ISO 14001 Legal Register Explained: Every Environmental Law Your Factory Must Track

Ask an ISO 14001 auditor which document they want first, and most will give you the same answer: the legal register. Not the policy. Not the manual, if you even have one. The register that lists every environmental law that applies to your factory, what each one demands, and the proof that you meet it. If it is thin, copied, or a year out of date, the auditor starts the rest of the audit already doubting your system. If it is honest and current, the audit feels like a discussion about a factory you actually run.

Short answer: An ISO 14001 legal register is the documented list of a site's environmental compliance obligations under clause 6.1.3 of ISO 14001:2015 — the laws, consents and other requirements that apply to its aspects, each written in plain words with an owner, a date and evidence. It turns "we follow the law" from a claim into something an auditor can check.

What a legal register actually is — and what it is not

Clause 6.1.3 of ISO 14001:2015 asks an organisation to determine its compliance obligations, work out how they apply to its environmental aspects, take them into account when building the system, and keep documented information about them. The legal register is where that work lives. One point surprises first-timers: the standard never uses the words "legal register". The register is simply the tool most companies use to meet the clause, whatever you call it.

Compliance obligations come in two kinds, and the register must hold both. Legal requirements are the ones the law imposes — Acts, rules, consents and authorisations. Other requirements are the ones you have taken on yourself — a buyer's supplier code, a contract clause, a voluntary commitment your company has adopted. Once adopted, the standard treats a voluntary commitment as an obligation like any other. A register listing only Acts is half a register.

The register has a partner clause. Clause 9.1.2 requires you to evaluate, at planned intervals, whether you actually meet your compliance obligations, and to keep the result as documented information. The register without that evaluation is a list; with it, a system.

Start from your aspects, not from a law list

The most common way to build a bad register is to download a long list of environmental laws and paste it in. That gives you fifty rows, half of which do not apply to your site, and no way to tell which half. Building a register from a law list alone is like stocking a first-aid box by buying every medicine in the pharmacy. You need the diagnosis first.

The diagnosis is your aspects register, built in our ISO 14001 documents checklist guide. Walk the site and list every way it touches the environment: the chimney, the drain, the diesel generator, the paint booth, the drums behind the maintenance shed. Each aspect points at the laws that govern it — a chimney at the Air Act and your consent conditions, a drain at the Water Act and your effluent limits, solvent drums at the hazardous waste rules. No aspect, no row. That rule alone keeps the register honest and short enough to maintain. Keep it short.

Work the other way too. Read a draft register back against the aspects and ask what is missing. An aspect with no law, consent or other requirement attached is either genuinely unregulated or a row you forgot. Auditors do exactly this cross-check from the shop floor, not from your desk.

The columns every row needs

A row that says only "Water Act, 1974 — applicable" tells an auditor nothing. Each row needs eight pieces of information, and a register missing any of them will be sent back for rework at Stage 1:

• The law, rule, consent or authorisation, named in full with its year — "Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016", not "waste rules". The year tells you which version you mean.
• The requirement in plain words — what the law asks of you, in one or two sentences a plant manager can grasp without a lawyer in the room.
• How it applies to this site — the specific process, area or waste stream it touches. Generic notes here are the first sign of a copied register.
• The aspect it links to — the row in your aspects register, so the two registers join up.
• The person responsible — a name or a role, not a department. A row owned by "EHS" is owned by nobody.
• The renewal or reporting date — when the consent expires or the return falls due.
• The evidence of compliance — the consent copy, the return filed, the manifest, the test report. A row with no evidence is a wish list.
• The current status — compliant, in progress, or overdue, with the action if not compliant. A register claiming perfection while a return sits unfiled reads as fiction.

Keep the register in a spreadsheet your team can actually open. Auditors notice how long it takes you to find a document. A tidy shared file beats an expensive system nobody updates.

The Indian laws that belong in most factory registers

India's environmental law rests on three Acts and a set of rules made under the Environment (Protection) Act, 1986. The table below covers the entries that appear in most factory registers. Not every row applies to every site — that is the point of the aspects-first rule — but if your site has the aspect and lacks the row, you have a gap.

Two cautions on that table. First, sector rules sit on top of it: a pharmaceutical unit, a tannery and a food plant each carry extra rules, and a register that stops here is incomplete for them. Second, the table is a starting point, not a substitute for checking the current text of each rule and your own consent. Rules are amended — the plastic waste rules in 2018, 2021 and 2022, the e-waste rules replaced entirely in 2022 — and a register built from an old summary quietly goes stale.

Consents and authorisations are obligations too

Many registers list Acts and forget the documents that bind the factory day to day. Consent to establish comes before construction; consent to operate comes before production, and it sets your real numbers: how much you may emit, how much you may discharge, how often you must test. The standard's own guidance lists permits and licences as a source of compliance obligations. Treat each consent as a register row in its own right, conditions spelled out, expiry date tracked.

Your industry's pollution category decides how heavy that row is. The Central Pollution Control Board sorts sectors into red, orange, green and white by pollution index. Red, orange and green units need both consents. White-category units — practically non-polluting, pollution index up to 20 — do not need consent; they intimate the State Pollution Control Board instead. That intimation still belongs in the register, with its date and proof, because "no consent needed" is a conclusion an auditor will want justified, not assumed. And the exemption does not switch off the other laws: a white-category unit generating hazardous waste still needs its waste authorisation.

