ISO 45003: the standard your regulator, your insurer and your next tender will measure you against

A tender asks whether you are "aligned to ISO 45003". Or the insurer's renewal questionnaire does. Or a board member read the number somewhere and wants it confirmed before the next risk committee. And the honest position in the room is that nobody can give a straight answer — what it actually is, whether it is mandatory, or whether the EAP you already pay for covers it.

That is not a knowledge gap in your team. It is a structural feature of how this standard arrived: quietly, as guidance, without the certification machinery that usually tells operators "this is real now, deal with it". So the question lands and there is nothing clean to point at. Here is what it is, what it is not, and what your organisation has to be able to show.

What is ISO 45003, exactly?

ISO 45003:2021 — full title Occupational health and safety management — Psychological health and safety at work — Guidelines for managing psychosocial risks — is the first international standard of its kind (ISO, 2021). Before it, there was no globally agreed reference for how an organisation should manage psychosocial risk. There were codes, frameworks and a great deal of opinion. There was no standard. Now there is one.

The word that matters is guidelines. ISO 45003 is guidance that supports an ISO 45001 occupational health and safety management system (ISO, 2021). You cannot be certified to ISO 45003 on its own. There is no auditor who hands you a 45003 certificate to put in a tender pack. That absence is exactly why the question is so hard to answer in a meeting — people assume that if there were a real obligation, there would be a certificate, and because there is no certificate, they assume there is no obligation.

Both halves of that assumption are wrong.

If it is not mandatory, why is everyone asking about it?

Because "not separately certifiable" is not the same as "optional". The duty to manage psychosocial risk is already law in every Australian jurisdiction through WHS regulation, and Safe Work Australia's model Code of Practice: Managing psychosocial hazards at work sets out what that duty requires — a cycle of identify, assess, control and review (Safe Work Australia). ISO 45003 and the model code are describing the same work. The standard gives you the international management-system language; the code gives you the local legal teeth. They point at the identical activity.

So when a tender, an insurer or a regulator reaches for "ISO 45003", they are not asking whether you hold a certificate. They are using the standard as shorthand for a harder question: can you demonstrate that you systematically manage psychosocial hazards the way a reasonable organisation in your position would? That is the "reasonably practicable" test, and the standard has quietly become the market's reference point for what a defensible answer looks like.

The hazards in scope are not vague. The model code recognises high job demands, low job control, poor support, poor change management, role ambiguity, bullying and harassment, and isolated or remote work, among others (Safe Work Australia). Read that list again as an operator. None of it is about an individual's mood. All of it is about how work is designed, resourced and managed. These are operating-model questions, which is precisely why the buyer for this is operations and risk — not the wellbeing inbox.

Does our EAP cover it?

No. And this is the most expensive misunderstanding in the room, because it is the one that feels safest.

An EAP is reactive, individual support. It activates after someone has been harmed enough to pick up the phone. It is necessary, and you should keep it. But it sits at the bottom of the cliff. ISO 45003 is about the top of the cliff — identifying the hazard in how work is organised, assessing it, and controlling it before it produces a claim, a resignation or an incident. Pointing at your EAP when an insurer asks about ISO 45003 alignment is like pointing at your ambulance contract when the auditor asks about your fall-prevention controls. It answers a different question.

The standard expects you to apply the hierarchy of controls to psychosocial hazards the same way you would to a physical one: eliminate or redesign the source where you can, and treat individual support as the lowest-order control, not the whole strategy. An EAP, by definition, is that lowest-order control. Counting it as your psychosocial safety framework is the gap most organisations do not know they have until a tender or a renewal makes it visible.

Two further things the standard assumes, that an EAP cannot give you. First, officer due diligence — your officers must be able to show they took reasonable steps to understand and address psychosocial hazards, and "we have an EAP" is not evidence of that. Second, a structural limit you already feel: once a site, team or manager's span passes Dunbar's number — the roughly 150-relationship ceiling — informal "we'd notice if someone was struggling" stops working. Above that, you need structured prevention and a risk register, not goodwill and accidental counsellors absorbing the load until they leave too.

What does demonstrating alignment actually require?

Map ISO 45003 onto the cycle the model code already requires, and the work becomes concrete. Demonstrating alignment means showing, in order:

• Identify — a documented process that finds the psychosocial hazards present in your actual work, by site and by role. Making the invisible visible. Not a staff survey about happiness — a hazard identification against the recognised categories.
• Assess — those hazards entered on the same risk register as everything else, rated for likelihood and consequence, with the high-exposure areas named.
• Control — controls applied against the hierarchy, with redesign of work taking priority over individual support, and the EAP correctly positioned as one control among several rather than the strategy.
• Review — evidence that you re-check after changes, restructures and incidents, because a control you set last year against a structure that no longer exists is not a control.

An organisation that can produce that trail can answer the tender question in one line. An organisation that cannot will reach for the EAP — and a sharp procurement or risk reviewer will see the gap immediately, because the EAP shows up in the wrong column.

Where the standard sits against the local duty

The wrong question, and the right one

"Are we certified to ISO 45003?" is the wrong question — you cannot be, and chasing a certificate that does not exist wastes the budget. The right question is whether you can produce the identify-assess-control-review evidence trail that the standard describes and the law already requires. That is the people-risk infrastructure that sits upstream of the EAP, in the gap nobody owns. Building it does two things at once: it reduces escalations to the EAP because the hazards causing them are being controlled, and it raises appropriate uptake because people are routed earlier and better. The Pathway exists to build that evidence trail — so the next time the question lands in a meeting, the answer is already on the register.