In short
ISO 45001 is voluntary and does not replace the obligations of Legislative Decree 81/2008: the DVR remains a non-delegable duty of the employer, and the system keeps it up to date.
Article 30 of Legislative Decree 81/2008 presumes that models conforming to UNI EN ISO 45001 meet its requirements for the corresponding parts, but a complete 231 model also needs a supervisory body and a disciplinary system.
An ISO 45001 management system certified by an accredited body is a type A measure in INAIL's OT23 form and earns additional credits on the construction-site credit-based licence.
Consultation and participation of workers at all levels is the requirement that sets ISO 45001 apart and the one where audits most often find weak evidence.
ISO 45001 shares the harmonized structure with ISO 14001 and ISO 9001, so context, documents, internal audits and management review can be handled once for all three.
The risk assessment document (DVR) is mandatory, ISO 45001 is not, but it is the system that keeps that document alive all year round. This guide explains what the standard requires, how it fits with Italy's Legislative Decree 81/2008 and what really changes in your company when you decide to adopt it.
Almost every Italian company with employees has a risk assessment document. Many, however, only open it when an inspection is due, when the occupational physician changes or when an injury forces them to revisit it. ISO 45001 exists to prevent exactly this: it turns health and safety from a binder to be updated into a management system that works every day, with objectives, responsibilities, controls and improvement. In this guide we look at what the standard is and what it is not, how it relates to the DVR, what it requires section by section, how it connects to Article 30 of Legislative Decree 81/2008 and to the 231 compliance model, what concrete benefits it brings (a lower INAIL premium rate, credit-based licence points on construction sites, supplier qualification with customers), how certification works and which mistakes we see most often in audits.
What is ISO 45001 and what is it not?
ISO 45001 is the international standard that specifies the requirements for an occupational health and safety management system. Its purpose is to enable the organization to prevent work-related injury and ill health and to provide safe and healthy workplaces, improving its performance over time. It applies to organizations of every type and size: a 20-person workshop, a construction firm, a services company, a private hospital.
It is a voluntary standard. No Italian law requires a company to be ISO 45001 certified, whereas Legislative Decree 81/2008 imposes a set of precise obligations on every employer. The standard does not replace those obligations: it presupposes them and organizes them within a system.
A management system, not one more document
The most common mistake is to think of ISO 45001 as a manual to be written. In reality the standard asks you to keep a cycle running: understand the context, set policy and objectives, assess hazards and risks, put controls in place, check that they work, correct what does not. It is the same Plan-Do-Check-Act cycle as the other management system standards, applied to health and safety.
That is why ISO 45001 adopts the harmonized structure shared by ISO management system standards: context of the organization, leadership, planning, support, operation, performance evaluation, improvement. If your company already has a quality or environmental system, you will find the same chapters and many shared processes. If you are starting from scratch, our guide on what ISO certifications are gives you the overall picture.
From OHSAS 18001 to ISO 45001
Before ISO 45001, the most widespread reference was OHSAS 18001, which was not an ISO standard. ISO 45001 was published in 2018 and replaced it, with a three-year migration period set by IAF for accredited certifications. ISO presented it as a new and distinct standard, not a revision: it looks much more at the company's interaction with its context, at leadership and at worker participation, whereas the previous approach focused more on the internal management of hazards.
In 2024 the standard received a climate change amendment, common to all ISO management system standards, and a new edition is under development within technical committee ISO/TC 283. When a new edition is published, certified companies have a transition period defined by IAF, so it is worth always checking on the ISO website which edition is in force.
DVR and ISO 45001: what is the difference?
The DVR is a legal obligation; ISO 45001 is a voluntary management system that makes that obligation live and verifiable. Article 17 of Legislative Decree 81/2008 states that assessing all risks and drawing up the document required by Article 28 are non-delegable duties of the employer, together with appointing the head of the prevention and protection service (RSPP). No certification changes this rule.
The DVR takes a snapshot, the system manages
The DVR describes the risks present at a given moment and the prevention and protection measures decided. ISO 45001 adds what is needed to keep that snapshot true: who updates the assessment when a new machine arrives, how a layout change is handled, who checks that measures are actually applied, how results are measured, how a near miss is analysed, how management reviews performance.
