ISO 45001: The Complete Guide to Occupational Health and Safety Management System Certification (2026)

The request for an ISO 45001 certificate usually arrives from the outside: a tender committee wants proof that occupational safety is under control, an international customer sends a supplier questionnaire, a general contractor won't let you on site without evidence of systematic risk management. ISO 45001 is the international standard for occupational health and safety management systems (OH&S management systems, often shortened to OHSMS). It describes how to build a system that spots hazards before an incident, rather than investigating the aftermath.

If you had to answer "what is ISO 45001?" in one paragraph: the standard doesn't duplicate labour protection legislation and doesn't boil down to logbooks and safety briefings. It demands a managed system. Identify the hazards in your processes, assess the risks, plan protective measures, train your people, and check regularly that all of it actually works. What exactly to control is up to the company, based on its own processes.

The current edition is ISO 45001:2018, published in March 2018. It's the first international ISO standard for occupational health and safety management: before it, companies certified against the British OHSAS 18001. The transition ended in September 2021, and OHSAS 18001 certificates have been invalid since. If your system was built on the old logic, start with our breakdown of the differences between OHSAS 18001 and ISO 45001, which covers exactly what changed.

By the number of valid certificates, ISO 45001 is now the third most widespread management system standard in the world after ISO 9001 and ISO 14001. The logic is simple: businesses have certified quality and environmental management for decades, while systematic workplace safety became a market requirement relatively recently, and it's catching up fast.

The standard is built on the PDCA cycle: plan, do, check, act. That sounds abstract, so here's a warehouse example. The company identifies a hazard: forklifts and pedestrians share the same routes. It assesses the risk: a collision is likely and the consequences are severe. It plans controls: separate the flows with floor markings, install mirrors at blind corners, cap the speed. It implements them, and a month later it checks: are people keeping to the routes, were there any near misses? If not, the cycle runs again with new inputs. That's what a system is: a permanent mechanism, not a one-off campaign before an inspection.

The second pillar is worker participation. ISO 45001 explicitly requires consultation mechanisms: people are involved in risk assessment and have a clear channel to report a hazard without fear of punishment. The reason is pragmatic: a machine operator knows more about the real hazards of their workstation than any safety engineer who walks the floor once a week.

The third pillar is the risk-based approach. Classic labour protection in Ukraine was built for decades around prescriptions: tick every box on the list and, formally, you're fine. The standard flips that logic: first assess what could actually happen in your processes, then build protection around those scenarios. Incidentally, the same model sits at the heart of the draft law on workplace safety, which we'll get to below.

Formally, the standard is voluntary. In practice, there are four situations where working without an ISO 45001 certificate gets noticeably harder.

First: manufacturing sites with real risks, such as machinery, shift work, hazardous operations, and in-plant transport. Here the system delivers a direct operational effect: fewer incidents, fewer stoppages, more predictable processes. Insurers and customer auditors look at it favourably too.

Second: construction and installation companies. General contractors increasingly require subcontractors to prove a working safety system, because an injury on site means stopped work, inspections, and blown schedules. The certificate becomes a pass to large projects; without it, you simply don't qualify.

Third: logistics and warehousing, with forklifts, high-bay storage, loading yards, and rotating shift crews. The risks here are less obvious than on a construction site, but incident statistics in the sector stay stubbornly high, and large shippers know it.

Fourth: tender participation and work with corporate customers. In procurement run by energy companies, international groups, and donor organisations, a certified OH&S management system regularly appears as a qualification criterion. For exporters and contractors of international businesses it's effectively a standard requirement now, not a competitive edge.

And who doesn't need it? The honest answer: if you run a ten-person office with no production processes and no customer is asking for the certificate, start with basic legal compliance. A system built for the sake of a frame on the wall won't pay for itself.

ISO 45001 follows Annex SL, the single high-level structure (HLS) shared by all modern management system standards. Clauses 1 through 3 are technical: scope, normative references, terms. The requirements an auditor checks start at clause 4. If your company already runs ISO 9001 or ISO 14001, the structure will feel familiar down to the clause numbering, which makes integration noticeably easier and cuts the volume of new documentation.

One practical nuance for your preparation: the auditor doesn't test your knowledge of the standard's text; they check how each clause's requirements are implemented in your processes. So read the table below not as a summary of contents but as a map of what the auditor will look for on site.

