Why Compliance Obligations Matter in an EMS
If you work in environmental management or audit environmental management systems, Clause 6.1.3 is one of the clauses you will spend the most time on. It sits at the heart of what an EMS is actually for: making sure an organisation knows what it is legally and otherwise required to do in relation to its environmental aspects, and that it actually does it.
On this page
The 2026 edition of ISO 14001 brought some meaningful changes to this clause. The structure is tighter, the expectations around documentation are clearer, and the connection between compliance obligations and the rest of the planning process has been strengthened. If you are managing a transition from ISO 14001:2015 or preparing for a certification audit under the new edition, understanding what Clause 6.1.3 now requires is not optional.
This article walks through the clause in plain terms, explains what has changed, and tells you what auditors will be looking for when they sit down with your compliance register.
What Clause 6.1.3 Actually Requires
Clause 6.1.3 requires an organisation to determine and have access to the compliance obligations relevant to its environmental aspects. These obligations fall into two categories.
Legal Requirements
Legal requirements are the non-negotiable ones. In Australia, these include Commonwealth legislation such as the Environment Protection and Biodiversity Conservation Act 1999, state and territory environment protection laws, conditions attached to environmental licences and permits, local government planning requirements, and any other regulatory instrument that applies to how the organisation manages its environmental aspects.
For a manufacturing plant in Queensland, this might include obligations under the Environmental Protection Act 1994, specific conditions in a development approval, and noise or air quality standards set by the Department of Environment and Science. For a civil contractor working on an infrastructure project, it might include conditions in an environmental impact statement, erosion and sediment control obligations, and requirements under a project-specific environmental management plan that has statutory force.
The point is that legal requirements are not generic. They are specific to what the organisation does, where it operates, and what environmental aspects its activities create.
Other Requirements
The second category is what the standard calls other requirements. These are obligations the organisation has committed to voluntarily, but that commitment makes them binding in practice. Common examples include:
- Industry codes of practice or sector-specific environmental standards
- Contractual obligations with clients that include environmental performance conditions
- Requirements from parent organisations or corporate environmental policies
- Voluntary commitments made in environmental policies or public sustainability reports
- Requirements from community agreements or consultation processes
This is where organisations sometimes get caught out. A company might publicly commit to zero liquid discharge or to reporting scope 3 emissions. Once that commitment is made, it becomes a compliance obligation under Clause 6.1.3, and the organisation needs to manage it with the same rigour as a regulatory requirement.
Exemplar Global Recognised Training ProviderRTP No. 310970
What Changed in ISO 14001:2026
The 2015 edition already covered compliance obligations in Clause 6.1.3, so this is not a brand new concept. But the 2026 revision sharpened several aspects that were previously interpreted inconsistently across organisations and certification bodies.
For a full picture of what changed across the standard, the ISO 14001:2026 transition guide covers the key differences between the 2015 and 2026 editions in detail.
Stronger Link to Environmental Aspects
The 2026 edition makes the connection between compliance obligations and environmental aspects more explicit. It is not enough to have a generic legal register. The register needs to demonstrate which obligations relate to which aspects and impacts. An organisation that has identified fuel storage as a significant environmental aspect needs to show that the legal requirements around bunded storage, spill containment, and reporting thresholds are captured and linked to that aspect.
Documented Information Requirements
The 2026 edition is clearer about what needs to be documented. Organisations must maintain documented information on their compliance obligations. This does not mean a single spreadsheet with a list of laws. It means the register needs to be structured well enough to show the obligation, its source, how it applies to the organisation, the responsible person, and the status of compliance.
Keeping Obligations Current
The 2026 edition reinforces the requirement to keep compliance obligations up to date. Legislation changes. Licences are renewed with new conditions. Contracts are renegotiated. An organisation that captured its obligations in 2022 and has not reviewed them since will struggle to demonstrate ongoing conformity. The standard now makes it clearer that this is a live, maintained process, not a one-time exercise.
How Compliance Obligations Feed Into the Rest of the EMS
Clause 6.1.3 does not sit in isolation. The compliance obligations identified here flow through the entire management system.
Planning and Objectives
Compliance obligations are one of the inputs to setting environmental objectives under Clause 6.2. If the organisation has a licence condition requiring it to reduce particulate emissions by 20 percent over three years, that obligation should be reflected in the environmental objectives. Auditors will look for this connection. If the objectives have no relationship to the compliance register, that is a red flag.
Operational Controls
Compliance obligations also drive what operational controls are needed under Clause 8.1. If a permit condition requires a specific monitoring frequency for wastewater discharge, the operational procedures need to reflect that. The compliance register and the operational control documentation should be consistent. When they are not, you have a gap that an auditor will find quickly.
Evaluation of Compliance
The most direct connection is to Clause 9.1.2, which requires the organisation to evaluate how well it is meeting its compliance obligations. The compliance obligations register established under Clause 6.1.3 is the foundation for that evaluation. You cannot evaluate compliance with obligations you have not properly identified.
For a deeper look at how auditors approach the compliance evaluation process, the article on auditing compliance evaluation in ISO 14001 covers the evidence auditors look for and the common gaps they find.
Building a Compliance Obligations Register That Works
The compliance register is the primary documented output of Clause 6.1.3. Here is what a well-constructed register looks like in practice.
