Templates and records · ISO 37301 · Clause 4.5
ISO 37301 compliance obligations register template
The living list of everything the company is bound or has committed to comply with, with its source, who it affects and who watches for changes.
In one sentence
The compliance obligations register lists the requirements the organisation must meet —laws, regulations, licences, rulings— and the commitments it chooses to take on —contracts, industry codes—, with their source, the area affected and the person responsible; ISO 37301 requires them to be identified systematically and kept as documented information (4.5).
- Where the standard requires it
- ISO 37301 · Clause 4.5 Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
- Type of information
- Mandatory document Documented information to be maintained (4.5)
- Who fills it in
- Compliance function With legal counsel and the heads of each area, who know their sector-specific obligations
- When
- On an ongoing basis With a full review at least once a year and whenever regulations or activities change
- How long it is kept
- Always current Kept up to date; earlier versions show since when each obligation was known
What the standard requires
What ISO 37301 demands and what it leaves to your judgement
The standard asks for a systematic identification of the obligations arising from activities, products and services, and an assessment of their impact on operations. It separates the requirements that must be met from the commitments the organisation chooses to meet, and both go into the register.
It also requires a process to detect new or changed obligations and assess the impact of the change. A register with nobody keeping an eye on legal developments is out of date within months.
It is the starting point for the 4.6 risk assessment: each compliance risk is identified by matching an obligation with the activity that could breach it.
Structure
Fields the template should include
- Obligation and type: requirement or voluntary commitment
- Source: regulation, article, contract, code or licence
- Activities, processes or areas affected
- Person responsible for meeting it
- How it is met: control or procedure
- Consequence of noncompliance
- Date identified and date last reviewed
- Changes detected and their impact
Example
Example: four obligations of a medical supplies distributor
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Organisation | Distribuciones Arlanza (fictitious) · 220 people |
| Law 2/2023 | Requirement · internal reporting system · System Officer · channel on the employee portal |
| Regulation (EU) 2016/679 | Requirement · protection of customer and patient data · data protection officer |
| Code of ethics of a healthcare industry association (fictitious) | Voluntary commitment · limits on hospitality towards healthcare professionals · sales management |
| Framework contract with a public hospital | Contractual requirement · ban on gifts to procurement staff · sales management |
| Last review | 30 June 2026 |
At the audit
Mistakes auditors commonly flag
- A list of laws that does not say what specific obligation each one imposes, or on whom.
- Voluntary commitments are missing: industry codes of ethics and contract clauses.
- Nobody is assigned to monitor regulatory changes.
- Obligations that do not show up as any risk in the matrix.
In Kimobox
How this record is kept in Kimobox
- 1Compliance obligations are kept as a versioned register.
- 2Interested parties and their compliance expectations are recorded in the same system.
- 3The process map flags the noncompliance risk of each process, linked to its obligations.
Frequently asked questions
What people ask us before getting started
Is it the same as the legal requirements register of ISO 14001 or ISO 27001?
It is broader. Those are limited to environmental or information security matters; this one captures every compliance obligation. If you run several systems, a single register filtered by scope works best.
Should tax obligations be included?
If they fall within the scope of the system, yes. Organisations that also follow UNE 19602 usually keep tax obligations in a separate, more detailed register with its own calendar.
Keep your ISO 37301 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Register of legal and contractual security requirements
How to document the legal, regulatory and contractual security requirements ISO 27001 asks for: GDPR, NIS2…
UNE 19602 tax obligations register template
How to document a company’s tax obligations for UNE 19602: tax, return form, frequency, deadline, owner and…
Context of the organization
The compliance system starts by mapping which legal, regulatory and voluntary obligations apply to the…
ISO 37301 compliance risk matrix template
How to document an ISO 37301 compliance risk assessment: obligation, activity, causes, likelihood…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.