Introduction

In the previous two articles, “[ISO 45001 Series] Defining External Interested Parties and External Issues” and “[ISO 45001 Series] Identifying Internal Issues in the Context of the Organization,” I offered recommendations and practical methods for investigating the external and internal issues required by the “context of the organization” clauses of ISO 45001.

After the organization has investigated the information relevant to its context, it must determine the scope of its occupational health and safety management system in light of its budget and applicable legal requirements before moving on to later management-system processes.

ISO 45001 Requirements for the Scope of the Management System

ISO 45001 specifies requirements for an occupational health and safety management system and provides guidance for its use. It can be applied to an organization of any size, type, or activity, including sole proprietorships, companies, corporate groups, firms, authorities, partnerships, charities, and academic institutions, whether public or private. The standard’s concept of an “organization” is consequently broader than the scope of any one body of Taiwanese labor legislation.

Activities Covered

Although ISO 45001 has a broad field of application, it also has limits. It addresses risks to workers and other interested parties; it does not itself address product safety, property damage, or environmental impacts.

People Covered

The people within the scope of ISO 45001 include “interested parties” or “stakeholders” and “workers.”

An interested party includes a person or organization that can objectively be affected, as well as one that perceives itself to be affected. The guidance in ISO 45001 gives a broad range of examples, including regulators, parent organizations, suppliers, worker representatives, workers’ and employers’ unions, owners, shareholders, customers, neighbors in the local community, the public, governmental and nongovernmental organizations, and occupational health and safety organizations and professionals.

A worker is a person who performs work or work-related activities under the organization’s control. Two elements are therefore important: organizational control and a connection to work. The concept is not limited by whether a person is paid or works regularly or intermittently. It may extend vertically from top management—which assigns responsibilities, provides resources, and bears ultimate accountability for the OH&S management system—to non-managerial workers, and horizontally outside the organization to contractors and agents, whenever the organization exercises some degree of control over their work.

If the management system covers only one part of an organization, the relevant interested parties and workers are those connected with that part.

Physical Scope

The physical scope is expressed through the concept of a “workplace.” Under ISO 45001, this is not limited to premises inside a factory. It includes a place under the organization’s control where a person needs to be for work purposes.

Factors and Cautions When Determining Scope

When determining scope, an organization should consider its external and internal issues and the needs and expectations of workers and other interested parties. The boundary may encompass the entire organization or a particular part, but top management of the included part must have the functions, resources, and responsibilities needed for the OH&S management system.

ISO 45001 does not compel every organization to establish a management system or prescribe one mandatory boundary for all people, places, and activities. The selected boundary may not, however, be used to evade legal or other requirements or to exclude activities and products that can affect OH&S performance.

The organization must maintain the scope and boundaries of its OH&S management system as documented information, and the description must not mislead interested parties.

Taiwanese Legal Requirements for Establishing a Management System

Under the previous law, Taiwanese occupational safety and health legislation does not require every organization to establish a complete occupational health and safety management system. Instead, former Paragraph 4 of Article 23 of the Occupational Safety and Health Act—now Paragraph 5—authorized the competent authority to prescribe differentiated requirements in the Regulations of Occupational Safety and Health Management according to the scale and characteristics of a business entity.

Regardless of scale or characteristics, the first sentence of former Paragraph 1 of Article 12-1 of the Regulations—now Paragraph 2—required the employer to formulate an occupational safety and health management plan and to require managers at each level and relevant personnel responsible for direction or supervision to implement it. At that time, the matters to be included in the plan were prescribed in Article 31 of the Enforcement Rules of the Occupational Safety and Health Act.

A business entity with no more than 30 workers could substitute occupational safety and health implementation records or documents for a management plan. An entity with at least 100 workers also had to establish occupational safety and health management rules. Failure to prepare the required plan or rules was subject to an administrative fine of NT$30,000 to NT$150,000 under the former Article 45 of the Act.

Article 12-2 of the Regulations identified four categories required to establish an occupational health and safety management system: (1) a Category One business with at least 200 workers; (2) a Category Two business with at least 500 workers; (3) a petrochemical workplace engaged in petroleum cracking; and (4) a workplace manufacturing, handling, or using hazardous chemicals in quantities reaching the threshold prescribed by the central competent authority.

Under the law in force when the article was published, failure to establish a required occupational health and safety management system was subject to an administrative fine of NT$30,000 to NT$300,000 under Article 43 of the Act.

Accordingly, the former law did not require organizations of every size to establish a complete management system. The duty applied to the four categories specified in the Regulations.

Organizations outside those mandatory categories were nevertheless subject to the applicable management-plan requirement; entities with at least 100 workers also had to establish management rules. A small entity could use implementation records or documents in place of a plan under the applicable threshold. Matters such as identifying and controlling workplace hazards, periodic inspections, operational checks, and site patrols overlap with parts of ISO 45001, although the law did not necessarily require a complete ISO-style system.

The 2022 Rules, the 2026 Amendments, and the Current Requirements

Rules in force when this article was published in 2022: Article 12-1 required an employer to prepare an occupational safety and health management plan according to the size and nature of the business entity and to have managers and responsible supervisors implement it. An entity with no more than 30 workers could use implementation records or documents instead of a plan, while an entity with at least 100 workers also had to prepare management rules. Article 12-2 listed the four mandatory categories described above.

