UK and EU Health and Safety Law: A Post-Brexit Comparison

Introduction

UK and EU health and safety law remain far more alike than different, but since Brexit they have started to drift apart in how rules are made, updated and enforced. Both systems share one core idea: employers must identify workplace risks and control them. They reach that idea by different legal routes, and the routes are now diverging.

For decades the two were effectively one system. Britain’s modern framework, set by the Health and Safety at Work etc. Act 1974 (HSWA), was built on the Robens Report of 1972. It was enacted in 1974, a year after the UK joined the European Economic Community, but it was a home-grown design. From 1992 onwards, much of its detailed regulation was written to implement EU directives. The famous “six pack” of 1992 regulations, and later rules on work at height, construction, asbestos and display screen equipment, all trace back to Brussels. The EU’s own foundation is the Framework Directive 89/391/EEC, which set common principles for all member states in 1989.

The UK left the EU on 31 January 2020, and the transition period ended on 31 December 2020. Since then Great Britain has been free to rewrite its rules, and Northern Ireland has followed a different path under the Windsor Framework. Meanwhile the EU has kept legislating, adding new rules on machinery, asbestos, chemicals, artificial intelligence and platform work. For a business, a consultant or a safety professional working across the Channel, the practical question is no longer “are the rules the same?” but “where do they still match, and where must I check twice?”

This article compares the two systems in five steps:

  1. The foundations: the UK’s goal-setting model and the EU’s directive model.
  2. What Brexit changed legally, including retained EU law and Northern Ireland.
  3. How regulators and enforcement differ.
  4. A topic-by-topic comparison of the main workplace regimes.
  5. Where the systems diverge, where they still align, and a closing summary.

A note on terms. UK” is used where the point applies across the whole country, and “Great Britain” (GB) or “Northern Ireland” (NI) where it does not, because health and safety is devolved in Northern Ireland and enforced by a separate regulator. “EU” means the Union-level rules, which member states must transpose into national law. Member states differ from one another, so any statement about “the EU” is necessarily a generalisation. This is general information, not legal advice, and the position was checked against public sources in October 2026.

UK and EU Health and Safety Law

Two foundations: goal-setting statute versus directive framework

The UK model rests on a single enabling statute, while the EU model rests on a treaty power and a set of directives that member states must turn into national law. That structural difference explains most of the other contrasts in this article.

The UK model: the 1974 Act

The Health and Safety at Work etc. Act 1974 is an “enabling” Act. It sets broad duties and then lets ministers make detailed regulations under it. Employers must ensure the health, safety and welfare of their employees (section 2) and of other people affected by their work (section 3). Duties also fall on the self-employed, on those who design, make or supply articles and substances (section 6), and on employees themselves (section 7).

Most of these duties are qualified by the phrase “so far as is reasonably practicable”. That wording lets a duty-holder weigh the size of a risk against the cost, time and trouble of removing it. It is the signature of the British approach: the law states the outcome and leaves the method to the duty-holder, with the burden of proving that more could not reasonably have been done resting on the defendant.

Beneath the Act sit regulations, then Approved Codes of Practice (ACOPs), then HSE guidance. An ACOP has a special legal status. A court can treat a breach of the relevant code as proof of a breach of the law unless the defendant shows it complied in some equally effective way. Guidance has no such status and is advisory.

Since 1 October 2013, section 69 of the Enterprise and Regulatory Reform Act 2013 has also removed civil liability for breach of most health and safety regulations. An injured worker must now generally prove negligence rather than rely on breach of a statutory duty alone. Criminal enforcement is untouched.

The EU model: Framework Directive and daughter directives

The EU has no single workplace safety statute. Instead, Article 153 of the Treaty on the Functioning of the European Union lets the Union adopt directives setting minimum requirements for the working environment. Member states can then go further, and many do.

The cornerstone is the Framework Directive 89/391/EEC. It requires employers to ensure the safety and health of workers in every aspect related to work. It also sets out general principles of prevention, which in outline are to avoid risks, evaluate those that cannot be avoided, combat risks at source, adapt work to the individual, and give collective protective measures priority over individual ones. Other core obligations are:

  • a documented risk assessment;
  • competent protective and preventive services;
  • information, consultation and participation of workers;
  • training; and
  • health surveillance.

More than twenty “individual” or daughter directives then deal with particular subjects such as workplaces, work equipment, manual handling, display screens, carcinogens, asbestos, noise, vibration and construction sites.

The key conceptual difference

The two models look alike in practice but differ in legal wording. The EU duty is expressed as an obligation to “ensure” safety, with only narrow exclusions available to member states for unforeseeable events and exceptional circumstances beyond the employer’s control. The British duty is qualified by reasonable practicability.

The European Commission challenged this gap in the Court of Justice. In Case C-127/05, Commission v United Kingdom (2007), the Court held that the UK had failed to transpose the Framework Directive correctly by qualifying the employer’s duty in this way. Britain never amended the 1974 Act in response, and since Brexit there is no longer any obligation to do so. The point remains the clearest example of a difference in legal design that has little to do with day-to-day outcomes but could matter in litigation.

A second difference is the status of detailed rules. In the EU, a directive binds member states, not individual businesses, until it is transposed. In Britain, regulations, codes and guidance form a layered system in which HSE can often adjust the lower layers without new primary legislation. That flexibility matters for the post-Brexit story that follows.

What Brexit changed, and what it did not

Brexit changed who can amend the rules far more than it changed the rules themselves. On 1 January 2021 almost every health and safety regulation in force on 31 December 2020 continued to apply word for word. The real shifts came later, as Great Britain began to use its new freedom, and in Northern Ireland, where a different arrangement applies.

Day one: retained EU law

The European Union (Withdrawal) Act 2018 preserved EU-derived law at the end of the transition period as “retained EU law”. It came in three forms:

Because the main workplace rules were already domestic regulations made under the 1974 Act, they were largely untouched. Chemicals were the exception. EU REACH became “UK REACH”, and EU CLP became “GB CLP”, with HSE and other agencies taking over tasks previously done in Helsinki by the European Chemicals Agency.

The “bonfire” threat and the 2023 Act

In 2022 the government introduced the Retained EU Law (Revocation and Reform) Bill. In its original form it would have revoked all EU-derived secondary legislation at the end of 2023 unless ministers saved it, with an extension available to 23 June 2026 for specified items. Safety bodies led by RoSPA warned that the Management Regulations, work at height rules and the “six pack” could be lost through an arbitrary deadline, and that better regulation is not deregulation. The 1974 Act itself was never at risk because it is domestic law.

The Act as passed in June 2023 dropped the blanket sunset. Instead it:

  • revoked a schedule of around 600 named instruments, which the government described as largely defunct and unnecessary now that the UK has left the EU;
  • ended the supremacy of EU law and renamed the remainder “assimilated law”, from 1 January 2024;
  • gave senior courts more freedom to depart from EU case law; and
  • gave ministers powers to amend assimilated law by regulations.

Those amending powers are the route to post-Brexit divergence. They have already been used. The Chemicals (Health and Safety) (Amendment, Consequential and Transitional Provision) Regulations 2026 (SI 2026/484) came into force on 21 May 2026. They abolished the duty to notify classification and labelling information to HSE and introduced a “fast-track” route under which HSE can adopt classification proposals from trusted overseas authorities, which can include the EU. They also removed the link requiring HSE to consider every opinion of the European Chemicals Agency’s risk committee. HSE says it is maintaining high standards, and the core classification criteria are unchanged. Some environmental groups and Scottish parliamentary committee members questioned the lack of detail and impact assessment.

Northern Ireland: a different regime

Northern Ireland remains inside part of the EU system. Under the Windsor Framework, more than 300 EU legal acts, mostly covering goods, continue to apply there, with the Court of Justice of the European Union as final arbiter of their meaning. The Stormont Brake lets the Northern Ireland Assembly challenge new or replacement EU rules that would significantly affect everyday life. The practical result is that product-safety law such as machinery, personal protective equipment and explosive-atmosphere equipment follows EU rules in Northern Ireland.

Workplace duties are different. Employers’ obligations in Northern Ireland come from domestic legislation, principally the Health and Safety at Work (Northern Ireland) Order 1978, enforced by the Health and Safety Executive for Northern Ireland (HSENI). So a business there lives under EU product rules but locally made workplace rules.

The trade agreement floor

The EU-UK Trade and Cooperation Agreement also matters. Its level playing field provisions include a commitment not to weaken labour and social protections in ways that affect trade or investment, which covers occupational health and safety standards. This is a non-regression promise, not a duty to follow EU changes. It limits how far the UK could cut standards, and it is backed by the agreement’s own consultation and rebalancing mechanisms rather than its main dispute-settlement route. It does not require Britain to copy new EU rules.

Regulators and enforcement

Britain enforces through one national regulator and a heavy criminal-penalty culture, while the EU leaves enforcement entirely to its 27 member states and coordinates them from the centre. This is one of the most visible practical differences between the two systems.

Great Britain and Northern Ireland

The Health and Safety Executive (HSE), created under the 1974 Act, is the national regulator for Great Britain. It shares enforcement with local authorities, which cover lower-hazard sectors such as offices, shops, hospitality and leisure, and with sector regulators such as the Office for Nuclear Regulation and the Office of Rail and Road. In Scotland, prosecutions are decided by the Crown Office and Procurator Fiscal Service rather than by HSE. Northern Ireland has its own regulator, HSENI.

