Management system guidance
6.1 Actions to Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.3 Compliance obligations
ISO 14001:2026 requires your organization to identify the compliance obligations that relate to its environmental aspects, to have access to them, to work out how each one applies to the organization, and to take them into account when establishing, implementing, maintaining and continually improving the environmental management system. The compliance obligations must be available as documented information. Use a compliance obligation register to capture and monitor your organization’s compliance obligations. These compliance obligations can result in risks and opportunities to the organization which need to be assessed further under 6.1.4 Risks and opportunities.
This requirement is unchanged in substance from ISO 14001:2015. The 2026 edition speaks of documented information being "available" rather than "maintained", uses "meet" rather than "fulfil" compliance obligations throughout, and adds a note that compliance obligations can result in risks and opportunities. It also clarifies in clause 4.2 that voluntary requirements of interested parties become compliance obligations once your organization decides to adopt them (see 4.2).
Sources of compliance obligations
Compliance obligations include the legal requirements your organization must comply with and other requirements it has to, or chooses to, comply with. Mandatory obligations can arise from:
- International, national and local environmental laws and regulations;
- Conditions in environmental permits, licences, consents and other authorizations;
- Orders, rules or guidance issued by regulators;
- Judgments of courts or administrative tribunals.
Voluntary commitments include organizational and industry standards, contractual relationships, agreements with customers, community groups or non-governmental organizations, voluntary labelling schemes and codes of practice, principles of good governance and community and ethical standards. The introduction of new legislation and changes to current legislation can be monitored through the following sources:
- Resource efficiency and recycling www.wrap.org.uk
- Environment www.environment-agency.gov.uk
- NET Regs Environment www.netregs.gov.uk
- Environmental legislation updates www.cedrec.com/home/index.htm
- Relevant publications, trade associations and professional bodies.
Determining how obligations apply
Identifying the title of an Act or regulation is not enough. For each obligation, record which environmental aspects, sites, activities or products it relates to, what specifically your organization must do (e.g. permit emission limits, waste duty of care, packaging or producer responsibility reporting), who is responsible, and how compliance will be checked. Documented information could be a list or matrix of compliance obligations. You can download a free copy of our Compliance Obligation Register.
Ensure that your organization determines and has access to information concerning obligations and how they apply to the business. Ensure the obligations are taken into account when setting environmental objectives (6.2.1), planning actions (6.1.5), establishing operational controls (8.1), deciding competence and training needs, and when implementing and continually improving the management system. Compliance is then checked periodically under 9.1.2 Evaluation of compliance, so keep the register up to date whenever legislation, permits or voluntary commitments change.
You should seek and record evidence that your organization has identified the compliance obligations related to its environmental aspects, has access to them, understands how they apply, and keeps them available as documented information. Check that there is a method for tracking new and changed requirements and that obligations are reflected in objectives, controls and planned actions. Objective evidence could be in the following various forms:
- Compliance obligation register;
- Risk and opportunity register;
- Permits, licences and records of regulator correspondence;
- Compliance evaluation records;
- Corrective actions;
- Non-conformance reports;
- Management review minutes.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
Want to know more about our templates?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
PDCA Database
Planning
Doing
Checking
Acting
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.