Templates and records · ISO 45001 · Clause 9.1.2
ISO 45001 evaluation of compliance with health and safety law
Having a list of laws is not enough: you need to check, with evidence, that every applicable obligation is met, and put the result in writing.
In one sentence
The evaluation of compliance with health and safety law sets each applicable legal requirement —from Spanish Law 31/1995 and its regulations to industrial installations— against the evidence that it is met, records the result and opens actions where it is not, because ISO 45001 requires compliance to be evaluated at the frequency determined and documented information on the results to be retained (9.1.2).
- Where the standard requires it
- ISO 45001 · Clause 9.1.2 Clauses are cited using the numbering of ISO 45001:2018, the current edition, which includes the 2024 amendment on climate change.
- Type of information
- Mandatory record Documented information to be retained (9.1.2); the register of requirements is maintained (6.1.3)
- Who fills it in
- Health and safety practitioner With maintenance for regulated installations, and HR for training and health surveillance
- When
- At the frequency determined Usually once a year, and whenever applicable legislation changes
- How long it is kept
- Set by the organisation ISO 45001 sets no retention periods (7.5.3). Spanish Law 31/1995 also requires prevention documentation to be kept available to the labour authority (art. 23), so it is wise not to destroy anything while the role or risk it refers to still exists.
What the standard requires
What ISO 45001 demands and what it leaves to your judgement
First, the applicable legal requirements and other requirements —collective agreements, commitments to customers, internal rules— must be identified and maintained as documented information, kept up to date (6.1.3). Then you must decide how often and how compliance is checked, evaluate it, act where necessary and know the compliance status at all times.
The standard requires the results of that evaluation to be retained. A list of laws with “compliant” written next to each one, without evidence, proves nothing: the auditor will ask to see the statutory inspection, the certificate or the record that backs up each answer.
The frequency is up to the company. Many evaluate once a year and also whenever a new rule that affects them comes into force.
Structure
Fields the template should include
- Legal requirement: law, article and specific obligation
- Scope it applies to: site, installation, role
- Evidence of compliance reviewed
- Result: compliant, partially compliant, non-compliant
- Date of the evaluation and who carried it out
- Action where not compliant, owner and deadline
- Next check or expiry date
- Legislative changes identified since the previous evaluation
Example
Example: extract from the 2026 annual evaluation
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Risk assessment (art. 16 of Law 31/1995) | Compliant · assessment reviewed for every role in the last twelve months |
| PPE issue (RD 773/1997) | Compliant · signed issue record; two hearing protectors replaced late |
| Role training (art. 19 of Law 31/1995) | Partially compliant · 4 February starters without role-specific training |
| Action | Train the 4 people before 15 March · HR |
| Health surveillance (art. 22 of Law 31/1995) | Compliant · medical checks offered; signed waivers on file |
| Coordination of activities (RD 171/2004) | Compliant · documentation up to date for the 7 contractors regularly on site |
| Fire extinguisher inspection | Compliant · quarterly check by own staff and annual service by an approved maintenance company |
| Evaluated by | Health and safety practitioner · 20 February 2026 |
At the audit
Mistakes auditors commonly flag
- A legal register copied from a generic list, containing laws that do not apply and missing those that do.
- An evaluation with “compliant” on every row and no evidence noted.
- Non-compliances found that trigger no action at all.
- Nobody tracks new legislation between one evaluation and the next.
- The result never reaches the management review, of which it is one of the inputs.
In Kimobox
How this record is kept in Kimobox
- 1The register of health and safety legal requirements is maintained with validity alerts.
- 2Each requirement links to the evidence behind it: training, PPE, contractor documentation, inspections.
- 3Non-compliances are opened as actions with an owner and a deadline, with an alert if they slip.
- 4The compliance status reaches the management review already aggregated.
Frequently asked questions
What people ask us before getting started
What is the difference between 6.1.3 and 9.1.2?
Clause 6.1.3 requires the applicable legal requirements to be identified and kept up to date; 9.1.2 requires periodic checks that they are being met and the results to be retained. The first is a document that is maintained; the second, a record that is retained.
Can the external prevention service carry it out?
It can prepare the evaluation, but the organisation is responsible for the result and the actions. Someone in the company should review and sign it, because much of the evidence —training, PPE issues, contractors— is held only by the company itself.
Does it include industrial safety regulations?
Yes, insofar as they affect workers’ safety: work equipment, electrical, pressure or fire protection installations, storage of chemicals. They are applicable legal requirements even though they are not in the prevention law.
Keep your ISO 45001 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Performance evaluation
This clause forces safety into real data: accident-rate indicators, incident investigation, internal audits…
ISO 45001 risk assessment template by job role
How to document the risk assessment of each job role under ISO 45001 (6.1.2) and Spanish law: hazards…
ISO 45001 accident and incident investigation template
What an accident or incident investigation report should cover under ISO 45001 (10.2): facts, causes, worker…
ISO 45001 accident rate indicators record
How to measure health and safety performance under ISO 45001 (9.1.1): frequency and severity rates, leading…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 45001:2018 — Occupational health and safety management systems — Requirements with guidance for use ISO · 2018 ed., with Amd 1:2024
- Ley 31/1995 of 8 November on the prevention of occupational risks BOE-A-1995-24292 · Consolidated text
- Royal Decree 39/1997 of 17 January approving the Prevention Services Regulation BOE-A-1997-1853 · Consolidated text