Inspectors have strong administrative tools. They can serve improvement notices and prohibition notices without going to court, and since 2012 HSE has charged businesses a “fee for intervention” when it finds a material breach. HSE raised the hourly rates it charges under several cost-recovery schemes from 1 April 2026.

Criminal penalties are a defining feature. Fines in the Crown Court are unlimited, and the Sentencing Council’s guideline links the level of fine to the offender’s turnover as well as to culpability and the harm risked. Individuals, including directors and managers, can face up to two years in prison for most health and safety offences. Where a death results, organisations can also be prosecuted under the Corporate Manslaughter and Corporate Homicide Act 2007, and individuals for gross negligence manslaughter.

The European Union

There is no EU-level inspector. Article 4 of the Framework Directive requires member states to make sure there are adequate controls and supervision, but how they do it is left to national law. Models vary widely. In Germany, statutory accident insurance institutions (the Berufsgenossenschaften and similar bodies) write accident-prevention rules and inspect alongside the state labour authorities. In France, labour inspectors enforce the Labour Code. Nordic countries typically combine strong inspectorates with dedicated workers’ safety representatives.

The Union’s role is coordination and monitoring:

The UK was a full participant in these bodies before 2021. HSE is no longer part of the EU institutional network, so Britain no longer receives that structured peer review, though HSE still works with international bodies and individual regulators.

Penalties compared

The directives require that national systems be effective, but they do not set penalty levels. Sanctions in the member states therefore range from administrative fines to criminal prosecution of managers, and the amounts differ greatly. British courts’ turnover-linked fines for large companies are generally among the heaviest of any system, though comparisons are hard because many EU states impose liability through insurance and social security schemes as well as courts. A business operating in several countries should not assume that a low-penalty jurisdiction means a low expectation of compliance. Inspections, stop-work orders and civil liability can all carry substantial consequences.

Key regimes compared

On most core workplace topics, Great Britain’s regulations are still near-copies of the EU directives they came from, because they were written to implement them and have rarely been rewritten. The differences that matter sit in how duties are framed, in a few specific numbers, and in areas where only one side has legislated since 2020.

TopicGreat BritainEuropean UnionCurrent position
Risk assessmentManagement of Health and Safety at Work Regulations 1999; significant findings recorded for employers with five or more staffFramework Directive 89/391/EEC; documented assessment, with national rules allowed for the smallest firmsVery similar
Worker consultationSafety representatives (trade-union appointed) and consultation regulations of 1977 and 1996Framework Directive requires consultation and participation; many states mandate safety committees or elected representativesSimilar aims, different mechanics
Work equipment and liftingPUWER 1998 and LOLER 1998Work Equipment Directive 2009/104/ECVery similar
Manual handling and display screensRegulations of 1992Directives 90/269/EEC and 90/270/EECVery similar; EU review under way
Work at heightWork at height Regulations 2005Directive 2001/45/EC, amending the Work Equipment DirectiveVery similar
Noise and vibrationControl of Noise at Work Regulations 2005 and Control of Vibration at Work Regulations 2005Directives 2003/10/EC and 2002/44/ECVery similar
Hazardous substancesCOSHH 2002; workplace exposure limits in EH40Chemical Agents Directive 98/24/EC and Carcinogens Directive 2004/37/ECSimilar, with divergence in limit-setting
AsbestosControl of Asbestos Regulations 2012; control limit of 0.1 fibres per cmยณ over four hoursDirective 2009/148/EC, amended in 2023 to 0.01 fibres per cmยณ over eight hoursDiverging
ConstructionCDM 2015 with principal designer and principal contractorDirective 92/57/EEC with safety coordinatorsDifferent models
Working timeWorking Time Regulations 1998 with an individual opt-out from the 48-hour limitWorking Time Directive 2003/88/ECSimilar text, different case law
Accident reportingRIDDOR 2013, under reviewNational systems; common statistical definitions for reportingDifferent

Where the match is closest

Risk assessment, work equipment, manual handling, display screens, noise and work at height are the clearest cases. The British regulations and EU directives require the same steps in the same order: assess, control, inform, train and review. Even the numbers match. Both systems use the same lower and upper exposure action values for noise (80 and 85 dB(A)) and the same daily limit of 87 dB(A) allowing for hearing protection. A safety adviser trained in one system can move to the other with very little relearning on these subjects.

Where structure differs

Consultation shows how similar aims can reach different mechanics. Britain’s regime grew from trade-union appointed safety representatives, supplemented since 1996 by direct consultation or elected representatives where no union is recognised. Many EU states give statutory roles to works councils, elected safety delegates or joint committees, with stronger rights to time off and training, and in some cases rights to stop dangerous work.

Construction is the clearest structural contrast. CDM 2015 places named duties on clients, designers, principal designers, principal contractors and contractors, so responsibility follows the project hierarchy. The EU directive instead centres on safety and health coordinators, appointed for the design and execution stages, and national laws vary in how they apply it.

Working time also shows divergence in case law as much as text. The two systems share a 48-hour average weekly limit, minimum daily and weekly rest, and statutory paid leave. But the British law relies heavily on the individual opt-out the Directive permits, which many member states allow only in narrow circumstances. The EU Court of Justice also held in 2019 (Case C-55/18) that employers must have a reliable system for measuring each worker’s daily working time. That ruling binds EU states. Britain has no equivalent duty to record every worker’s daily hours, and since Brexit it is not bound by the ruling.

Chemicals and exposure limits

Chemicals show the biggest practical split. Both sides begin from the same hazard classification system, the UN’s Globally Harmonised System, and both retain a REACH-style registration regime. But UK REACH and EU REACH are now separate, with separate registration requirements, deadlines and databases. GB CLP also now follows a different amendment process from the EU’s CLP, as described earlier. Workplace exposure limits are set in separate processes too: the EU adopts binding and indicative limits at Union level, while Britain’s limits are published and revised through HSE’s EH40 list, advised by its own committees.

Asbestos illustrates the point. The 2023 EU amendment cut the binding limit tenfold, to 0.01 fibres per cmยณ, with transposition due by 21 December 2025 and a move to more sensitive electron-microscopy measurement by 2029. Great Britain’s control limit remains 0.1 fibres per cmยณ, but it is averaged over four hours rather than eight, which HSE regards as the more conservative measure. In 2026 HSE published a review concluding that there was no clear evidence that lowering the limit would improve health outcomes, and argued that competence, training and enforcement matter more than the number. HSE has separately consulted on changes to its asbestos regulations covering clearance, surveys and notifiable non-licensed work, with responses closing in January 2026. Where the EU has tightened a number and Britain has deliberately held its own, the two systems are no longer aligned by default.

Where the systems are diverging

Most divergence so far is “passive”: the EU has legislated and Great Britain has stood still, so gaps open without any British decision to differ. A smaller but growing share is “active”, where Britain has chosen its own route. Four areas matter most.

Product safety and conformity marking

Product rules are where the two systems touch most directly, because machinery, protective equipment and electrical goods carry workplace risks as well as consumer ones. Britain originally planned to replace the CE mark with its own UKCA mark. After industry pressure, the Product Safety and Metrology etc. (Amendment) Regulations 2024 made recognition of CE marking indefinite for 21 product regulations, covering machinery, personal protective equipment, electrical and radio equipment and toys. In Great Britain, a CE-marked product in those categories can generally be sold without UKCA marking. UKCA remains necessary for some categories outside that scheme, such as construction products. Northern Ireland follows EU rules, so there CE marking is required and a UKCA mark alone is not valid. Because indefinite recognition is a policy choice rather than a treaty guarantee, some manufacturers keep UKCA marking as insurance.

Machinery is the next test. Regulation (EU) 2023/1230 replaces the Machinery Directive from 20 January 2027. It adds requirements for artificial intelligence in safety functions, cybersecurity, autonomous machinery and digital instructions, and widens mandatory third-party assessment for certain high-risk categories. Northern Ireland must apply it, and a 2026 statutory instrument provides for its enforcement there. For Great Britain the position is open. The government has run a call for evidence on machinery legislation, and its own explanatory material warns of a possible cliff edge in January 2027 if products meeting the new EU rules are not accepted. A business exporting machinery to both markets should plan for the EU deadline and watch the GB decision.

Chemicals

Chemicals regulation has diverged more than any other area. UK REACH and EU REACH are separate systems. The EU has also revised its CLP Regulation, while Great Britain has used the 2023 Act’s powers to change its own, abolishing the classification and labelling notification and creating the fast-track route described earlier. HSE says its policy is to maintain high levels of protection. Critics argue that a divergent GB system may produce different labels for the same chemical on either side of the Channel, and that monitoring divergence is hard. Northern Ireland, by contrast, remains under EU CLP.

New EU initiatives with no British equivalent

The EU’s current Strategic Framework on Health and Safety at Work covers 2021 to 2027. Its main active threads are:

  • Psychosocial risks. No dedicated EU directive exists, although the European Parliament has repeatedly asked the Commission for one covering stress, burnout and work organisation, and trade unions are campaigning for it. Several member states, including Belgium, Denmark and Sweden, already have specific national rules.
  • Review of older directives. The Commission’s Quality Jobs Roadmap promised a mid-2026 report on how the Framework Directive and related directives work in practice, and a review of the Workplace and Display Screen Equipment directives. The European Parliament held a hearing on the post-2027 strategy on 2 June 2026.
  • Digital work. The Platform Work Directive, adopted in 2024, includes rules on algorithmic management and is due for national transposition around the end of 2026. The EU AI Act and the new Machinery Regulation also affect workplace technology.
  • Hazardous substances. The EU has tightened limits for carcinogens and other substances, including asbestos, and has more updates planned.

