ISO 45001 Certification in Saudi Arabia: Workplace Safety Standard for KSA Industries

Ask any HSE manager in Jubail Industrial City what the single document is that most of their contractors need before work can begin, and the answer is almost always the same: ISO 45001.

Not because ISO 45001 is the law in Saudi Arabia. It is not legally mandated, at least not directly. But in the Eastern Province’s industrial and energy sector, the commercial reality is more binding than most regulations. Saudi Aramco’s Supplier Prequalification System requires it. SABIC’s vendor registration process requires it. EPC contractors managing large project supply chains pass the requirement down to subcontractors. The result is that ISO 45001 certification has become a practical prerequisite for serious work in Saudi Arabia’s construction, oil and gas, and manufacturing sectors, regardless of company size.

This guide covers what ISO 45001 actually requires, how it connects to Saudi Labour Law and Aramco HSE requirements, who needs it, and what the certification process looks like in 2026.

What Is ISO 45001 Certification?

ISO 45001:2018 is the international standard for Occupational Health and Safety Management Systems (OHSMS). It replaced OHSAS 18001 in 2018 and is now the globally recognized framework for managing workplace health and safety risks.

The standard provides a structured approach to identifying hazards, assessing and controlling risks, ensuring legal compliance, setting safety objectives, and continuously improving the organization’s safety performance. It applies to any organization regardless of size, sector, or the nature of the work its people do.

Where ISO 45001 differs from previous approaches to workplace safety is in its emphasis on worker participation and leadership commitment. The standard requires that workers at all levels are involved in identifying hazards and reviewing safety performance, and that top management is demonstrably accountable for the OHSMS rather than delegating it entirely to the HSE department.

ISO 45001 and Saudi Labour Law: The Regulatory Connection

ISO 45001 is not legally required by name under Saudi Arabia’s Labour Law. But the requirements it imposes on organizations align directly with what Saudi law demands of employers.

Saudi Arabia’s Labour Law, in its eighth chapter, clarifies the provisions related to workers’ safety, protection, and health and social care. The employer is required to take the necessary precautions to protect workers against hazards, occupational diseases, and machinery, and to ensure work safety and protection.</cite>

The Regulations of the Occupational Safety and Health Administration 2018 require employers to implement an Occupational Health and Safety Policy and prescribe the contents of such policy. Non-compliance can attract serious penalties under the Labour Law, including fines. A fine of SAR 25,000 can be imposed for a failure to comply with the obligation to take the necessary precautions to protect employees against hazards and diseases associated with work.</cite>

The Saudi Ministry of Human Resources and Social Development launched comprehensive updates to high-risk occupational safety regulations and labour laws in early 2026 to ensure stricter compliance and worker protection.</cite>

ISO 45001 does not just help companies comply with these requirements. It creates a documented, auditable system that demonstrates compliance. For companies operating in high-risk environments where MHRSD inspections are a reality and where a workplace incident triggers regulatory scrutiny, having an ISO 45001 certified OHSMS is the strongest available evidence of a systematic approach to worker protection.

Employers are now required to implement regular compliance audits, verify permits, and strengthen occupational health and safety standards to avoid financial and operational risks.</cite> An ISO 45001 management system provides exactly this structure.

ISO 45001 and Aramco Vendor Registration: The Commercial Connection

This is the specific angle that no competitor has properly developed, and it is the most commercially significant fact about ISO 45001 in the Saudi context.

Saudi Aramco’s Supplier Prequalification System (SAPS) is the gate through which all Aramco vendors must pass. The system evaluates suppliers across multiple dimensions before approving them for contract consideration. ISO 45001 is not a bonus or a differentiating factor in SAPS. It is a baseline requirement for vendor categories that involve physical operations: construction, maintenance, industrial services, engineering, logistics, and others.

A company that does not hold valid, IAF-accredited ISO 45001 certification cannot complete the SAPS prequalification for these categories. It is not that the application is weakened. It is that the application cannot advance past the documentation stage.

