An ISO 45001 implementation checklist for UAE safety managers covers seven clauses, the documented evidence behind them and a workable order of phases. The standard sets out an occupational health and safety management system, often shortened to OHSMS, that any organisation can certify regardless of size. In the UAE it sits beside employer duties under Federal Decree-Law No. 33 of 2021 and, in Abu Dhabi, the OSHAD SF framework (Occupational Safety and Health System Framework) administered by ADPHC (Abu Dhabi Public Health Centre).
The checklist below follows the sequence AAA Safe Dubai sees on UAE projects, from gap analysis through certification audit. It lists the documented information inspectors and auditors sample, maps each clause onto local framework expectations and names the findings that hold up Stage 2. Use it to build a plan your team can defend in an audit room.
What the standard requires from UAE organisations
ISO 45001 follows Annex SL, the shared structure used across ISO management system standards. Its seven core clauses cover context, leadership and worker participation, planning, support, operation, performance evaluation and improvement. Documented information, the standard’s term for controlled documents and records, runs through all seven clauses. Certification bodies accredited by EIAC, the Emirates International Accreditation Centre, audit against these clauses and against applicable UAE law.
Clause 4 also asks for interested parties and internal and external issues. For a UAE contractor that list includes subcontractors, client HSE teams, camp operators and regulators. Write those parties into the scope rationale, because auditors test whether scope decisions link to their expectations.
Who asks for certification in the UAE
No UAE federal law makes certification mandatory for ordinary workplaces. Main contractors, developers, oil and gas operators and free zone authorities add it to prequalification questionnaires, and tender panels score the answer. OSHAD SF expects a documented occupational safety management system in Abu Dhabi, which a certified system answers in full. Dubai clients test the same evidence during supplier audits.
How ISO 45001 maps onto OSHAD SF and Dubai expectations
Mapping keeps one system in place instead of two parallel ones. OSHAD SF expects policy, risk assessment, competence, emergency preparedness, performance monitoring and continual improvement, and each expectation lands on an ISO 45001 clause. Dubai Municipality inspection and Dubai Civil Defence emergency planning reach the operation clause through permits, drills and equipment control. Build a single legal register that cites each requirement once and places the clause reference beside it.
Free zone and government projects add their own conditions alongside these frameworks. Airport, port and utility operators publish contractor safety requirements that reference the same clauses, so one system answers several questionnaires. Record which client conditions apply in the legal register beside the statutory entries. AAA Safe Dubai tracks these conditions during supplier and contractor onboarding.
The evidence that satisfies both frameworks
Auditors sample records, not intentions. A signed policy without posting evidence fails on site. A risk assessment without review after an incident fails in the same way. The table pairs each clause with the UAE expectation and the evidence that answers both at once.
| ISO 45001 CLAUSE | UAE EXPECTATION | EVIDENCE THAT SATISFIES BOTH |
|---|---|---|
| Clause 4 – Context | OSHAD-SF scope definition and hazard inventory | Scope statement listing sites, camps and subcontractor work |
| Clause 5 – Leadership | Employer duties under Federal Decree-Law No. 33 of 2021 | Signed OH&S policy, objectives and worker consultation minutes |
| Clause 6 – Planning | Risk assessment and legal compliance duties | Risk register and legal register with applicable UAE legal citations |
| Clause 7 – Support | Competence and equipment provision duties | Training and competency records, plus equipment issue and inspection registers |
| Clause 8 – Operation | Permit-to-work requirements for high-risk activities and emergency preparedness expectations | Task method statements, signed permit records and emergency drill reports |
| Clause 9 – Performance Evaluation | Incident reporting and workplace inspection duties | Internal audit reports, inspection records and incident notification records |
| Clause 10 – Improvement | Continual improvement and corrective-action expectations | Corrective action log with root-cause analysis, assigned actions and verified closure |
AAA Safe Dubai provides site assessments for industrial facilities, labour camps and offices reviewing documented safety systems and equipment control. Contact our technical team for project specific recommendations.
The implementation checklist in sequence
Sequence the work so each phase produces evidence the next phase needs. Organisations that write procedures first and assess risk later rewrite those procedures within months. The phases below follow a realistic order for a UAE entity with a handful of sites, camps or workshops in scope.
