendments: An entry in a register may list the correct title of an Act or Regulation, yet remain silently out of date because an amending statutory instrument altered a exposure threshold, broadened a legal definition, or moved a mandatory reporting deadline.
  • Retaining Revoked Legislation: Failing to remove repealed or revoked legislation creates unnecessary administrative clutter. This wastes valuable time during internal checks and misleads staff into enforcing duties that no longer exist under law.
  • Overlooking Updated Regulatory Guidance: Regulators such as the Health and Safety Executive (HSE) and the Environment Agency (EA) frequently update Approved Codes of Practice (ACOPs) and guidance documents. Although guidance is not always statutory law, it defines the legal benchmark expected by courts and enforcement inspectors. Missing these updates leaves operational procedures aligned with obsolete standards.

2. Flawed Compliance Assessments and Distorted Evaluations

Under international management standards such as ISO 14001 (Clause 9.1.2) and ISO 45001 (Clause 9.1.2), organisations must conduct periodic evaluations of their legal compliance status. A compliance evaluation tests operational reality against the parameters documented in the legal register.

If the underlying legal register contains out-of-date information, any subsequent compliance assessment becomes fundamentally flawed. Evaluating site practices against superseded statutory requirements generates inaccurate compliance scores. Managers receive reports indicating complete compliance, unaware that newly enacted statutory duties, altered discharge limits, or updated permit conditions have gone completely unassessed.

3. Failure to Identify New Obligations from Business Triggers

Legislative updates represent only one side of legal register maintenance; internal organisational changes represent the other. Updating a register solely on an annual schedule inevitably causes the document to lag behind internal operational developments.

A failure to execute trigger-based reviews means that routine commercial changes generate unmanaged legal exposure:

  • New Equipment and Machinery: Installing new plant or lifting machinery introduces obligations under the Provision and Use of Work Equipment Regulations 1998 (PUWER) or the Lifting Operations and Lifting Equipment Regulations 1998 (LOLER).
  • New Chemical Substances: Introducing new raw materials or cleaning agents can trigger the Control of Substances Hazardous to Health Regulations 2002 (COSHH) or REACH obligations.
  • Premises and Physical Footprint: Moving to new sites or altering existing buildings brings different fire safety orders, planning consents, and building regulations into scope.
  • Environmental Permit Variations: Varied abstraction consents, modified trade effluent limits, or altered waste classifications must be entered into the register the moment they are granted.
  • Cross-Border Expansion: Expanding operations into a new jurisdiction—such as moving from Great Britain into Northern Ireland or the Republic of Ireland—introduces an entirely separate body of legal requirements rather than a variation of existing rules.

Without a system that links operational changes directly to legal register reviews, new legal duties remain unidentified and unmanaged.

4. Incorrect Regulatory Risk and Misleading Executive Confidence

Executive leadership relies on corporate compliance reporting to evaluate organisational risk and allocate resources effectively.

An outdated legal register distorts this governance feedback loop. It provides leadership with a false sense of security, leading executives to believe that all statutory liabilities are isolated and controlled. In reality, unmonitored regulatory shifts accumulate quietly. This distorted view of regulatory risk can lead management to allocate compliance budgets in error, bypass necessary operational controls, or omit vital safety training.

5. Third-Party Audit Findings and ISO Non-Conformities

For organisations certified to ISO 9001, ISO 14001, or ISO 45001, the legal register is one of the most rigorously examined elements during third-party certification and surveillance audits.

Third-party auditors routinely evaluate legal registers using two distinct approaches:

  1. Top-Down Auditing: The auditor inspects a physical aspect or hazard on site (such as a chemical store, timber workshop, or waste area) and checks whether the corresponding statutory requirements and permit conditions are correctly detailed in the legal register.
  2. Bottom-Up Auditing: The auditor selects a specific entry within the legal register and requests live physical evidence demonstrating how that requirement is fulfilled on the ground.

If an auditor discovers that a register lacks recent legislative amendments, omits applicable permit conditions, or references revoked statutes, a formal non-conformity will be raised against Clause 6.1.3. Treating the legal register as a static, one-time exercise remains one of the most frequent causes of ISO audit failures.

6. Difficulty Demonstrating Legal Compliance and Due Diligence

Maintaining compliance requires more than listing statutory titles; it demands clear evidence of active oversight. A defensible legal register entries should link each statutory clause directly to an internal operating procedure, an assigned internal owner, and a verifiable evidence log.

If a regulatory inspector from the Health and Safety Executive (HSE) or Environment Agency (EA) inspects a site, or if an insurer evaluates an operational claim, an outdated register fails to demonstrate due diligence. Presenting a static document that has not been updated or audited within the preceding twelve months demonstrates a breakdown in compliance governance, making it difficult to prove that the business actively manages its statutory duties.

7. Breakdown of the Plan-Do-Check-Act Management Framework

Recognised management system frameworks—such as ISO 45001 and HSG65—operate on a continuous Plan-Do-Check-Act (PDCA) cycle.