Great Britain has no matching legislative programme. Instead HSE works mainly through campaigns, guidance and enforcement priorities.

British reforms of its own

Britain is also making its own changes, partly in response to domestic pressures rather than Brexit. HSE has consulted on the first major overhaul of RIDDOR, the injury reporting regulations, since 2013, with responses closing on 30 June 2026. It has also consulted on revising its asbestos regulations. Work-related stress is a major focus, with the Working Minds campaign and inspections that treat stress as a risk to be assessed under the Management Regulations. Building safety has its own regime under the Building Safety Act 2022, and a new duty for venues and events under Martyn’s Law is due in spring 2027. None of these has an EU counterpart, which shows the UK system is evolving rather than frozen.

What still unites them, and what it means in practice

The shared core is large and durable. Both systems place the primary responsibility on the employer. Both expect a risk-based approach in which hazards are identified, removed where possible, and otherwise controlled by measures that protect groups before individuals. Both require information, instruction, training and some form of worker involvement, and both expect employers to have access to competent safety advice. These ideas come from the same intellectual tradition, including the Robens philosophy of self-regulation within a legal framework and international labour standards that both sides support.

Some technical infrastructure also remains common. British standards bodies stay full members of the European standards organisations CEN and CENELEC, so a large body of European harmonised standards for machinery and protective equipment continues to be used on both sides. Management-system standards such as ISO 45001 are international and used in both markets. Professional bodies and trainers move freely between the two systems, and the vocabulary of safety practice remains almost identical.

That shared base means that most compliance programmes for UK workplaces transfer to EU workplaces with adaptation rather than reinvention. But the differences above point to a short list of practical checks.

  • Treat Northern Ireland as its own case for products. EU product rules apply there, and workplace law follows local rules and HSENI.
  • Plan for 20 January 2027 if you make or import machinery. Compliance with the new EU Machinery Regulation is mandatory for EU and Northern Ireland sales from that date. For Great Britain, wait for the government’s decision before assuming that EU-compliant machinery will be accepted automatically.
  • Keep chemical compliance separate. Registrations, safety data sheets and classifications for UK REACH and GB CLP may differ from the EU’s. Do not assume that an EU registration covers Great Britain or the reverse.
  • Check national law in each EU state. A directive sets a minimum. A country may require more, such as formal safety committees, particular training hours or psychosocial risk rules. Using the British approach as a template is a reasonable start, but it does not replace a check of local requirements.
  • Use the strictest exposure limit when working across both. For asbestos in particular, the EU’s binding limit is 0.01 fibres per cmยณ over eight hours. The GB figure is not directly comparable because it uses a four-hour average, so plan to the EU rule when working in member states.
  • Watch for case-law differences. EU court rulings on matters such as working-time recording bind member states but no longer bind Britain.

For consultancies and in-house teams, the safest posture is to build one management system around the common principles and then add a short, maintained register of jurisdiction-specific rules.

Summary

UK and EU health and safety law share the same core and are slowly separating at the edges. The ideas are the same, the day-to-day rules are largely the same, and the gaps are growing mainly where the EU has legislated and Great Britain has not, or where Britain has chosen its own path.

Where they are similar

  • Both place primary responsibility on employers and require risk assessment, prevention, information, training and worker involvement.
  • Most British workplace regulations still mirror the EU directives they implemented, including work equipment, manual handling, display screens, noise and work at height.
  • Both use the same hazard-classification science and rely on shared technical standards.
  • Brexit did not repeal the main workplace regulations. The Retained EU Law Act of 2023 dropped the blanket sunset clause that had threatened them.

Where they differ

  • Legal design: Britain’s law is a goal-setting statute qualified by “reasonably practicable”, while the EU’s is a directive framework of minimum rules implemented by 27 states.
  • Enforcement: HSE and local authorities enforce in Great Britain with unlimited, turnover-linked fines. The EU has no central inspector, only coordination through the Commission, EU-OSHA and SLIC.
  • Chemicals: UK REACH and GB CLP now run separately from the EU’s regimes, and amendments in 2026 have made GB CLP diverge further.
  • Products: CE marking is accepted indefinitely in Great Britain for 21 regulations, but Northern Ireland follows EU rules, and the EU Machinery Regulation applies from 20 January 2027 with no GB decision yet.
  • Exposure limits and new topics: the EU has cut its asbestos limit tenfold and is considering psychosocial risk rules, platform work and a post-2027 strategy. Britain has kept its own asbestos control limit after an HSE review and relies mainly on guidance and its own consultations, such as those on RIDDOR and the asbestos regulations.
  • Northern Ireland: it sits between the two, applying EU product rules but local workplace law.

What to watch next

  1. The UK government’s decision on machinery rules before 20 January 2027.
  2. Any Commission proposal on psychosocial risks and the shape of the EU’s post-2027 strategy.
  3. The outcome of the RIDDOR and asbestos consultations in Great Britain.
  4. Further use of the 2023 Act’s powers to amend chemicals and other assimilated law.

The practical message for businesses is to build around the shared principles, and to keep a maintained register of the specific rules that now differ by jurisdiction. We can develop your legal register and maintain it. Contact one of our team now to see how we can help your business.

Does the Control of Asbestos Regulations apply to my business?

If your business owns, manages or is responsible for repairing a non-domestic building, or if your people could disturb the fabric of a building during their work, the Control of Asbestos Regulations 2012 (CAR 2012) almost certainly apply to you. Asbestos was not fully banned in the UK until 1999, so any building built or refurbished before 2000 may contain it. This guide explains who is covered, what you must do, and how to check your own position.

Who do the Control of Asbestos Regulations apply to?

CAR 2012 apply to almost every workplace in Great Britain, but the duties you hold depend on your role. Three groups are caught:

  • Owners and managers of non-domestic premises. Offices, shops, factories, warehouses, schools, farms, care homes and pubs all count, as do the shared areas of blocks of flats and other multi-occupancy homes.
  • Tenants with repair or maintenance responsibility. If your lease makes you responsible for the fabric of the building, you share the duty to manage asbestos, or hold it outright.
  • Employers whose staff may disturb asbestos. Electricians, plumbers, joiners, gas fitters, decorators, telecommunications engineers and facilities teams can all drill into, cut or damage asbestos-containing materials without knowing it.

Self-employed people are covered in the same way as employers. Homeowners living in their own private home are not dutyholders, but a tradesperson working in that home still is.

Does the Control of Asbestos Regulations Apply to You?

Do your business premises have asbestos? Do your employees come into contact with it?

The duty to manage asbestos (Regulation 4)

Regulation 4 is the part that catches most small and medium-sized businesses. If you have it, you must:

  1. Find out whether asbestos is present. Take reasonable steps to locate materials likely to contain it, and assume a material contains asbestos unless you have strong evidence it does not.
  2. Keep a written record of where it is, what condition it is in and how much there is. This is your asbestos register.
  3. Assess the risk that anyone could be exposed to fibres from those materials.
  4. Prepare a management plan that says how you will keep the risk under control, and put it into action.
  5. Review and monitor the plan and the register, especially after any change to the building or the condition of the materials.
  6. Pass the information on to anyone likely to disturb the materials, including contractors, before they start work.

The usual starting point is an asbestos management survey carried out by a competent surveyor, following HSE guidance in HSG264. Sampling and analysis should use a UKAS-accredited laboratory. Asbestos left in good condition and unlikely to be disturbed can often stay where it is, as long as it is managed.

Work that disturbs asbestos

Separately from the duty to manage, CAR 2012 sets rules for any work that could disturb asbestos. These depend on the type of material and the risk of releasing fibres.

  • Licensed work. Work on higher-risk materials such as sprayed coatings, lagging and most asbestos insulating board must be done by a contractor licensed by the HSE. The work must be notified to the enforcing authority, normally at least 14 days in advance.
  • Notifiable non-licensed work (NNLW). Some lower-risk work does not need a licence but must still be notified, and workers need health surveillance and records of the work must be kept.
  • Non-licensed work. Short, low-risk tasks, such as removing a few asbestos cement sheets or drilling into textured coating, still need proper controls, trained workers and a risk assessment.

If your employees do any of this work, you must also give them information, instruction and training at the right level for what they do. Even workers who never handle asbestos on purpose need asbestos awareness training if their work could disturb it.

Quick check: does it apply to my business?

Your situationDoes CAR 2012 apply?What it means for you
You own or manage a non-domestic building built before 2000YesYou hold the duty to manage: survey, register, risk assessment and management plan
You rent premises and your lease makes you responsible for repairsYesYou share or hold the duty to manage, so check your lease and agree responsibilities in writing
You rent premises, the landlord handles all repairs and maintenancePartlyThe landlord holds the duty, but you should ask to see the asbestos register and plan
You manage shared areas of flats or a multi-occupancy buildingYesCommon areas are covered by the duty to manage
You send staff into other people’s buildings (trades, maintenance, installers)YesStaff need asbestos awareness training and must check the register before starting work
Your premises were built after 2000 and have not been refurbished with older materialsUnlikelyKeep a record of how you decided, and check if the building has been altered
You work from your own private homeNoThe duty to manage does not cover private homes, but trades working in them are still covered

If you cannot say for certain which row you fall into, treat the regulations as applying until you have checked.

Northern Ireland, the Isle of Man and the Republic of Ireland

CAR 2012 itself applies in Great Britain. If you operate elsewhere, different legislation applies, although the principles are very similar.

