Is ISO 45001 mandatory? The standard, the DUERP and French law

The question comes up systematically with executives discovering the standard: is ISO 45001 mandatory? The answer is clear-cut — no, it is a voluntary certification. But it immediately calls for a second, equally clear answer: occupational risk prevention itself is strictly mandatory in France, with precise legal texts and real sanctions. Untangling the two levels avoids misunderstandings in both directions: believing a certificate is required by law, or believing that without one nothing is owed.

What French law requires of every employer

The French Labour Code places on the employer a general duty of prevention (articles L4121-1 and following): avoiding risks, assessing those that cannot be avoided, combating risks at the source, training and informing workers. This duty applies from the first employee, in every sector — no certification exempts from it, and no absence of certification waives it.

Its documentary centrepiece is the DUERP (document unique d’évaluation des risques professionnels — the single occupational-risk assessment document), governed by articles R4121-1 and following:

• mandatory from the hiring of the first employee, in every company;
• updated at least once a year in companies of 11 or more employees, and in every case upon any significant change in working conditions or when new information about a risk emerges;
• retained, in its successive versions, for 40 years — a requirement introduced by the French law of 2 August 2021 strengthening prevention in occupational health, designed notably for exposure traceability.

Breaches are sanctioned: the absence of the document exposes the employer to criminal fines, and the administration additionally holds administrative fines for certain health and safety breaches. Beyond the fines, it is above all in the event of an accident that the bill comes due: a missing or outdated DUERP weighs heavily in assessing the employer’s liability, civil as well as criminal. Depending on the activity, the prevention plan for external companies working on site, regulatory safety training and periodic equipment inspections come on top.

What ISO 45001 is — and is not

ISO 45001 is the international standard for occupational health and safety management systems, published in March 2018 to succeed the OHSAS 18001 scheme. It is voluntary, generic and certifiable by accredited third-party bodies, over a three-year cycle with annual surveillance.

What it is not: a legal requirement, an exemption from duties, a French administrative label. What it is: the steering framework that turns scattered obligations into a system — policy and objectives, hazard identification, worker consultation, operational control, emergency preparedness, indicators, internal audits, management reviews and continual improvement.

The link with the DUERP perfectly illustrates the complementarity. The DUERP is the legal inventory of risks by work unit; the standard requires precisely a living hazard identification and risk assessment, fed by the field and translated into tracked action plans. A well-built approach therefore has a single risk-assessment foundation: the DUERP, used and kept up to date by the management system. Duplicating — one DUERP “for the labour inspectorate” and one analysis “for ISO” — guarantees inconsistency and costs you at the audit as in court.

Not mandatory, yet required: market pressure

If no law imposes ISO 45001, the market increasingly asks for it. Industrial client organisations, international groups, public and private buyers value — sometimes require — a health and safety certification in their tenders, alongside the MASE scheme in French industry; our comparison ISO 45001 or MASE helps you choose based on your clients. The “obligation” is then contractual: it conditions access to certain markets, not the legality of your business.

Note the variable geometry of this pressure: it concentrates on high-accident sectors (industry, construction, logistics, maintenance) and on subcontracting chains, where the client organisation answers for co-activity on its sites. A small office-based company with no client requirement can legitimately stick to an exemplary legal baseline; a contractor on industrial sites will see the question return at every supplier-qualification round.

This movement has an empirical basis. A Danish study by Madsen and co-authors published in 2022 in Safety Science compared companies holding a certified OH&S management system with the others: certified companies showed significantly more developed prevention efforts than non-certified ones (see the study). For a client organisation, that is exactly what the certificate is for: a verifiable signal that a structured prevention system exists at its contractor.

Special case: safety training and the Qualiopi perimeter

Beware of a frequent confusion in the training sector. Safety training courses (SST first-aid-at-work, manual handling, electrical authorisations) feed a company’s ISO 45001 system — but the provider delivering them falls under an entirely different regime: to access French public and pooled training funds, Qualiopi certification is required, based on the 32 indicators of the national quality framework. A safety-training provider may thus need Qualiopi to sell, while its industrial clients pursue ISO 45001 to prevent. The two logics coexist without overlapping.

In practice: where to start

The right order is always the same:

1. Secure the legal baseline: a DUERP that exists, is up to date and dated; traceable regulatory training; compliant periodic inspections. That is owed, certificate or not.
2. Decide knowingly: certification is justified by your clients, your risks and your need for structure — not by an imaginary obligation.
3. Build on the existing baseline: the DUERP as the single foundation, the standard as the steering layer. Our guide to obtaining ISO 45001 certification walks through the full journey, from gap analysis to certificate.

Take action

To situate your company — legal baseline, real value of certification, steps — consult the full ISO 45001 certification page: status, frequently asked questions and a free ebook to structure your approach starting from the DUERP.