The same applies to SABIC’s vendor registration process, to SADARA, SIPCHEM, TASNEE, and the other major industrial operators in Jubail. The Jubail Industrial City supply chain runs on ISO certification. Companies providing services inside the city’s fence, to any of its major operators, are expected to hold ISO 9001 and ISO 45001 as a starting point.

EPC contractors managing major projects in the Eastern Province cascade these requirements down their supply chains. A tier-one contractor with Aramco approval applies the same vendor qualification criteria to its subcontractors that Aramco applies to it. For a small-to-medium mechanical or electrical contractor in Dammam or Al Khobar looking to grow its project pipeline, ISO 45001 is the certificate that enables access to the tier-one contractor supply chain.

Who Needs ISO 45001 Certification in Saudi Arabia

Construction companies. Saudi Arabia’s Vision 2030 infrastructure pipeline is the largest construction program in the world by investment value. NEOM, Diriyah, The Red Sea Project, and Qiddiya all require contractors and their supply chains to demonstrate ISO 45001 certification. For construction companies targeting these projects, or the government infrastructure contracts supporting them, ISO 45001 is non-negotiable.

Oil and gas service providers. Any company providing drilling, well services, maintenance, inspection, or support services to Aramco, SABIC, or their joint ventures needs ISO 45001 for vendor qualification. The Eastern Province’s oil and gas sector is where ISO 45001 requirements are most consistently enforced.

Manufacturing companies. Manufacturers in Jubail, Yanbu, Dammam, Jeddah, and Riyadh’s industrial zones that supply to industrial clients or export to international markets encounter ISO 45001 in client procurement requirements and export market vendor qualification processes.

Facilities management companies. FM companies managing industrial, commercial, and healthcare facilities face ISO 45001 requirements from clients who hold the standard themselves and require it from their service providers.

Engineering and technical services firms. Structural, mechanical, electrical, and piping engineering firms working in the Eastern Province encounter ISO 45001 requirements from EPC clients as a standard term of engagement.

Logistics and transportation companies. Companies moving goods and materials through the Eastern Province supply chain for industrial clients face increasing ISO 45001 requirements, particularly those operating in hazardous goods transportation or port-adjacent logistics.

What ISO 45001:2018 Actually Requires

ISO 45001 follows the same high-level structure as ISO 9001 and ISO 14001. Organizations that already hold either of those standards will find significant structural overlap. The specific requirements that distinguish ISO 45001 from a general quality management system include the following.

Hazard identification and risk assessment. The organization must establish, implement, and maintain documented processes for identifying hazards and assessing occupational health and safety risks. In Saudi Arabia’s industrial context, this means systematic processes for identifying risks from working at height, confined space entry, hot work, electrical isolation, lifting operations, chemical exposure, and the full range of industrial hazard categories.

Legal and other requirements register. ISO 45001 requires organizations to maintain a register of applicable legal and regulatory requirements covering workplace safety. For Saudi companies, this means tracking MHRSD occupational safety regulations, Saudi Labour Law provisions, Aramco and SABIC client standards where applicable, and any sector-specific regulations from the Ministry of Energy or relevant authorities.

Worker participation and consultation. One of the most distinct requirements of ISO 45001 is formal worker participation in the OHSMS. Workers must be consulted on hazard identification, risk assessment, incident investigation, and the review of OH&S objectives. Auditors verify this through interviews with workers at all levels, not just with management.

Incident investigation. All work-related incidents, not just those involving injury, must be investigated. Root causes must be identified, and corrective actions implemented and verified. In Saudi Arabia’s industrial sector, where incidents trigger both regulatory reporting and client notification requirements, a documented incident investigation process is both an ISO requirement and a commercial necessity.

Emergency preparedness and response. Documented emergency procedures covering the scenarios relevant to the organization’s operations: fire, chemical release, medical emergency, structural failure, and others. Procedures must be tested at defined intervals, and records of testing maintained.

Management of contractors. ISO 45001 requires documented processes for managing the OH&S performance of contractors working under the organization’s control or on its premises. For Saudi construction and industrial companies managing large subcontractor workforces, this is often the most substantive part of the implementation.

