ISO 45001 tender requirements, measured
If you are being told ISO 45001 is what UK health-and-safety buyers require, the notices disagree — and what they ask for instead is cheaper and faster to get.
ISO 45001 is named in 94 notices and only 12.8% of those namings are obligations — the lowest rate of any ISO standard we measure. Constructionline alone appears in 693 notices.
-
Constructionline693 notices, 33.0% obligations
-
NICEIC / NAPIT177 notices, 43.5% obligations
-
SSIP158 notices, 47.5% obligations
-
CHAS126 notices, 42.9% obligations
-
ISO 4500194 notices, 12.8% obligations
-
OHSAS 18001 — withdrawn38 notices, 65.8% obligations
-
SafeContractor29 notices, 9 as obligations
-
Acclaim / Alcumus11 notices, 0 as obligations
Health and safety tender requirements: what the notices say
Before the number, what it counts. We read the published text of each notice — title and description — not the tender pack, which is where certification requirements usually live. So this is a floor: what is said out loud.
With that stated: ISO 45001 is named in 94 notices of 753,797 dated UK notices, and 12.8% of those namings use obligation language. Both halves of that are low — it is neither common nor, when it appears, usually a hard gate.
That is unusual, and it is the opposite of the pattern on the sector standards. ISO 17025 and ISO 13485 are named rarely and demanded hard, because when a lab or a device maker needs one the work genuinely cannot proceed without it. ISO 45001 is named rarely and demanded softly, which means something different: buyers mention it as a preference, or as one item in a list of things they would like to see.
The reason is not that UK buyers are relaxed about health and safety. It is that they have a different instrument for it, and they use that instead. That is the next section, and it is the practical answer to what you should actually buy.
OHSAS 18001 was withdrawn in 2021 — and is still demanded hardest
This is the finding that tells you most about how health-and-safety requirements are actually written.
OHSAS 18001 was the occupational health and safety management standard that ISO 45001 replaced. It was formally withdrawn in 2021 after a three-year migration period. It should have disappeared from procurement documents.
It has not. It is named in 38 notices in our corpus, and 65.8% of those namings use obligation language — the highest rate of any credential in the ISO set, and more than 5 times ISO 45001’s own. The most recent notice naming it was published in 2024 — 3 years after withdrawal.
So the health-and-safety standard UK buyers insist on most reliably is one that no longer exists, and the standard that replaced it is the one they insist on least.
The explanation is mundane and useful: requirement text is copied forward. A specification written in 2016 is reused in 2019, adapted in 2022, and the certification clause survives untouched because nobody on the buying side is auditing it against the standards catalogue. That is not incompetence — it is how procurement documents are actually produced, under time pressure, from the last one that worked.
What UK buyers ask for instead
Health-and-safety assurance in UK procurement runs through scheme membership, not through the ISO standard. This is the practical answer to where your money should go.
Constructionline alone is named in 693 notices against ISO 45001’s 94 notices, and it is demanded as an obligation 33.0% of the time against 12.8%. The schemes win on both measures, and they are cheaper and faster to obtain.
Why buyers prefer the schemes. SSIP-recognised schemes exist to answer exactly one question — is this contractor safe to engage — and they answer it in a form a procurement officer can verify in seconds against a register. Mutual recognition between SSIP members means a contractor assessed once is accepted by many buyers. An ISO 45001 certificate answers a broader question, less specifically, and requires the buyer to read a scope statement to know what it covers.
What that means for spending. If you are a contractor bidding UK public work and choosing where to put a certification budget, the notices point at scheme membership first. ISO 45001 is worth holding where you are already running an integrated management system, or where a specific pipeline of contracts names it — not as a general key to the market.
What ISO 45001 certifies, and what it does not
The distinction matters when you answer, and it is the same distinction that trips people up on every management-system standard.
ISO 45001:2018 certifies an occupational health and safety management system: how you identify hazards, assess and control risk, consult workers, plan for emergencies, investigate incidents and review performance. Its most distinctive requirements are around worker participation and consultation — the standard is unusual in requiring that non-managerial workers are actively involved, not merely informed.
