Cincinnati, Ohio-Kentucky-Indiana
ISO 45001 consulting for a three-state metro.
A Cincinnati manufacturer with plants either side of the river answers to two different safety regulators. What that difference actually consists of changed in June 2025, and most sources have not caught up.
We work in the Kansas City metro. Engagements here run remotely, with on-site visits at the points where being in the building changes the outcome — gap analysis, internal audit, and the certification audits themselves. We do not maintain an office in this market and would rather say so than imply otherwise.
One metro, three states, three regimes
Cincinnati is fifteen counties across three states — Ohio, Kentucky and Indiana. That is not a piece of trivia. It means a manufacturer with a plant in Hamilton County and another in Boone County is running one safety programme against two different occupational-safety regulators, with two different inspectorates and two different sets of procedural deadlines.
The federal position on each is unambiguous. Ohio “is not an OSHA-approved State Plan, and is under federal OSHA jurisdiction which covers most private sector workers within the state.” Kentucky “operates an OSHA-approved State Plan covering most private sector workers.” So does Indiana.
Now the part that makes this worth a page rather than a paragraph. The intuitive conclusion — that the Kentucky side is the stricter one — used to be defensible and is no longer.
Kentucky enacted legislation effective 27 June 2025 that prohibits its programme from adopting new standards stricter than the federal ones, and from enforcing existing standards that federal OSHA has not adopted. The same law cut the window for filing a retaliation complaint from 120 days to 30, and codified issuing citations within six months.
Industry in Cincinnati
- Three states, two regimes Ohio sites are under federal OSHA; Kentucky and Indiana sites are under state plans with their own inspectorates and procedural deadlines. Indiana diverges on a unique excavations standard
- Kentucky's 2025 statute Effective 27 June 2025, Kentucky's programme may no longer adopt or enforce standards stricter than federal OSHA's, and the retaliation-complaint window fell from 120 days to 30
- The aerospace supplier tiers The metro's largest manufacturer publishes tiered supplier conditions — one requires only ISO 9001, the two above it require AS9100. Which one is on your purchase order decides everything
- Ohio BWC safety grants A three-to-one match up to $40,000 per cycle, with no management system requirement of any kind. The money is real; the certification prerequisite is imaginary
- Procter & Gamble Headquartered here, and its published supplier guidelines and responsible sourcing document name no ISO standard at all. It cannot be used as an ISO anchor and we will not use it as one
What the three-state split actually costs you now
If the substance has converged, does the split still matter? Yes — but for different reasons than a consultant would have given you two years ago, and the difference changes what you should build.
What is no longer true: that your Kentucky sites carry a materially heavier standards burden than your Ohio sites. That was the old answer and it is out of date.
What is still true, and what an ISO 45001 obligations register has to carry: you are dealing with separate regulators with separate enforcement programmes and separate inspection priorities. Your procedural clocks differ — the Kentucky retaliation window is now 30 days, and the citation deadline is codified. Your on-site consultation service is provided by a different state agency on each side. And Indiana genuinely does diverge on one point: per OSHA, Indiana “adopts all OSHA standards and regulations except it has a unique excavations standard.”
Clause 6.1.3 of ISO 45001 requires you to determine and have access to the legal requirements applicable to your hazards. For a multi-site employer in this metro, that is not one list. It is a list per jurisdiction, maintained separately, because the thing most likely to go wrong is not a missing standard — it is a missed deadline in a jurisdiction somebody assumed worked like the one next door.
A source conflict we are going to leave visible
We would rather show you an unresolved contradiction than tidy it away.
OSHA's own Kentucky state plan page still describes the programme as consisting of standards unique to Kentucky, federal standards incorporated with state-specific provisions, and federal standards incorporated without change. It makes no mention of the 2025 statute at all.
We cannot tell you from the outside whether the federal page is simply behind, or whether the practical effect is narrower than the statute's text suggests. What we can tell you is that both documents exist, that they point in different directions, and that anyone giving you a confident one-line answer about Kentucky safety standards in 2026 has probably read only one of them.
