ISO 45001 vs health & safety law — what's the difference?
It is one of the most common misunderstandings in safety: treating an ISO 45001 certificate as if it were legal compliance. They are related, but they are not the same thing — and you need both.
Two different things
ISO 45001 is a voluntary standard. It sets out how to run an occupational health and safety management system, and a certification body assesses you against it. No UK law obliges you to hold it — businesses pursue it for assurance, for tenders and for a structured way to manage safety.
Health-and-safety law is mandatory. In Great Britain the baseline is the Health and Safety at Work etc. Act 1974 and its regulations — such as the Management of Health and Safety at Work Regulations 1999, which require a suitable and sufficient risk assessment. These duties apply to virtually every employer regardless of any certificate, and are enforced by the HSE or local authorities, with real legal consequences.
How they relate
A well-run ISO 45001 system pulls strongly in the direction of legal compliance — evaluating compliance with legal requirements is itself part of the standard, so the system keeps your legal register and checks it. But certification is not a substitute for meeting your duties, and it is not, by itself, a legal defence. You can be certified and still breach the law if the system is not lived; you can meet the law without ever being certified.
The sensible way to see it: your legal duties are the floor you must meet, and ISO 45001 is a structured, externally-assured way to meet them well and prove it. The evidence overlaps almost entirely — risk assessments, competence, incident investigation, corrective action — which is why one system of record can serve both your legal and your certification needs.
Evidence for the law and the standard, once
Complys keeps the risk assessments, competence, incidents and actions that satisfy your legal duties and your ISO 45001 system in one place.
ISO compliance software →FAQs
Is ISO 45001 a legal requirement?
No. ISO 45001 is a voluntary international standard. No UK law requires you to be certified to it. Your legal health-and-safety duties exist independently and apply whether or not you hold the certificate.
So what is the legal baseline in Great Britain?
The Health and Safety at Work etc. Act 1974 and its supporting regulations — for example the Management of Health and Safety at Work Regulations 1999, which require suitable and sufficient risk assessment. These are enforced by the HSE (or local authorities); ISO 45001 is assessed by a certification body.
If I'm certified, am I automatically legally compliant?
Not automatically. A good ISO 45001 system makes legal compliance far more likely and easier to evidence — evaluating legal compliance is part of the standard — but certification is not a legal defence in itself, and the two are assessed by different people against different things.
Related: ISO 45001 requirements checklist and ISO 9001 vs 14001 vs 45001. General information, not legal advice.