ISO 45001 in Germany: implementing and certifying an OHS management system
Customers ask for the certificate, management wants order in health and safety: what ISO 45001 requires, how to implement an OHS management system step by step and how certification works in Germany.
Last updated on 7 min readAMS Go editorial team
Key points at a glance
- ISO 45001 is the international standard for occupational health and safety management systems; it was published on 12 March 2018, replaced BS OHSAS 18001 and was supplemented in 2024 with requirements on climate change.
- The standard follows the PDCA cycle and the common structure of ISO management system standards; its requirements are set out in clauses 4 to 10, from the context of the organisation to continual improvement.
- Certification is voluntary: an accredited certification body audits in a two-stage initial audit, the certificate is valid for three years, with annual surveillance audits in between.
- ISO 45001 does not replace any duty under the Occupational Safety and Health Act (ArbSchG) or DGUV regulations but organises how they are met; alternatively, accident insurance institutions assess OHS management systems under DGUV Principle 311-002.
What is ISO 45001?
ISO 45001 is the international standard for occupational health and safety management systems. It describes how a company systematically plans, implements, reviews and improves its health and safety in order to prevent work-related injury and ill health. It does not prescribe specific technical safety measures – these still come from laws, ordinances and the rules of the statutory accident insurance institutions.
The standard was published on 12 March 2018 and replaced the British standard BS OHSAS 18001. A three-year migration period applied, which was extended by six months to 30 September 2021 because of the COVID-19 pandemic. In Germany, it now applies as DIN EN ISO 45001:2023 – an unchanged adoption as a European standard. Since an amendment in 2024, every organisation must also determine whether climate change is a relevant issue for its management system.
Structure of the standard: PDCA and clauses 4 to 10
ISO 45001 follows the common structure of ISO management system standards (Harmonized Structure, formerly High Level Structure). Anyone already working to ISO 9001 or ISO 14001 will find the same layout and can share processes such as document control, internal audits and management review. Clauses 1 to 3 cover scope, references and terms; the requirements are set out in clauses 4 to 10:
Clause 4
TopicContext of the organisation
What it means in practiceInternal and external issues, expectations of employees, authorities, the accident insurance institution and customers, scope of the system
Clause 5
TopicLeadership and worker participation
What it means in practiceResponsibility of top management, OHS policy, roles, consultation and participation
Clause 6
TopicPlanning
What it means in practiceHazards, risks and opportunities, legal requirements, objectives and planning of actions
Clause 7
TopicSupport
What it means in practiceResources, competence, awareness, communication and documented information
Clause 8
TopicOperation
What it means in practiceControls following the hierarchy of controls, management of change, procurement, contractors, emergency preparedness
Clause 9
TopicPerformance evaluation
What it means in practiceMonitoring and KPIs, evaluation of compliance, internal audits, management review
Clause 10
TopicImprovement
What it means in practiceInvestigating incidents and nonconformities, corrective action, continual improvement
Behind this is the PDCA cycle: Plan (clause 6), Do (7 and 8), Check (9) and Act (10). Leadership and worker participation (5) form the core, and the context of the organisation (4) the framework.
Consultation and participation of workers
Involving workers carries much more weight in ISO 45001 than in its predecessor OHSAS 18001 – it even appears in the title of clause 5. The standard distinguishes between consultation, i.e. seeking workers' views before a decision, and participation, i.e. involvement in decision-making. This explicitly includes workers without managerial roles. Typical topics:
- identifying hazards and determining controls
- investigating accidents and near misses
- setting objectives and the KPIs to be monitored
- determining training and instruction needs
- removing obstacles, such as language barriers or fear of reprisals for reporting
German companies already have structures for this: the occupational safety committee under Section 11 of the Occupational Safety Act (ASiG), safety representatives (Sicherheitsbeauftragte) and – where one exists – the works council, which has co-determination rights on health and safety rules under Section 87(1) no. 7 of the Works Constitution Act (BetrVG). A management system should use these bodies rather than create parallel structures.
All AMS Go modulesKeep versioned risk assessments, track actions from inspections, accidents and risk assessments in the action plan, and record safety instruction in the training matrix and inspection deadlines in the inspection register – as a basis for internal and external audits.ISO 45001 and legal duties
The standard does not replace a single legal duty. The national foreword of the German edition makes clear that it can only play a supplementary role alongside European and national health and safety regulations. It does, however, help to meet these duties systematically and verifiably:
Risk assessment and documentation (Sections 5 and 6 ArbSchG)
Where it appears in the management systemPlanning: assessing hazards and risks
Suitable organisation and resources (Section 3(2) ArbSchG)
Where it appears in the management systemLeadership, roles and resources
Safety instruction (Section 12 ArbSchG)
Where it appears in the management systemSupport: competence and awareness
First aid and emergency measures (Section 10 ArbSchG)
Where it appears in the management systemOperation: emergency preparedness
Checking effectiveness and adapting (Section 3(1) ArbSchG)
Where it appears in the management systemPerformance evaluation and improvement
The standard also requires organisations to determine their legal requirements and evaluate compliance regularly – in practice usually with a legal register (Rechtskataster). If the certification body finds breaches of health and safety regulations during the audit, it informs the company. A certificate is therefore not a licence but presupposes compliance with the regulations.