What changed in 2026: Following the amendment of the Occupational Safety and Health Act promulgated on December 19, 2025, the Ministry of Labor amended the Regulations on June 29, 2026, with effect from July 1, 2026. The amendment placed general hazard identification and risk assessment before preparation of the management plan. Before assigning workers to work, an employer must assess risks arising from buildings, machinery, equipment, tools, raw materials, other materials, work activities, and other hazards; take the necessary preventive equipment and measures; and then prepare the management plan with reference to the entity’s size, nature, and assessment results. The prescribed contents of the plan were also moved from Article 31 of the Enforcement Rules into Article 12-1 of the Regulations.

Current requirements after the amendment: Article 12-1 continues to make the management plan the general core requirement. The former phrase “30 workers or fewer” is now “fewer than 30 workers”; those entities may use implementation records or documents instead of a plan. Entities with at least 100 workers must still prepare management rules. Article 12-2 retains the original four mandatory categories and the thresholds of 200 and 500 workers, but adds a fifth category: other business entities designated and announced by the central competent authority. A covered entity must establish and implement an OH&S management system appropriate to the entity in accordance with CNS 45001 or equivalent requirements.[1][2]

Former and current administrative fines: When the article was published, failure to establish a required OH&S management system was punishable by NT$30,000 to NT$300,000 under former Article 43; failure to prepare a required management plan or management rules was punishable by NT$30,000 to NT$150,000 under former Article 45. Since July 1, 2026, an employer that violates Article 23, Paragraph 2 (the management-system duty) and does not remedy the violation by the notified deadline falls under current Article 43, Subparagraph 1, with a fine of NT$50,000 to NT$3 million. A violation of Article 23, Paragraph 1 (including the applicable management-plan duty) that remains uncorrected after notice falls under Article 45, Subparagraph 1, with a fine of NT$30,000 to NT$750,000. A Paragraph 1 breach that causes a specified serious occupational accident may also fall under the distinct conditions in Article 43. Any statutory increase and the applicable provision depend on the specific facts and the competent authority’s disposition.[3]

Recommended Approach

After investigating external and internal issues and the needs and expectations of interested parties, an organization should use the categories in the Regulations to determine which occupational safety and health management measures it must establish.

If the organization falls within a category required to establish an OH&S management system, it should build a corresponding occupational safety and health risk-management process in accordance with the applicable CNS 45001 or equivalent requirements and current regulatory guidance.

Even when a complete management system is not mandatory, the organization must still satisfy the applicable management-plan and management-rule requirements. It may use selected steps from a risk-management process to create those procedures or voluntarily establish a complete process that incorporates the legally required plan and rules.

An organization establishing an OH&S management system must determine its scope. ISO 45001 requires it to consider external and internal issues and the needs and expectations of workers and interested parties when defining the system’s boundaries, but it does not invariably require the entire organization to be included; a particular part may be selected.

An organization not legally required to establish a complete system can use the flexibility provided by ISO 45001. Where the law requires a management system, however, the legally prescribed coverage must be included. Flexibility remains only for areas not fixed by law. This is the practical meaning of the rule that the selected boundary cannot be used to evade legal or other requirements.

People Within the Scope

For people, ISO 45001 focuses on whether the person is under the organization’s control and whether the activity is connected with work. Contractors and agents may therefore be included whenever the organization exercises a degree of control over their work.

The Taiwanese Occupational Safety and Health Act defines workers to include employees, self-employed workers, and other persons directed or supervised by the person responsible for a workplace while performing labor. The concept of worker in ISO 45001 may therefore be broader than the statutory definition.

Given the flexibility of ISO 45001 and the prohibition against avoiding legal duties, the people covered by the risk-management process should at minimum include employees, self-employed workers, and other persons performing labor under the direction or supervision of the person responsible for the workplace, as required by Taiwanese law.

Physical Scope

Taiwan’s Occupational Safety and Health Act does not itself provide the same definition of workplace used by ISO 45001. The ISO definition can therefore help identify any place under the organization’s control where a person needs to be for work purposes.

The boundary and scope must be retained as documented information. For example, an organization may use the approach described in “[ISO 45001 Series] Identifying Internal Issues in the Context of the Organization” to describe the system’s scope, provided that the description does not mislead interested parties.

Conclusion

ISO 45001 is designed for organizations of different sizes and recognizes that their capabilities and budgets differ. It therefore does not force every organization to establish or certify an OH&S management system; implementation of the standard is voluntary.

Taiwanese occupational safety and health legislation nevertheless requires certain business entities to establish an OH&S management system. Because the scope selected under ISO 45001 cannot be used to evade the law, the organization must still satisfy the minimum coverage required by current Taiwanese legislation.

Once the organization has investigated its external and internal issues and determined the scope of the OH&S management system, the next major preliminary task is to build the institutional structure needed to operate it. I will leave the details of that subject for the next article : D.

References

[1] Ministry of Labor, Taiwan, Regulations Governing Occupational Safety and Health Management, amended June 29, 2026; effective July 1, 2026.

[2] Occupational Safety and Health Administration, Ministry of Labor, Taiwan, Ministry of Labor Revises and Issues the Guidelines for Occupational Safety and Health Management Rules and Occupational Safety and Health Management Plans, June 25, 2026.

[3] Ministry of Labor, Taiwan, Occupational Safety and Health Act, amended December 19, 2025; effective July 1, 2026.