In practice the DVR becomes the main input to the system, not its end point. The management system decides when to reopen it, with what data and with whom.
A concrete example
Picture a metal fabrication company with 45 employees. The DVR is complete and signed, training is up to date. In March a new press brake arrives, in June the warehouse is reorganized and two forklift drivers change shifts, in September an operator injures a hand during a die change. Nobody updated the DVR: everyone assumed someone else was doing it.
With an ISO 45001 system, the same sequence takes a different shape. Buying the press brake triggers management of change: risk assessment before installation, a work instruction, specific training. The warehouse reorganization goes through consultation with the workers' safety representative (RLS) and the forklift drivers. The near miss reported in July on the die change is analysed and leads to a procedure before anyone gets hurt. The DVR is always up to date because the system requires it, not because someone remembers.
What does the standard require, section by section?
ISO 45001 asks you to govern health and safety with the same rigour you apply to quality, costs or deliveries. The text of the standard is copyrighted and can be purchased from ISO or UNI; here you will find the substance of the sections without reproducing them.
Context, interested parties and climate
The system starts from an analysis of the context: internal and external factors that affect health and safety (type of work, shifts, contracting, labour market, sector regulations) and the needs of relevant interested parties: workers, the RLS, the occupational physician, customers, contractors, enforcement authorities, INAIL.
With the 2024 climate amendment, common to all management system standards, the company must also determine whether climate change is a relevant issue and consider that interested parties may have climate-related requirements. For occupational safety the link is often very concrete: heat stress on summer construction sites, extreme weather affecting work at height and logistics, emergency plans that need revisiting. ISO and IAF have made clear that the amendment should not turn the audit into a disproportionate climate review: it is to be considered where relevant.
Leadership and worker participation
The standard gives top management overall responsibility for preventing work-related injury and ill health. Signing the policy is not enough: management must ensure resources, integrate safety into business processes and promote a culture in which reporting a hazard is not punished.
This is where ISO 45001 stands out most: it requires processes for consultation and participation of workers at all levels and functions, including those without managerial roles. We cover this in a dedicated section further on, because it is the point where audits most often find weak evidence.
Hazards, risks, opportunities and legal requirements
Planning requires you to identify hazards continually and proactively, assess health and safety risks as well as other risks to the system, and seize opportunities for improvement. The logic of risks and opportunities is common to the other standards: you will find it covered in depth in our guide on risks and opportunities in ISO systems.
An often underestimated point is the management of legal requirements and other requirements. The company must know which obligations apply to it, keep them up to date and periodically evaluate whether it complies. In Italy this means Legislative Decree 81/2008 and its annexes, but also sector rules, State-Regions agreements on training and regulations on equipment and substances. Measurable objectives and a plan to achieve them are then set on this basis.
Support and operation
Support covers resources, competence, awareness, communication and documented information. For safety, competence does not end with the certificate from the mandatory course: you need to show that the person can do that job safely, and that the company checks the effectiveness of training.
Operation is the heart of the system. The standard asks you to eliminate hazards and reduce risks following a hierarchy of controls (eliminate first, then substitute, then engineering and administrative controls, and finally personal protective equipment), to manage change, procurement, contractors and outsourcing, and to prepare for emergencies with periodic drills. In a company that uses many external contractors, contractor management is often the most delicate part.
Performance evaluation and improvement
The company must monitor and measure its performance, evaluate legal compliance, carry out planned internal audits and hold the management review. Indicators are not just injuries and lost days: a mature system also looks at proactive indicators such as near misses reported, inspections carried out, actions closed on time and participation in consultations.
Improvement closes the loop: every incident, nonconformity or near miss must be investigated, with root cause analysis and corrective actions whose effectiveness is verified. Internal audits and the management review work as in the other ISO standards: you will find the details in the guide on ISO internal audits.
How does ISO 45001 fit with Legislative Decree 81/2008?
ISO 45001 fits with Legislative Decree 81/2008 mainly through Article 30, which describes the organization and management model for safety. It is the point where voluntary standard and law meet, and also the one surrounded by the most misunderstandings.
