ISO 45001, 50001, 27001: when to use them and which legal duties they do not replace

ISO 45001, ISO 50001 and ISO 27001 cover three different fields: occupational safety, energy and information security. They share one point that is easy to misread: all three are management system certifications issued by certification bodies and adopted voluntarily. Each field also has its own set of statutory duties, which bind companies that fall within scope. These duties run in parallel and do not depend on whether the company holds an ISO certificate.

Short answer: holding ISO 45001, 50001 or 27001 does not replace the corresponding statutory duty. This article explains when each standard is useful, and which legal requirements must still be met separately.

ISO 45001: safety certification does not replace occupational safety duties

ISO 45001 is the standard for occupational health and safety management systems. The assessment team looks at hazards on the shop floor: machinery, chemicals, work at height, forklifts, and how the organization manages those hazards.

Holding ISO 45001 is an advantage with customers and supply chains, but the certificate does not replace these duties:

• Mandatory occupational safety and hygiene training under the Law on Occupational Safety and Hygiene No. 84/2015/QH13;
• Technical safety inspection of machinery, equipment and materials that carry strict safety requirements;
• Periodic monitoring of the working environment;
• Fire prevention and fighting (PCCC): escape routes, fire alarm and firefighting systems, under the separate law on fire prevention and fighting. See fire safety for factories.

The ISO 45001 audit team also asks for these records during on-site assessment. So missing them makes certification difficult; holding the certificate does not exempt the company from them.

Before inviting an ISO 45001 audit team, companies should:

• Identify hazards by area: cutting, welding, warehouse, office;
• Assess risks, control measures and the person responsible for each area;
• Record all accidents, incidents and near misses in full, without hiding figures;
• Check PCCC, occupational safety and hygiene training records and personal protective equipment before the audit team arrives.

Note: the Law on Occupational Safety and Hygiene No. 84/2015/QH13 is still the law in force. The Government has recently issued Resolution 275/NQ-CP (17/9/2026) submitting a draft amending law to the National Assembly. It is still at the submission stage and is not in force. Companies continue to apply the current law and need not adjust anything for the draft.

ISO 50001: voluntary certification does not replace reporting to the energy authority

ISO 50001 is the standard for energy management systems (EnMS). Companies pursue it to manage energy internally: set an energy baseline, set saving targets, and track improvement year by year.

In parallel, the Law on Energy Conservation and Efficiency (amended by Law No. 77/2025/QH15, effective 01/01/2026) and Decree 30/2026/NĐ-CP (guiding implementation, issued 21/01/2026) impose separate duties on major energy-using facilities: prepare annual and 5-year plans for efficient energy use, carry out periodic energy audits, and report to the state authority.

A common mistake is to think that “getting ISO 50001 takes care of energy matters” without first confirming whether the company is a major energy-using facility. This can lead to pursuing the wrong route: the ISO certificate is obtained while the reporting duty to the state authority remains open.

What to do first: confirm whether the facility is a major energy-using facility under Decree 30/2026/NĐ-CP, and only then decide whether ISO 50001 is needed for customers or tender files. Likewise, ISO 14001 (environment) does not replace an environmental permit. See ISO 14001, 22000 and HACCP compared with state licences and ISO 14001:2026: how factories update their environmental system.

ISO 27001: information security certification does not replace the Personal Data Protection Law

ISO/IEC 27001 is the standard for information security management systems (ISMS). Certification confirms that an organization has a defined ISMS scope, a risk assessment, corresponding controls, and annual surveillance.

The Personal Data Protection Law No. 91/2025/QH15 (adopted 26/06/2025, effective 01/01/2026) and Decree 356/2025/NĐ-CP (guiding implementation, effective the same date) set a separate group of duties on personal data:

• Establish the legal basis for processing personal data (for example, the consent of the data subject; silence is not treated as consent);
• Carry out a personal data processing impact assessment where required;
• Apply specific rules when transferring personal data abroad;
• Define the responsibilities of data controllers and data processors.

Pursuing ISO 27001 as a “complete solution for personal data” misses this separate legal requirement. The certificate is useful when customers or tender files ask for evidence of an information security system. But it does not replace the impact assessment or the records on cross-border transfers when the company is required to prepare them.

A frequent trap: displaying the ISO 27001 logo on a website without having determined the legal basis for processing data, or without an impact assessment where one is required. When a customer asks on what basis their data is processed, a certification logo does not answer the legal question.

Three standards, three different legal frameworks: summary table

Common pitfalls and how to handle them

• Believing that an ISO certificate exempts a company from specialized-law duties. How to handle it: identify the two separate tracks at the start, and do not bundle them into one package for one fee.
• Not knowing whether the facility is a major energy-using facility before pursuing ISO 50001. How to handle it: determine the scope under Decree 30/2026/NĐ-CP first, then decide whether to add ISO 50001.
• Advertising an ISO 27001 certificate before determining the legal basis for processing personal data. How to handle it: review the records under the Personal Data Protection Law 91/2025/QH15 in parallel, rather than waiting until a customer asks.
• Pursuing ISO 45001 while factory escape routes are blocked or PCCC issues remain open. How to handle it: resolve PCCC and the basic occupational safety duties before inviting the audit team.

What Thái Tín supports

Thái Tín receives information about a company’s industry, size, and the requirements of its customers or tenders. This helps the company determine in advance whether it falls under a statutory duty (occupational safety, a major energy-using facility, or personal data processing), and whether to add ISO 45001, 50001 or 27001 certification. We connect it with consulting partners suited to each field and with certification bodies. Inspection, examination and enforcement under specialized laws are carried out by state authorities; assessment and issuance of certificates are decided by certification bodies. We track progress within the agreed scope.

Costs include consulting fees (if engaged) and the certification body’s assessment fees (if the company pursues ISO certification). We provide a quotation once the industry, size and specific scope of application are clear. See also ISO 14001, 22000 and HACCP compared with state licences, ISO 9001 certification and ISO, standards and certification services.

If you are unsure whether your company falls under a statutory duty on occupational safety, energy or personal data, send us your industry, size and current situation for a check before you decide whether to add ISO 45001, 50001 or 27001.

Questions and answers

Related articles

ISO What Should a Company Prepare to Obtain ISO 9001 Certification? ISO ISO 14001:2026: How Factories Update Their Environmental System Fire safety Factory Fire Safety: Design Appraisal, Acceptance, Records