If your business has premises in more than one jurisdiction, you need to manage each site against the law that applies there.

What happens if you ignore the regulations?

Breaches of CAR 2012 are prosecuted regularly. Penalties include unlimited fines and, in serious cases, prison sentences for individuals. Beyond the legal risk, unmanaged asbestos can lead to contractors, cleaners or staff being exposed, claims for illness that can take decades to appear, and delays or cost increases when a refurbishment or sale uncovers material you did not know about.

Frequently asked questions

Do I need an asbestos survey? If you hold the duty to manage and cannot show the building is asbestos-free, a survey is the normal way to meet it. A refurbishment and demolition survey is needed before any major building work.

Does it apply to a small office or shop? Yes. Size makes no difference. If the building is non-domestic and you own it, manage it or are responsible for repairs, the duty applies.

Does it apply if I only rent my premises? It depends on your lease. The duty falls on whoever has repair or maintenance responsibility, or on the person who controls the premises. Where there is no clear owner of the duty, the person in control of the building holds it.

How often should I review my asbestos register? There is no fixed interval. Review it when anything changes, such as damage, building work or a change in use, and carry out regular condition checks. Many businesses reinspect known materials once a year.

Do my staff need training? Anyone whose work could disturb asbestos needs asbestos awareness training. Those who carry out non-licensed or notifiable work need higher levels of training.

Next steps

  1. Establish when your premises were built and whether they have been altered.
  2. Check your lease, or ask your landlord, to confirm who holds the duty to manage.
  3. Ask for the asbestos register and management plan, or arrange a survey if there is none.
  4. Make sure anyone working on the building sees the register before they start.
  5. Arrange asbestos awareness training for staff who could disturb the fabric of the building.

We review your business premises and activities to determine which legislation applies to you as well as detailing the steps you need to take to comply. To discuss your needs further, please contact one of our team.

This article is general guidance and does not constitute legal advice or replace advice on your own premises.

What Businesses Need to Comply with UK REACH?

If your business makes, imports or uses chemicals in Great Britain, UK REACH almost certainly affects you. Since the end of the Brexit transition period, GB has operated its own chemicals regime, separate from EU REACH, and the rules, deadlines and costs have been shifting ever since.

This guide explains who UK REACH applies to, what you must do, and the practical steps to take now.

What is UK REACH?

UK REACH (Registration, Evaluation, Authorisation and Restriction of Chemicals) is the Great Britain chemicals regulation that took over from EU REACH on 1 January 2021. It is administered by the Health and Safety Executive (HSE) as the UK REACH agency, with policy led by Defra.

Its core principle is “no data, no market“: a substance on the GB market must be registered, and the information needed to use it safely must be available and passed down the supply chain.

Important: UK REACH applies in England, Scotland and Wales. Northern Ireland continues to follow EU REACH under the Windsor Framework, so businesses trading across the UK may need to comply with both systems.

UK REACH compliance

Does REACH apply to your business?

Who needs to comply?

Your obligations depend on your role in the supply chain.

RoleWhat it meansTypical obligations
ManufacturerYou make a substance in GBRegister substances at 1 tonne or more per year; classify and label; supply compliant safety data sheets
ImporterYou bring a substance, a mixture or an article into GB from outside GB, including from the EURegister substances at 1 tonne or more per year; meet transitional notification or registration requirements; communicate hazards downstream
Downstream userYou use chemicals in your business activities (formulators, manufacturers, industrial and professional users)Follow the safety data sheet and exposure scenarios; check that suppliers are registered; pass information up and down the chain
Distributor / retailerYou store and sell chemicals without changing themPass on safety information; check the supply chain is compliant
Article producer / importerYou make or import products such as equipment, furniture or textilesNotify and communicate on SVHCs in articles; check restrictions apply

Obligations apply per legal entity, so a group with several GB companies needs to assess each one.

The main UK REACH requirements

1. Registration

Manufacturers and importers of substances at 1 tonne or more per year must register them with HSE. Because most businesses could not complete full registrations on day one, the government introduced transitional arrangements:

  • Grandfathering: companies that held an EU REACH registration could carry it across to UK REACH.
  • Downstream User Import Notification (DUIN): downstream users who had been importing from the EU could notify HSE and keep trading while full registration deadlines run.
  • New Registration of Existing Substances (NRES): a route for substances that were not already registered under EU REACH but were on the GB market.
  • Inquiry and registration of new substances: substances not previously on the GB market need a full registration before supply.

2. Transitional registration deadlines

The deadlines have been pushed back twice. Defra has been developing an Alternative Transitional Registration model (ATRm) that is intended to reduce data requirements and costs. Because the ATRm could not be legislated before the original first deadline of October 2026, the government extended the submission dates. The revised deadlines are 27 October 2029, 27 October 2030 and 27 October 2031, phased by tonnage and hazard:

  • 27 October 2029: the highest tonnage and hazard band (broadly substances at 1,000 tonnes or more per year, and certain highly hazardous substances at lower tonnages)
  • 27 October 2030: substances at 100 tonnes or more per year
  • 27 October 2031: all other substances at 1 tonne or more per year

Even with extra time, you should not wait. The detailed ATRm information requirements are still being finalised, and data gathering, supplier agreements and cost-sharing take time.

3. Safety data sheets and communication in the supply chain

Suppliers must provide safety data sheets (SDS) that meet UK REACH requirements, and downstream users must apply the advice in them. Make sure your SDSs carry the correct GB details and that you have a process to update them when information changes. Where substances of very high concern (SVHCs) are present in articles above the threshold concentration, you must pass on information so the articles can be used safely.

4. Restrictions

Annex 17 of UK REACH lists substances and uses that are restricted or banned. If you manufacture, supply or use a restricted substance, you need to confirm that your use is permitted and that any conditions are met. Restrictions can apply to substances on their own, in mixtures and in articles.

5. Authorisation

Substances of very high concern can be added to the Authorisation List (Annex 14), after which they cannot be used or placed on the GB market without authorisation. Watch the UK REACH Candidate List and the Authorisation List and check whether any of your substances are listed.

6. Classification and labelling

UK REACH works alongside GB CLP, which governs the classification, labelling and packaging of hazardous chemicals. Suppliers must classify and label correctly, and use the GB mandatory classifications where they apply.

Practical steps to get compliant

  1. Map your chemicals. List every substance and mixture you make, import or use, with volumes and suppliers.
  2. Confirm your role. Identify whether you are a manufacturer, importer, downstream user, distributor or article producer for each substance.
  3. Check your supply chain. Ask suppliers whether they hold a UK REACH registration or notification, and get confirmation in writing.
  4. Review your transitional status. Establish whether you have a grandfathered registration, a DUIN, an NRES submission or nothing at all.
  5. Check tonnage bands and deadlines. Work out which deadline applies to each substance and plan backwards from it.
  6. Review safety data sheets. Check they are current and meet UK requirements.
  7. Screen for restrictions and SVHCs. Check your substances and products against Annex 17 and the Candidate and Authorisation Lists.
  8. Assign responsibility and keep records. Name an owner for UK REACH, and keep evidence of your assessments and supplier correspondence.
  9. Monitor developments. Follow HSE and Defra updates on the ATRm, fees and deadlines.

What happens if you do not comply?

Supplying or using chemicals in breach of UK REACH can lead to enforcement action by regulators, including notices and prosecution, as well as commercial risk. Non-compliant supply chains can lose market access, and customers increasingly require evidence of regulatory compliance.

Frequently asked questions

Does UK REACH apply if I only import from the EU? Yes. Since 1 January 2021, substances imported from the EU into GB are treated as imports and can carry registration or notification duties.

Does UK REACH apply in Northern Ireland? No. Northern Ireland follows EU REACH under the Windsor Framework, although businesses moving goods between NI and GB may face obligations under both regimes.

Do small businesses need to comply? Yes. There is no general exemption for small businesses, although the 1 tonne per year threshold means many smaller businesses fall into the downstream user category rather than registrant.

Have the deadlines changed? Yes. The transitional registration deadlines were extended to 27 October 2029, 2030 and 2031. Check the current position with HSE or Defra before making decisions.

How we can help

UK REACH sits alongside COSHH, GB CLP and your wider health, safety and environmental duties. We can help you map relevant legislation for your business and compile a legal register. The register will also include details of how your business must comply with each piece of legislation.

Contact us to discuss your legal register requirements.

This article is for general information only and is not legal advice. Regulations and deadlines change, so confirm the current position with HSE, Defra or a qualified adviser.

When Does DSEAR Apply?

Short answer: DSEAR applies whenever your work involves a substance that could cause a fire, explosion or similar energetic event. The Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR) cover far more than heavy industry. Petrol, solvents, LPG, wood dust, flour and even the hydrogen given off by charging forklift batteries can bring a workplace within scope.

This guide explains when DSEAR applies, which activities are excluded and what employers need to do.

What is DSEAR?

DSEAR is the main piece of Great Britain’s health and safety law for protecting people from the fire and explosion risks of dangerous substances at work. It requires employers to assess those risks and then eliminate or reduce them, so far as is reasonably practicable. The regulations are enforced by the Health and Safety Executive (HSE) and, for some premises, local authorities.

What is a “dangerous substance” under DSEAR?