Phase one scope and gap analysis
Write the scope statement first, listing sites, camps, workshops and subcontractor activities included or excluded. Run a gap analysis against clauses 4 to 10 and record every gap with an owner and a target date. Include labour camps and remote yards when your workers live or operate there, since auditors follow headcount in the field instead of head office boundaries.
Gap analysis works as a spreadsheet with clause, current state, gap, owner and target date. Photograph the current state where equipment or signage is involved, because the photo closes the finding later. Consultants can run this phase, though internal staff who know the sites produce tighter scope statements.
Phases two to five build, run and certify
Phase two builds the documented system, covering the policy, the manual, procedures and forms. Phase three runs it, with risk assessments, permits, training records and personal protective equipment (PPE) issue registers accumulating as evidence. Phase four checks it through internal audit and management review before the certification body arrives. Phase five covers Stage 1 and Stage 2 audits with finding closure. In AAA Safe Dubai experience with UAE suppliers and contractors, a single entity with a few sites plans on six to nine months for the full sequence.
| PHASE | CORE ACTIONS | OUTPUT |
|---|---|---|
| Phase 1 – Scope and Gap Analysis | Define the OH&S management system scope, conduct a clause-by-clause gap review and assign responsible owners | Gap register with assigned owners, priorities and target completion dates |
| Phase 2 – Documented System | Develop the OH&S policy, management system manual, procedures, risk controls and required forms | Controlled document set with document identification, approval and version control |
| Phase 3 – Implementation | Implement risk assessments, permit-to-work controls, training, equipment issue and inspection systems, and energy isolation arrangements | Operational records that accumulate as objective evidence of implementation |
| Phase 4 – Internal Audit and Management Review | Audit all applicable ISO 45001 clauses, evaluate system performance and conduct management review | Internal audit reports, findings, corrective actions and management review minutes |
| Phase 5 – Certification | Complete Stage 1 review, undergo Stage 2 certification audit and close any identified findings | ISO 45001 certificate and documented evidence of finding closure |
Documented information auditors ask for
The documented set splits into controlled documents and records. Documents carry version control, approval dates and review dates. Records carry dates, names and evidence of use. Auditors test both, and the common failure is a record that exists on paper and nowhere in the workplace.
Version control deserves a short note. Documents carry a version number, an approval signature and a review date, and obsolete versions leave the point of use. Auditors find superseded procedures in site offices within weeks, and each one becomes a finding. Hold one master list showing document, owner, version and location.
What inspectors sample on site
Inspection follows the paperwork to the floor. An inspector picks a worker and traces competence records, PPE issue entries and toolbox talk attendance. Follow-up queries test whether the worker knows the procedure, not whether the file looks complete.
In maintenance areas the inspector asks for the energy isolation procedure and the lockout tagout starter kit inventory. Lockout tagout, shortened to LOTO, means locking an energy source in the safe state before maintenance work starts, and the inspector checks tags on a live isolation point. Photograph what the inspector found and close each gap with a dated action. Keep the corrective action log beside the inspection record, since closure evidence carries the finding.
| DOCUMENT OR RECORD | OWNER | WHAT AUDITORS SAMPLE |
|---|---|---|
| OH&S Policy and Objectives | Senior Management | Management signature, review date and evidence of communication or site posting |
| Risk Assessment and Hazard Register | Health and Safety Manager | Evidence of review following incidents, changes and subcontractor input |
| Legal and Regulatory Register | Compliance Officer | Citations to applicable federal legislation, OSHAD-SF requirements and relevant emirate-level rules |
| Competence and Training Records | HR and HSE | First-aider certificates, equipment-specific training records and competency evidence |
| Incident and Corrective Action Log | Health and Safety Officer | Dated closure evidence, root-cause actions and verification of effectiveness |
| Emergency Plans and Drill Records | Site Manager | Attendance sheets, drill records, observations and documented lessons learned |
| PPE Issue and Inspection Registers | Stores Supervisor | Correct size, applicable standard, issue dates, inspection status and replacement dates |
| Energy Isolation and LOTO Records | Maintenance Lead | Isolation device inventory, authorised isolator list and evidence of relevant training |
Operational controls that prove the system works
Clause 8 covers operational controls, and equipment records show whether those controls run in practice. Selection of PPE follows the risk assessment, with issue registers showing size, standard and replacement dates. Clause 5.4 requires consultation and participation of non managerial workers, and auditors read the consultation minutes beside the issue register to judge whether the control is real.
