ISO 45010:2026 in practice — how to move from intention to arrangements people can actually use

On Monday 7 September 2026, ISO 45010:2026 was published — the first international standard on menstruation and menopause in working life. A year ago I wrote about a standard that did not yet exist. Now it does, anyone can read it, and the question many companies and managers are sitting with right now is: how do I implement it?

I will say where I think employers should begin, and where you need to pay particular attention — because there are traps that are easy to fall into if you do not know they are there.

The trap sits inside the subject matter itself

The standard is about health, and health data is a special category of personal data across the whole of the EU/EEA. That makes the most common first reflex — "we need to map the needs" — also the riskiest one. The standard knows this. Two sentences in the published text are, in my view, the most important ones for employers who want to stay inside European data protection law.

On evaluation and measurement (5.9.1, note 2):

"Information relating to menstrual and menopausal health can be considered identifiable health data and can be subject to national or regional jurisdiction-specific requirements for its collection, storage and analysis."

And inside the manager's toolkit, right beside the template for the confidential conversation (Annex B.1.2, note 2):

"Applicable national or regional legal and regulatory requirements can apply to the collection, storage and analysis of health-related data."

So the standard says that what a manager hears in such a conversation may be health data, and that collection, storage and analysis are legally regulated. It does not say how you solve that. It leaves that to each jurisdiction — and to you.

What does that mean in practice?

The standard offers guidance and obliges no one. National employment law — in Norway, where I write from — allows an employer to hold information about health circumstances in order to adapt the work, but not to demand diagnoses, and it distinguishes information about work capacity from details about illness. Processing health data requires both a legal basis under GDPR Article 6 and that an exemption in Article 9 is met. (See the Norwegian Data Protection Authority on health data in employment and its guidance on monitoring at work.)

My recommendation is the third layer, and it is simple: Do not make health data your standard proof.

First establish which needs you can meet through ordinary access — where no one has to explain themselves — and which ones require individual follow-up. Individual accommodation still exists, with the information that is genuinely necessary, and with a clear route to a confidential conversation. But it should be the exception, not the front door.

Start with one arrangement employees can use

Picture a workplace running several shifts. The staff handbook says: "Employees who need accommodation can contact their immediate manager." That sentence is a necessary route of contact. It says nothing about what is available before the conversation, or what the manager has the authority to do.

Take access to menstrual products as the example. An employee discovers mid-shift that she needs a product. If the products sit in a locked cupboard and the key is with a manager who has gone home, the staff handbook helps her very little in that moment.

This review is already laid out, arrangement by arrangement, in the reading view of the guide: what access to products looks like in practice.

A practical review starts at the cupboard. Talk with employees and safety representatives about where the products should be, and check whether the solution works on every shift. No one has to disclose anything about their own health to take part. Then someone has to own the arrangement over time: the facilities lead owns restocking, with a named stand-in during absence; the location goes into the onboarding of new employees; empty dispensers are reported as an operational deviation with a deadline for correction.

A possible starting point for the routine:

Menstrual products are available in the designated toilets throughout working hours and can be taken without individual approval. The facilities lead follows up stock levels, with a named stand-in during absence. The routine states the inspection frequency and the deadline for correction. The organisation records stock and restocking, not who takes a product.

This is a constructed example of one narrow arrangement, not a quotation from the standard and not a finished routine. But the difference from the starting point is clear: it is now possible to check whether the arrangement is in place, and who corrects a shortfall. The employee knows what she can use without first finding the right person. The same review can be done for temperature, breaks and the possibility of rest.

Follow the arrangement in operation — and be honest about what the numbers show

Once the arrangement exists, examine availability: are the products where the organisation said they would be? Does that hold for the shift that rarely meets the head office? How long does a reported shortfall stay open?

Three aggregate numbers — coverage, use and friction — show that the arrangement exists, is used and can be reached. They do not show how many employees have a particular health need, and they do not prove that sickness absence fell. Conclusions like that need a different basis. Be especially careful with reporting from small groups: removing names is not the same as anonymising, and information can make people recognisable when it is seen in combination.

"We have no legal, compliance or HR department"

Most organisations do not, and the standard has its own guidance for small businesses. The minimum is three things held by one person, often the managing director: someone who owns the arrangement, one sentence in the staff handbook about what a manager should not write down, and three numbers showing the arrangement is running. You do not need a new dashboard or a dedicated app to discover that the cupboard is locked.

Where the system is missing an important part

Reading the Norwegian public inquiry NOU 2023:5 "The great difference" three years ago made it clear to me that working life was missing something important. For me this is also the connection to what we are building at Sydera. We call it Workplace Resource Infrastructure: the infrastructure that ties the workplace's physical resources to availability and day-to-day operation. Women's occupational health makes the need concrete, but the logic is the same when an employee needs ergonomic equipment, when shift workers need somewhere to rest, or when caring responsibilities require predictability. The needs differ; the question is the same: who owns the arrangement, how do people get access, how is failure detected, and who corrects it.

Put simply: measure the arrangement, not the person.

What comes next

I have written a practical guide for Norwegian workplaces — arrangement by arrangement, with the data boundary as a design requirement throughout, and the link to ISO 45001. It is open to everyone: Kroppen følger med. If you want to go straight to the practical walkthrough, you can read it page by page — step by step, with the robot showing what actually happens on the floor.

And if you want to start today: read the guide «The Body Comes to Work». It is open online and as a PDF, and shows what a workplace can arrange in advance and what procedures should say, with reference to ISO 45010:2026. If you are a group, we can prepare an Executive Brief, free of charge, built only on published sources. What is missing from the text may well exist in practice — a document reading does not confirm that the organisation complies with the standard or the law. But it is a bounded place to start.

Thanks to Kathleen Riach and the whole working group, and to Standards Norway and the able and invaluable members of SN/K 551 Occupational health and safety management systems. The standard is freely available from ISO: iso.org/standard/64365.html

Nicolai Slinning · Member of SN/K 551 Occupational health and safety management systems · Working Group Expert, ISO/TC 283/WG 6 and WG 10, nominated by Standards Norway · contributor to ISO 45010:2026 · STÖ GROUP / SYDERA.io Technologies AS

Participation is in a personal capacity following nomination by Standards Norway. Content on this website does not represent ISO or ISO/TC 283.