ISO 14001 Legal Compliance: Meeting Environmental Obligations
ISO 14001 legal compliance is a non-negotiable requirement of the Environmental Management System (EMS). Clause 6.1.3 of the standard requires organisations to identify, access, and understand the compliance obligations that apply to their environmental aspects. Fail to do so, and your EMS cannot claim conformity. This article explains exactly how to build and maintain a compliance framework that meets the standard.
What Does Clause 6.1.3 Require?
Clause 6.1.3 – Compliance Obligations – states that the organisation shall: “determine the compliance obligations related to its environmental aspects” and “determine how these compliance obligations apply to the organisation.” It then requires the organisation to take these obligations into account when establishing, implementing, and maintaining its EMS.
| Clause Element | Requirement | How to Demonstrate |
|---|---|---|
| 6.1.3 a) | Identify compliance obligations related to environmental aspects | Compliance obligations register (COR) with full list of applicable laws, permits, and voluntary commitments |
| 6.1.3 b) | Determine how obligations apply to the organisation | Cross-reference each obligation to specific environmental aspects and operational processes |
| 6.1.3 c) | Take obligations into account in EMS planning | Include compliance requirements in objectives, operational controls, and resource planning |
Note that ISO 14001 uses the term “compliance obligations” rather than just “legal requirements.” This is intentional: obligations include both mandatory legal requirements AND voluntary commitments such as industry codes of conduct, customer environmental requirements, and corporate sustainability pledges.
Building a Compliance Obligations Register
The compliance obligations register (COR) is the central document for clause 6.1.3. Every organisation must maintain one, and it should be a living document, not a static spreadsheet that is dusted off once a year for the audit.
| Register Column | Description | Example Entry |
|---|---|---|
| Obligation ID | Unique reference number | COR-001 |
| Obligation type | Legal or voluntary | Legal |
| Source | Legislation, permit, code, or commitment | Environmental Protection Act 1990 (UK) |
| Requirement summary | What the obligation says | Duty of care for waste disposal – must ensure waste is transferred to an authorised carrier with a waste transfer note |
| Applicable environmental aspect | Which aspect it relates to | Waste generation (non-hazardous and hazardous) |
| Applicable operational area | Which site, process, or department | Manufacturing facility – Building B |
| Evidence of compliance | What records prove compliance | Waste transfer notes, carrier registrations, site waste audit reports |
| Review frequency | How often to check | Quarterly |
| Responsible owner | Person accountable | Environmental Manager |
Start by listing every piece of environmental legislation that applies to your organisation. Common categories include:
- Emissions and air quality – permits for stacks, fugitive emissions, greenhouse gas reporting.
- Waste management – waste classification, storage, transportation, disposal, and duty of care.
- Water and wastewater – discharge consents, groundwater protection, abstraction licences.
- Hazardous substances – storage, labelling, spill control, and COMAH regulations.
- Energy and carbon – energy efficiency schemes, carbon pricing, and reporting requirements.
- Biodiversity and land use – protected species, habitat regulations, contaminated land.
- Chemicals (REACH, CLP) – registration, classification, labelling, and safety data sheets.
Identifying Legal Requirements
The ISO 14001 standard does not tell you where to find your legal requirements, but clause 6.1.3 obliges you to “determine” them. Reliable sources include:
- Government websites: National environmental agency portals (e.g. UK Environment Agency, US EPA, EU EUR-Lex).
- Legal registers services: Third-party providers that monitor legislation changes and send alerts.
- Industry associations: Trade bodies often provide regulatory briefings for their sector.
- Local authorities: Permits and licences issued by municipal environmental health departments.
- Legal advisors: Environmental law firms or in-house counsel with regulatory expertise.
The key is to have a defined process for scanning for new or amended legislation. Assign someone to review regulatory updates monthly and update the COR within 30 days of a change taking effect.
Compliance Evaluation
Clause 9.1.2 of ISO 14001 requires the organisation to evaluate its compliance with its obligations. This is separate from the identification process and must be done systematically. There are two recognised approaches:
| Approach | Frequency | Method | Output |
|---|---|---|---|
| Routine monitoring | Ongoing / monthly | Operational checks, meter readings, waste ticket reviews | Dashboards, exception reports |
| Periodic compliance audit | Annually (or more often if high risk) | Internal audit against the COR using a compliance checklist | Compliance audit report with findings and corrective actions |
| Third-party verification | Every 1–3 years | External auditor or regulator inspection | Certification audit report or enforcement notice |
Your compliance evaluation must produce records that demonstrate whether or not you are meeting each obligation. If a non-compliance is identified, it must be treated as a nonconformity under clause 10.2 and corrective action must be taken.
Managing Non-Compliance
Non-compliance is not the end of the world, but ignoring it is. ISO 14001 recognises that breaches can happen. What matters is how you respond. Your non-compliance management process should include:
- Immediate containment: Stop the activity causing the breach if it poses an environmental risk.
- Root cause analysis: Use the 5 Whys or a fishbone diagram to identify why the non-compliance occurred.
- Corrective action: Define what will be done to fix the immediate issue and prevent recurrence.
- Effectiveness check: Verify that the corrective action worked within a defined timeframe.
- Management notification: Escalate significant non-compliances to top management as part of the management review process.
Keeping Up with Regulatory Changes
Environmental law is not static. New regulations, amended permits, and evolving case law mean your COR can become outdated within months. A robust regulatory watch process should:
- Monitor government publications and regulatory agency announcements weekly.
- Assess each new or amended regulation for applicability within 30 days.
- Update the COR and communicate changes to affected process owners.
- Re-train staff where new obligations require operational changes.
- Review the management of change procedure annually to ensure it covers regulatory updates.
Frequently Asked Questions
What is the difference between a legal requirement and a compliance obligation in ISO 14001?
A legal requirement is mandatory (statute, regulation, permit). A compliance obligation is broader and includes legal requirements plus voluntary commitments such as industry codes of conduct, corporate sustainability policies, and customer environmental specifications. Both must be included in your COR.
Do we need a compliance obligations register if we have no environmental permits?
Yes. Even organisations without environmental permits have legal obligations: waste duty of care, energy reporting, packaging regulations, and potentially carbon reporting. The COR captures all obligations, not just permits.
How often should the compliance obligations register be updated?
At minimum, review the register quarterly. Full updates are needed whenever new legislation is passed, a permit condition changes, or the organisation adds a new process or product that introduces new environmental aspects.
What records does an ISO 14001 auditor look for to verify legal compliance?
The auditor will ask for: the compliance obligations register; evidence of the method used to identify obligations (e.g. subscriptions to legal databases); compliance evaluation records; non-compliance reports and corrective actions; and proof that compliance is reviewed in management meetings.
Is a legal register the same as a compliance obligations register?
Not exactly. A legal register typically lists only statutory requirements. The COR goes further by including voluntary commitments and by cross-referencing each obligation to specific environmental aspects and operational processes. Your COR may start as a legal register, but it should evolve into the broader document.
What happens if we find a non-compliance during internal audit?
You must log it as a nonconformity, investigate the root cause, take corrective action, and verify effectiveness. If the non-compliance is serious (e.g. an unpermitted discharge), you may also have a legal duty to self-report to the regulator. Your EMS procedure should include escalation criteria.
Get Expert Help with ISO 14001 Legal Compliance
Building and maintaining a compliant EMS takes expertise in both environmental management and regulatory affairs. Our consultants can help you set up your compliance obligations register, conduct gap analyses, and prepare for certification audits.
Prefer instant support? Chat with us on WhatsApp.
