What is ISO 45001?
ISO 45001 is the international standard from ISO that sets requirements for an occupational health and safety (OH&S) management system, enabling an organisation to prevent work-related injury and ill health and to demonstrably improve its health and safety performance. The standard was published on 12 March 2018 and replaced the British OHSAS 18001. It applies to any type of organisation, but matters most in sectors with physical hazards such as manufacturing, the process industry, construction, logistics and energy. In highly automated plants, ISO 45001 touches the OT world directly: machines, control systems, maintenance and software changes all shape how safely people work.
ISO 45001 = working systematically and demonstrably on a safe and healthy work environment.
🧠 How is ISO 45001 structured?
ISO 45001 follows the Harmonized Structure (formerly Annex SL), the same clause layout used by ISO 9001, ISO 14001, ISO 50001 and ISO 27001. Clauses 1 to 3 are introductory; the requirements sit in clauses 4 to 10 and follow the PDCA cycle.
| Clause | Topic | What it means in practice |
|---|---|---|
| 4 Context | Organisation and interested parties | Internal and external issues, needs of workers and regulators, scope of the system |
| 5 Leadership | Policy, roles and participation | Top management is accountable; workers are consulted and take part (5.4) |
| 6 Planning | Hazards, risks and objectives | Hazard identification, assessment of risks and opportunities, legal requirements, measurable OH&S objectives |
| 7 Support | Resources and competence | Training, awareness, communication and documented information |
| 8 Operation | Operational control | Hierarchy of controls, management of change, procurement and contractors, emergencies |
| 9 Performance evaluation | Measuring and reviewing | Monitoring, evaluation of legal compliance, internal audit, management review |
| 10 Improvement | Incidents and correction | Investigation of incidents and nonconformities, corrective action, continual improvement |
Two points set ISO 45001 apart from its predecessor. First, responsibility clearly rests with top management rather than with a standalone safety officer. Second, the standard requires active consultation and participation of non-managerial workers, for example when identifying hazards and choosing controls.
🎯 What does ISO 45001 cover?
| Component | Description |
|---|---|
| Policy and commitment | Leadership actively demonstrates commitment to health and safety and sets it out in an OH&S policy |
| Hazard identification | Systematic identification of workplace hazards, including routine and non-routine tasks |
| Controls | Technical and organisational measures applied in a fixed order of preference |
| Training and awareness | Employees are instructed and know how to act in hazardous situations |
| Incident reporting | Accidents, near misses and nonconformities are investigated and followed up |
| Continual improvement | PDCA cycle aimed at reducing OH&S risks and improving performance |
At its core is the hierarchy of controls in clause 8.1.2. An organisation must consider measures in this order:
- Eliminate - remove the hazard, for example by automating a task.
- Substitute - choose a less hazardous process, material or piece of equipment.
- Engineering controls and reorganisation of work - guards, interlocks, local exhaust ventilation.
- Administrative controls - procedures, work permits and training.
- Personal protective equipment - PPE as the last line of defence.
This order broadly matches the occupational hygiene strategy in the Dutch Arbowet. In practice ISO 45001 is often combined with environmental management into an HSE system, but ISO 45001 itself does not cover the environment; that is the domain of ISO 14001.
🏭 Where does ISO 45001 meet OT and production?
In automated plants, many OH&S risks stem from machines and control systems. ISO 45001 does not prescribe technology, but its requirements for operational control, change and emergencies end up with the OT department in practice.
| Application | ISO 45001 relevance |
|---|---|
| Lock-out Tag-out during maintenance | Preventing unintended start-up of machines while people work on them |
| Working with hazardous substances | Control through instructions, ventilation, gas detection and PPE |
| Machine safety | Safety PLCs, emergency stops and interlocks designed to functional safety standards; SCADA and a standard PLC monitor the process but are not a safety layer |
| RI&E | Digital recording and follow-up of hazards and measures |
| Training via HMI or e-learning | Built-in operator instructions for critical actions |
| Changes to control software | Management of change (8.1.3) prevents a modified program from silently disabling a safety function |
| Alarm management | Alarm floods cause missed warnings and therefore OH&S risks |
Cybersecurity belongs in that assessment too. An attack on or failure of the control system can start a machine unexpectedly or undermine a safety function. Include such scenarios in hazard identification and use IEC 62443 for the technical measures. A change process that assesses both OH&S and security impact keeps the two departments from working at cross purposes.
