Is ISO 45003 Certifiable? What Indian Employers Must Do

8 min read · Work · Compliance

If someone has quoted you a price for getting your organisation certified to ISO 45003, it is worth understanding what you are buying before you sign anything. The answer is more interesting than a straight no.

ISO 45003:2021 is a guidance standard. It contains recommendations rather than requirements, so no accredited certification body can certify an organisation against it the way one certifies to ISO 45001 or ISO 9001. Some certification bodies do offer unaccredited certification or a compliance assessment instead. In India, no regulation currently requires a psychosocial risk assessment at all.

None of which means the standard is useless. It means the useful thing about it is not the certificate.

What Is ISO 45003, and What Does It Actually Contain?

It is the first international standard addressing psychological health at work, published in June 2021 by the technical committee ISO/TC 283. The full title runs: Occupational health and safety management, Psychological health and safety at work, Guidelines for managing psychosocial risks.

According to ISO's own catalogue entry, the document gives guidelines for managing psychosocial risk inside an occupational health and safety management system based on ISO 45001. It is written for organisations of any size in any sector. That relationship to ISO 45001 is the part that matters commercially, and we will come back to it.

The document itself is not free. ISO and its national member bodies sell it, which is worth knowing before you brief anyone to implement something they have only read summaries of.

Can You Be Certified to ISO 45003?

Not in the sense you are used to, and the clearest statement of this comes from BSI, the British Standards Institution, which led the development of ISO 45001 and pioneered ISO 45003. On its India page, BSI's own FAQ says: "Being a guidance standard, ISO 45003 does not include any requirements."

The same FAQ goes further. It states that because ISO 45003 is guidance, an organisation cannot be awarded an accreditation to it in the way it can to ISO 45001, and advises seeking a certification body accredited to ISO 45001 instead. It then says plainly that BSI offers unaccredited certification to ISO 45003, for clients with and without ISO 45001.

That disclosure is to BSI's credit, because it is buried in an FAQ on a page whose marketing copy elsewhere invites you to get certified. The distinction a buyer needs to hold is this. Accredited certification means a national accreditation body has assessed the certifier against international rules for how certification is done. Unaccredited certification means a company has assessed you and issued a document. Both can be useful. They are not the same thing, and they should not cost the same.

A standard written in the language of "should" cannot be audited for compliance in the language of "shall". Anyone selling you a pass or fail against ISO 45003 is selling you their own scheme, not the standard.

Certification body marketing in this category routinely lists legal compliance among the benefits. Before you accept that, ask which law.

Does Indian Law Require Any of This?

Not yet, and the detail here is more useful than the headline. The Occupational Safety, Health and Working Conditions Code, 2020 was brought into force by the Ministry of Labour and Employment on 21 November 2025, replacing thirteen central labour laws and extending health, safety and welfare coverage from seven named sectors to all of them.

The Government's own explainer of the Code, published by the Press Information Bureau, includes a section headed health, safety and wellbeing. What that section covers is safety committees at larger establishments, free annual health check-ups for every employee, and a single National Occupational Safety and Health Advisory Board to set national standards. Psychosocial risk does not appear in it. The health provisions are physical health provisions.

So an Indian employer today has a duty to run annual health check-ups and cap the working week at forty eight hours. It has no statutory duty to assess whether the work is making people mentally unwell, and no Indian regulator certifies anyone against ISO 45003.

Two things in the Code are worth watching, though. It creates a provision for third party audit and certification of certain classes of establishment. And the new National Advisory Board is empowered to set national standards that states must follow. If psychosocial risk ever becomes a compliance obligation in India, that is the door it walks through. Central and state rules under the Code were still being finalised through 2026, so this is a live space rather than a settled one.

What Counts as a Psychosocial Hazard?

Conditions of work, and relationships at work, that can damage a person's health. BSI's definition covers factors in the workplace and in the work itself that negatively affect physical, mental, cognitive or emotional health. It gives two clusters of examples: how the work is organised, meaning workload, deadlines, type of work, isolation and the balance between work and life; and social factors, meaning culture, working relationships, bullying, harassment, fairness and career development.

Read that list as an Indian HR leader and the gap between it and a wellness benefit becomes obvious. Nothing on it is fixed by an app subscription. Workload is a management decision. Fairness is a promotion process. Career development is a conversation someone is not having. We have written separately about what the evidence says about wellbeing programmes aimed at individuals, and it points the same way the hazard list does.

The Indian texture matters too. Hierarchy, loyalty to a manager who has been generous, the career cost of being the person who raised something. Those are psychosocial hazards operating through cultural mechanisms that a checklist written in Geneva will not name for you. We have written about what that looks like inside Indian workplaces in more detail.

So What Should an Indian Employer Actually Do?

Treat ISO 45003 as a decent structure for work you were going to have to do anyway, and stop shopping for a certificate.

Practically, that means four things. Identify which psychosocial hazards actually exist in your organisation, by asking people rather than guessing. Assess which of them are doing real harm and to whom. Change the conditions, which is the step almost everyone skips in favour of adding a service. Then measure again, so you can tell whether anything moved.

That middle step is where the money is and where the discomfort is. If your psychosocial hazard list says workload and role ambiguity, the intervention is a workload and role conversation held with the people who set both. No standard can hold that meeting for you.

On measurement, use instruments that have been validated rather than a questionnaire someone wrote in an afternoon, report only in aggregate with a minimum group size so nobody can be identified by inference, and never let the employer see individual responses. We have set out how to do that honestly at more length. And because you will be handling data about employee health, the Digital Personal Data Protection Act, 2023 and the rules notified in November 2025 apply to how you store and share it. We are not lawyers. Take your own advice, and read our note on what employers can and cannot see before you design the survey.

What Should You Ask a Vendor Selling You This?

Five questions, and the answers will sort the field quickly.

Is the certification you are offering accredited, and if so by which accreditation body. Which specific law does the legal compliance benefit refer to in India. What instruments will you use, and are they validated and published. What happens to an individual whose responses suggest they are struggling, and who sees that. And what will you report back to us that makes your own work look bad.

A vendor who answers those in writing is worth talking to. A vendor who cannot distinguish accredited from unaccredited certification, on a standard whose own publisher says it has no requirements, has told you how carefully they read things.

Which is the honest summary of this whole area. ISO 45003 is a useful document and a poor certificate. The employers who get something out of it will be the ones who used it as a checklist for changing how work is organised, and who were never really shopping for a logo.

What Else Do People Ask About ISO 45003?