Article 30: the organizational model and the presumption of conformity
Article 30 describes the organization and management model capable of exempting companies from administrative liability. The model must ensure compliance with legal obligations on technical and structural standards, risk assessment, emergencies, first aid, contracting, periodic meetings, consultation of RLSs, health surveillance, training, supervision of procedures, mandatory documentation and periodic checks. It must also provide for recording systems, an allocation of functions with adequate skills and powers, a disciplinary system and a system for monitoring implementation.
Paragraph 5 states that, on first application, models defined in accordance with the UNI-INAIL Guidelines or with UNI EN ISO 45001 are presumed to conform to the requirements of the article for the corresponding parts. The text in force on Normattiva refers to the UNI EN ISO 45001:2023+A1:2024 edition, i.e. the national adoption of the standard including the climate amendment. Paragraph 5-bis also provides for simplified procedures for adopting models in small and medium-sized enterprises.
What exempting effect means, and what it does not
Article 25-septies of Legislative Decree 231/2001 lists among the predicate offences manslaughter and serious or very serious injury committed in breach of occupational health and safety rules. If a serious injury occurs and the company gains an interest or advantage from it (for example savings on safety measures), the entity itself may also be liable, with financial and disqualification penalties.
A suitable and effectively implemented model can exclude this liability. Watch out for two things, though. The Article 30 presumption only applies to the corresponding parts: elements such as the supervisory body and the disciplinary system required by Legislative Decree 231/2001 must be built separately. And the final assessment is up to the judge, who looks at how the model was applied in practice, not at the certificate hanging in reception. ISO 45001 is the most solid technical basis for a 231 safety model, not an insurance policy.
Where law and standard meet
The table helps you see where legal obligations sit within the system.
Obligation under Legislative Decree 81/2008 | Where it lives in the ISO 45001 system |
|---|---|
Risk assessment and DVR (Articles 17 and 28) | Hazard identification and risk assessment, management of change |
Consultation of the RLS (Article 50) | Consultation and participation of workers |
Periodic meeting (Article 35) | Communication, consultation, input to management review |
Training and instruction (Articles 36 and 37) | Competence and awareness, checking effectiveness |
Contract management and DUVRI (Article 26) | Procurement, contractors, outsourcing |
Emergencies and first aid | Emergency preparedness and response, periodic drills |
Periodic checks (Article 30) | Monitoring, evaluation of compliance, internal audit |
What concrete benefits does certification bring?
ISO 45001 certification brings concrete benefits on three fronts: the INAIL premium, access to construction sites and relations with customers and clients. The first benefit, though, remains internal: fewer injuries, fewer stoppages, less time spent chasing deadlines.
A lower INAIL rate with the OT23 form
Every year INAIL, the Italian workplace accident insurance institute, rewards companies that carry out safety improvements beyond legal obligations with a reduction in the average rate. The application is submitted online using the OT23 form, which lists the eligible measures, each classified as type A or type B: to qualify for the reduction you need one type A measure or two type B measures carried out in the previous calendar year.
In the form published on the INAIL website, adopting or maintaining a management system certified to UNI ISO 45001 by an accredited body is a type A measure. The supporting evidence is the certificate bearing the logo of a body accredited for the specific sector, valid for the whole reference year. The reduction is higher for smaller companies, and the benefit depends on being up to date with contributions and complying with prevention rules. Deadlines and conditions change from year to year: always check the current form and completion guide.
Credit-based licence on construction sites
Since 2024, companies and self-employed workers operating on temporary or mobile construction sites must hold the credit-based licence provided for by Article 27 of Legislative Decree 81/2008, issued by the National Labour Inspectorate (INL). The licence starts with an initial score and only allows work above a minimum threshold; Ministerial Decree 132/2024 provides additional credits for certain requirements, including holding a management system certified to UNI EN ISO 45001.
INL note no. 288 of 15 July 2025 sets out how this works: the legal representative or a delegate uploads to the portal the certificate issued by a body accredited by an IAF MLA signatory, with its validity dates, and updates it on renewal. If the certification is suspended, the company must take steps to have the credits removed. The same note also covers certification of the organizational model by joint bodies (organismi paritetici), another route provided for by law.