Consent conditions also change. A consent renewed in June with tighter limits must reach the register in June, not at the next audit — if it still shows the old limits in December, the auditor will find it before you do.

The "other requirements" most registers miss

Now the second half of clause 6.1.3, the part most registers skip. Read your customer contracts for environmental clauses — a buyer requiring segregated waste handling or banning a particular solvent has created an obligation, and it belongs in the register with the contract as evidence. Read your own policy commitments: a promise made to a buyer, a lender or a community group is now an obligation to track. So is an industry code you have signed up to. Each entry follows the same eight columns, with the contract or code named as source instead of an Act.

This is also where the register earns its keep between audits. When a buyer asks what rules you follow, it is your answer. When a new manager joins, it is their induction. When a law changes, it is the single place you update.

Building it in six steps

Take a small metal-finishing unit as an illustration — forty people, a plating line, a boiler, a diesel generator, drums of spent acid. This is a worked illustration, not a client. Step one: walk the site and list aspects — plating effluent, stack emissions, spent acid, rinse water, DG noise, chemical storage. Step two: match each aspect to its law — effluent to the Water Act consent, stack to the Air Act consent, spent acid to the hazardous waste rules, DG noise to the Noise Rules, groundwater to the CGWA permission if the unit runs a borewell. Step three: write each row in the eight-column format, in plain words. Step four: attach the evidence — consent copies, the waste authorisation, the last Form 4 return, the noise readings. Step five: name an owner and a date for every row, with a calendar reminder a month ahead. Step six: run the first evaluation — read the register against the evidence, write the verdict, list the gaps with actions. That evaluation is your first clause 9.1.2 record, and it turns the register from a list into a system.

A first register built this way usually takes a week of part-time work for a small factory. The trap is copying a consultant's template and never walking the site, which produces a register full of another industry's aspects and missing your own.

Keeping it current, and the annual check the standard demands

Law does not stand still, and neither does a factory. Update the register whenever something changes: a new process, a new chemical, a renewed consent, a new rule, a new customer clause. Review it formally before each internal audit and management review, so the habit shows in your records rather than in a last-minute scramble.

Then, at planned intervals, evaluate compliance properly: read the register against the evidence, row by row, and write the verdict down — compliant, in progress, overdue — with the action for anything not compliant. The evaluation does not need a lawyer. It needs someone senior enough to read a consent condition and a test report side by side and say whether they match. A verdict that admits one overdue return and shows it being chased beats one that claims perfection.

For factories weighing ISO 14001, our ISO 14001 guide for factories explains how consent conditions and buyer audits connect to the wider system, and our ISO 14001 cost and process guide sets out the certification journey.

Five mistakes auditors keep finding

First, the copied register — another company's aspects, another sector's laws, nobody in your company able to explain a row. Second, law names without applicability — a row that says a rule applies but never says how or to which process. Third, no owner and no date — rows nobody maintains or renews. Fourth, consents missing entirely — the Acts are listed, but the consent setting your actual emission limits is nowhere in the file. Fifth, the register updated only the week before the audit — a review history that reads as theatre. Fix those five and you fix most of what a Stage 1 document review flags.

What it costs to get this built properly

Our ISO 14001 certification consultancy runs ₹9,999 for the Standard tier (up to 25 employees) and ₹19,999 for Growth (26–100 employees), and building the legal register with you — aspects walk, row writing, evidence check, first compliance evaluation — is part of that work. Certification-body audit fees sit outside it, charged at actuals. The compliance fee calculator puts a number on the wider compliance bill before you start.

Frequently asked questions

Do I need a lawyer to build a legal register? No, not for the register itself. You need someone who can read a law or consent, write what it requires in plain words, and say how it applies to your processes. A lawyer helps when a requirement is genuinely unclear or a notice arrives — not for writing the rows.

How often should the register be updated? Whenever something changes, and formally reviewed before each internal audit and management review. A register reviewed only before the external audit is a common Stage 1 finding, because the review dates give it away.

Can one register cover two sites? Only if the sites genuinely share the same processes, and even then each site needs its own rows for what differs — different consents, waste streams, groundwater permissions. One register with a site column works for a head office and a warehouse. It does not work for two factories making different products.

Does a white-category unit need a legal register? Yes, if it is in an ISO 14001 system. White category removes the consent requirement, not the obligation to know what applies. The register for such a unit is shorter — the board intimation, waste rules where they bite, noise limits, customer clauses — but the clause still requires it.

What if a law does not apply to my site? Leave it out, and keep a short note of why. A register of applicable laws plus a one-page "considered and not applicable" note — e-waste rules for a unit with no electronic products, bio-medical rules for a unit with no clinic — shows the auditor you thought about it. A register that silently omits a law leaves them guessing whether you missed it.

A legal register is not paperwork for its own sake. It is the one document that answers, in plain words, the question every regulator, buyer and auditor eventually asks: which laws apply to this factory, and how do you know you meet them? Build it from your aspects, give every row an owner and a date, and keep it current.