Most of the practical work hides in clauses 6 and 8: this is where the hazard register, the risk assessment, and the hierarchy of controls appear, running from eliminating the hazard and substituting the process through engineering and administrative measures down to personal protective equipment. PPE sits at the bottom of that hierarchy, which is the shortest possible explanation of the difference between a system and the habit of "we handed out hard hats, so safety is covered".

An official Ukrainian version exists. DSTU ISO 45001:2019 "Occupational health and safety management systems. Requirements with guidance for use" is the national standard adopted as an identical translation (IDT). It contains no additional or modified requirements: it's the same ISO 45001:2018 under a national designation, and the different years refer only to the adoption dates.

The practical takeaway: there's no such thing as certifying "separately against DSTU" and "separately against ISO". The certification body issues one certificate of conformity, and it works equally in a Ukrainian tender that says "DSTU ISO 45001:2019" and in a European customer's questionnaire that says ISO 45001:2018.

What genuinely deserves your attention is the certification body's accreditation. For international recognition, the body must operate under an accreditation within the IAF system: in Ukraine that's NAAU, abroad it's the national accreditation bodies of member countries. A certificate from a "body" that appears in no registry will be rejected by any serious customer, no matter how many stamps it carries.

And here's the answer to the popular query about ISO 45001 in Ukrainian: the official DSTU text is sold through UkrNDNC, the national standards body, and it's paid, just like the original on the ISO website. The PDF copies floating around the internet are fine for a first look, but implementation requires a legal, current text.

The road from decision to certificate takes anywhere from three or four months to a year, depending on company size, the number of sites, and the starting point. The steps themselves are the same for everyone.

Start with an honest answer to "where are we now". A gap analysis compares existing practices against the standard's requirements: what already works, what exists only on paper, what's missing entirely. A convenient format is a pre-certification readiness assessment: it produces a list of gaps and a realistic work plan. This is also where the OH&S system's scope gets fixed: which sites, processes, and categories of personnel are covered, and how contractors are handled.

The heart of the whole system. The team walks the processes and records hazards: machinery, work at height, electricity, chemicals, transport, plus organisational factors like fatigue or lone working. Each risk is scored by likelihood and severity, producing a prioritised register. A tip from practice: involve people from the shop floor, don't rely on the safety engineer alone. Real hazards are visible from the workstation, not from an office.

Policy, objectives, operational control procedures, contractor permit rules, emergency response plans. The standard doesn't prescribe a page count: you need exactly as many documents as it takes to keep things managed. If you're short on hands, this phase is covered by implementation consulting, with one condition: procedures must reflect real processes. Beautiful but invented documentation falls apart on the first day of a certification audit.

People need to understand their role in the system: from the director, who owns leadership, to the operator, who knows the channel for reporting a hazard. Then an internal audit checks the system end to end, and a management review confirms readiness for the external assessment. Nonconformities at this stage are working material: better to find them yourselves than to hear about them from the certification body's auditor.

The certification body works in two stages. Stage 1 reviews documentation and readiness: is the system mature enough for a full audit at all. Stage 2 is the on-site assessment: site walkthroughs, interviews with employees, sample checks of records. Any nonconformities found are closed through corrective actions within agreed deadlines. If you want backup at this stage, there's certification audit support, from interview rehearsals to handling nonconformities.

Once nonconformities are closed, the body issues a certificate valid for three years. Every year there's a surveillance audit checking that the system is alive: the risk register is current, incidents get investigated, objectives get met. Year three brings recertification. A system that gets "mothballed" right after the certificate arrives starts cracking at the very first surveillance visit.

No honest contractor will quote an exact price without diagnostics, so treat "turnkey for a fixed fee" advertising with scepticism. The budget consists of three independent parts.

First, preparation: gap analysis, documentation development, implementing controls, training people. The main factor here is the starting point. A company with a valid ISO 9001 gets through preparation faster and cheaper: the shared Annex SL structure lets you extend existing procedures instead of writing everything from scratch.

Second, the certification body's audit. Its price is tied to auditor man-days, which the body calculates using the IAF MD 5 methodology: headcount, number of sites, and process risk level all feed in. For a compact single-site plant that usually means a few auditor-days across both stages; for a multi-site business, several times more.