Structure and Content
A useful compliance obligations register includes the following for each obligation:
- The source of the obligation (legislation name and section, permit number, contract clause, etc.)
- A plain-language description of what the obligation requires
- Which environmental aspects or activities it applies to
- The responsible person or team
- How compliance is demonstrated (monitoring records, inspection reports, training records, etc.)
- The date it was last reviewed
- Current compliance status
Some organisations combine the compliance obligations register with their legal register for other management systems. This can work if the register is structured to capture environmental obligations specifically and link them to environmental aspects. What does not work is a generic list of laws with no indication of how they apply.
Keeping It Current
The most common nonconformity raised against Clause 6.1.3 is that the register is out of date. Legislation changes without organisations noticing. A practical approach is to assign a specific person to monitor for regulatory changes, subscribe to legislative update services from relevant state environment agencies, and schedule a formal review of the register at least annually, or more frequently in heavily regulated sectors.
During management review, the compliance obligations register should be one of the inputs discussed. If management review minutes show no discussion of compliance obligations, that is another finding waiting to happen.
Contractual and Voluntary Obligations
Organisations often capture legal requirements reasonably well but miss contractual and voluntary obligations. Go back through major contracts and check whether any environmental performance conditions exist. Review your environmental policy and any public commitments. If the policy says the organisation will comply with all applicable environmental legislation and any other requirements it subscribes to, then those subscribed requirements need to be in the register.
What Auditors Look For Under Clause 6.1.3
When an auditor sits down to assess Clause 6.1.3, they are working through a specific set of questions.
Is the Register Comprehensive?
The auditor will cross-reference the environmental aspects register against the compliance register. If the aspects register identifies stormwater runoff as a significant aspect but there are no stormwater-related obligations in the compliance register, that is a gap. They will also ask about the process used to identify obligations. If the answer is that the environmental manager Googled it once, that is not a systematic process.
Is It Current?
The auditor will check when obligations were last reviewed and whether recent legislative changes have been captured. In Australia, state environment protection laws have been subject to ongoing reform in several jurisdictions. An organisation that has not updated its register since 2021 is likely missing something.
Does It Flow Into Operations?
Auditors will trace specific obligations through to operational controls and monitoring. They might pick a permit condition and ask to see the procedure that implements it and the records that demonstrate compliance. If the procedure does not exist or the records cannot be found, the obligation is on paper only.
Is There Documented Information?
The 2026 edition requires documented information on compliance obligations. The auditor will want to see the register itself, evidence of how it is maintained, and records of review. An obligation that exists only in someone's head is not documented information.
For organisations working through the broader planning requirements of the 2026 edition, the article on auditing general planning under Clause 6.1.1 of ISO 14001:2026 provides useful context on how the planning clauses connect.
Common Nonconformities Against Clause 6.1.3
Based on real audit experience, these are the most frequent findings raised against this clause.
- The register has not been reviewed since the initial certification. Organisations set up a compliance register to get certified and then leave it untouched. Environmental laws change. Licence conditions change. The register needs to be a live document.
- Voluntary commitments are not captured. Organisations include legislation but forget that their own policy commitments and contractual obligations are also compliance obligations.
- There is no link between obligations and aspects. A list of laws without any connection to what the organisation actually does is not useful and does not meet the intent of the clause.
- The register is owned by one person with no backup process. When that person leaves, institutional knowledge of the compliance obligations leaves with them. The register should be a documented system, not a personal file.
- Compliance status is not tracked. The register lists obligations but gives no indication of whether the organisation is actually meeting them. That information is needed for the Clause 9.1.2 evaluation.
Exemplar Global Recognised Training ProviderRTP No. 310970Practical Advice for Environmental Managers
If you are responsible for maintaining compliance under ISO 14001, here is what to focus on in light of the 2026 requirements.
Start by auditing your own register. Work through each significant environmental aspect and ask whether every applicable legal requirement is captured. Then go through your contracts and your environmental policy and check whether any commitments have been missed.
Set up a process for monitoring regulatory change. This does not need to be expensive. Most state environment agencies publish legislative updates. A simple calendar reminder to check for updates quarterly, combined with a formal annual review, is enough for many organisations.
Make sure the register is accessible to the people who need it. Operational supervisors managing activities with significant environmental aspects should know what the relevant obligations are. If the register lives only in the environmental manager's laptop, it is not being used to drive operational behaviour.
Document your review process. When you update the register, record who reviewed it, what sources were checked, and what changes were made. This creates the audit trail that an auditor will look for.
Training for Environmental Auditors and Managers
Understanding Clause 6.1.3 in depth is essential for anyone auditing or managing an EMS. Whether you are preparing for an internal audit of your organisation's compliance obligations or building skills to audit EMS compliance as a practitioner, having a solid grounding in how the 2026 edition works makes a real difference.
Audit Workshop offers ISO 14001 internal auditor and lead auditor training that covers the 2026 edition in full, including the compliance obligations clause and how it connects to the rest of the planning and evaluation requirements. The training is built on practical audit experience across a range of industries, not just theory. If you are preparing for the transition or looking to develop your environmental auditing skills, it is worth exploring the available course options at auditworkshop.com.
