Management system guidance
6.1 Actions to Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.3 Determination of legal requirements and other requirements
Clause 6.1.3 requires you to establish, implement and maintain a process to:
- identify the legal requirements and other requirements that apply to your hazards, your OH&S risks and your OH&S management system, and keep access to current versions of them;
- work out how those requirements apply to your organization and what needs to be communicated, and to whom;
- take them into account when you establish, implement, maintain and continually improve the OH&S management system.
You must maintain and retain documented information on your legal requirements and other requirements and keep it updated when they change. Legal requirements and other requirements can themselves create risks and opportunities, so the outputs of this clause feed into 6.1.1 and 6.1.4, and compliance is later checked under 9.1.2 Evaluation of compliance.
What counts as a legal requirement or other requirement?
Legal requirements can include national, regional or international legislation (statutes and regulations), decrees and directives, orders issued by regulators, permits, licences and other authorizations, court or tribunal judgments, treaties and conventions, and collective bargaining agreements.
Other requirements are those your organization must, or chooses to, comply with. They can include your own organizational requirements, contract conditions, employment agreements, agreements with interested parties or health authorities, non-regulatory and consensus standards and guidelines, voluntary codes of practice, technical specifications and charters, and public commitments made by your organization or its parent. The needs and expectations of workers and other interested parties (clause 4.2) become requirements of your system only where they are mandatory or where you decide to adopt them.
Identifying legal requirements
Form a small review team, typically the health and safety manager with relevant department managers and worker representatives, to identify the requirements that apply. Useful steps include:
- Listing the hazardous substances stored and used, with their maximum quantities, and their properties from safety data sheets and COSHH assessments;
- Listing the characteristics of activities, operations and process inputs, using measured data or information from suppliers;
- Using your hazard identification and risk assessments (6.1.2) to see which legislation applies to each significant hazard, and making sure risk controls take the relevant legal requirements into account;
- Identifying statutory inspections and examinations, e.g. under LOLER and PUWER, and preventive maintenance of plant and equipment that is required by law;
- Deciding whether each piece of legislation is relevant or not relevant, and recording the reason;
- For each relevant requirement, describing how it applies, what controls are in place to fulfil it and what controls manage the related hazard;
- Breaking requirements down into procedural, operational and monitoring requirements, and defining operational control criteria from the legislation and other sources such as manufacturers’ manuals and industry guidance;
- Assigning responsibilities for compliance and reporting across the organization.
Typical UK health and safety legislation
For organizations operating in the UK, relevant legislation is published at www.legislation.gov.uk and guidance, including Approved Codes of Practice (ACOPs), is available from the Health and Safety Executive. Depending on your activities, your register may include:
- Health and Safety at Work etc. Act 1974;
- Management of Health and Safety at Work Regulations 1999;
- Workplace (Health, Safety and Welfare) Regulations 1992;
- Regulatory Reform (Fire Safety) Order 2005;
- Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR) 2013;
- Control of Substances Hazardous to Health Regulations (COSHH) 2002;
- Safety Representatives and Safety Committees Regulations 1977;
- Health and Safety (Consultation with Employees) Regulations 1996;
- Lifting Operations and Lifting Equipment Regulations (LOLER) 1998;
- Provision and Use of Work Equipment Regulations (PUWER) 1998;
- Health and Safety (First-Aid) Regulations 1981;
- Building Regulations 2010.
Organizations operating in other countries should use the equivalent national legislation and regulator guidance for each location within the scope of the OH&S management system.
Determining other requirements
Other requirements include customer and contract conditions, client site rules, industry and trade association codes, national and international standards, insurers’ requirements, guidance notes and technical memoranda from government agencies and professional bodies, and your own group policies. Ways of identifying and keeping track of them include:
- Subscribing to legal update services and newsletters;
- Membership of trade associations and professional OH&S bodies;
- Research using reputable government websites;
- Using competent consultants;
- Reviewing contracts, tender documents and client requirements;
- Attendance at occupational health and safety training courses and industry events.
Record the evaluation of other requirements in the register, so that you can show why each one applies.
Documenting legal requirements and other requirements
Most organizations maintain a legal and other requirements register, linked to the hazards, safety-critical tasks and equipment to which each requirement applies. For each requirement the register typically records:
- The title and a short description of the requirement;
- How it applies to the organization, and whether any licences, permits or approvals are needed;
- The supporting documents and controls that demonstrate compliance;
- Who is responsible and what needs to be communicated, to whom;
- How and how often compliance is verified.
Keep the current register as maintained documented information, and retain superseded versions and records of reviews as evidence of how it has been kept up to date.
Communicating and updating requirements
Communicate relevant requirements to the workers, contractors and managers whose work or decisions can affect compliance, for example through procedures, permits, inductions, toolbox talks and contractor briefings (see 7.4 Communication). Clause 5.4 requires you to emphasize consultation with non-managerial workers on how legal requirements and other requirements will be fulfilled, so involve safety representatives or the safety committee when deciding how to comply (see 5.4 Consultation and participation of workers).
Review the register regularly and whenever you are notified of new or amended legislation, guidance or contract conditions. For each update, decide whether it is relevant, whether you already comply, and what changes are needed to controls, procedures, training or resources. Keep a record of each review, amend and communicate the register within a defined time (for example, one calendar month), and report significant changes to top management through management review. Planned changes to processes or premises should also trigger a check of the requirements that apply. Sources of update information include:
- Legal update services and email alerts;
- Trade associations, professional bodies and industry publications;
- Direct communication with regulators and local authorities;
- Networking with industry peers and attending trade events;
- Outside consultants and training courses on health and safety law.
Monitoring compliance status
Identifying requirements is only half the job; you must also evaluate whether you are fulfilling them. Plan compliance evaluations at a frequency based on the risk and on past results (see 9.1.2 Evaluation of compliance). Any additional requirements identified during evaluation should be added to the register, and any noncompliance should be recorded, actioned and tracked through your incident, nonconformity and corrective action process.
You should seek and record evidence that your organization has a process for identifying and accessing up-to-date legal requirements and other requirements applicable to its hazards, OH&S risks and management system; that it has determined how each requirement applies and what needs to be communicated; that non-managerial workers have been consulted on how requirements will be fulfilled; that the requirements are reflected in risk controls, objectives and procedures; and that documented information on them is maintained, retained and updated when changes occur.
More information on PDCA
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.