Third, maintaining the system: annual surveillance audits, internal audits, keeping the risk assessment current. This line item lives for all three years of the certificate, and it's the one most often left out of the budget. Another line that tends to fall out of the estimate is instrument measurements: if your risk assessment relies on measured levels of noise, dust, or lighting, you'll need protocols from an accredited laboratory, because the auditor won't accept eyeball estimates.

As for timelines, the market benchmark looks like this: a compact company of up to 50 employees with one site gets there in three to four months, a manufacturer with 200 to 300 people in six to nine, and a multi-site business plans on a year. That's an observation from practice, not a guarantee: the real schedule emerges after diagnostics. But a promise of "certificate in two weeks" should be read literally: nobody intends to build a system in that time.

Alongside market demands, a legislative reform is in motion. Registered in the Verkhovna Rada is bill No. 10147 "On Safety and Health of Workers at Work", intended to replace the 1992 law "On Labour Protection". As of mid-2026, the document has passed its first reading (August 2024) and awaits the second. In other words, it's still a bill, not an effective law, and the final text may change.

The bill's core novelty is a risk-based approach modelled on the EU Framework Directive 89/391/EEC: the employer assesses the risks in their own workplaces and builds protection around them, instead of mechanically following uniform prescriptions. Recognise the logic? It's the same model ISO 45001 stands on. The standard is, in effect, the world's most field-tested tool for implementing exactly this approach.

The practical conclusion is a cautious one: there's no point waiting for the law to pass before starting. A company already running ISO 45001 is meeting the future requirements in advance, with risk assessment, training, and incident investigation already systematic. We'll publish a deeper analysis of the reform as a separate piece once the text takes its final shape.

The first and most expensive: a paper system. Documents were ordered from a consultant, binders sit on the shelf, and the processes live a separate life. A Stage 2 auditor uncovers this within an hour: it's enough to ask an operator how to report a hazard and watch their face.

The second: treating the OH&S system as one department's project. When only the safety engineer works on the system and production "has no time for it", no management system emerges. There's a reason the standard put leadership into its own clause: without top management involvement, everything slides into formality.

The third: ignoring contractors. Clause 8 explicitly requires controlling the risks contractors bring. In practice, contractors account for a tangible share of incidents: other people's habits, your territory, your liability.

The fourth: a formal risk assessment. A hazard register copied from an internet template doesn't reflect the company's actual processes. A risk assessment done without setting foot on the shop floor is the top candidate for a nonconformity during the certification audit.

The fifth: stopping after the certificate. The register isn't updated, near misses go unrecorded, corrective actions hang open for years. Such a system degrades within a year, and the surveillance audit will show it.

This guide gives you the overall picture. Topics that fit into a paragraph or two here get their own hands-on articles in the Ekontrol blog:

• how to build an OH&S management system: what elements the system consists of and a six-step plan to build it on your own processes;
• the risk-based approach to workplace safety: hazard identification, the 5×5 risk matrix, a living risk register, and the hierarchy of controls;
• the ISO 45001 audit: how to prepare for certification: internal audit, Stage 1 and Stage 2 through the auditor's eyes, common nonconformities, and a preparation checklist;
• the differences between OHSAS 18001 and ISO 45001: what changed in the standard's structure and logic if your system dates back to the old scheme;
• an integrated management system for ISO 9001, ISO 14001 and ISO 45001: how to combine three standards on the Annex SL framework without tripling the paperwork;
• draft law No. 10147 on worker safety and health: what the new law means for business and why the risk-based approach is set to become the norm.

Read in any order: start with the piece that answers your most immediate question.

The Ekontrol team has been preparing companies for management system certification since 2014 and works as a Bureau Veritas partner in Ukraine. The cooperation scheme is simple: diagnostics of the current state, an implementation plan tailored to your processes, documentation developed together with your team, training, internal audit, and support during the certification audit. We don't do "turnkey certificates in three days"; we build systems that pass an accredited body's audit and keep working after it.

The most frequent requests in the occupational safety practice: ISO 45001 certification from scratch for tender participation, rebuilding legacy systems left over from OHSAS 18001, and integrating the OH&S system with existing ISO 9001 and ISO 14001. If your case sounds similar, discuss the project with an expert: the first consultation is free and comes with no strings attached.