ISO 45003 is an international guidance standard, published in June 2021, that sets out how to manage psychosocial risks at work, things like workload pressure and poor support from managers; because it is guidance rather than a requirements standard, you cannot breach it, and you cannot hold accredited certification to it.
If a board member has just asked about it, or it has appeared in a tender question: nothing in the standard requires you to buy anything, and the management approach it describes is one most of health and safety law in Great Britain already points towards.
ISO 45003:2021 sits inside the ISO 45001 family. Its full title is Occupational health and safety management - Psychological health and safety at work - Guidelines for managing psychosocial risks, and it was prepared by ISO/TC 283. ISO 45001 is the certifiable requirements standard for occupational health and safety management systems. ISO 45003 is the companion guidance document, "intended to be used together with ISO 45001, which contains requirements and guidance on planning, implementing, reviewing, evaluating and improving an OH&S management system".
The distinction runs on a single word. ISO's own drafting rules say that "shall" indicates a requirement and "should" indicates a recommendation, and that ISO documents which do not contain "shall" "are not intended to be used for conformity assessment". ISO 45003 is written in "should". Across the portion of the text available in ISO's own free preview, covering the scope, definitions and the opening of the planning clause, there is no "shall" outside the boilerplate foreword, against twenty-four occurrences of "should". BSI, the UK national standards body, states the conclusion directly on its own page: "Being a guidance standard, ISO 45003 does not include any requirements."
So there is no accredited certification to ISO 45003 in the way there is to ISO 45001 or ISO 9001, and this is not a matter of interpretation. BSI, which sells assessment services against the standard, writes: "As ISO 45003 is a guidance standard, your organization cannot be awarded an accreditation in the same way as ISO 45001… BSI offers unaccredited certification to ISO 45003 to both clients with and without ISO 45001." ISO 45003 also does not appear among the management-system schemes UKAS accredits.
Certification and accreditation are not the same thing, and the difference carries this whole section. Certification is what a certification body issues to an organisation. Accreditation is what UKAS grants to a certification body. If a supplier tells you it is "ISO 45003 certified", a certificate probably does exist. The useful questions are which body issued it, against whose scheme criteria, and who accredited that body for this standard.
Worth knowing before you go looking: "ISO 45003:2023" is not a second edition. It is the Slovenian national adoption of the same 2021 text, in the same way that BS ISO 45003:2021 is the UK one. The standard is currently in ISO's routine periodic review, which is a ballot on whether to confirm, revise or withdraw. No revised edition exists and no decision to produce one is on the record.
ISO 45003 has no legal force in Great Britain. Ignoring it is not an offence, and no regulator will act against you for never having read it.
The legal duties sit elsewhere and existed long before the standard did. Section 2 of the Health and Safety at Work etc. Act 1974 places a general duty on employers to ensure, so far as is reasonably practicable, the health, safety and welfare of employees. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient assessment of risks to health, which HSE states covers work-related stress. Under regulation 3(6), an employer with five or more employees must record the significant findings of that assessment in writing. Regulation 3(1) names no standard, methodology or framework at all. Those duties, and how they apply to the hazards this standard is about, are set out in psychosocial risk at work.
There is a further point that cuts against the way this standard is usually sold. Parliament did build a mechanism for giving a non-statutory document weight in criminal proceedings: section 17 of the 1974 Act makes an Approved Code of Practice admissible in evidence, with a failure to observe it taken as proved unless the court is satisfied the duty was complied with some other way. That mechanism applies to codes approved under section 16. ISO 45003 is not an Approved Code of Practice, and no equivalent mechanism attaches to it.
Both of the usual overstatements therefore fail. Following ISO 45003 does not demonstrate compliance, because compliance is measured against the statutory duty and ISO's own rules say voluntary standards "do not replace national laws, with which standards users are understood to comply and which take precedence". And not following it is not a breach of anything.
The defensible middle is narrower than either camp would like. In principle, a published standard can form part of the picture a court or regulator considers when assessing what an employer could reasonably practicably have done. In practice, no reported judgment on the National Archives case law service refers to ISO 45003, and no HSE publication we could find mentions it, so its evidential weight here is untested.