It does not certify that your site is safe. It certifies that a system for managing safety exists and is followed. An organisation with a valid certificate can still have an incident, and an organisation without one can be extremely safe. That is not a criticism of the standard — it is what a management-system standard is — but it is why an evaluator who understands it asks for your incident data alongside the certificate.
It replaced OHSAS 18001 and adopts the same high-level structure as ISO 9001 and ISO 14001, which is what makes the integrated management system practical.
ISO 45001 certification UK: what it takes
We do not publish a price, and the reason is the same one that applies to every certification on this site.
Certification is quoted per organisation by the certification body against headcount, number of sites, the risk profile of your activities and whether you already hold a certificate the auditor can build on. A twelve-person office and a two-hundred-person civils contractor are not buying the same audit, and a single figure covering both fits neither.
Our requirement taxonomy holds cost and lead time deliberately null for all 137 requirements it tracks, and the source records why: an invented “£10k, four months” is exactly the kind of plausible-looking number this project has been burned by. The previous version of this page carried figures of that shape and they have been removed rather than updated.
The integrated management system
Where ISO 45001 genuinely earns its place is as one leg of three, certified against one set of processes.
ISO 9001 (quality), ISO 14001 (environmental) and ISO 45001 (health and safety) share a common high-level structure, so one process set, one internal audit programme and one management review can carry all three. Certifying them together is materially cheaper than three separate projects, and buyers who ask for one commonly ask for all three — which is the strongest practical argument for holding ISO 45001.
How to answer the health and safety question in a bid
Four situations, four different answers. Getting this wrong costs more marks than not holding the certificate.
You hold ISO 45001 and it is asked for. Give the certificate number, certification body, accreditation, scope statement and expiry. Check the scope covers the activity and site delivering this contract — a scope mismatch is a real and frequent failure.
It is scored rather than a gate. Do not merely state it. Evidence what the system does: your hazard identification process, how workers are consulted, an incident you investigated and what changed as a result. Evaluators score the answer, not the certificate.
You do not hold it. Say so plainly and lead with what you do hold — an SSIP-recognised scheme, your accident frequency rate, your RIDDOR record, your training matrix. On the evidence above, that is what most buyers were looking for anyway.
The notice asks for OHSAS 18001. Answer with ISO 45001 and state the succession explicitly, with the withdrawal year. Never leave the evaluator to infer it.
Questions people actually ask about ISO 45001 and tenders
Real questions this cluster surfaces on, answered from the corpus rather than the brochure.
do i need iso 45001 to bid for uk public contracts?
Usually not, and the notices are unusually clear about it. ISO 45001 is the least-demanded ISO standard we measure: it is named in a small number of UK notices and only a small share of those namings use obligation language, which is the lowest rate in the ISO set. What health-and-safety buyers ask for far more often is scheme membership — Constructionline, NICEIC, SSIP-recognised schemes and CHAS all appear in more notices and are demanded harder. If you are choosing where to spend to win public work, the notices point at a scheme first. ISO 45001 earns its place where you are already running an integrated management system, or where a specific pipeline of contracts names it.
is ohsas 18001 still valid?
No. OHSAS 18001 was withdrawn in 2021 after a three-year migration period, and ISO 45001:2018 replaced it. Certificates against it are no longer issued and are not current. What is genuinely strange, and worth knowing before you bid, is that UK notices still ask for it — it remains one of the most forcefully demanded health-and-safety credentials in our corpus, years after withdrawal, because requirement text gets copied forward from earlier specifications. If a notice asks for it, answer with ISO 45001 and state the succession explicitly: name the withdrawal, name the successor, and say you hold it. Do not silently tick the box, because a panel working from a checklist may record a mismatch.
should i get iso 45001 or an ssip scheme first?
