India's EHS Laws Are Stricter Than Most Companies Know. Here's What the New BRSR Disclosure Changes

January is audit season for most Indian companies. ISO 45001 certifications are being renewed. BRSR disclosures for FY2025 are in draft. And most EHS officers are realizing something uncomfortable: their company's compliance calendar is scattered across fragmented systems, different regulatory frameworks, and unclear accountability chains.

The reality is this: India's EHS regulatory framework isn't just about preventing workplace accidents. It's a multi-layer system that connects occupational safety to environmental compliance, financial disclosures, and statutory liability. And it's gotten stricter.

Which laws make up India's EHS regulatory stack?

At least four overlapping frameworks: the Factories Act, 1948 (now consolidated into the Occupational Safety, Health and Working Conditions Code, 2020), the Environment Protection Act, 1986, the ISO 45001:2018 management-system standard, and SEBI's BRSR for large listed companies.

If you're an EHS officer at a manufacturing, construction, pharma, or large office-based company in India, you're working within at least four overlapping regulatory domains:

What's changed most recently? BRSR now requires listed companies to disclose EHS incidents that previously stayed internal. No more soft reporting. A chemical exposure, a lost-time injury, or a regulatory inspection finding, it goes into your annual BRSR filing and is publicly visible. This has transformed EHS from a risk-management function into a governance and investor-relations matter.

What does BRSR require companies to disclose on workplace safety?

Principle 3 of the BRSR format asks for safety training coverage, the health and safety management system, safety incident numbers, and complaints and assessments on health and safety, for employees and workers separately.

The Business Responsibility and Sustainability Report (BRSR) requirement for listed companies has created what we call "EHS transparency at scale." Companies that previously reported incidents only to their internal audit committees now file them with stock exchanges.

"BRSR disclosure has forced companies to move from siloed safety reporting to integrated EHS governance. You can't hide a lost-time injury in an ISO 45001 audit anymore. It appears in your published disclosure."

For construction companies: the Factories Act + the OSH Code, 2020 + Environment Protection Act + BRSR (if among the top 1,000 listed) create overlapping compliance calendars. A single incident triggers inspections across multiple regulators.

For pharma: hazardous chemical handling is regulated under three frameworks simultaneously: the Factories Act (occupational exposure), the Environment Protection Act (waste disposal), and now BRSR (public disclosure).

For large office-based companies: BRSR coverage has expanded EHS responsibility beyond warehouse safety into office ergonomics, emergency preparedness, and contractor management.

Why do EHS compliance calendars break down?

Because each framework runs on its own cycle and is owned by a different function, and few companies pull them into one calendar.

Here's what we've learned talking to EHS teams across 50+ companies: most don't have an integrated compliance calendar that pulls together:

• Factories Act statutory inspections (which can be announced or surprise)
• Pollution Control Board NOCs and compliance schedules
• ISO 45001 internal audit cycles
• BRSR filing deadlines and disclosure preparation
• Regulatory training requirements under the OSH Code, 2020

When an inspection happens, companies scramble because these frameworks don't talk to each other in their systems. A pollution control visit and a safety audit hit different functions.

What should EHS teams prioritise in 2026?

If you're setting your EHS compliance priorities for 2026, three things matter:

1. Integrated Audit Readiness: Your Factories Act compliance and ISO 45001 audits aren't separate exercises anymore. They feed the same disclosure narrative. Auditors now cross-reference them.

2. Incident Disclosure Discipline: If you're a listed company, assume everything will be public. Train your teams that incident reporting is now governance reporting. Structured workplace safety and security training with per-person completion records also gives you the training-coverage figure BRSR asks for; see our workplace safety training hub.

3. Contractor and Subcontractor Accountability: Regulatory investigators don't accept "that was the contractor's responsibility." You're responsible for EHS oversight of everyone on your site.

What does regulatory misalignment cost?

Failed audits, regulatory notices and damage to investor credibility, usually discovered in the middle of an audit.

We've worked with companies that discovered during audits that their EHS compliance calendar wasn't aligned with regulatory timelines. One manufacturing firm realized their ISO 45001 audit was scheduled two weeks after a Factories Act inspection. Another pharma company found their BRSR disclosure was missing incident data because safety records lived in a different database than what the investor relations team was using.

The cost: failed audits, regulatory notices, and investor credibility damage.

The solution: a single source of truth for EHS compliance that tracks all frameworks, their cycles, their overlapping requirements, and your preparedness status.