A substance counts as dangerous under DSEAR if it could cause harm through fire, explosion or a similar energetic reaction. This includes:

  • Flammable liquids, such as petrol, solvents, thinners, alcohols and some paints, varnishes and adhesives
  • Flammable gases, such as LPG, propane, acetylene, hydrogen and natural gas
  • Aerosols containing flammable propellants
  • Flammable solids, such as certain metal powders
  • Oxidising substances and organic peroxides, which can feed or intensify a fire
  • Self-reactive, self-heating and pyrophoric substances, which can ignite without an obvious ignition source
  • Substances that give off flammable gas on contact with water
  • Combustible dusts, such as flour, sugar, grain, wood, paper, plastics and some metal dusts, which can form explosive clouds when dispersed in air

Look at hazard pictograms and the supplier’s safety data sheets, these are a good first indicator of whether a substance is covered.

DSEAR

Does DSEAR apply to you?

What is an explosive atmosphere?

DSEAR is particularly concerned with explosive atmospheres. These are mixtures of air and flammable gases, vapours, mists or dusts in which, once ignited, burning spreads through the whole mixture. A small leak in a poorly ventilated room, a cloud of dust in a hopper or vapour from a spray booth can each create one. If there is also an ignition source (a spark, static electricity, a hot surface or an electrical fault), the result can be devastating.

When does DSEAR apply to my business?

DSEAR applies when dangerous substances are present at work, whether you:

  • Use them in a process, such as spraying, mixing, cleaning or welding
  • Store them, for example solvents, gas cylinders or fuel
  • Produce or handle them, intentionally or as a by-product (such as dust from sanding or cutting)
  • Transport them within or around your premises

It applies regardless of business size or sector. Typical examples include:

  • Vehicle repair, spraying and refinishing
  • Woodworking, joinery and furniture manufacture
  • Food and drink production, milling and bakeries
  • Warehousing, including battery charging areas
  • Engineering, welding and fabrication
  • Waste and recycling, where dust, gases and fire risks are common
  • Farms, including grain stores and fuel storage
  • Laboratories, schools and universities
  • Petrol stations and fuel depots

DSEAR protects employees, contractors, visitors and members of the public who could be affected by your work, and self-employed people have duties too. Small quantities can still bring DSEAR into play, although the controls needed should be proportionate to the risk.

When does DSEAR not apply?

DSEAR does not apply to some activities, which are covered by other specific legislation, including:

  • Areas used directly for the medical treatment of patients
  • Appliances burning gaseous fuel that are covered by gas appliance rules
  • The manufacture, handling, use, storage and transport of explosives and chemically unstable substances, which fall under explosives legislation
  • Mineral extraction industries, which have their own regulations
  • Certain forms of transport, such as use of vehicles on public roads, which have separate rules

If you are unsure whether an exclusion applies to your activity, take advice before relying on it – in some cases only parts of DSEAR are disapplied.

DSEAR or COSHH: what’s the difference?

The two sets of regulations are often confused, but they address different harms. COSHH deals with hazardous substances that damage health, such as through inhalation or skin contact. DSEAR deals with substances that can cause fire, explosion and similar events. Many substances fall under both. Solvents, for example, can harm health through exposure and also burn or explode, so you may need to assess the risks under each.

What do I need to do to comply with DSEAR?

DSEAR compliance usually follows these steps:

  1. Carry out a risk assessment. Identify the dangerous substances, how they might ignite or explode and who could be harmed. Consider the quantities, the processes, the possible ignition sources and what could go wrong.
  2. Eliminate or reduce the risk. Substitute with a less hazardous substance where you can, reduce quantities, improve ventilation and control leaks and spills.
  3. Control ignition sources. Use suitable equipment in hazardous areas, manage static, control hot work and keep unsuitable equipment out.
  4. Classify hazardous areas into zones. Where explosive atmospheres may occur, areas are classed by how often and for how long they are likely to be present (zones 0, 1 and 2 for gases and vapours; zones 20, 21 and 22 for dusts). This determines the equipment that can be used there.
  5. Mark hazardous areas where necessary. Display the explosive atmosphere warning sign at entry points.
  6. Mitigate the effects. Use measures such as explosion relief, suppression, isolation and separation, so that harm is limited if an incident occurs.
  7. Prepare for emergencies. Provide procedures, alarms, escape routes and equipment, and practise them.
  8. Inform, instruct and train. Everyone who works with or near dangerous substances must understand the risks and controls.
  9. Review regularly. Revisit your assessment when substances, processes, equipment or layouts change.

What happens if I don’t comply?

Fires and explosions involving dangerous substances can cause fatalities, life-changing injuries and major damage to property and business continuity. HSE can issue improvement and prohibition notices and prosecute, and serious breaches can bring unlimited fines or even imprisonment. Insurers may also challenge claims where a business has not assessed or controlled its risks.

Does DSEAR apply in Northern Ireland and the Republic of Ireland?

DSEAR applies in Great Britain. Northern Ireland has an equivalent set of regulations, the Dangerous Substances and Explosive Atmospheres Regulations (Northern Ireland) 2003, and the Republic of Ireland regulates explosive atmospheres and chemical agents under its own health and safety legislation. The principles are broadly the same, but the details differ, so check the rules that apply where you operate.

Not sure whether DSEAR applies to you?

If your business stores, uses or produces flammable liquids, gases, aerosols or dusts, assume DSEAR is relevant and start by listing the substances you have and where they are. The HSE provides additional guidance for businesses.


This article is general guidance and not legal advice. Requirements depend on your specific work activities and location.

Does COSHH Apply to My Business?

Short answer: almost certainly, yes. If anyone at your workplace uses, makes, handles or is exposed to substances that could harm their health, the Control of Substances Hazardous to Health Regulations 2002 (COSHH) apply to you. That covers far more businesses than most owners expect, from building sites and factories to salons, schools, care homes and offices.

This guide explains what COSHH covers, who must comply, what is excluded and what you need to do.

What is COSHH?

COSHH is the main piece of Great Britain’s health and safety law governing hazardous substances at work. It requires employers to prevent or adequately control exposure to substances that can cause ill health, whether through breathing them in, skin contact, swallowing or contact with the eyes.

The regulations are enforced by the Health and Safety Executive (HSE) and, for some sectors, local authorities.

Which substances does COSHH cover?

COSHH applies to a wide range of substances hazardous to health, including:

  • Chemicals and products containing them, such as cleaning products, paints, solvents, adhesives, de-greasers and disinfectants
  • Fumes, such as welding or soldering fumes
  • Dusts, such as wood dust, flour dust, silica dust from cutting stone or concrete, and cement
  • Vapours, gases and mists, such as spray mists and exhaust fumes
  • Biological agents, such as bacteria, viruses and fungi, including Legionella in water systems
  • Germs that cause diseases, such as leptospirosis (Weil’s disease) or hepatitis, where work brings people into contact with them
  • Nanotechnology materials, where hazardous
  • Asphyxiating gases, which displace oxygen

Many everyday products carry hazard warning pictograms on the label. These are a good first clue that COSHH is relevant. The supplier’s safety data sheet gives the detail you need for your assessment.

Who does COSHH apply to?

COSHH places duties on employers, but it also protects others affected by your work. You must consider:

  • Your employees and agency or temporary workers
  • Contractors working on your premises
  • Visitors, customers and members of the public who could be exposed
  • Self-employed people, who have duties for their own protection and that of others

Business size doesn’t matter. A sole trader with one employee has the same duties as a large organisation, although the paperwork and controls should be proportionate to the risk.

Does COSHH apply to offices and low-risk workplaces?

Yes, although the risks are usually lower. Offices use cleaning products, toner and printer consumables, and some have air conditioning or water systems that need managing for Legionella. You still need to consider whether any substances could cause harm. In many cases a short, sensible assessment will show that risks are low and existing controls are enough.

What does COSHH not cover?

Some hazards have their own specific regulations, so COSHH does not apply to them:

  • Asbestos, covered by the Control of Asbestos Regulations 2012
  • Lead, covered by the Control of Lead at Work Regulations 2002
  • Radioactive substances and ionising radiation, covered by the Ionising Radiations Regulations 2017
  • Substances hazardous only because they are explosive, flammable, or are at extreme temperature or pressure, which are covered by other legislation such as the Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR)

Even where COSHH doesn’t apply, you will normally still have duties under these other regulations and under the Health and Safety at Work etc. Act 1974.

COSHH bucket

Do you know what chemicals are used in your business?

What do I need to do to comply with COSHH?

In practice, COSHH compliance comes down to these steps:

  1. Assess the risks. Identify which hazardous substances are present, who could be exposed, how and how much. Record your significant findings if you employ five or more people.
  2. Prevent or control exposure. Where you can, eliminate the substance or substitute something safer. Otherwise use engineering controls such as enclosure or local exhaust ventilation, safe working systems, and personal protective equipment (PPE) only as the last line of defence.
  3. Make sure controls are used and maintained. Local exhaust ventilation must be thoroughly examined and tested at least every 14 months, and records kept.
  4. Monitor exposure where needed. Compare exposure against the workplace exposure limits in HSE’s EH40 guidance.
  5. Provide health surveillance where required. This applies where there is a risk of identifiable ill health, such as dermatitis or occupational asthma.
  6. Inform, instruct and train your people. Workers need to understand the risks, the controls and what to do if something goes wrong.
  7. Plan for emergencies. Have procedures for spills, accidents and incidents involving hazardous substances.
  8. Review regularly. Revisit your assessment whenever processes, substances or work methods change.

What happens if I don’t comply?

Poor COSHH compliance can lead to serious occupational illness, including occupational asthma, dermatitis, cancers and lung disease, often with effects that appear years later. The HSE can issue improvement or prohibition notices and prosecute, with unlimited fines for serious breaches. Beyond enforcement, you face the cost of civil claims, sickness absence and reputational damage.