Energy isolation and permit to work
Maintenance work needs documented energy isolation, a practice called lockout tagout. A written procedure, a lockout tagout equipment inventory and named trained isolators form the minimum set. Add group lockout boxes and valve covers where crews share an isolation, and keep the isolation register at the point of work.
A starter kit covers padlocks, hasps and tags for a small workshop. Larger sites extend the kit to device specific locks and numbered tags matched to the permit to work system. Keep the training record beside the inventory, since auditors ask who trained on which device.
Internal audit and the certification path
Building the internal audit programme
Clause 9.2 sets planned intervals based on risk and the results of earlier audits, and it does not fix an annual rule. Programmes that work run a full internal audit across all clauses each year and check high risk processes twice. Train auditors outside their own department and log findings with owners and closure dates. Management review then tests objectives, audit results and resource needs on a documented agenda.
Stage 1, Stage 2 and surveillance
The certification body runs Stage 1 as a documentation and readiness review, then Stage 2 as a site audit that samples records and practice. Certificates run on a three year cycle with surveillance audits in between. Closure evidence for Stage 2 findings decides whether the certificate issues on schedule, and weak closure evidence is the delay we see in practice.
Getting support with implementation
Procurement sits inside clause 7 and clause 8. Purchases need documented specifications, conformity evidence and acceptance checks recorded against the order. AAA Safe Dubai supplies workplace safety equipment across the UAE and reviews specification sheets against the standards your risk assessment cites. Written quotations cover equipment, accessories and installation.
AAA Safe Dubai stocks safety equipment meeting UAE conformity requirements. View the shop for equipment and accessories, and request itemised quotations covering installation across the UAE.
Contact our safety compliance specialists to discuss implementation support and receive project specific recommendations.
Frequently Asked Questions
ISO 45001 is an international certifiable standard, and OSHAD SF is the Abu Dhabi regulatory framework for occupational safety. OSHAD SF sets local obligations for entities operating in Abu Dhabi, while ISO 45001 sets a certifiable system structure. Mapping the two keeps one document set and one legal register.
Expect the policy, the scope statement, the risk register, the legal register, competence records, internal audit reports, management review minutes and the corrective action log. Auditors sample records against dates and signatures, and they trace one risk from identification to control to review.
Failures cluster around evidence of use. Policies without posting records, risk assessments without post incident review, corrective actions closed without verification and missing consultation records for non managerial staff cause repeat findings. Verify each one before the auditor arrives.
Timelines track scope and readiness. A single entity with a few sites plans on six to nine months in AAA Safe Dubai experience, covering gap analysis, documentation, internal audit and certification. Organisations with labour camps, marine assets or many subcontractors add months to that sequence.
The standard sets planned intervals based on risk and previous results, and it does not fix an annual rule. Full coverage across all clauses each year is common practice in UAE implementations, with high risk processes audited twice.
No federal law requires certification for ordinary workplaces. Federal Decree-Law No. 33 of 2021 sets the underlying safety duties, and clients add certification through contracts and prequalification questionnaires. OSHAD SF in Abu Dhabi requires a documented management system, which a certified system satisfies.
Yes, when your organisation controls them or houses workers there. Auditors follow headcount and ask for camp risk assessments, emergency plans, drill records and welfare inspections. Excluding camps without written justification creates a scope finding.
Disclaimer
This article gives general guidance on ISO 45001 implementation for UAE organisations. It does not replace advice from a certified auditor, legal consultant or accredited certification body, and requirements vary by emirate, sector and contract. Confirm current obligations with the responsible authority before you start implementation work.
Useful primary sources include the following authorities.
- MOHRE for labour law and occupational safety duties
- Dubai Municipality for workplace inspection requirements
- ADPHC for OSHAD SF obligations in Abu Dhabi
- Dubai Civil Defence for emergency planning requirements
- Ministry of Industry and Advanced Technology for standards and conformity matters
