ISO 45001 for contractors: VCA or ISO 45001?
As a contractor, you deal with clients who set requirements for occupational safety. Some ask for VCA, others ask for ISO 45001 , and a few clients accept both. The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) supervises compliance with the Arbowet (Dutch Working Conditions Act) , whatever certification you hold. On this page we explain when you need which certification and how to handle requirements for subcontractors.
VCA or ISO 45001 for contractors?
For most contractors in Dutch construction and industry, VCA is the usual requirement. It is the standard in tenders from housing associations, municipalities and industrial clients in the Benelux. ISO 45001 is gaining ground in international projects and with clients who expect a management system approach.
The difference is fundamental. VCA is a checklist with concrete requirements: a required number of toolbox meetings, mandatory personal certificates (Basis-VCA and VOL-VCA), and specific records. ISO 45001 is a management system that prescribes what you must arrange, but leaves you free in how you do it. Read the full comparison on the page ISO 45001 vs VCA.
VCA is recognised only in the Benelux and to a limited extent in Germany. If you work for international clients or multinationals, they often do not know VCA and ask for ISO 45001.
When does a contractor need ISO 45001?
The choice depends on your client base and the requirements clients set.
VCA alone is enough
VCA is enough if you:
- Work exclusively for Dutch or Belgian clients in construction or industry
- Have clients who explicitly ask for or require VCA
- Have no international activities
- Do not want to integrate with an ISO 9001 or ISO 14001 system
Example: An installation company that works for housing associations and municipalities in North Brabant is well served by VCA**. All clients know and ask for VCA.
Client requirements for contractors
Many clients set safety requirements for the contractors who work for them. This is anchored in ISO 45001 itself: clause 8.1.4 asks organisations to control the G&VW risks of outsourced work.
Typical client requirements are:
| Requirement | VCA | ISO 45001 |
|---|---|---|
| Proof of safety certification | VCA*/VCA** | ISO 45001 certificate |
| Personal certificates for employees | Basis-VCA or VOL-VCA | Not mandatory, but you must demonstrate competence |
| Safety induction on site | Standard in VCA practice | Part of contractor control |
| Work permit for hazardous work | VCA prescribes this | Part of operational control |
| Periodic evaluation of supplier | Not mandatory | Explicitly required by the standard |
If you work as a contractor without certification, a client can refuse you. The Arbowet also places responsibility on the client for the safety of contractors on its premises. In practice, this makes certification almost unavoidable for contractors working for professional clients.
Setting requirements for subcontractors
If you hire in contractors yourself, you are responsible for their safety at your workplace or project. ISO 45001 sets explicit requirements for this in clause 8.1.4 on controlling outsourced processes.
You must at least:
- Determine which G&VW requirements you set for subcontractors
- Communicate which risks are present at the workplace
- Demonstrate that you check whether subcontractors meet your requirements
- Record which subcontractors are active and what their safety status is
A contractor who outsources roofing work to a specialist company does not need to assess their entire G&VW system. But they do need to check whether the subcontractor knows the hazards, whether employees are certified for working at height, and whether they have the right personal protective equipment.
If a subcontractor has an accident on your construction site, the Nederlandse Arbeidsinspectie (Netherlands Labour Authority) will also look at you as main contractor. You share responsibility for coordinating safety when you have several parties working together.
A practical approach to subcontractor management
A simple approach works best. Draw up a standard questionnaire to send to new subcontractors. In it, ask about their certifications, their RI&E, how they organise toolbox meetings and how they report near misses.
Keep the answers and copies of certificates. For repeat work, check that certificates are still valid. Include safety requirements in your contractor agreement. And carry out a safety induction at the start of each project.
ISO 45001 as the basis for contractor management
If you have ISO 45001, the management of subcontractors is already built into your system. The standard requires you to arrange this. You do not need to set it up separately alongside your certification.
Link the evidence of subcontractors’ safety performance to your own internal audits and management review. That way it returns in your improvement cycle. Read more about the requirements of ISO 45001 per clause and about identifying hazards and assessing risks for outsourced work.
Construction and contractors: specific challenges
Contractors in construction face additional challenges that ISO 45001 specifically mentions.
Changing workplaces call for risk assessments per project. Under ISO 45001, hazard identification is an ongoing process, not a one-off document. Read how this works in ISO 45001 for construction.
On construction projects, the health and safety plan (V&G-plan, Veiligheids- en Gezondheidsplan) is also legally required. This plan aligns with the operational control in ISO 45001 and can serve as a project-specific elaboration of your system.
Next step
Want to learn more about choosing between VCA and ISO 45001? Read the full comparison on ISO 45001 vs VCA. Want to start certification? Look at the step-by-step plan or request a quote from a certification body such as Kiwa or TÜV .