ISO 45001 Certification UK: How It Works

A principal contractor, a large client or a public-sector framework has probably asked you for ISO 45001 certification. If so, you have hit a quote-based market. Of the UK certification providers we checked, only one publishes a fixed online rate card. That price list covers ISO 9001, ISO 14001 and ISO 27001. It does not offer ISO 45001 at all. For this standard, quote-based pricing is effectively the only route in.

This guide covers what ISO 45001 certification proves, what the standard requires day to day, and how the Stage 1 and Stage 2 audit process works. It also covers what certification realistically costs, using indicative market ranges rather than a price list that does not exist for this standard. And it covers a timing point most guides skip. ISO 45001:2018 remains the current edition. But iso.org says a new edition is expected within the coming months, which changes the question worth asking a certification body before you commit.

What Is ISO 45001 Certification?

ISO 45001 is the international standard for occupational health and safety management systems. It was published as ISO 45001:2018, and ISO reviewed and confirmed it in 2024, so the 2018 edition remains current today. Certification against it does not test your workplace directly. It tests the management system you run to identify hazards, control risk, involve workers and act on incidents. A certification body audits that system. It does not inspect every task or site. That distinction matters for how you use a certificate. ISO 45001 certification is not a substitute for hiring a general health and safety consultancy. It does not replace the legal health and safety duties you already hold as a UK employer. A certified management system supports how you meet those duties. It does not discharge them. Any certification body worth using will tell you the same.

ISO 45001 sits alongside ISO 9001 for quality and ISO 14001 for environmental management. All three are management-system standards, audited the same way by an accredited certification body. If you already hold or are pursuing ISO 9001 certification, the process will feel familiar. It uses the same Stage 1 and Stage 2 structure and the same 3-year cycle, just different subject matter. Businesses in construction, logistics, manufacturing and facilities management are the most common applicants. Their work carries physical risk that clients want managed formally.

A New Edition Is Coming

ISO’s own standard page states plainly that ISO 45001:2018 remains the current edition. It says the standard was reviewed and confirmed in 2024. It also says the standard is expected to be replaced by ISO/DIS 45001 within the coming months. That is unusual candour from ISO, and worth acting on rather than ignoring. In practice, this changes nothing about certifying now. A business that needs ISO 45001 for a tender or client requirement should certify against the 2018 edition today, not wait for a standard with no confirmed publication date. What it does change is the conversation to have with your certification body before you sign anything. Ask directly how they plan to handle the transition window once ISO/DIS 45001 is published. Ask about the timeline for existing certificate holders to move across too.

What the Standard Requires

ISO 45001 sets requirements for how you run health and safety as a management system, not a checklist of physical controls. An auditor wants evidence that the following are genuinely embedded in how your business operates, not written up for the audit and then shelved:

• Hazard identification and risk assessment across your operations, kept current as the work changes.
• A legal compliance register that tracks the health and safety law applicable to your business.
• Worker consultation and participation in identifying hazards and shaping controls, not just management sign-off.
• Operational controls that reduce risk at the point of work, from site inductions to permit-to-work systems.
• Incident investigation that traces root cause and closes out corrective action, not just logs what happened.
• Internal audit and management review on a defined cycle, feeding lessons back into the system.

The Certification Process

Certification follows the same two-stage structure as the UK’s other management-system standards. Stage 1 is a readiness review. The certification body checks your documentation, your legal compliance register and whether your management system is developed enough to be audited. Stage 2 assesses the system in operation. The auditor wants to see hazard identification, worker consultation and incident investigation actually happening, not just documented. A certificate is issued on successful completion of Stage 2. It then runs on a 3-year cycle. Annual surveillance audits in years two and three check the system is still live. A full recertification audit then starts the next cycle.

How many audit days that takes, and so what you eventually pay, is not decided site by site. Accredited certification bodies set audit-day counts from your employee headcount, complexity and number of sites. This follows IAF MD 5, the mandatory document that governs audit time across accredited bodies. That is why every enquiry form, including a certification body’s own, asks how many people you employ before it asks anything else. Our guide to the best ISO certification bodies in the UK covers how to compare quotes once you have that figure.

How Much Does ISO 45001 Cost?

There is no published price list for ISO 45001 in the set of UK providers we checked. The one online provider with a fixed rate card prices ISO 9001, ISO 14001 and ISO 27001. ISO 45001 is not on it. So every quote for this standard comes from an accredited certification body assessing your specific headcount and site count. Indicatively, small businesses typically see first-year totals of £3,000 to £7,000 for one standard including consultancy support, and SMEs £5,000 to £10,000. Both figures are market estimates, not a price you can book online. Our full ISO certification costs guide breaks down how that number is built and what drives it up or down.

Who Actually Needs ISO 45001?

ISO 45001 is not a legal requirement. UK health and safety law applies to your business whether or not you hold a certificate, and no regulator asks to see one. What drives demand is who is asking you for it. Principal contractors want it before subcontracting site work. Large clients increasingly specify it in their supply-chain requirements, particularly in construction, logistics, manufacturing and facilities management. Public-sector procurement frameworks frequently list it as a qualifying criterion, alongside ISO 14001 and ISO 27001. If none of your customers or tenders ask for it, certification is a commercial choice, not an obligation. The cost only makes sense against a specific piece of business it unlocks.

ISO 45001 buys you a certified management system. It is not a shortcut past the health and safety work itself, and not a lower legal bar than you already operate under. If a tender or client has asked for it, start with your employee count. Get more than one accredited quote. Ask each certification body how it plans to handle the move to ISO/DIS 45001 once it lands. Our guides to choosing a certification body and to what ISO certification costs across all four standards cover the two decisions that follow once you know you need it.

Clara Wenslow

Finance & Business Services Editor

Clara analyses SME finance and procurement markets, covering business loans, invoice finance, payroll, and related B2B services. She ensures each comparison and guide is transparent and data-driven.

Reviewed by

Sarah Mitchell

B2B Commerce & Finance Reviewer