For a compliance register, the working assumption we would use is the statute, with the divergence noted in the register itself and a review date attached. That is what a documented obligations process is for. Recording an unresolved question and the date you will revisit it is a legitimate output. Pretending the question does not exist is not.
The aerospace boundary here is not what you would assume
The largest manufacturing employer in this metro is an aerospace engine business in Hamilton County, and the reflexive conclusion is that its supply chain is AS9100 territory we cannot serve. That is partly right, and the part that is wrong is worth real money to some readers.
Its published supplier quality requirements set out tiered conditions. One tier states that “the organisation shall have a quality management system that complies with … ISO 9001 — Quality Management System Requirements.” The two tiers above it require AS9100, one of them with independent certification under the aerospace industry's own scheme.
So the boundary is not the industry. It is which condition appears on your purchase order. A supplier flowed the baseline condition needs ISO 9001 and does not need AS9100, whatever the general reputation of the sector suggests.
Two honest limits on that. We do not know what proportion of the local supplier base sits at the baseline tier versus the AS9100 tiers, and we are not going to invent a share. And special processes — heat treatment, coating, welding and the rest — carry a separate accreditation requirement that we do not offer. Read your purchase order, find the condition number, and tell us what it says. If it names AS9100, we cannot take the work and we will say so in the first call.
Two things people believe about Ohio that are not so
The safety grant does not require a safety management system. Ohio's Bureau of Workers' Compensation runs a genuinely useful safety intervention grant — a three-to-one match, up to $40,000 per eligibility cycle. We read the eligibility criteria: state-fund or public taxing district employer, active coverage, current on payments, a demonstrated need for the intervention, two years of baseline data, and coverage activated at least two years ago. There is no ISO 45001 requirement, no certified safety management system requirement, and no management system requirement of any kind.
The money is real. The certification prerequisite is imaginary. If a consultant has linked the two, they are selling you something the programme does not ask for.
What is worth saying is the reverse connection, which is genuine rather than invented: the grant requires two years of baseline data and a follow-up case study. That is measurement discipline, and it is exactly what an ISO 45001 system produces as a by-product. If you are going to be asked for baseline and outcome data anyway, having a system that generates it is convenient. That is a reason to build one. It is not a requirement to.
And the largest consumer products company headquartered here does not require ISO certification of its suppliers. We checked both its supplier guidelines and its responsible sourcing document. Neither names ISO 9001, ISO 14001, ISO 45001 or ISO 27001. It is a name people reach for on pages like this, and it does not support the claim.
What we are not going to claim about this metro
Northern Kentucky is a major air cargo node, and we went looking for a standards angle in it. We did not find one — no ISO 9001, ISO 14001 or supply-chain security certification requirement at the airport or its two large hub operators that we could document. So there is no logistics section on this page.
We are also not printing a medical device establishment count for this metro, because the federal database was not reachable when we checked. There is real device manufacturing here. We just do not have a number we would stand behind, and an unverified figure is worse than none.
The manufacturing base itself is substantial and verified: 2,121 manufacturing establishments, 1,847 of them under 100 employees, employing around 114,850 people (US Census County Business Patterns, 2023). That is the market. It does not need embellishing.
How we work with companies here
We are based in the Kansas City metro and run Cincinnati engagements remotely, with on-site work at the points where being in the building changes the outcome — the gap analysis walkthrough, the first internal audit cycle, and the certification audits.
For a multi-site employer here the on-site work concentrates on the obligations register, because that is the deliverable most likely to be wrong and least likely to be checked. Building it per jurisdiction rather than per company is the whole job.
The consultant who scopes the engagement does the work. No handoff to a junior implementer after the sale.
What an engagement covers
- ISO 45001 system build An occupational health and safety management system for an employer whose sites are not all under the same regulator. See ISO 45001.
- Multi-jurisdiction obligations register Clause 6.1.3 done properly: a maintained list per state, with the procedural deadlines that differ, and a recorded review date against the questions that are genuinely open.
- ISO 9001 for the baseline aerospace tier If your purchase order names the ISO 9001 condition rather than the AS9100 ones, that is work we can do. See ISO 9001.