Does COSHH apply in Northern Ireland and the Republic of Ireland?

COSHH itself applies in Great Britain. Northern Ireland has its own equivalent, the Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003, and the Republic of Ireland regulates chemical and biological agents under separate legislation. The core principle is the same: assess, control and review. If you operate across more than one jurisdiction, check the requirements for each.

Not sure where you stand?

If your business uses any chemicals, dusts, fumes or biological agents, assume COSHH applies and start by listing the substances you use. If you’re unsure whether your assessments are adequate, our health and safety consultants can help you review your hazardous substances, carry out COSHH assessments and put practical controls in place.


This article is general guidance and not legal advice. Requirements depend on your specific work activities and location.

What an Auditor Looks for in an ISO 45001 Compliant Legal Register

As an auditor with over 10 years experience, I am often asked what do I look for in a legal register? Your legal register is one of the first documents an ISO 45001 auditor will ask to see โ€” and one of the easiest places to lose points if it isn’t maintained properly. Clause 6.1.3 requires organisations to identify and have access to the legal and other requirements relevant to their occupational health and safety management system, and to keep this information up to date. In practice, auditors treat the legal register as a litmus test for the whole management system: if it’s weak, they’ll assume other processes are too.

Here’s what auditors actually check, and how to make sure your register holds up.

1. Coverage: Is It Actually Complete?

Auditors will cross-reference your register against your organisation’s activities, sites, and hazards. They’re looking for gaps such as:

  • Legislation relevant to specific plant, equipment, or processes (e.g. LOLER for lifting equipment, PUWER for work equipment, DSEAR if flammable substances are present)
  • Jurisdiction-specific law where you operate across multiple regions โ€” for example, differences between Great Britain, Northern Ireland, the Isle of Man, and the Republic of Ireland
  • Sector-specific regulations, not just generic Health and Safety law
  • Environmental legislation where it overlaps with Occupational Health and Safety risk (waste, emissions, COMAH)

A register that only lists headline Acts (Health and Safety at Work etc. Act 1974, Management of Health and Safety at Work Regulations 1999) without the supporting regulations underneath will be flagged immediately.

ISO 45001 Legal Register

ISO 45001 Legal Register: What auditors look for

2. Currency: Is It Kept Up to Date?

This is the single most common nonconformity auditors raise. They will ask:

  • What is your process for identifying new, amended, or revoked legislation?
  • How often is the register reviewed, and who owns that review?
  • Can you show evidence of the last update (version control, revision log, sign-off)?

Auditors are wary of registers that look identical year to year โ€” it signals no active monitoring process exists. A dated revision history, or a subscription to a legislation-update service, is strong evidence here.

3. Evaluation of Compliance: Not Just a List

ISO 45001 doesn’t just require you to identify legal requirements โ€” clause 9.1.2 requires you to evaluate compliance against them. Auditors will look for:

  • A clear compliance status against each legal requirement (compliant / partially compliant / non-compliant)
  • Evidence linking each requirement to how compliance is demonstrated (a policy, procedure, permit, inspection record, or training log)
  • A defined frequency for compliance evaluation, separate from the register review itself

A register with no compliance column, or one where every line simply says “compliant” with no supporting evidence, will draw scrutiny.

4. Traceability and Accessibility

Auditors will trace a sample of legal requirements through your system to check they’re not just sitting in a spreadsheet nobody uses. Typical questions:

  • Is this requirement referenced in a risk assessment, procedure, or work instruction?
  • Do relevant staff know this requirement applies to their role?
  • Is the register accessible to those who need it โ€” not locked away with one person?

This is where many organisations fall down: the register exists, but there’s no visible link between it and day-to-day operational control.

5. Ownership and Process

Beyond the document itself, auditors assess the process behind it. Expect questions such as:

  • Who is responsible for monitoring legislative change?
  • What’s the escalation route when a new legal requirement is identified โ€” how does it get actioned, and by when?
  • Is legal compliance a standing item in management review, per clause 9.3?

A register maintained by one person with no documented process, and no visibility at management review, suggests the requirement is being met on paper only.

6. Format Doesn’t Matter โ€” Function Does

ISO 45001 doesn’t mandate a specific format for the legal register. Auditors don’t care whether it’s a spreadsheet, database, or software module โ€” they care whether it functions as a live compliance tool. That said, a well-structured register typically includes:

AspectPurpose
Legislation title & referenceIdentification
JurisdictionApplicability
Summary of requirementInterpretation
Applicability to the organisationRelevance
Compliance statusEvaluation
Evidence/referenceTraceability
Date reviewed / next reviewCurrency
OwnerAccountability

Getting Audit-Ready

If you’re preparing for an ISO 45001 audit (or surveillance visit), the fastest way to strengthen your legal register is to:

  1. Run a gap analysis against your current activities and sites
  2. Add a compliance-status column if you don’t already have one
  3. Establish a documented, evidenced review cycle
  4. Make sure the register is referenced in risk assessments and management review minutes

A legal register that’s actively maintained, evidenced, and embedded in operational decisions is one of the strongest signals of a mature management system โ€” and one of the quickest wins in an audit.

If you need a bespoke legal register or you would like your existing register reviewed, please contact one of our team.

The Difference Between Generic and Bespoke Legal Registers

Why a one-size-fits-all approach to legal compliance leaves organisations exposed โ€” and what a register built around your actual operations gives you instead.

If your organisation is subject to health, safety, or environmental law โ€” and almost every organisation is โ€” you need a legal register. It’s the document that tells you which legislation applies to your operations, what it requires of you, and whether you’re actually compliant. But not all legal registers are built the same way, and the difference between a generic template and a bespoke register isn’t cosmetic. It’s the difference between a document that looks like due diligence and one that actually protects your organisation.

What Is a Legal Register?

A legal register is a structured record of the laws, regulations, and codes of practice that apply to an organisation, typically covering health and safety, environmental, and related compliance obligations. It’s a cornerstone requirement of recognised management system standards, including ISO 9001, ISO 45001 and ISO 14001, and it’s usually the first document an auditor or regulator asks to see. On paper, every legal register looks similar: a list of legislation, a summary of requirements, a compliance status. In practice, how that list is built determines whether the register is a genuinely useful management tool or a box-ticking exercise.

The Trouble With Generic Legal Registers

Generic legal registers are typically off-the-shelf templates or subscription database exports, built to cover an entire sector or industry in one document. They’re inexpensive, quick to obtain, and easy to see the appeal of โ€” but that convenience comes at a real cost:

  • They list legislation that may have nothing to do with your actual activities, sites, or risk profile, burying the requirements that genuinely matter under dozens that don’t.
  • They rarely reflect the specific jurisdictions, licences, or permits your organisation holds, particularly for organisations operating across Great Britain, Northern Ireland, the Isle of Man, or the Republic of Ireland, where legal frameworks diverge significantly.
  • They’re built for updating on a fixed schedule rather than in response to your organisation’s changes โ€” a new site, a new process, a new piece of equipment โ€” so they drift out of date the moment your operations move.
  • They describe legal duties in abstract terms, without translating them into what compliance actually looks like for your sites, your equipment, and your people.
  • They offer no meaningful gap analysis โ€” you’re left to work out for yourself whether you actually comply with each requirement.

The result is a register that satisfies the letter of the audit requirement โ€” “yes, we have a legal register” โ€” without doing the job a legal register exists to do: giving your organisation a clear, current, accurate picture of its legal exposure.

Bespoke vs generic legal register, which is best?
Photo courtesy of Pixabay tumisu-audit

A bespoke legal register demonstrates to auditors that you actually know your legal obligations.

Why a Bespoke Legal Register Is the Only Register Worth Having

A bespoke legal register is built from the ground up around your organisation: your sites, your activities, your industry sector, your jurisdictions, and your risk profile. Rather than starting from a generic list and hoping it fits, it starts from your operations and identifies exactly which legislation applies โ€” and, critically, what that legislation actually requires you to do about it. The advantages compound quickly:

  • Relevance: every entry has a direct line to something your organisation actually does, so nothing important gets lost in noise that doesn’t apply to you.
  • Accuracy across jurisdictions: legislation is mapped to the specific jurisdiction โ€” GB, NI, Isle of Man, or ROI โ€” that each site operates under, rather than treated as a single homogeneous “UK law” list.
  • A genuine compliance status: each requirement is assessed against evidence from your organisation, so you know โ€” not guess โ€” where you stand, and where the gaps are.
  • Built-in gap analysis and action planning: a bespoke register doesn’t just flag non-compliance, it gives you a prioritised route to closing it.
  • Living, current content: as legislation changes or your organisation changes โ€” a new site, a new process, an amended regulation โ€” the register is updated to reflect it, so it never becomes a snapshot of a moment that’s already passed.
  • Audit and due diligence confidence: a bespoke register demonstrates, to auditors, regulators, insurers, and clients, that your organisation understands and manages its legal obligations โ€” not that it purchased a document that says it does.

In short: a generic register tells you what the law says. A bespoke register tells you what the law means for you โ€” and whether you’re meeting it.

FEATURES

Generic Legal Register

Bespoke Legal Register


Identifies only relevant laws


Focused on the actual business


Relevant and easy to understand


A practical management tool


Includes sector specific requirements


Demonstrates that you understand your obligations

The Bottom Line

A legal register is only as valuable as its accuracy and relevance to your organisation. A generic template can create a false sense of security โ€” the appearance of compliance without the substance of it โ€” and that gap tends to surface at the worst possible moment: during an incident investigation, a regulatory visit, or a client’s due diligence review. A bespoke legal register, developed and maintained by health and safety professionals who understand your sector and your sites, is an investment in genuine legal certainty, not just a document for the audit file.