Customers, tenders and the supply chain
Many clients, especially in industry, energy and major works, ask suppliers for evidence of a safety management system, often in qualification questionnaires. ISO 45001 certification does not remove the client's checks on mandatory documents, but it makes it easier to show that safety is managed in a structured way, and in some tenders it may be a requirement or an award criterion. Always check the tender notice or specifications: that is where you find what is required.
Why does the standard insist on participation and consultation?
ISO 45001 insists on participation because the people doing the work know the hazards sooner and better than anyone else. The standard requires processes to consult workers and involve them at all levels, including those without managerial roles, and to remove the barriers that hold them back: fear of reprisals, language, lack of time, complicated procedures.
Beyond the RLS and the periodic meeting
Italian law already provides precise tools. Article 50 of Legislative Decree 81/2008 states that the RLS is consulted in advance and in good time on the risk assessment and on prevention measures, and may obtain a copy of the DVR. Article 35 requires at least one periodic meeting a year in companies with more than 15 workers, attended by the employer, the RSPP, the occupational physician and the RLS.
ISO 45001 does not duplicate these tools: it uses them as a foundation and asks you to go further. A certification audit looks for evidence that workers are involved in identifying hazards, in incident investigations, in choosing protective equipment and in drafting work instructions. A periodic meeting whose minutes are a carbon copy of last year's is not enough.
How to really capture workers' voices
In the companies we work with, we see simple solutions work. A channel for reporting near misses and hazardous situations, anonymous if needed, with a visible response within defined times. Short department briefings before a change, not after. Involving team leaders in drafting work instructions. Public feedback on closed reports, because nobody reports twice if the first report went nowhere.
In small organizations participation can be direct, without formal committees: ISO itself recognizes this. What matters is that the evidence exists and shows in the results.
How do you achieve ISO 45001 certification?
You achieve certification by building the system, running it long enough to generate evidence and passing the audit of an accredited certification body. Timescales depend on size, number of sites, complexity of risks and starting point.
Initial analysis and scope
The first step is a gap analysis: you compare what the company already does to meet legal obligations with what the standard requires. The starting point is often better than expected: the DVR, appointments, training and health surveillance already exist. What is usually missing is management of change, indicators, internal audit, management review and structured contractor management.
This phase also defines the scope: which sites, which activities, which construction sites. A clear scope avoids surprises at audit.
Building and running the system
You write the policy and objectives, define roles and responsibilities, set up the missing processes and collect records. The system must really run for a few months: the certification body wants to see reports handled, emergency drills carried out, objectives monitored, training checked and contractors controlled.
Internal audit and management review
Before the external audit you need at least one complete cycle of internal audit and one management review. The internal audit checks that the system conforms to the standard and is effectively implemented; the management review brings results, incidents, the status of actions and the decisions to be taken to top management.
Certification audit and maintenance
The certification audit takes place in two stages: the first checks documentation, scope and readiness; the second checks on site that the system is implemented. You will find the differences explained in the guide on stage 1 and stage 2. The certificate follows a three-year cycle with periodic surveillance audits and recertification at expiry. For the OT23 form and the credit-based licence, the certificate must remain valid without interruption, so the audit schedule needs careful management.
Does it make sense to integrate ISO 45001, ISO 14001 and ISO 9001?
Integrating ISO 45001, ISO 14001 and ISO 9001 makes sense when the three standards bear on the same processes, which is very common in manufacturing, construction and logistics. Thanks to the harmonized structure, context, leadership, documents, internal audits and management review can be managed only once for all three.
Safety and environment in particular overlap a great deal: emergencies, hazardous substances, waste, contractor management, legal requirements. A single assessment of aspects and risks per site or department, a single emergency procedure and a single integrated internal audit reduce the workload and, above all, contradictions between systems. You will find the basics in the guides on ISO 14001 and on the integrated management system.
Integration is not mandatory and it does not always pay to do it all at once. A construction company can start with ISO 45001 for the INAIL and credit-based licence benefits, and add quality and environment when clients ask for them.
What are the most common mistakes?
The most common mistakes almost always come from treating ISO 45001 as a paperwork exercise rather than as a way of managing work. These are the ones that come up most often in audits.
