Legal register: where the law requires a register of obligations, where it only requires supervision, and why a status column on its own proves nothing

The question that comes before any software

Vendors of legal registers show tables of statutes with a status column: applicable, to be checked, not applicable. Which provision obliges a company to keep such a register is rarely stated on those pages. For deciding whether and how deeply a company with 20, 120 or 400 employees builds a register, that is the first question. The answer has two parts that should not be mixed.

Part 1: the express duty is in the EMAS Regulation

Annex I of Regulation (EC) No 1221/2009 governs the environmental review that, under Article 4(1)(a), every organisation seeking registration for the first time carries out. Point 3 of that annex reads in the version currently in force: “In addition to the establishment of a register of applicable legal requirements, the organisation shall also indicate how evidence that it is complying with the different legal requirements can be provided.”

The sentence contains two duties, not one. The register is the first, and the sentence takes it for granted. The second is the statement of evidence for every single obligation. Article 4(4) of the Regulation sets the same standard for registration: “Organisations shall provide material or documentary evidence showing that the organisation complies with all applicable legal requirements relating to the environment.”

EMAS is voluntary, and the duty is limited to environmental law. For a software company or an online retailer without registration, Annex I is therefore not a legal duty. As a benchmark for what a usable register contains, it is nonetheless the most precise text the law offers. The standards ISO 14001 and ISO 45001 likewise require, in their clause 6.1.3, that compliance obligations or legal requirements be determined; they are certification bases, not statutes.

Part 2: everyone else is bound by Section 130 OWiG

Section 130 Para. 1 Sentence 1 OWiG reads: „Wer als Inhaber eines Betriebes oder Unternehmens vorsätzlich oder fahrlässig die Aufsichtsmaßnahmen unterläßt, die erforderlich sind, um in dem Betrieb oder Unternehmen Zuwiderhandlungen gegen Pflichten zu verhindern, die den Inhaber treffen und deren Verletzung mit Strafe oder Geldbuße bedroht ist, handelt ordnungswidrig, wenn eine solche Zuwiderhandlung begangen wird, die durch gehörige Aufsicht verhindert oder wesentlich erschwert worden wäre.“ In substance: the owner of a business who intentionally or negligently omits the supervisory measures required to prevent contraventions of duties that fall on the owner and are punishable by penalty or fine commits an administrative offence if such a contravention occurs that proper supervision would have prevented or made substantially more difficult. Sentence 2 adds that the required supervisory measures include the appointment, careful selection and monitoring of supervisory staff.

The provision names no headcount and no sector. It does not require a register. It does, however, presuppose that the owner knows which duties carrying a fine or penalty bind the company, because there is no supervision over a duty nobody knows about. This is where a register turns from administrative overhead into evidence.

Section 130 Para. 3 OWiG sets the amount in two tiers. Where the breach of duty is punishable by a criminal penalty, the failure of supervision can be fined up to one million euros under Sentence 1. Where it is punishable only by a fine, Sentence 3 caps the fine at the maximum threatened for the breach of duty itself. Anyone who does not keep a hazardous substances register risks up to fifty thousand euros under Section 22 Para. 1 No. 2 GefStoffV in conjunction with Section 26 Para. 3 ChemG; the failure of supervision that allowed it reaches the same amount under Section 130 Para. 3 Sentence 3 OWiG.

The column most registers lack

A table of statute and status answers whether a provision applies. Annex I point 3 EMAS asks a second question: how compliance is evidenced. Section 130 OWiG asks a third that appears in no annex: who supervises the duty. A register that answers these three questions per row looks like this:

The middle column is why a status entry on its own proves nothing. “Applicable” without a reason cannot be checked, and “not applicable” without a reason is the riskiest row in the whole register during an inspection, because it asserts a deliberate decision that is documented nowhere.

Where CIVAC comes in and where it does not

A complete legal register covers environmental, occupational safety, product and data protection law. CIVAC covers the layer that Section 130 Para. 1 Sentence 2 OWiG expressly addresses: the appointment and monitoring of supervisory staff. The platform's obligation check matches the company profile against the catalogue of officer roles and marks for each role whether it is mandatory or recommended, together with the statutory trigger. For this layer that produces exactly the columns provision and “applies because”. Evidence and responsibility are kept by the respective role on the platform, at 49 euros per officer role per month.

Plant permits, conditions attached to official decisions and duties that attach to no officer role belong in a register that goes beyond this layer. An EMAS-registered organisation needs it in full.