For scale: five years after publication, a search of the whole of gov.uk for the exact phrase "ISO 45003" returned eight documents, as at 31 July 2026. One of them, the Mining Remediation Authority's health, safety and wellbeing plan, describes what it is doing accurately, and is a good model for how to talk about the standard: it commits to "benchmark ourselves against recognised standards like ISO 45003" and to a gap analysis against ISO 45001 and ISO 45003. It does not claim certification or conformity, because there is none to claim.
The standard's content is less mysterious than its title. It asks you to look at three groups of psychosocial hazards and to run a familiar management loop around them.
The three groups, in its own words, are "aspects of work organization, social factors at work, work environment, equipment and hazardous tasks".
For worked examples of what sits inside those groups, the practical source in Great Britain is not the standard. ISO 45003 puts its detailed hazard examples in tables that sit behind the paywall, whereas the six HSE Management Standards cover much of the same ground, are free, and are written for the regulatory context you are actually in. HSE's six areas:
| HSE Management Standard | HSE's description |
|---|---|
| Demands | "issues such as workload, work patterns, and the work environment" |
| Control | "how much say the person has in the way they do their work" |
| Support | "the encouragement, sponsorship and resources provided by the organisation, line management and colleagues" |
| Relationships | "promoting positive working to avoid conflict and dealing with unacceptable behaviour" |
| Role | "whether people understand their role within the organisation and whether the organisation ensures that the person does not have conflicting roles" |
| Change | "how organisational change (large or small) is managed and communicated in the organisation" |
Two parts of ISO 45003 that are directly quotable, and useful, sit in its clause on organisational context. Among external issues it names "rapid technological changes (e.g. increased connectivity to electronic devices, impact of artificial intelligence and automation technology)". Among internal ones it names "locations of work (e.g. itinerant workforce without a fixed workplace, working remotely, working at home, working in isolation…)" and "workers' terms and conditions (e.g. flexible work arrangements, compensation and benefits, part-time, casual or temporary workforce)". If you want the standard's own hook for hybrid working, that is it.
Its leadership clause is more pointed than most people expect. Top management should "protect workers from reprisals and/or threats of reprisals for reporting incidents, hazards, risks and opportunities", and should communicate how people who raise psychosocial risk concerns will be protected. Those are still recommendations, but they are the part of the standard that asks something real.
Some organisations have a concrete one. If you already hold ISO 45001 certification, ISO 45003 is the natural extension of the system you already run. If you bid into public-sector or large-corporate tenders, questions referencing it turn up in procurement questionnaires, and a considered answer beats a blank. And if your board wants a recognised structure for governing psychological health, the standard supplies one.
Quite a few organisations. If you do not run an ISO 45001 management system, nobody is asking about it in your tenders, and you are already assessing work-related stress through the HSE Management Standards route, then buying and studying ISO 45003 adds little. The HSE framework is free, and it is the regulator's own published method.
Skipping the standard is not negligence. What you cannot skip is the underlying duty: the assessment itself, recorded in writing once you have five or more employees, kept under review, with action following what it finds.
The management loop the standard describes comes down to a small set of repeatable habits, none of which requires purchasing the document or paying an assessor. A dated assessment of psychosocial risk. Measurement that is anonymised and aggregated, repeated at intervals, so people can answer honestly and you can see movement. Documented actions taken in response. A review cycle that closes the loop. And someone senior who owns the findings.
HSE's free Talking Toolkit gives you six conversation templates, one per Standards area, and its Indicator Tool gives you a 35-item survey if you want one. HSE is clear that the Toolkit "should not be used in isolation as an employer's only response if there is an existing problem with work-related stress", and that a survey is not an essential step. Both are inputs to the assessment rather than the assessment itself.
On support routes, one correction is worth carrying, because ISO 45003 content routinely gets it wrong in both directions. An employee assistance programme is not required by law, and providing one is not a defence. In Intel Corporation (UK) Ltd v Daw [2007] EWCA Civ 70 at [45], the Court of Appeal held that "the reference to counselling services in Hatton does not make such services a panacea by which employers can discharge their duty of care in all cases". It is a factor a court weighs, alongside everything else you did.
An employer doing those things consistently is, for most practical purposes, already working the way the standard describes.
The free strategy audit takes twenty minutes and gives you your gaps in writing. No card, no call booked at the end of it unless you ask for one.
Start the free audit →