If your organisation is currently relying on a generic register โ€” or doesn’t have one at all โ€” talk to us about building a bespoke legal register tailored to your operations, sites, and jurisdictions. It’s the foundation every other part of your compliance management sits on, and it’s worth getting right.

Do Small Businesses Need a Health and Safety Legal Register?

A clear look at legal obligations, business size, and why proportionate compliance matters.

It is a question we hear often from small business owners: โ€œDo I really need a health and safety legal register? Surely that’s something only for large companies with big compliance teams.โ€ It’s an understandable assumption, but it is not correct. Legal obligations in health and safety law are not switched on by company size โ€” they are triggered by what a business actually does, where it does it, and the risks that activity creates. A five-person joinery workshop and a five-hundred-person office may face entirely different legal duties, regardless of which one has more employees on the payroll.

In this article, we look at why the size of a business is the wrong starting point for thinking about legal compliance, and why a well-designed legal register โ€” far from being a burden reserved for large organisations โ€” can be one of the most practical and cost-effective tools a small business ever puts in place.

What Is a Health and Safety Legal Register?

A legal register is a structured record of the health and safety (and often environmental) legislation, regulations, and approved codes of practice that apply to a specific organisation. Rather than listing every law in existence, it identifies the ones that are actually relevant to that business’s operations, sites, and activities, and sets out what needs to be done to remain compliant with each one.

Done properly, a legal register becomes a single point of reference that tells a business owner or manager, at a glance: which laws apply to us, what each one requires, how we currently meet that requirement, and where any gaps exist.

Legal Obligations Depend on Circumstances, Not Company Size

This is the point worth dwelling on, because it is the one most often misunderstood. UK health and safety legislation is largely activity-based and risk-based rather than headcount-based. The Health and Safety at Work etc. Act 1974 and its supporting regulations apply to employers and the self-employed alike, and the specific duties that follow are shaped by factors such as:

  • The nature of the work being carried out (for example, construction, food handling, manual handling, or working with hazardous substances)
  • The premises involved and who else might be affected โ€” employees, contractors, visitors, or members of the public
  • Whether specific hazards are present, such as asbestos, fire risk, electrical systems, or work at height
  • Sector-specific rules that apply regardless of business size, such as food safety, licensing, or environmental permitting requirements

A single self-employed trades person using a ladder has duties under the Work at Height Regulations. A two-person catering business has duties under food hygiene and allergen legislation. A small manufacturer using solvents has duties under COSHH. None of these obligations disappear because the business is small โ€” in some cases, a smaller business with fewer resources to manage risk may need to pay closer attention, not less.

In other words, the question is never really โ€œis my business big enough for this to matter?โ€ The question is โ€œwhat do we actually do, and what does the law say about doing it safely?โ€ A legal register is simply the tool that answers that question clearly and keeps the answer up to date as legislation changes.

Why Small Businesses Benefit from a Concise, Proportionate Register

Recognising that legal duties apply regardless of size is only half the picture. The other half is that how a small business meets those duties can, and should, look very different from how a large organisation meets them. A 200-page legal register modelled on a multinational’s compliance framework is not only unnecessary for a small business โ€” it is actively counterproductive. It gets opened once, filed away, and forgotten.

Do small businesses need a health and safety legal register?

A legal register should be proportionate to your business activities

A register that is built specifically for a small business, scaled to its real activities and risks, tends to work far better in practice. This is why:

1. It Stays Usable

A concise register lists only the legislation that genuinely applies to that business’s operations. Instead of an overwhelming, generic checklist, the owner or manager is left with a short, relevant list they can actually refer to โ€” and act on โ€” day to day.

2. It Reflects the Business as It Really Operates

A bespoke register is built around the specific sites, equipment, substances, and work activities involved, rather than a one-size-fits-all industry template. This means it captures the obligations that matter and does not waste time on ones that do not.

3. It Makes Gaps Visible

Because it is proportionate rather than padded out, a well-built register makes it far easier to spot where compliance is solid and where attention is needed โ€” an outdated risk assessment, a missing policy, a licence due for renewal โ€” without those gaps being buried in irrelevant detail.

4. It Demonstrates Due Diligence

In the event of an incident, an inspection, or a client or insurer asking about compliance arrangements, a maintained legal register is tangible evidence that the business has identified its obligations and is actively managing them. For a small business without a dedicated compliance function, this matters a great deal.

5. It Supports Growth Without Starting from Scratch

As a small business takes on new work, new premises, or new equipment, a legal register built with the right structure can be updated and expanded rather than rebuilt. This means compliance grows alongside the business instead of becoming a sudden, overwhelming project further down the line.

Building a Register That Fits Your Business

The most effective legal registers for small businesses share a few common features: they are reviewed and updated regularly to reflect legislative change, they are written in plain language rather than legal jargon, they link each legal requirement to a clear action or evidence of compliance, and they are proportionate โ€” covering what applies, in appropriate detail, without unnecessary bulk.

This is where working with a health and safety consultancy adds real value. Rather than adapting a generic template, a consultancy can assess your specific activities and premises, identify the legislation that genuinely applies, and build a register that is both legally sound and genuinely usable by your team.

The Bottom Line

Health and safety law does not ask how many people are on your payroll before it applies to you โ€” it asks what risks your work creates. That means every business, regardless of size, has legal obligations worth identifying and managing properly. For small businesses, the smart response is not to ignore this reality, nor to adopt a compliance framework built for a much larger organisation. It’s to build a legal register that is concise, proportionate, and tailored to how the business actually operates โ€” one that gets used, kept current, and genuinely supports safer, more compliant day-to-day operations.

If you are unsure which legal requirements apply to your business, or you would like help building a legal register that is proportionate to your size and sector, our team can help you get a clear, practical picture of your obligations.

Would you like a free copy of our health and safety and environmental legal register checklist for UK operations?

What Happens if Your Legal Register is Out of Date?

A legislation registerโ€”or legal registerโ€”serves as the compliance anchor of an organisationโ€™s corporate governance structure and management system. Designed to identify, organise, and monitor all statutory duties and regulatory obligations applicable to an organisationโ€™s operations, it acts as the baseline for legal adherence. However, maintaining a legal register is not a one-time administrative task; it requires active upkeep to retain its utility.

The key risk of an outdated legal register is that it gives executive management a false picture of the organisationโ€™s true legal obligations and actual compliance level. While an outdated register may not immediately lead to criminal prosecution, relying on obsolete legal information creates subtle, compounding vulnerabilities across operational management, internal auditing, and ISO management systems.

Understanding the operational consequences of an outdated legal register highlights why static compliance documents fail to protect modern enterprises.


1. Missing Critical Legislative Changes and Statutory Amendments

Health, safety, and environmental statutory frameworks across Great Britain, Northern Ireland, the Isle of Man, and the Republic of Ireland are in constant motion. Regulators and parliaments amend existing legislation far more frequently than they enact entirely new primary Acts.

When a legal register is not updated regularly, the following issues occur:

  • Unrecorded Statutory Amendments: An entry in a register may list the correct title of an Act or Regulation, yet remain silently out of date because an amending statutory instrument altered a exposure threshold, broadened a legal definition, or moved a mandatory reporting deadline.
  • Retaining Revoked Legislation: Failing to remove repealed or revoked legislation creates unnecessary administrative clutter. This wastes valuable time during internal checks and misleads staff into enforcing duties that no longer exist under law.
  • Overlooking Updated Regulatory Guidance: Regulators such as the Health and Safety Executive (HSE) and the Environment Agency (EA) frequently update Approved Codes of Practice (ACOPs) and guidance documents. Although guidance is not always statutory law, it defines the legal benchmark expected by courts and enforcement inspectors. Missing these updates leaves operational procedures aligned with obsolete standards.

2. Flawed Compliance Assessments and Distorted Evaluations

Under international management standards such as ISO 14001 (Clause 9.1.2) and ISO 45001 (Clause 9.1.2), organisations must conduct periodic evaluations of their legal compliance status. A compliance evaluation tests operational reality against the parameters documented in the legal register.

If the underlying legal register contains out-of-date information, any subsequent compliance assessment becomes fundamentally flawed. Evaluating site practices against superseded statutory requirements generates inaccurate compliance scores. Managers receive reports indicating complete compliance, unaware that newly enacted statutory duties, altered discharge limits, or updated permit conditions have gone completely unassessed.


3. Failure to Identify New Obligations from Business Triggers

Legislative updates represent only one side of legal register maintenance; internal organisational changes represent the other. Updating a register solely on an annual schedule inevitably causes the document to lag behind internal operational developments.

A failure to execute trigger-based reviews means that routine commercial changes generate unmanaged legal exposure:

  • New Equipment and Machinery: Installing new plant or lifting machinery introduces obligations under the Provision and Use of Work Equipment Regulations 1998 (PUWER) or the Lifting Operations and Lifting Equipment Regulations 1998 (LOLER).
  • New Chemical Substances: Introducing new raw materials or cleaning agents can trigger the Control of Substances Hazardous to Health Regulations 2002 (COSHH) or REACH obligations.
  • Premises and Physical Footprint: Moving to new sites or altering existing buildings brings different fire safety orders, planning consents, and building regulations into scope.
  • Environmental Permit Variations: Varied abstraction consents, modified trade effluent limits, or altered waste classifications must be entered into the register the moment they are granted.
  • Cross-Border Expansion: Expanding operations into a new jurisdictionโ€”such as moving from Great Britain into Northern Ireland or the Republic of Irelandโ€”introduces an entirely separate body of legal requirements rather than a variation of existing rules.