Implementing ISO 45001: roadmap in eight steps
- 1
Management decision
Top management decides to introduce the system, appoints a person responsible and provides time and budget. Without visible commitment from management, no management system holds.
- 2
Gap analysis
Compare the existing organisation with the requirements: risk assessments, safety instruction, inspections, safety committee, emergency organisation. Usually what is missing is less the content than a system and records.
- 3
Context, scope and policy
Define sites and activities, identify interested parties and their expectations, assess the climate question and formulate the OHS policy.
- 4
Hazards, legal requirements and objectives
Complete the risk assessments, set up a legal register and define measurable objectives with actions, owners and deadlines.
- 5
Processes and documentation
Define procedures for safety instruction, inspections, contractors, procurement, changes, emergencies and accident investigation – document as much as necessary, not as much as possible.
- 6
Involve and train employees
Train managers on their duties, inform employees and organise consultation and participation through the safety committee, safety representatives and works council.
- 7
Run the system and audit internally
Apply the system in day-to-day work for a few months, collect KPIs, carry out a complete internal audit and correct nonconformities.
- 8
Management review and certification
Management reviews results, objectives and resources. Then – if desired – the certification audit follows.
The certification process
Certification is voluntary. It is carried out by certification bodies accredited for ISO 45001 – in Germany by the German Accreditation Body (DAkkS). The process follows the international rules for certification bodies (ISO/IEC 17021-1):
Stage 1 audit
ContentReview of the documentation, the state of implementation and readiness for the main audit
Timingbefore the stage 2 audit
Stage 2 audit
ContentOn-site check that the system has been implemented effectively – with site tours and interviews with employees
Timingfollowed by the certification decision
Surveillance audit
ContentReview of key elements such as internal audits, management review, incidents and improvements
Timingfirst one no later than twelve months after the decision, then at least once per calendar year
Recertification
Contentrenewed full assessment of the system
Timingbefore the three-year validity expires
Certification bodies usually expect internal audits and a management review to have been completed by the stage 2 audit. The company corrects any nonconformities found through corrective action; major nonconformities must be resolved before the certificate is issued.
Is ISO 45001 worth it? Benefits, effort and alternatives
- Clear responsibilities and fewer missed deadlines, because duties are anchored in fixed processes
- Evidence for customers, parent companies and in tenders
- An overview of legal duties, because they are identified and evaluated regularly
- Shared processes and audits with ISO 9001, ISO 14001 or ISO 50001
On the other side are the internal effort for setting up and maintaining the system, training and internal audits, plus the fees of the certification body. Certification bodies calculate audit days based on the number of employees, sites and the level of hazards – so a reliable quote is only available on request.
Checklist: ready for the certification audit?
- Scope, context and interested parties determined
- Climate change assessed as an issue and decision justified
- OHS policy and measurable objectives approved by management
- Risk assessments complete and up to date
- Legal requirements identified and compliance evaluated
- Consultation and participation of workers organised
- Internal audit carried out and nonconformities addressed
- Management review completed and documented
Free templates for this guide
As PDF and Excel, free – to use in your own company.
Frequently asked questions
Is ISO 45001 mandatory?
No, certification is voluntary. What is mandatory are the requirements of the Occupational Safety and Health Act, ordinances and DGUV regulations – ISO 45001 helps to meet them systematically. Customers or clients can, however, require a certificate by contract.
How long is an ISO 45001 certificate valid?
Three years from the certification decision. Surveillance audits take place in between – the first no later than twelve months after the decision, then at least once per calendar year. Recertification is required before it expires.
What is the difference between ISO 45001 and OHSAS 18001?
ISO 45001 replaced the British standard BS OHSAS 18001 in 2018; since the migration period ended on 30 September 2021, there have been no accredited OHSAS certificates. ISO 45001 follows the common structure of ISO management system standards and involves management and workers more strongly.
Who can certify to ISO 45001?
Certification bodies accredited for this field – in Germany by the German Accreditation Body (DAkkS). Before appointing one, check that the body's accreditation covers ISO 45001; the DAkkS publishes accredited bodies in a database.
Terms from the glossary
This guide gives a general overview of German occupational safety law and does not replace legal advice. The regulations in force and the rules of the statutory accident insurance institutions are authoritative.
Organise occupational safety digitally
With the occupational safety software AMS Go you handle risk assessments, safety instructions, inspections and more in one system – mobile and with AI support.
Newsletter
Occupational safety, straight to your inbox
New templates, guides and changes to regulations – free from AMS Go. The newsletter is in German. You can unsubscribe at any time via the link in every email.