🔄 How does ISO 45001 relate to other standards and laws?
| Standard or law | Focus | Relationship with ISO 45001 |
|---|---|---|
| ISO 9001 | Quality management | Same structure; often combined in one system |
| ISO 14001 | Environmental management | Same structure; together often called an HSE system |
| ISO 45001 | Occupational health and safety | The OH&S management system itself |
| ISO 50001 | Energy management | Same structure, different subject |
| Arbowet | Statutory OH&S duties in the Netherlands | Mandatory; ISO 45001 helps demonstrate compliance but does not replace the law |
| VCA | Safety checklist for contractors | Dutch certification focused on the workplace; ISO 45001 is broader and system-based |
| ISO 31000 | Risk management in general | Provides principles for risk assessment |
These standards can be combined modularly within a single integrated management system (IMS). ISO has also published supporting guidance: ISO 45003 (2021) on psychological health and safety at work, and ISO 45002 (2023) with practical guidance on implementing ISO 45001.
🔧 How do you implement ISO 45001 in an industrial organisation?
- Define context and scope - which sites, installations, contractors and processes are included?
- Start from the RI&E - the legally required Dutch risk inventory and evaluation is the natural starting point. For complex installations, use a risk assessment or HAZOP.
- Map legal requirements - Arbowet, the Working Conditions Decree, the Machinery Directive (from 20 January 2027 the Machinery Regulation), NEN 3140 and ATEX rules.
- Select controls using the hierarchy - and record why a higher level was not feasible.
- Manage contractors and procurement - many accidents happen during maintenance by third parties; requirements such as VCA and work permits fall under clause 8.1.4.
- Rehearse emergencies - evacuation, leaks and loss of control systems, including communication.
- Measure and improve - record incidents and near misses, run internal audits and hold a management review.
Certification is carried out by a certification body which, in the Netherlands, is usually accredited by the Dutch Accreditation Council (RvA) against ISO/IEC 17021-1. The initial audit has two stages: a document and readiness review (stage 1) and an on-site audit (stage 2). The certificate is valid for three years, with annual surveillance audits followed by recertification. Clients often ask for the certificate in tenders and supply chains.
📅 What developments affect ISO 45001?
- 2018 - publication of ISO 45001:2018; organisations certified to OHSAS 18001 were given three years to migrate, extended to September 2021 because of COVID-19.
- February 2024 - Amendment 1 requires an organisation to determine whether climate change is a relevant issue when establishing its context.
- 2024–2027 - ISO/TC 283 is revising the standard. The draft (ISO/DIS 45001) was out for ballot from June to September 2026, with publication expected in 2027. Proposed themes include well-being at work, workforce diversity, new ways of working, return to work after injury or illness, and stronger controls on externally provided products and services.
❓ Frequently asked questions
Is ISO 45001 mandatory?
ISO 45001 is a voluntary standard; no Dutch or EU law requires certification. Clients do, however, regularly ask for the certificate in tenders. Statutory duties under the Arbowet, such as the RI&E, apply whether or not an organisation holds ISO 45001.
What is the difference between ISO 45001 and OHSAS 18001?
ISO 45001 replaced the British OHSAS 18001 in 2018. ISO 45001 follows the Harmonized Structure of other ISO management standards, places more emphasis on leadership and worker participation, and considers the context of the organisation. OHSAS 18001 certificates have not been valid since 2021.
How long is an ISO 45001 certificate valid?
An ISO 45001 certificate is valid for three years. During that period the certification body carries out an annual surveillance audit. After three years a recertification audit follows.
What is the difference between ISO 45001 and VCA?
VCA is a Dutch checklist for contractors performing hazardous work and focuses on concrete safety measures at the workplace. ISO 45001 is an international management system standard for the whole organisation. Many contractors hold both, because industrial clients often require VCA.
Does ISO 45001 have anything to do with cybersecurity?
ISO 45001 does not mention cybersecurity, but it does require hazards to be identified systematically. If an attack on or failure of a control system can endanger people, that risk belongs in the OH&S management system. The technical measures then come from standards such as IEC 62443.
Is a new version of ISO 45001 coming?
Yes, ISO/TC 283 has been revising ISO 45001 since 2024. The draft went to ballot as a DIS in 2026 and the final standard is expected in 2027. Certified organisations are then expected to receive a transition period to migrate.
📌 In summary
ISO 45001 helps organisations work systematically and demonstrably towards a safe, healthy and legally compliant working environment. In an industrial context it connects the risk inventory, the hierarchy of controls, management of change and incident investigation with machine safety and OT, supporting risk management, compliance and employee wellbeing.