ISO 45001:2018Occupational health and safety management systems
ISO 45001 sets out how an organization prevents injury and ill health at work. It asks you to find the hazards in your work, reduce the risks, involve workers in the decisions and learn from incidents, and it covers everyone working under your control, including contractors. The current edition is ISO 45001:2018.
01At a glance
- Standard
- ISO 45001:2018
- Subject
- Occupational health and safety management systems
- Certificate
- Issued by AQC Group. Valid for three years, with a surveillance audit each year.
- Facts checked
- 9 October 2026, against iso.org
Who it is for
- Factories and workshops with machinery, chemicals, noise or heat
- Construction, engineering and maintenance contractors
- Contractors whose clients ask for a certified safety system before work starts
- Food plants with knives, hot surfaces, wet floors and cold stores
- Hospitals with sharps, manual handling, chemicals and exposure to infection
- Warehouses and transport operations with vehicles and lifting
02What you gain
What certification to ISO 45001 gives you
Meet client and tender requirements
Clients who let contractors onto their sites often ask for evidence of a safety management system. Certification to ISO 45001 is a recognized form of that evidence.
Hazards controlled before someone is hurt
Hazards are looked for in a planned way, and near misses are reported and acted on. The standard cannot promise that no accident will happen, but it puts the means of prevention in place.
Legal obligations tracked
You keep a list of the health and safety legal requirements that apply to you and check at planned intervals that you meet them.
Workers involved
Workers are consulted on hazards, controls and the findings of incident investigations. The people closest to the work know where it is dangerous, and the standard makes sure they are asked.
Incidents that lead to change
Each incident and near miss is investigated for its cause, and the action is followed to a close. The same accident is less likely to happen twice.
03What it asks of you
What ISO 45001 asks you to have in place
In plain terms and in our words, not the standard's. The standard itself is the authority, and you will need a copy.
Context, workers and scope
Decide which sites, activities and people the system covers. Note the issues that affect health and safety in your work. List what workers and others, such as clients, regulators and contractors, expect of you.
Leadership and worker participation
Top management takes responsibility for preventing injury and ill health and issues a health and safety policy. Workers who are not managers must be consulted and able to take part: in identifying hazards, choosing controls, investigating incidents and setting objectives. You provide the time and the means, such as a safety committee or worker representatives, and you remove obstacles such as fear of blame for reporting.
Hazards, risks and legal requirements
Identify hazards in a planned and continuing way. Cover routine and occasional work, machinery, substances, work at height, vehicles, workload, past incidents and possible emergencies. Assess the risks and record how you did it. Identify the legal requirements that apply to you and keep the list current.
Objectives and plans
Set health and safety objectives, each with actions, an owner, a date and a way to measure it. Examples are fewer manual handling injuries, or guards fitted to every machine by a set date. Plan how the actions fit into daily work.
Competence, awareness and communication
Show that workers are competent for the tasks they do, including the ability to recognize hazards. Make sure each person knows the policy and the hazards and controls that concern them. People must know that they may step away from work they believe is seriously dangerous, and that they will not be punished for it. Decide what you communicate, to whom and how, including to contractors and visitors.
Controlling the work
Reduce risk in an order of preference. First remove the hazard. If that is not possible, replace it with something safer, then use engineering controls such as guards and ventilation, then procedures and training. Personal protective equipment comes last. Assess a change, such as a new machine, chemical or shift pattern, before you make it. Control contractors on your sites and consider safety in what you buy.
Emergencies
Plan for fire, serious injury, chemical release and the other emergencies that could happen in your work. Provide first aid, train people, hold drills and keep the records. Review the plan after each drill or event.
Monitoring, incidents and improvement
Monitor what matters: inspections, exposure measurements where they are relevant, incidents and near misses, progress on objectives. Evaluate at planned intervals whether you meet your legal obligations. Investigate incidents for their causes, with workers involved. Run internal audits and management reviews, and follow actions to a close.