A DVR disconnected from the system: the system says one thing, the DVR another, and nobody updated the assessment after the last change.
Participation on paper only: the only evidence of consultation is the minutes of the periodic meeting, with no trace of workers being involved in operational decisions.
Contractors managed only through the DUVRI: documents collected, but no check on how external firms actually work on your premises or sites.
Near misses not recorded: zero reports in a year does not mean zero hazards; it means the channel is not working.
Only reactive indicators: injuries and lost days are counted, but not preventive actions, so the management review has nothing to improve.
Legal requirements not updated: the list of applicable rules is frozen at the date it was written and there is no periodic evaluation of compliance.
Certificate allowed to lapse: a delay in recertification can cost you the INAIL reduction or the licence credits for the reference year.
How to simplify the journey with Complaion
Complaion supports you through the ISO 45001 journey with a dedicated Lead Auditor and a platform that holds the whole system together. The Lead Auditor starts from an analysis of what you already do under Legislative Decree 81/2008 and proposes the path best suited to your company: ISO 45001 alone, or integrated with ISO 14001 and ISO 9001 if you already work on those systems or your customers ask for them.
Throughout the journey the Lead Auditor guides you in building the system, and companies that take the journey with Complaion carry out the internal audit with us: it is conducted by the Complaion Lead Auditor, who does not audit their own operational work, so the audit remains impartial. The platform collects the evidence (meeting minutes, near-miss reports, emergency drills, training certificates), manages the system documents, keeps the schedule of audits and certificates and prepares the certification audit. The Complaion journey avoids nonconformities and leads to the external audit with a 100% success rate.
More than 1,000 clients have already chosen Complaion for their management systems. Discover the ISO 45001 service or contact us for a quote built around your company.
Frequently asked questions about ISO 45001
Is ISO 45001 certification mandatory?
No, ISO 45001 is a voluntary standard and no Italian law requires certification. What is mandatory for every employer are the obligations of Legislative Decree 81/2008, starting with risk assessment and the DVR. Certification can, however, become necessary in practice when a client or a tender requires it, and it brings benefits such as a lower INAIL rate and additional credits on the credit-based licence.
If I have ISO 45001, can I do without the DVR?
No. The DVR remains a non-delegable obligation of the employer, as established by Article 17 of Legislative Decree 81/2008. ISO 45001 does not replace it: it uses it as the basis of the system and ensures it is updated when machines, processes, people or organization change. At audit, a DVR not aligned with the system is one of the most frequent weaknesses.
Does ISO 45001 count as a 231 model?
Not automatically. Article 30 of Legislative Decree 81/2008 states that models conforming to UNI EN ISO 45001 are presumed to conform to its requirements for the corresponding parts. A complete 231 model, however, also needs elements specific to Legislative Decree 231/2001, such as the supervisory body and the disciplinary system, and the final assessment rests with the judge, who looks at actual implementation.
What is the difference between OHSAS 18001 and ISO 45001?
OHSAS 18001 was the reference standard before ISO 45001, which replaced it after publication in 2018 with a three-year migration period. ISO 45001 adopts the structure common to ISO management system standards and gives more weight to context, top management leadership and worker participation. Accredited OHSAS 18001 certifications are no longer valid.
How do you get the INAIL reduction with ISO 45001?
You submit the online application for the reduction of the average prevention rate using the OT23 form, by the deadline INAIL sets each year. A management system certified to ISO 45001 by an accredited body is a type A measure, so on its own it is enough to qualify for the reduction. The certificate must cover the whole reference year and the company must be up to date with contributions and prevention rules.
Is ISO 45001 suitable for a small business too?
Yes, the standard applies to organizations of every type and size and leaves freedom in how to structure the system. In a small business consultation can be direct, without committees, and documentation can stay essential. What counts is evidence that the system works: reports handled, risks updated, objectives followed up.
How much does ISO 45001 certification cost?
The cost depends on factors such as number of employees and sites, type of work and risk level, presence of construction sites, the system's starting point and whether you integrate it with ISO 14001 or ISO 9001. That is why there is no price that fits everyone. The most reliable way to find out is to ask for a tailored quote based on your situation.
