If your occupational health and safety management system still traces its DNA back to OHSAS 18001, it is time for a candid conversation. OHSAS 18001 was formally withdrawn in September 2021. The transition standard, ISO 45001, is now the only internationally recognized standard for occupational health and safety management, and any organization still operating an OHSAS-era system is working from a framework that no longer exists in the eyes of registrars, customers, and regulators.
The difference between ISO 45001 and OHSAS 18001 is more than a change of name and number. ISO 45001 rebuilt the standard on a modern structure, elevated the role of leadership, made worker participation a formal requirement, and shifted the entire mindset from reacting to hazards toward proactively managing risk. This article walks through what actually changed, why those changes matter, and what companies still running legacy safety systems should do next.
The short history: how OHSAS 18001 gave way to ISO 45001
OHSAS 18001 was first published in 1999 and revised in 2007. For nearly two decades it was the default benchmark for occupational health and safety management, but it was never a true ISO standard. It was developed by a consortium of national standards bodies and certification organizations to fill a gap that ISO had not yet addressed.
ISO 45001 was published in March 2018 as the first genuine ISO standard for occupational health and safety. Organizations certified to OHSAS 18001 were given a migration window to transition. That window closed in September 2021, when OHSAS 18001 was officially withdrawn. Certificates issued against it are no longer valid, and accredited registrars no longer audit against it.
In practical terms, an OHSAS 18001 certificate today carries no accredited standing. If your safety system was built around that standard and has not been updated, you are running a management system that the certification world has retired.
Annex SL: the structural change under the hood
The most fundamental difference between ISO 45001 and OHSAS 18001 is invisible on the surface but shapes everything above it. ISO 45001 is built on Annex SL, the common high-level structure that ISO now uses across its major management system standards, including ISO 9001 for quality and ISO 14001 for environmental management.
Annex SL organizes every standard around the same ten clauses: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement, among others. OHSAS 18001 used its own older structure that did not align with these standards.
Why does this matter? Because most organizations do not run a single management system in isolation. A manufacturer might hold ISO 9001, ISO 14001, and ISO 45001 at the same time. Under the shared Annex SL structure, those systems can be integrated into one coherent framework rather than three disconnected sets of binders. Common clauses mean common processes for document control, internal audits, management review, and corrective action. That integration reduces duplication, lowers the cost of maintaining certification, and makes audits considerably less painful. If you already run an ISO 9001 quality system, aligning safety under the same structure is far easier than it was under OHSAS 18001.
Leadership: safety moves into the boardroom
OHSAS 18001 allowed organizations to delegate safety to a management representative, often a single safety officer who owned the system and answered for it. ISO 45001 removed that escape hatch.
Under ISO 45001, top management is explicitly accountable for the effectiveness of the occupational health and safety management system. Leadership must demonstrate commitment, integrate safety requirements into core business processes, provide the resources the system needs, and take an active role in directing and supporting it. Safety is no longer a compliance function parked in a corner of the org chart. It is a leadership responsibility woven into how the business is run.
This shift reflects a hard-won lesson from decades of workplace incidents: safety cultures succeed or fail based on what leadership visibly prioritizes. When executives own safety outcomes, the rest of the organization follows. When safety is delegated and forgotten, gaps appear.
Worker participation: the people doing the work get a formal voice
One of the most significant additions in ISO 45001 is the requirement for genuine worker participation and consultation. OHSAS 18001 touched on consultation, but ISO 45001 makes it a structural requirement rather than an afterthought.
The reasoning is straightforward. The people performing a task usually understand its hazards better than anyone reviewing it from a desk. ISO 45001 requires organizations to consult workers when identifying hazards, assessing risks, and determining controls, and to actively remove barriers that discourage them from participating, including fear of reprisal, language differences, and lack of time.
For non-managerial workers in particular, the standard calls for meaningful involvement in decisions that affect their safety. This is not a box to tick. Auditors will look for evidence that workers genuinely contribute to the system and that their input shapes real decisions.
Risk versus hazard: a shift in mindset
Perhaps the deepest conceptual change is how ISO 45001 frames the goal of the system. OHSAS 18001 was largely hazard-focused and reactive. It concentrated on identifying hazards and controlling them, often after an incident had already revealed the gap.
ISO 45001 is risk-based and proactive. It asks organizations to think in terms of both risks and opportunities, and to understand the broader context in which the organization operates before deciding how to act. That means considering the needs and expectations of workers and other interested parties, anticipating how changes in the business could introduce new risks, and building prevention into planning rather than bolting controls on afterward.
This risk-based thinking mirrors the approach ISO 9001 introduced for quality management. Instead of documenting a fixed set of procedures and hoping they cover every scenario, the organization continually evaluates where things could go wrong and directs its attention accordingly. The result is a safety system that adapts as the business changes rather than one that only responds after something has already gone wrong.
A side-by-side summary
- Status: OHSAS 18001 was withdrawn in September 2021. ISO 45001 is the only recognized international standard for occupational health and safety.
- Structure: OHSAS 18001 used its own older format. ISO 45001 uses the Annex SL high-level structure shared with ISO 9001 and ISO 14001, enabling integrated management systems.
- Leadership: OHSAS 18001 permitted delegation to a management representative. ISO 45001 holds top management directly accountable.
- Worker involvement: OHSAS 18001 mentioned consultation. ISO 45001 requires formal worker participation and the removal of barriers to it.
- Orientation: OHSAS 18001 was hazard-focused and reactive. ISO 45001 is risk-based, proactive, and context-aware.
What companies on legacy OHSAS-style systems should do now
If your organization never formally migrated to ISO 45001, or if your safety system still looks and feels like an OHSAS 18001 program, the practical path forward is clear.
Start with an honest gap analysis. Compare your current safety documentation and practices against the requirements of ISO 45001, clause by clause. In most legacy systems, the biggest gaps show up in the newer requirements: understanding organizational context, demonstrating active leadership involvement, documenting worker consultation, and applying risk-based thinking rather than a static hazard register.
From there, the work usually falls into a few areas. Leadership needs to be brought into the system in a visible, documented way. Worker participation processes need to be built or formalized. Risk and opportunity assessment needs to replace or supplement the older hazard-only approach. And if you already hold ISO 9001 or ISO 14001, this is the moment to integrate safety into a single management system under the shared Annex SL structure rather than maintaining it separately.
None of this requires starting from scratch. A well-run OHSAS 18001 system already contains much of what ISO 45001 asks for. The migration is largely a matter of restructuring existing content, closing specific gaps, and demonstrating the leadership and worker involvement the newer standard expects. Organizations that approach it methodically, ideally with a gap analysis up front, typically find the transition far more manageable than they feared.
The bottom line is that OHSAS 18001 is gone, and the reasons it was replaced still matter. ISO 45001 exists because the older, reactive, delegated approach to safety left too many gaps. Moving to it is not just a certification formality. It is an opportunity to build a safety system that leadership owns, that workers help shape, and that anticipates risk instead of merely responding to harm.
QRC’s ISO 45001 consulting team helps organizations migrate legacy safety systems, close the gaps that matter, and integrate occupational health and safety with existing ISO 9001 and ISO 14001 systems. To see where your current system stands, a structured gap analysis is the right first step. Call (800) 244-5409 or contact us to talk it through.