- Purchase order condition review Reading the supplier quality conditions on your actual orders to establish which standard you are contractually held to, before anyone quotes a project.
- Safety grant evidence Baseline data and follow-up measurement assembled so it serves both the management system and a grant application, rather than being produced twice.
- Gap analysis and roadmap Two to four weeks, fixed scope and price, with a clear go or no-go before real money is committed.
- Internal audit and management review Auditor-grade internal audits and a facilitated management review producing recorded decisions.
Questions we get from companies in this market
Are Kentucky's safety standards stricter than Ohio's?
They were arguably heading that way, and as of 27 June 2025 they are not. Kentucky enacted legislation prohibiting its programme from adopting standards stricter than the federal ones and from enforcing existing standards federal OSHA has not adopted. It also shortened the retaliation-complaint window from 120 days to 30 and codified a six-month citation deadline. So the practical difference between your Ohio and Kentucky sites is now administrative and procedural — different regulator, different inspectorate, different clocks — rather than a different standards burden. Anyone telling you otherwise in 2026 is describing 2024.
Then why does the three-state split still matter?
Because clause 6.1.3 of ISO 45001 requires you to determine and have access to the legal requirements applicable to your hazards, and for a multi-site employer here that is not one list. Ohio sites are under federal OSHA. Kentucky and Indiana sites are under state plans with their own enforcement programmes and inspection priorities. Indiana genuinely diverges on one point — OSHA notes it adopts all federal standards except for a unique excavations standard. And the procedural deadlines differ. The failure mode is rarely a missing standard; it is a missed deadline in a jurisdiction someone assumed worked like the one across the river.
OSHA's own Kentucky page does not mention that 2025 law. Which is right?
We do not know, and we are not going to pretend we do. The federal page still describes standards unique to Kentucky and makes no mention of the statute. Both documents exist and they point in different directions. From outside the agency we cannot tell whether the page is simply behind or whether the practical effect is narrower than the text. What we would do in a compliance register is work to the statute, record the divergence explicitly, and attach a review date. Documenting an open question with a date on it is a legitimate output of an obligations process.
We supply the aerospace engine plant. Can you help us?
It depends on which supplier quality condition appears on your purchase order. The published requirements are tiered: one tier requires a quality management system complying with ISO 9001, and the tiers above it require AS9100, one with independent industry certification. If your order names the ISO 9001 condition, that is work we can do. If it names AS9100, we cannot — we do not offer it, and neither do we offer the special-process accreditation that applies to heat treatment, coating and welding. Send us the condition number from the order and we can tell you in one email rather than three meetings.
Do we need ISO 45001 to get an Ohio safety grant?
No. We read the eligibility criteria for the Bureau of Workers' Compensation safety intervention grant and there is no management system requirement of any kind — the criteria are being a state-fund or public taxing district employer with active coverage, being current on payments, demonstrating a need, providing two years of baseline data, and having had coverage for at least two years. It is a three-to-one match up to $40,000 per cycle. The money is real and the certification prerequisite is imaginary. What is genuinely useful is the overlap: the grant wants baseline data and a follow-up case study, and that measurement discipline is something an ISO 45001 system produces anyway.
Does the big consumer products company here require ISO certification from suppliers?
Not as far as we can establish. We checked both its published supplier guidelines and its responsible sourcing document, and neither names ISO 9001, ISO 14001, ISO 45001 or ISO 27001. Its responsible sourcing material cites the UN Guiding Principles on Business and Human Rights and the ILO Declaration rather than any ISO standard. It is a name that gets used to justify ISO projects in this market and it does not support the claim. If a customer is genuinely requiring a standard of you, it will be in your contract or supplier manual — ask to see the clause.
Other standards we support in Cincinnati
Other standards in Cincinnati
This page is about ISO 45001, which is what this metro's industry asks for most often. We cover these here too.
- ISO 9001 in Cincinnati The aerospace supplier requirements published here are tiered. One tier asks for ISO 9001 and nothing more. Which tier appears on your purchase order decides everything.