04The audit
How certification to ISO 45001 works
Application and quotation
You tell us your scope, sites and headcount. We quote the audit days the standard's rules require.
Stage 1 audit
A review of your documented system and your readiness. You get a list of anything to settle before stage 2.
Stage 2 audit
The auditor follows your processes on site and samples records, to see that the system is in use and works.
Decision
Nonconformities are answered, the file is reviewed independently of the audit team, and AQC Group issues the certificate.
Surveillance and recertification
A shorter audit in each of the next two years, then a full recertification audit in the third.
What the auditor looks at
- Hazard identification and risk assessments, compared with the work the auditor sees on site
- Evidence that workers are consulted: committee minutes, and interviews with workers where they work
- Incident and near miss reports: whether the investigation reached a cause and the action was completed
- Controls in practice: guarding, permits to work, lifting equipment, chemical storage, protective equipment
- Control of contractors, from selection to supervision on site
- The register of legal requirements, the evaluation of compliance, emergency drills and first aid
What affects audit time
- The number of workers, including contractors working under your control
- The level of risk in the work: construction or chemical processing needs more audit time than office work
- The number of sites, temporary sites and shifts, since night and weekend work may need to be seen
- Whether ISO 9001 or ISO 14001 is audited in the same visit
05Often combined with
Standards audited alongside ISO 45001
Standards that share a structure can be audited together, in one visit and against one set of documents.
06Questions
Questions about ISO 45001
Is ISO 45001 being revised?
ISO is revising the standard, but nothing has changed yet. Voting on the draft closed in September 2026, and ISO's catalogue says the new edition is expected in the first half of 2027. It is not published, and no transition dates have been set.
ISO 45001:2018 is the current edition, and an organization that applies now is audited to it. When ISO 9001 and ISO 14001 were revised in 2026, certificates to the earlier editions stayed valid for a three-year transition period.
A tender still asks for OHSAS 18001. What should we do?
OHSAS 18001 was not an ISO standard. ISO 45001 replaced it in 2018, OHSAS 18001 was withdrawn, and certificates to it stopped being valid in 2021. No accredited certificate to OHSAS 18001 can be issued today.
If a tender or an old supplier form still names it, ask the buyer to confirm in writing that certification to ISO 45001:2018 meets the requirement.
How is ISO 45001 different from ISO 14001?
ISO 14001 is about your effect on the environment. ISO 45001 is about the health and safety of people at work. The structure is the same and many parts can be shared, but the core work differs: environmental aspects and impacts in one, hazards and risks to people in the other.
ISO 45001 also puts more weight on one thing: workers must be consulted and must be able to take part in decisions about their own safety.
We already follow the safety law. What does ISO 45001 add?
Meeting the law is the starting point, and ISO 45001 does not replace it. The standard adds a management method: hazards identified in a planned way, objectives, consultation with workers, investigated incidents, internal audits and management review.
Certification gives a client independent evidence that the method is in place. It is not a statement that you comply with every law, and it is not a guarantee that no accident will happen. Check the legal requirements that apply to you.
Can a small contractor be certified to ISO 45001?
Yes. The standard has no minimum size. A small contractor's system can be short: a risk assessment for each type of job, a way of briefing the crew before work starts, records of training and equipment checks, a way to report incidents, and a regular review by the owner.
Temporary sites are part of the audit. The auditor will normally need to see work in progress, so tell us where your work is taking place when you ask for a quotation.
What records will an auditor ask for?
Expect to show risk assessments, the register of legal requirements, training and competence records, inspection and maintenance records for equipment, permits to work where you use them, incident and near miss reports with their investigations, evidence that workers were consulted, emergency drill records, internal audit reports and management review records.
The auditor will also walk the site and talk to workers. What people do and say counts as much as what is written.
Ask about ISO 45001 for your organization.
Tell us your scope, your sites and how many people work in them. We will tell you what the audit involves.