Building a US Compliance Obligations Register for ISO 14001

This page explains what the rules and common practice call for. Every site is different, and what a survey or a filing needs at your facility is something we work out with you after we see it.

Search for help with a compliance obligations register and you will get British and Australian pages. They are sound pages, but they are written for other countries' regulations: the Environmental Permitting Regulations, the Environment Agency and state EPAs in New South Wales. If you run a plant in Ohio or Arizona, none of the obligations they list are yours.

ISO 14001, the environmental management system standard, has a clause on the legal and other requirements you must meet. The standard calls them compliance obligations, and the list is often called a register. That clause requires three things:

• Determine which obligations relate to your environmental aspects, and have access to them.
• Determine how they apply.
• Take them into account in your management system.

Here is what that means when the regulator is EPA.

A note on the clause number. This was clause 6.1.3 in ISO 14001:2015. Clause 6 was renumbered in the 2026 edition: clause 6.1.4 is now "Risks and opportunities," planning action moved to clause 6.1.5, and a clause called "Planning of changes" is new. No free source states where compliance obligations landed, so we name the clause and do not guess the number. If you cite it in a procedure, check a purchased copy of the standard first, and consider describing what the procedure does instead of citing a number that has already moved once. In ISO 45001:2018, the occupational health and safety management system standard, the corresponding clause is 6.1.3, and that number is current.

Start from your own operations, not from a list of laws

The most common mistake is to build the register backward. People start with a list of environmental laws and ask which ones apply, which produces something huge, generic and unusable.

The standard ties compliance obligations to your environmental aspects, so work from your aspects register and ask, for each aspect, which obligations attach to it. Take an aspect of "air emissions from surface coating operations." It pulls in your permit, your volatile organic compound (VOC) limits and your recordkeeping, and it may also pull in your annual Toxics Release Inventory (TRI) report to EPA. That is an entry with a reason to exist.

Note that the 2026 edition puts more weight on upstream and downstream impacts, meaning effects at your suppliers and after your product leaves you, so this step reaches further than it did under the 2015 edition. Certification bodies (registrars) differ in their guidance on where this change sits. It may be a note to the clause on environmental aspects, or it may come through the clause 4 requirement on scope, so check the standard before you decide how far to take it.

→ Transitioning to ISO 14001:2026

What belongs on a US register

Part numbers below refer to Title 40 of the Code of Federal Regulations, where EPA's regulations are published.

Federal: air

• Clean Air Act permits. This may be a major source permit (Title V) or a smaller one (a synthetic minor or state minor permit). Determining which applies is itself an obligation on the register, and it is the one most often assumed and not written down.
• Emissions inventories. These are annual reports, where your permit or state program requires them.
• National Emission Standards for Hazardous Air Pollutants (NESHAP and MACT standards). Part 63 holds the standards for each source category (the MACT program). Note that Part 61 still holds the original standards and applies to some sources. The subparts for surface coating, chrome plating and metal fabrication catch many manufacturers who do not know they are covered.
• New Source Performance Standards (NSPS), in Part 60.
• Refrigerant management. This means the Clean Air Act's refrigerant rules (Section 608). For hydrofluorocarbons (HFCs), it also means a separate law, the AIM Act, and Part 84, including the 2024 Emissions Reduction and Reclamation rule. A register that stops at Section 608 is incomplete.

Federal: waste

• Hazardous waste generator status under the Resource Conservation and Recovery Act (RCRA). You are a very small quantity, small quantity or large quantity generator. This is a status that changes with how much waste you generate, which makes it a live obligation, not a fixed fact. An entry that records your status but not how you track it is incomplete.
• Hazardous waste determinations. You must determine whether each waste is hazardous, and that obligation is itself a requirement, whatever the answer turns out to be.
• Land disposal restrictions, hazardous waste manifests, on-site accumulation time limits, container and tank standards, and contingency planning.
• Used oil and universal waste.

Federal: water

• Stormwater permits under the National Pollutant Discharge Elimination System (NPDES). This covers the multi-sector general permit for industry and the conditions for your sector, along with your stormwater pollution prevention plan (SWPPP) and your sampling and inspection requirements.
• Process wastewater discharge. You either discharge directly under an NPDES permit, or discharge to the public sewer and its publicly owned treatment works (POTW) under pretreatment rules, and the second route brings limits from your local sewer authority.
• Spill Prevention, Control, and Countermeasure (SPCC) plans for oil. These are in Part 112 and apply if the oil you store above ground crosses the threshold, bringing plan certification, inspections and integrity testing with them.

