![\"Diagram](\"https:\/\/aec.llc\/blog\/wp-content\/uploads\/2026\/03\/7-1024x683.png\")
<\/figure>\n\n\n\nWhat Clauses 6.1.3 and 9.1.2 Actually Require<\/h2>\n\n\n\n
Clause 6.1.3 is not a documentation exercise. It requires four things: identify legal and other requirements related to your environmental aspects, determine how they apply, account for them across the EMS, and maintain documented information. The word “maintain” is doing the heavy lifting \u2014 it means the register is a living process output, not a project deliverable filed at certification.<\/p>\n\n\n\n
Clause 9.1.2 compounds this. The organisation must determine the frequency of compliance evaluation, execute it, take action on noncompliance findings, and \u2014 critically \u2014 maintain knowledge and understanding of its compliance status. Auditors probe this directly. They don’t just ask for the evaluation records. They ask whether the organisation can state its current compliance position. An evaluation conducted against a register that references superseded legislation produces records that are worse than no records at all \u2014 they create a false documented compliance status.<\/p>\n\n\n\n
The link between 6.1.3 and 9.1.2 is what turns a single administrative lapse into a systemic audit finding. A register that cited the F-Gas Regulations 2015 when the 2018 version had been in force for years isn’t a typo. It’s evidence that the monitoring process required by 6.1.3 does not exist, and that every compliance evaluation since the regulatory change was conducted against the wrong baseline.<\/p>\n\n\n\n
Where ISO 14001 Legal Register Failures Occur<\/h2>\n\n\n\n
A real minor nonconformity raised during a transfer assessment captures the pattern precisely. The auditor found that the environmental legislation register was missing the Waste Enforcement Regulations 2018 and the WEEE Regulations 2018, still referenced the F-Gas Regulations 2015 instead of the 2018 version, and the register of environmental aspects was also out of date. Multiple superseded and missing entries in a single register \u2014 at an organisation that already held ISO 14001 certification.<\/p>\n\n\n\n
The pattern repeats because the root cause is structural, not administrative.<\/p>\n\n\n\n
At Stage 2, a materially incomplete or stale register typically generates a major nonconformity. It signals a fundamental planning failure \u2014 the organisation cannot demonstrate it has identified its compliance obligations. Certification gets withheld or conditioned. At surveillance, the same finding appears as a minor nonconformity when the register existed and passed Stage 2 but shows no evidence of update since. The auditor asks four questions in sequence: When was this register last reviewed? What process monitors regulatory change? Walk me through the last regulatory change that affected it. Show me your most recent compliance evaluation records. Inability to answer questions two and three with documented evidence generates the NCR almost every time.<\/p>\n\n\n\n
The corrective action cycle compounds the problem further under Clause 10.2. Organisations close the NCR by adding the missing legislation. They don’t address why the register went stale \u2014 no monitoring trigger, no named owner, no review mechanism. At the next surveillance, different regulations are missing. The NCR recurs. Auditors recognise the pattern, and repeated re-raises erode the credibility of the corrective action process itself.<\/p>\n\n\n\n A register that survives surveillance has five things the static version doesn’t.<\/p>\n\n\n\n Every entry references the specific regulation version currently in force \u2014 not a generic title, but the dated instrument. Each entry carries an applicability determination linked back to the Clause 6.1.2 aspect register. The register has a named owner \u2014 not “the EHS team” but an individual accountable for currency. A documented review frequency exists (quarterly or at minimum annual), with version history showing executed reviews, not just a policy statement. And a regulatory monitoring mechanism is in place and documented: official gazette subscriptions, EUR-Lex alerts, ECHA notifications, or a legal compliance service. The mechanism itself is auditable \u2014 the auditor can verify it exists and produces outputs.<\/p>\n\n\n\n The compliance evaluation under 9.1.2 then operates against a register the organisation can defend. Each evaluation records the date, scope, responsible person, and per-requirement result. Where noncompliance is identified, corrective action records under Clause 10.2 exist and address root cause, not just the immediate gap.<\/p>\n\n\n\n For organisations running integrated management systems, the cross-standard exposure matters. ISO 45001:2018 carries a mirror requirement at Clause 6.1.3<\/a> under the same Annex SL structure. Co-certified organisations maintaining ISO 14001 and ISO 45001 legal registers in separate silos \u2014 different owners, different review cycles \u2014 create a contradiction risk. When an IED or REACH update triggers entries on one register but the other is not updated, the auditor finds inconsistency between two co-certified systems.<\/p>\n\n\n\n If the register is already stale, the remediation sequence matters. Get the order wrong and the corrective action arrives incomplete \u2014 the auditor will see through it.<\/p>\n\n\n\n Pull the current register and record its last-review date. Cross-check every entry against the current version of each regulation using official sources \u2014 EUR-Lex, national gazette, ECHA. Flag every entry where the cited version is superseded. Don’t start adding new regulations yet. Map the gap analysis<\/a> completely so the corrective action is whole, not partial.<\/p>\n\n\n\n Update each flagged entry to the current version with a fresh applicability determination. Assign a named individual owner per register section or jurisdiction. Define a documented review frequency. Establish and document a regulatory monitoring mechanism \u2014 the process the auditor will ask about at the next surveillance.<\/p>\n\n\n\n![\"Three-step](\"https:\/\/aec.llc\/blog\/wp-content\/uploads\/2026\/03\/8-683x1024.png\")
<\/figure>\n\n\n\nWhat an Audit-Defensible Legal Register Looks Like<\/h2>\n\n\n\n
![\"\"](\"https:\/\/aec.llc\/blog\/wp-content\/uploads\/2026\/03\/10-1024x683.png\")
<\/figure>\n\n\n\nHow to Fix Your Legal Register Before Surveillance<\/h2>\n\n\n\n
Scope the Gap<\/h3>\n\n\n\n
Rebuild and Assign Ownership<\/h3>\n\n\n\n
Re-Run the Compliance Evaluation<\/h3>\n\n\n\n
![\"Auditor](\"https:\/\/aec.llc\/blog\/wp-content\/uploads\/2026\/03\/9-1024x683.png\")
<\/figure>\n\n\n\n