ISO 45001 and ISO 9001: Why Saudi Businesses Certify Both

The majority of Saudi businesses that pursue ISO 45001 certify it alongside ISO 9001 rather than in isolation. There are two practical reasons for this.

First, Aramco and SABIC vendor qualification requires both. Certifying them sequentially means two separate implementation cycles, two sets of consultant fees, and two certification audit processes. Certifying them together using an integrated approach reduces duplication significantly. The two standards share document control requirements, management review structures, internal audit frameworks, and risk management approaches. A combined implementation costs approximately 30 to 40 percent more than ISO 9001 alone, not twice the price.

Second, ISO 9001 and ISO 45001 together satisfy the majority of what Eastern Province industrial clients require from their supply chains. Adding ISO 14001 creates a full Integrated Management System covering quality, safety, and environment, which is the benchmark for serious industrial contractors in the region.

The ISO 45001 Certification Process

Gap analysis (3 to 5 days). A clause-by-clause review of your current OH&S practices against ISO 45001:2018 requirements. Identifies what documentation exists, what is informal and needs formalizing, and where genuine gaps need to be addressed. For construction and industrial companies in Saudi Arabia, the gap analysis typically reveals adequate physical safety practices but inadequate documentation of hazard identification, contractor management, and legal compliance monitoring.

Documentation development (2 to 5 weeks). OH&S policy and objectives, hazard identification and risk assessment records, legal and other requirements register, emergency preparedness procedures, contractor safety management procedures, incident investigation templates, worker participation records, competence and training records, and internal audit procedures. All documentation must reflect actual operations, not generic OH&S templates.

Training (1 to 2 weeks). Documented training for all workers with responsibilities in the OHSMS. In Saudi Arabia’s multicultural industrial workforce, ensuring training accessibility in relevant languages is a practical requirement that ISO 45001 reinforces.

Internal audit (1 to 3 days, plus corrective action closure). Full internal audit against all ISO 45001 clauses. Non-conformities must be properly investigated and closed before the certification body’s Stage 2 audit.

Management review. Senior leadership reviews OH&S performance data, audit results, incident trends, legal compliance status, and objectives. Recorded outputs demonstrating genuine leadership engagement.

Certification audit. Stage 1 document review, Stage 2 on-site audit. For industrial companies in Saudi Arabia, Stage 2 auditors pay particular attention to hazard identification records, contractor management evidence, worker participation records, and incident investigation files.

Timeline:

Starting point	Timeline to certificate
No existing OH&S documentation	60 to 90 days
Existing documented safety procedures	45 to 60 days
Transitioning from OHSAS 18001	30 to 45 days
Combined with ISO 9001 (IMS approach)	60 to 90 days

ISO 45001 Certification Cost in Saudi Arabia

For most Saudi businesses, ISO 45001 certification costs 15 to 25 percent more than ISO 9001 alone for the same company size. The additional cost comes from the expanded documentation scope and the typically longer Stage 2 audit time for industrial operations.

Company size	Employees	Estimated total cost (SAR)
Small	1 to 20	10,000 to 18,000
Small-medium	21 to 50	14,000 to 25,000
Medium	51 to 150	20,000 to 35,000
Large / multi-site	150 and above	30,000 to 55,000+

Companies certifying ISO 9001 and ISO 45001 together spend approximately 30 to 40 percent more than ISO 9001 alone, not the combined total of each standard separately.

Frequently Asked Questions

ISO 45001 Certification in Saudi Arabia

Intellitech is an ISO certification consultancy based in Al Jubail, Saudi Arabia, with direct experience in the Eastern Province’s industrial and energy sector requirements. The team has supported construction companies, oil and gas service providers, manufacturing operations, and EPC supply chain contractors through ISO 45001 certification and combined ISO 9001 and ISO 45001 implementations.

For companies pursuing Aramco or SABIC vendor qualification, Intellitech’s consultants understand what SAPS prequalification documentation requires from your OHSMS, which is specific knowledge that a generic ISO implementation does not always address.

ISO 45001 Certification Service Page | ISO 9001 Certification | ISO 14001 Certification | Integrated Management System | Get a Free Consultation