Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Regulatory Compliance

    Also known as: Compliance management, Legal compliance

    Definition

    Meeting the duties set by the laws, regulations and permits that apply to an organisation's activities, which depend on the jurisdiction and the activity.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/regulatory-compliance

    Scope: Compliance is a legal state set by the law that applies, not a software status or a certificate. A record shows evidence; a regulator or court judges the duty.

    Example for your evaluation: Link one duty to its legal source and version, the sites it applies to, an owner, the evidence of the action and the date it was last reviewed.

    Sources checked: . Examples are editorial illustrations.

    What the law and regulators say about duties and evidence

    The sources opened for this page give no single definition of regulatory compliance, so this page uses a working one: meeting the duties that the laws, regulations and permits applying to an organisation's activities set out. Section 5 of the US Occupational Safety and Health Act, as OSHA publishes it, tells an employer to provide a place of employment free from recognised hazards that are causing or are likely to cause death or serious physical harm, and to comply with the standards made under the Act. Each employee must comply with the standards, rules, regulations and orders that apply to their own conduct. HSE's legal-status page refers to regulations and to the duties imposed by the Health and Safety at Work etc Act. Compliance is judged against that legal text, so a company checklist is evidence about a duty and is not the duty.

    What counts as enough depends on the instrument. HSE says following its guidance is not compulsory unless stated, though doing so will normally be enough. An approved code of practice has a special status: if a duty holder is prosecuted and it is proved that the relevant provisions were not followed, the duty holder must show compliance in some other way or a court will find them at fault. EU-OSHA says the 1989 Framework Directive guarantees minimum requirements while Member States may keep or introduce stricter measures, and that transposing it had different effects across Member States.

    EPA says the legal obligations of the regulated community are determined by the terms of facility-specific permits, underlying statutes and state and local law, not by its audit protocols. Its Audit Policy offers incentives to entities that voluntarily discover, promptly disclose, correct and prevent recurrence of violations. Its conditions include systematic discovery through an audit or a compliance management system and written disclosure within 21 days of discovery, and repeat violations and those causing serious actual harm are excluded. Compliance management is a way of finding out where an organisation stands, not a status. This is general information, not legal advice, and the law where you work governs.

    Sources opened :

    What a compliance record holds in software

    • The requirement in plain words, with its exact source: Act, regulation or permit condition, section and version consulted.
    • Where it applies, by site, activity and legal entity, and where it was judged not to apply, with the reason.
    • The owner, the action or control that meets it and how often it is reviewed.
    • The evidence that the action happened, such as an inspection, test, training record or report, with its date and author.
    • The evaluation: met, partly met or not met, who judged it, when and on what evidence.
    • Gaps and their corrective actions, with due dates and closure evidence.
    • The change history: when the requirement changed, who reviewed the change and what was done.

    Compliance, evidence, guidance and certification

    Compliance is a state defined by the law that applies, and a regulator or court judges it. Evidence is the record that a duty was done, and a software status can show only evidence. Guidance has the legal status its publisher gives it, as HSE's page shows. A certificate or audit result concerns a standard and a scope on a date, and it does not replace the check against the law.

    A hypothetical example: a register that reads 85 per cent

    Everything in this case is invented and describes no real site or law. A small blending site keeps a register of 40 duties taken from its permit and from the regulations it has found to apply. Each row names the source and version, the area covered, an owner, the control, the evidence and the date of the last review.

    At quarter end the register shows 34 rows with current evidence, 4 with overdue evidence and 2 judged not to apply, which is 34 plus 4 plus 2, or 40. The dashboard figure of 85 per cent, 34 of 40, counts rows that hold evidence. It is not a compliance rate, because it does not say whether the duties were met. The reviewer opens two of the 34 and finds that one test result is above the limit written in the permit. The row is changed to not met, a corrective action is opened, and the reviewer records whether the permit requires notice to the regulator.

    Common misunderstandings about regulatory compliance

    • Software does not make an organisation compliant. It can hold the requirement, evidence and review, but the law sets the duty and others judge it.
    • A green status is not a finding of compliance. It may mean only that a document was uploaded.
    • Following guidance is not always the same as meeting the law. HSE says its guidance is not compulsory, yet an approved code of practice has a special status in a prosecution.
    • One rule does not apply everywhere. EU-OSHA describes minimum requirements that Member States may exceed, and EPA points to permits and state and local law.
    • Self-discovery does not guarantee relief. EPA's Audit Policy sets conditions, a 21-day disclosure window and exclusions.

    How regulatory compliance relates to other glossary terms

    Compliance sits where legal duties meet the systems an organisation builds to meet them, so its neighbours are specific duties, enforcement and audit.

    • RIDDOR: one specific legal duty in Great Britain, with its own list of events to report.
    • OSHA NEP: how one regulator directs its inspection effort, through directives that are not standards.
    • ISO 19011: guidance for auditing management systems, which is separate from the legal duties themselves.
    • EHS: the function that usually carries these duties for environment, health and safety.

    Records and evidence that usually exist for regulatory compliance

    • A register of requirements with source, version and jurisdiction.
    • Applicability decisions by site and activity, with reasons.
    • Evidence records such as inspections, tests, monitoring results, training and permits.
    • Corrective actions with owners, due dates and closure evidence.
    • Reports and notices sent to regulators, with dates and any acknowledgement.
    • Internal and external audit reports, and records of regulator inspections and their outcomes.
    • Review records showing when each requirement and its evidence were last checked.

    What a software tool needs to capture for regulatory compliance

    • Each requirement stored with citation, source link, version date and jurisdiction.
    • Applicability by site and activity, with a reason for each exclusion.
    • Separate states for evidence uploaded, judged met and confirmed by a named person, so an upload alone does not turn an item green.
    • An evaluation with reviewer, date and basis, which cannot be silently overwritten.
    • Change tracking that raises a task and a recorded decision whenever a requirement changes.
    • Deadlines for reports to regulators, with the date sent and proof, and an export of the register with its history.

    Catalog profiles documenting compliance obligation or regulatory content records

    The list follows the compliance obligation or regulatory content rule used by the compliance management software guide. It does not show that a product's legal content covers your jurisdiction or is current, so test it against a requirement you know has changed.

    Same rule for every product: tagged “Compliance Management”, “Compliance”, “Compliance Tracking”, “Risk & Compliance”, “EHS Management”, “ISO Management” or “Environmental Management”, with a sourced compliance obligation or regulatory content capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Ordered by how closely our sources document this process, not by quality. Sponsored placements are labelled. How lists are ordered

    All 12 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Does compliance software make an organisation compliant?

    No. The law that applies sets the duties, and a regulator or court judges whether they were met. Software holds evidence of what was done.

    Is following guidance the same as complying with the law?

    Not always. HSE says following its guidance is not compulsory but will normally be doing enough, and an approved code of practice has a special status in a prosecution. Other regulators word this differently.

    Do the rules differ between countries?

    Yes. EU-OSHA says the EU framework directive sets minimum requirements that Member States may exceed, and the US and British duties are separate laws. Check the law where you operate.

    More qhse terms