Federal: reporting

• Form R, the annual TRI report (EPCRA Section 313), due July 1 each year. The threshold determination is an ongoing obligation, not a one-time finding.
• Tier II, the annual chemical inventory report (EPCRA Section 312), due March 1.
• Emergency planning notifications and release reports under the Emergency Planning and Community Right-to-Know Act (EPCRA Sections 302 and 304).
• Release reports under the federal Superfund law (CERCLA Section 103).
• Greenhouse gas reporting, in Part 98, if it applies to you. ⚠️ Watch this one. EPA proposed ending most of the program in September 2025, and in February 2026 it extended the deadline for reporting year 2025 (RY2025). Part 98 is still on the books, but its future is not settled, which makes this a good example of why a register needs a regular review, not a one-time build.
• The Toxic Substances Control Act (TSCA), including obligations tied to PFAS chemicals.

Federal: safety, if you run one system for both standards

OSHA's rules belong on an ISO 45001 register under clause 6.1.3, not on the environmental one. If you run one integrated management system, though, keep them in one place. That includes the substance-specific standards, hazard communication (HazCom) and emergency action plans, along with process safety management (PSM) if you have covered processes.

State and local: the part that gets skipped

This is where the UK and Australian guidance is worse than unhelpful, because it will mislead you. Generic US content also gives up at this point.

Most environmental programs are delegated to the states, and state programs are often stricter than the federal minimum. County and city requirements add further layers.

In Arizona, that means:

• ADEQ, the Arizona Department of Environmental Quality: air quality permits, aquifer protection permits and waste programs.
• Maricopa County Air Quality Department or Pima County DEQ: county air permits. For many plants in the Valley, the county permit is the one that governs, not the state one.
• Arizona's pollution prevention plan (A.R.S. § 49-963) and Toxic Data Report (A.R.S. § 49-962(C)). Any plant that filed a Form R or Form A must prepare a pollution prevention plan and submit a Toxic Data Report through ADEQ's online system, myDEQ. The report is due July 1, the same date as the federal Form R. Separate thresholds also trigger the plan on their own. One is 1,000 kilograms (kg) a month of hazardous waste, under A.R.S. § 49-962(A)(2), and the other is 10,000 pounds a year of listed toxics, under § 49-963(D). Note that ADEQ's own guidance cites the 1,000 kg a month threshold to § 49-963(A)(2), but § 49-963(A) has no numbered paragraphs, and the threshold is in § 49-962(A)(2). Check the statute, not the guidance page. This is an Arizona obligation that federal-only registers miss.
• Your local sewer authority: pretreatment limits.
• Fire code: hazardous materials inventory statements and permits.

If you operate in more than one state, this part multiplies, and it is also the part that goes out of date fastest.

Other requirements: the "and other requirements" half

The clause covers more than law. It also covers:

• Customer requirements
• Corporate standards
• Permit conditions you agreed to beyond the legal minimum
• Voluntary commitments
• Community agreements
• Industry codes you have adopted

If you have told a customer you will do something for the environment, it is an obligation on your register.

What each entry needs

A list of law names is not a register. Each entry should carry:

That last row is the one auditors dig into, because a register with no review schedule and no revision history is a snapshot of the day a consultant left.

Three mistakes we see all the time

1. Treating it as fixed. Generator status changes with waste volumes, and whether you cross a Form R threshold changes with how much material you run. Permits get renewed with new conditions, and regulations change. A register built once and filed away is a nonconformity waiting to be found.

2. Listing without evaluating. One clause asks you to determine which compliance obligations apply. A second clause asks you to check that you meet them (the standard calls this evaluation of compliance). You must evaluate compliance on a regular basis, with results and with written conclusions. A register with no means of evaluation meets half the requirement. The table above gives that clause's number in ISO 45001:2018 and ISO 14001:2015, but confirm the 2026 number before you cite it.

3. Skipping the applicability determination. The hardest entries are the ones where applicability is genuinely uncertain. Are you a Title V major source? Does a NESHAP subpart cover your process? Do you cross a Form R threshold? Registers often record the answer without the analysis behind it. The analysis is the valuable part, and it is what you will need when someone asks.

What we do, and what we do not

We build this register as part of our ISO 14001 and ISO 45001 consulting, and two items on it are work we also perform ourselves: the annual TRI report (Form R) and the Tier II chemical inventory report.

The other programs, including hazardous waste, stormwater, SPCC plans and air permits, are outside the four fields we work in. We put them on your register and record how each one applies, but we do not run those programs for you.

→ ISO 14001 consulting · Toxics Release Inventory reporting (Form R) · Tier II reporting