Without a system that links operational changes directly to legal register reviews, new legal duties remain unidentified and unmanaged.


4. Incorrect Regulatory Risk and Misleading Executive Confidence

Executive leadership relies on corporate compliance reporting to evaluate organisational risk and allocate resources effectively.

An outdated legal register distorts this governance feedback loop. It provides leadership with a false sense of security, leading executives to believe that all statutory liabilities are isolated and controlled. In reality, unmonitored regulatory shifts accumulate quietly. This distorted view of regulatory risk can lead management to allocate compliance budgets in error, bypass necessary operational controls, or omit vital safety training.


5. Third-Party Audit Findings and ISO Non-Conformities

For organisations certified to ISO 9001, ISO 14001, or ISO 45001, the legal register is one of the most rigorously examined elements during third-party certification and surveillance audits.

Third-party auditors routinely evaluate legal registers using two distinct approaches:

  1. Top-Down Auditing: The auditor inspects a physical aspect or hazard on site (such as a chemical store, timber workshop, or waste area) and checks whether the corresponding statutory requirements and permit conditions are correctly detailed in the legal register.
  2. Bottom-Up Auditing: The auditor selects a specific entry within the legal register and requests live physical evidence demonstrating how that requirement is fulfilled on the ground.

If an auditor discovers that a register lacks recent legislative amendments, omits applicable permit conditions, or references revoked statutes, a formal non-conformity will be raised against Clause 6.1.3. Treating the legal register as a static, one-time exercise remains one of the most frequent causes of ISO audit failures.


6. Difficulty Demonstrating Legal Compliance and Due Diligence

Maintaining compliance requires more than listing statutory titles; it demands clear evidence of active oversight. A defensible legal register entries should link each statutory clause directly to an internal operating procedure, an assigned internal owner, and a verifiable evidence log.

If a regulatory inspector from the Health and Safety Executive (HSE) or Environment Agency (EA) inspects a site, or if an insurer evaluates an operational claim, an outdated register fails to demonstrate due diligence. Presenting a static document that has not been updated or audited within the preceding twelve months demonstrates a breakdown in compliance governance, making it difficult to prove that the business actively manages its statutory duties.


7. Breakdown of the Plan-Do-Check-Act Management Framework

Recognised management system frameworksโ€”such as ISO 45001 and HSG65โ€”operate on a continuous Plan-Do-Check-Act (PDCA) cycle.

Plan do check act. Legal register out of date?
Plan do check act cycle

The legal register forms the core foundation of the Plan stage. It defines what the organisation must comply with. If the Plan stage relies on obsolete statutory parameters:

  • Operational controls (Do) are built around incorrect standards.
  • Compliance audits (Check) evaluate performance against out-of-date criteria.
  • Corrective actions (Act) fail to address actual legal exposure.

When the legal register is disconnected from live operational checks, the entire management system fails to function as intended.


Establishing an Effective Legal Register Review Protocol

To prevent a legal register from becoming out of date, organisations should implement a dual-track review process:

  • Scheduled Legislative Reviews: Establish a fixed review schedule (typically quarterly) to monitor legislative changes, new statutory instruments, and updated regulator guidance across all operating jurisdictions.
  • Trigger-Based Internal Reviews: Integrate legal register review checklists directly into corporate change-management processes. Any change in business activities, premises, machinery, chemical usage, or environmental permits should prompt an immediate review.
  • Accountability and Audit Trails: Assign clear internal ownership for every entry and maintain a detailed audit trail showing when each requirement was last evaluated.

By pairing scheduled legislative monitoring with internal change management, executive leadership can ensure that the legal register remains an accurate, defensible reflection of the organisation’s legal duties.ย  To get help with your legal register, please contact one of our team.

What Does an ISO 45001 Legal Register Need to Contain?

If you are working towards ISO 45001 certification, or maintaining it, one of the most common sticking points during audits is the legal register. It sounds like a simple document โ€” a list of laws that apply to your business โ€” but auditors consistently find registers that are either incomplete, out of date, or too vague to demonstrate real compliance.

This article breaks down exactly what a compliant legal register needs to contain, why it matters, and how to keep it audit-ready.

What Is a Legal Register?

A legal register (sometimes called a “legal and other requirements register”) is a structured record of all the health and safety laws, regulations, codes of practice, and other obligations that apply to your organisation’s activities, products, and services.

Under ISO 45001, Clause 6.1.3 requires organisations to determine and have access to up-to-date legal requirements and other requirements relevant to their occupational health and safety management system (OH&S MS), and to keep this information current. The register is how you evidence that you have done this.

Legal register
Is your legal register up to date?

Why It Matters More Than It Looks

A legal register is not just a compliance checkbox. It is the foundation your OH&S management system is built on โ€” it drives your risk assessments, your operational controls, your training needs, and your internal audit criteria. If the register is wrong or incomplete, everything built on top of it is at risk too.

Auditors will typically test the register in two directions:

  • Top-down โ€” picking an activity or hazard on site and checking the relevant legislation is listed.
  • Bottom-up โ€” picking an entry in the register and asking how it is being met in practice.

If either direction breaks down, it is usually flagged as a non-conformity.

Core Elements Every Entry Should Include

While the exact format can vary, a robust legal register entry should contain the following information for each requirement:

  1. Legislation or requirement title โ€” the specific act, regulation, code of practice, standard, or other obligation (e.g. industry code, insurer requirement, client contractual clause).
  2. Reference number or citation โ€” the official identifier so it can be traced back to source.
  3. Jurisdiction โ€” which country, state, or region it applies to, especially important for multi-site organisations.
  4. Summary of the requirement โ€” a plain-language description of what the law actually requires, avoiding a copy-paste of dense legal text.ย  This is often where expert consultants can be beneficial in interpreting the law to your business operations.
  5. Applicability โ€” why and how this requirement applies to your specific operations, sites, or activities. Generic entries (“Health and Safety at Work Act applies to all businesses”) are a common audit finding.
  6. Compliance status โ€” a clear statement of whether you currently comply, partially comply, or are working towards compliance.ย  This is particularly useful when first implementing ISO 45001.
  7. Evidence of compliance โ€” links or references to the specific procedures, records, permits, certificates, or controls that demonstrate compliance.
  8. Responsible person or role โ€” who owns the register and is accountable for maintaining compliance.
  9. Review date and frequency โ€” when it was last checked and when it is next due for review.
  10. Source of update information โ€” how you monitor for changes (e.g. legislation update service, trade body bulletin, government gazette, etc.).
  11. Date of last legislative change โ€” useful for showing the register reflects the current version of the law, not an outdated one.

Beyond Statutory Law: “Other Requirements”

ISO 45001 explicitly extends beyond legislation to “other requirements.” These are easy to miss but often specifically probed by auditors. They may include:

  • Industry codes of practice and guidance documents
  • Client or contractual health and safety requirements
  • Relevant insurance provider conditions
  • Corporate group standards (for multi-site or multinational organisations)
  • Voluntary agreements or membership scheme conditions
  • Permits, licences, and consents tied to specific sites or activities

If your register only lists statutory legislation and ignores these, it will not fully meet the clause requirement.

How to Structure the Register

There is no single structure that every register must follow, and it is often determined by the type, size or nature of the organisation itself.  Most organisations use a spreadsheet, text document or a dedicated compliance software tool. Common groupings include:

  • General health and safety legislation
  • Fire safety
  • Environmental (where it overlaps with H&S, e.g. hazardous substances)
  • Sector-specific legislation (construction, manufacturing, healthcare, etc.)
  • Equipment and machinery
  • Chemical and hazardous substances
  • Transport and vehicles
  • Welfare and employment law touching on H&S

Structuring it makes the register easier to cross-reference against your risk assessments and operational controls, procedures and much faster to navigate during an audit.

Keeping It Live: Review and Monitoring

A legal register is only useful if it stays current. ISO 45001 requires that this information be kept up to date, so your process needs to show:

  • A defined review frequency (many organisations review quarterly, with a full review annually)
  • A named responsible person for monitoring legislative changes, this can be a representative in the organisation but could also be an external consultant
  • A method for capturing changes (legal update subscription services are common, as manually tracking government publications is unreliable)
  • A record of how changes were assessed and, where relevant, actioned (updated risk assessments, new controls, revised training)

Common Mistakes to Avoid

  • Treating it as a one-off exercise. Registers built once for certification and never revisited are one of the most frequent non-conformities.
  • Copying generic templates without tailoring. A register that does not reflect your actual sites, activities, and hazards will not withstand scrutiny.
  • No link to evidence. Listing a requirement without showing how it is actually met leaves a gap between the register and reality.
  • Missing “other requirements.” Focusing only on statute law and ignoring client, insurer, or industry obligations.
  • No ownership. Without a named responsible person, updates tend to fall through the cracks.

Final Thoughts

A well-built legal register does more than satisfy Clause 6.1.3 โ€” it becomes a working tool that keeps your entire OH&S management system grounded in what the law and your other obligations actually require. Getting the structure right from the start, and building in a genuine review cycle, is what separates a register that passes audit from one that merely exists on paper.

If you would like support building or auditing your legal register as part of your ISO 45001 journey, get in touch with our team for a consultation.