A legal register is a list of the laws and other requirements that apply to your business, with a note of what each one means for you and how you comply. ISO 14001 and ISO 45001 both require you to identify your compliance obligations, keep them up to date and evaluate whether you meet them. A register is the simplest way to show an auditor you do.
What goes in a legal register
For each requirement, record:
- The title, such as the Control of Substances Hazardous to Health Regulations 2002.
- Why it applies to you, in one line: "We use cleaning chemicals and adhesives in production."
- What it requires of you in practice, in plain English.
- How you comply: the procedure, assessment, record or person responsible.
- When compliance was last evaluated, the result, and the next review date.
Include "other requirements" too: customer contract terms, landlord conditions, environmental permits, insurers' requirements and industry codes you have signed up to.
Laws most UK small businesses list
- Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999.
- Workplace (Health, Safety and Welfare) Regulations 1992.
- COSHH 2002, Manual Handling Operations Regulations 1992, Display Screen Equipment Regulations 1992.
- RIDDOR 2013, the Health and Safety (First-Aid) Regulations 1981 and the Regulatory Reform (Fire Safety) Order 2005.
- PUWER 1998 and, if you lift loads, LOLER 1998. Work at Height Regulations 2005. Electricity at Work Regulations 1989.
- Environmental Protection Act 1990 (duty of care for waste) and the waste and packaging regulations that apply to you.
- UK GDPR and the Data Protection Act 2018, if you hold personal data, which every employer does.
Evaluating compliance
A register that only lists titles will not satisfy clause 9.1.2 of ISO 14001 or ISO 45001. You need to check, at planned intervals, that you actually comply, and keep evidence. A simple approach is to rate each line compliant, partly compliant or not compliant, note the evidence you looked at, and raise an action for anything less than compliant.
Spread evaluations across the year, or fold them into internal audits, so it is not one big job.
Keeping it current
- Subscribe to updates: HSE e-bulletins, the Environment Agency and gov.uk, and your trade association.
- Review the register at least once a year and when your activities change, for example a new process, product or site.
- Record what changed and when, so the auditor can see the register is maintained.
- Feed changes into your risk assessments, procedures and training.
Frequently asked questions
Is a legal register a legal requirement?
Not in itself. The law requires you to comply; ISO 14001 and ISO 45001 require you to know your obligations and evaluate compliance. A register is the accepted way to do both.
Should I list every regulation that exists?
No. List what applies to your activities, with a reason. An over-long register full of irrelevant law is harder to maintain and tells an auditor you have not thought about it.
How often should compliance be evaluated?
At planned intervals you decide, usually at least annually, and more often for high-risk obligations or where you have previously found a gap.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.