For UK public work, the scheme, on the evidence of the notices. SSIP-recognised schemes exist to answer one question — is this contractor safe to engage — in a form a procurement officer can verify against a register in seconds, and mutual recognition between SSIP members means one assessment is accepted by many buyers. They are also cheaper and faster than a management-system certification. ISO 45001 is the better buy when you are certifying an integrated management system alongside ISO 9001 and ISO 14001, when a specific contract names it, or when a private-sector or overseas client expects it. The two are not substitutes in principle; they are substitutes in the specific decision of what wins you UK public contracts soonest.
what does iso 45001 actually cover?
It certifies an occupational health and safety management system: hazard identification, risk assessment and control, worker consultation and participation, emergency preparedness, incident investigation, and performance review. Its most distinctive requirement is around worker participation — the standard requires that non-managerial workers are actively involved rather than merely informed, which is a meaningful difference from the standard it replaced. What it does not certify is that your sites are safe. It certifies that a system for managing safety exists and is followed, which is why an informed evaluator asks for your incident data and accident frequency rate alongside the certificate rather than instead of it.
how long does iso 45001 certification take?
We do not publish a figure, and we would be sceptical of a page that does without naming its source. The honest answer is that it depends on how much of the system you already run: an organisation with documented risk assessments, a working incident process and an existing ISO 9001 system is a long way further along than one starting from scratch, and the audit is only the last step. What we can tell you is the shape of the commitment rather than its length — a certification cycle runs three years, with surveillance audits in years two and three, so the recurring internal effort matters more than the initial project. Get timelines from three UKAS-accredited bodies alongside their quotes.
How we counted
Every figure on this page is read from our corpus when the page loads.
The population. 753,797 UK notices carrying a publication date, from Find a Tender and Contracts Finder under the Open Government Licence v3.0 — the same population the counts are built from, so numerator and denominator cannot drift apart.
The matcher. One extractor, classifier version 5, last full run 1 August 2026, matching notice title and description, storing the sentence each match came from and recording separately whether it uses obligation language. The same matcher powers the Requirements Observatory — a second matcher would be a second truth.
The obligation floor. No percentage is shown for anything named fewer than 30 times; the count is shown instead. The rule is enforced in the data layer, not the template, so no surface on this site can leak a percentage on a handful of notices.
Related reading
ISO tenders
The whole ISO family counted — and where the withdrawn-standard finding sits among the rest.
The ISO 45001 requirement page
The live record: the count, the year series, and real notices with the sentence each demand was found in.
OHSAS 18001, still being asked for
The withdrawn standard’s own record, with the notices that name it.
ISO 9001 tenders
Quality management — the first leg of the integrated management system.
ISO 14001 tenders
Environmental management — the second leg.
UK tender certifications
Every credential class a UK supplier is asked for, including the schemes that outrank the standards.
Sources
- rfp.quest corpus, read live at the moment this page was served. 753,797 UK notices carrying a publication date, from Find a Tender and Contracts Finder under the Open Government Licence v3.0. Counts produced by the extractor at
src/lib/requirements/extract.ts, classifier version 5, last full run 1 August 2026; matches against notice title and description only, each with a stored evidence sentence. Counts are floors; obligation shares suppressed below 30 matches. - ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use, ISO. The standard that replaced OHSAS 18001, which was withdrawn in 2021 after a three-year migration period.
- Managing risks and risk assessment at work, Health and Safety Executive. The UK regulator’s own guidance on the duties a management system exists to discharge.
- Health and Safety at Work etc. Act 1974, legislation.gov.uk. The statutory duties that sit underneath any certification — holding a certificate discharges none of them by itself.
- Safety Schemes in Procurement (SSIP). The mutual-recognition umbrella whose member schemes UK buyers name far more often than the ISO standard.
- Procurement Act 2023, legislation.gov.uk. Conditions of participation, award criteria, and the proportionality test on both.
- UKAS schedules of accreditation, United Kingdom Accreditation Service. Each accredited certification body publishes the schemes and scopes it holds, with an issue date.