Plan do check act. Legal register out of date?
Plan do check act cycle

The legal register forms the core foundation of the Plan stage. It defines what the organisation must comply with. If the Plan stage relies on obsolete statutory parameters:

  • Operational controls (Do) are built around incorrect standards.
  • Compliance audits (Check) evaluate performance against out-of-date criteria.
  • Corrective actions (Act) fail to address actual legal exposure.

When the legal register is disconnected from live operational checks, the entire management system fails to function as intended.

Establishing an Effective Legal Register Review Protocol

To prevent a legal register from becoming out of date, organisations should implement a dual-track review process:

  • Scheduled Legislative Reviews: Establish a fixed review schedule (typically quarterly) to monitor legislative changes, new statutory instruments, and updated regulator guidance across all operating jurisdictions.
  • Trigger-Based Internal Reviews: Integrate legal register review checklists directly into corporate change-management processes. Any change in business activities, premises, machinery, chemical usage, or environmental permits should prompt an immediate review.
  • Accountability and Audit Trails: Assign clear internal ownership for every entry and maintain a detailed audit trail showing when each requirement was last evaluated.

By pairing scheduled legislative monitoring with internal change management, executive leadership can ensure that the legal register remains an accurate, defensible reflection of the organisation’s legal duties.  To get help with your legal register, please contact one of our team.

Posted on

How Often Should a Legal Register Be Updated?

How often should a legal register be updated? There is no single answer that fits every organisation, but there is a wrong answer: updating it once a year and hoping nothing important happened in between. A legal register is only useful if it reflects the law as it stands today, and the law — along with your business — rarely stands still.

The honest answer is that a legal register needs two update cycles running side by side: a scheduled review (commonly quarterly) to catch legislative change, and a trigger-based review that fires whenever something changes inside your own organisation. Below is what should prompt each type of update, and why skipping either one leaves gaps.

Scheduled reviews: keeping pace with legislative change

Health and safety and environmental law changes constantly across every jurisdiction — Great Britain, Northern Ireland, the Isle of Man and the Republic of Ireland all move independently, and a register built for one will not automatically cover another. A quarterly review is the practical minimum for most organisations; higher-risk sectors (chemicals, waste, construction, food) often benefit from monthly monitoring. Each cycle should specifically check for:

New legislation

Acts, regulations and statutory instruments do not announce themselves. New legislation should be added to the register as soon as it is in force (or, where lead time allows, flagged ahead of its commencement date so you are not scrambling to comply on day one).

Amendments to existing legislation

Legislation is amended far more often than it is replaced outright — a threshold changed, a definition widened, a deadline moved. If your register only lists the original instrument, it is quietly out of date the moment an amending regulation takes effect, even though the entry still “looks” current.

Repealed and revoked legislation

Just as important as adding new law is removing what no longer applies. A register cluttered with revoked instruments does not just look untidy — it wastes audit time and can mislead someone into thinking a duty still exists when it is been withdrawn.

New guidance

Approved Codes of Practice, Health and Safety Executive (HSE) and Environment Agency (EA) guidance, and equivalent guidance from Northern Ireland, the Isle of Man and Ireland’s regulators are not always legally binding, but they set the standard regulators and courts expect you to meet. Guidance updates should be tracked alongside the legislation they relate to.

Is your legal register regularly reviewed or just left on a shelf?

Trigger-based reviews: keeping pace with your own business

Legislative monitoring only tells half the story. The other half is recognising when something inside your organisation changes the law you are subject to. These triggers should prompt an immediate register review, not wait for the next scheduled cycle:

  • Changes in business activities — a new process, service line, or way of working can bring entirely new legal duties into scope.
  • New premises — different buildings mean different building regulations, fire safety duties, planning conditions and local authority requirements.
  • New equipment — new plant or machinery can trigger PUWER, LOLER, pressure systems, or work equipment regulations that weren’t previously relevant.
  • New chemicals or substances — introducing a new substance can pull in COSHH, REACH, CLP, or storage and transport requirements, and may affect permit conditions.
  • Changes to environmental permits — a varied permit, a new abstraction or discharge consent, or a change in waste classification all need reflecting in the register the moment they’re granted or amended.
  • Changes to applicable jurisdictions — opening a site, taking on contracts, or employing staff in a new jurisdiction (say, expanding from Great Britain into Northern Ireland or the Republic of Ireland) means an entirely separate body of law applies, not a variation on the one you already have.

Building both cycles into one process

The most effective legal registers treat these two review types as complementary, not alternatives:

  1. Set a fixed schedule (quarterly is a sensible default) for legislative monitoring across every jurisdiction you operate in.
  2. Build a trigger checklist into change-management processes — procurement, facilities, HR and operations should all know to flag the business changes listed above.
  3. Assign ownership so it is clear whose job it is to action each type of update, not just who compiles the register.
  4. Keep an audit trail of when the register was reviewed and what changed, which matters as much to auditors and regulators as the register’s content itself.

The bottom line

A legal register updated only once a year, on a fixed date, will always be behind — both the law and the business move faster than that. Pair a quarterly (or more frequent) legislative review with a trigger-based process for internal change, and the register stays what it is meant to be: an accurate, defensible record of what applies to you right now.

Keeping a legal register current across multiple jurisdictions is exactly what our quarterly legislation updates are designed to support — get in touch to find out how we can help.