Regulatory monitoring program

This program establishes the minimum global requirements for assessing legal compliance at all Microsoft locations by:

• Identifying and evaluating legal requirements related to occupational health and safety, relevant to Microsoft’s activities, whether conducted directly or by third parties.
• Assessing and addressing the impact of these requirements on employees, the company, and external staff to ensure a safe and compliant work environment for all stakeholders.

These requirements are intended to be applied at all Microsoft locations. Any variation to this global program, whether creating a location-specific procedure or plan, modifying the existing requirements, or making other changes, must be evaluated through the Occupational Health and Safety (OHS) Governance Framework before implementation.

Information about approved variations to this program can be found in Section 9 of this document.  

This document provides requirements for legal monitoring at facilities in countries where Microsoft has employees and OHS provides support, including owned or leased office and laboratory locations. The intended audience is the OHS Team or other personnel responsible for monitoring health and safety compliance regulatory requirements. 

Legal monitoring must be conducted utilizing Enhesa to document the legal register and ensure compliance with the legal requirements outlined within the legal register.

3.1 Regulatory Monitoring Modules

In Enhesa you will find the following modules:

• Compliance Intelligence – offers assessment tools to identify, understand, and assess compliance against country or local regulations.
• Regulatory Forecaster – provides a preview of potential future OHS regulations to plan for continued compliance across the globe.
• Legal Foundations – a search engine for all global regulations and expert analysis

3.2 Regulatory Assessment Topics

OHS regulatory compliance is evaluated and verified at Microsoft locations through regulatory assessments that may include the following categories: 

3.3 Jurisdictions

Microsoft conducts regulatory assessments for applicable jurisdictions to ensure compliance with safety and occupational health laws and regulations in the countries and regions where it operates.

Additional jurisdictions can be added on an ongoing basis based on the company’s needs by contacting the Microsoft Enhesa administrator. The management of adding new jurisdictions will be done twice a year. Only Enhesa can add or update jurisdictions based on the current design of the platform.

3.4 Facility

In countries supported by OHS, an Enhesa Corporate Dashboard entry is created for each office or laboratory building located in different cities or regions within a country. If a Microsoft location has several buildings of the same type on the same site (offices or laboratories), only one Enhesa entry will be created.

For practical purposes, if an office and a laboratory are in the same building or city, two Enhesa entries can be created so that they can be managed independently.

Microsoft sites will be identified using the following naming convention:

• “Region-Country-City-Facility Type,” if there is more than one location in the same country
• “Region-Country-Facility Type,” if there is only one location in the country

Enhesa populates the national, regional, and federal requirements based on jurisdiction and keeps them updated over time.

3.5 Applicability Assessments

The applicability screening process in Enhesa enables users to determine which regulatory requirements are relevant for their facility and operations based on a series of topic specific questions.

3.7 Legal Register

The output of completing the regulatory applicability assessments within the Enhesa Compliance Intelligence module is a legal register that includes all regulatory requirements for a specific facility. The legal register is stored within the Enhesa Compliance Intelligence module and is also available to download in a Microsoft Excel format.

3.8 Dashboards

On the Corporate Dashboard, each facility has a compliance status indicator showing the level of compliance of the facility based on the completion of the applicability screening and compliance assessment. The applicability and compliance graphs show completion of the relevant assessment and the level of compliance for the facility using colored indicators.

The Facility Dashboard displays the overall compliance performance of the facility, as well as compliance trends, opportunities, actions required, and regulatory updates. The dashboard also allows users to navigate specific requirements within each topic as needed.

3.9 Assessments Minimum Frequency

3.10 Actions Required Follow-Up

All actions that arise from assessments of legal requirements need to be recorded in Enablon—the tool used by Global OHS to track action items (and other functions) globally. Recording in this tool enables the Program Manager to monitor these actions and promptly update Enhesa or Legal Register to reflect full compliance with the legal requirement.

Regulatory assessment training will be provided to all Enhesa users by the Microsoft administrator as part of the implementation of this program.

Enhesa: A global environmental, health, and safety (EHS) consultancy that provides regulatory intelligence and compliance solutions to multinational companies.

High-risk environments: Areas within manufacturing, laboratories, secured workspaces, and other areas that routinely use hazardous equipment, machines, chemicals, or processes that may cause serious harm to employees, storage areas for gases/liquids, and other hazardous/dangerous chemicals or waste products.