ISO 45001 in Panama: occupational health and safety as a system you can prove

2026-10-11 8 min readBy the ICS technical team

ISO 45001 is the international standard for managing occupational health and safety (OH&S). It helps an organization prevent work-related injuries and ill health with the same method ISO 9001 applies to quality: identify risks, control them, measure results and improve. In Panama, much of what the standard asks for is already required by law. The difference is that ISO 45001 turns it into a system that works every day and that an independent third party can verify.

What Panamanian regulations require

Panama does not require ISO 45001 certification, but it does require companies to manage occupational health and safety. These are the references that matter most for most companies:

• For every employer. The General Regulation on the Prevention of Occupational Risks and Workplace Safety and Hygiene issued by the Social Security Fund (CSS Resolution 41,039-2009-J.D.) states that employers must organize their own occupational health, safety and hygiene systems and keep their prevention plans available to the CSS from the start of operations. It also provides for active worker participation and for advisory health and hygiene committees made up of employers and workers.
• In construction. Executive Decree 2 of 15 February 2008, issued by the Ministry of Labor, regulates safety, health and hygiene in the construction industry. It makes safety, health and hygiene committees mandatory, with equal numbers of employer and worker representatives. It also requires a safety study and plan from the project planning stage, safety personnel according to the size of the works, and a management system to carry out the plan, covering policies, emergency response, accident records and periodic review, among other elements.
• Inspections. On construction sites, a labor inspector or the CSS occupational risk staff can order work that poses a serious risk to stop immediately. A system that identifies and controls those risks before the visit is the best defense.

This list is not exhaustive. Depending on the activity, technical standards and specific regulations also apply, for example on personal protective equipment, and the system must identify each of them.

What ISO 45001 adds to those obligations

The law says what you must have; ISO 45001 says how to organize it so that it works and lasts. The correspondence is fairly direct:

• Prevention plans → hazard identification and risk assessment. The standard requires an ongoing process to identify hazards and assess risks (6.1.2) and to apply the hierarchy of controls (8.1.2): eliminate the hazard, substitute it, engineering controls, administrative controls and, as a last resort, personal protective equipment.
• Legal compliance → legal requirements and evaluation of compliance. A register of the obligations that apply to you (6.1.3) and a periodic evaluation of whether they are met (9.1.2), with evidence.
• Committees → worker consultation and participation. ISO 45001 requires consulting non-managerial workers and involving them in key decisions, such as hazard identification and incident investigation (5.4). A committee that actually works is a good way to show it.
• Contractors → procurement and contractor control. The standard requires coordinating the risks of contractors and outsourced processes (8.1.4), a critical point on sites with several subcontractors and in outsourced services.
• Emergencies and first aid → preparedness and response. Emergency plans tested with drills and reviewed after each exercise or event (8.2).
• Accident records → incident investigation. Every incident is investigated to find the cause and prevent it from happening again, not just to report it (10.2).

Internal audits, management review and, if you decide to certify, an assessment by an independent third party also leave evidence that carries weight with customers, insurers and authorities.

Who benefits most in Panama

• Construction companies and contractors. In construction, the law already requires a committee, a plan and safety personnel. ISO 45001 brings all of that into a single system and makes it easier to prove to the project owner.
• Logistics, ports and industry. Operations with heavy equipment, loads, night shifts or hazardous substances, where an accident stops operations and damages reputation.
• Suppliers to large companies. More and more buyers assess the safety performance of their suppliers and contractors before hiring them, just as with ISO 9001 in tenders and supplier registration.

How to get to certification

The path is the same as for any management system standard. A practical order:

1. Measure the distance.A gap analysis against ISO 45001 and against the regulations that apply to you shows what already exists and what is missing, prioritized by risk.
2. Identify hazards with the people who do the work.The hazard and risk matrix is better, and better followed, when workers build it together with supervisors and the committee.
3. Build the legal requirements register.Regulations, technical standards and customer conditions, each with an owner and evidence of compliance.
4. Define operational controls.Procedures for critical tasks, work permits, contractor control, emergencies and protective equipment.
5. Audit internally and review with management.An internal audit before the external one finds what the auditor would find. Here we cover the most common findings and how to prepare for the audit.
6. Do the pre-audit and the certification audit.The pre-audit confirms the system is ready; the certification audit is carried out in two stages.

Is it worth waiting for the new edition?

No. The revision of ISO 45001 is under way: the international draft went to ballot in 2026 and the new edition is expected in 2027, with a transition period for certified organizations, as happened with ISO 9001 and ISO 14001. The essentials stay the same: identify hazards, control risks, involve workers and comply with the law.

The topics the revision reinforces are good starting points right now: psychosocial risks, such as stress and workload; climate-related risks, such as extreme heat; and tighter control of contractors and the supply chain. If your company already works with ISO 9001 or ISO 14001, you can integrate the three standards into one system and audit them together.

This article is for information only and is not a substitute for legal advice on the health and safety obligations that apply to your activity.