Search for “EHS compliance management” and the first page of Google is mostly software platforms. The framing the SERP gives you is that EHS compliance is a tool you buy. For a California facility under CUPA, Cal/OSHA, DTSC, the Regional Water Board, and the local air district, that framing only works up to a point.
EHS compliance management software is real and useful. It tracks deadlines, stores documents, and generates reports. But software does not walk your facility, write your HMBP, sign your manifest, or stand in front of the fire department when they show up to inspect. That work is done by people. This piece sorts out what each one actually does, where they overlap, and why most California facilities end up needing both. For the full picture of what people-led compliance looks like, see our ongoing EHS compliance management guide.
What EHS Compliance Software Does
EHS compliance management software is a database with a workflow on top of it. The categories of work it handles well:
- Document storage. A central place to keep SDS, plans, permits, training records, and incident reports.
- Deadline tracking. Calendar entries and email reminders for CERS submittals, biennial reports, training renewals, and permit cycles.
- Inspection log capture. Mobile forms that replace paper checklists for weekly haz waste storage walks, monthly facility walks, and forklift logs.
- Incident and observation tracking. Near-miss reports, corrective action assignments, and audit follow-up status.
- Reporting outputs. Dashboards and exports that aggregate the data the platform is collecting.
That set of capabilities is what most “EHS compliance management software” pages are selling. The well-built platforms do it well. The work they do is real, and a facility with no system at all benefits from putting one in place.
What EHS Compliance Services Do
EHS compliance services are people performing the regulated work the software tracks. The categories:
- Walk the facility. A consultant on site, looking at labels, accumulation areas, secondary containment, BMPs, exit signage, eye wash stations, and training certificates posted at the right stations. Software does not see a degraded berm or a missing label.
- Write and update the plans. The IIPP, the Workplace Violence Prevention Plan under SB553, the HMBP, the SWPPP, the SPCC, the heat illness plan. These are not template fills. They have to reflect the specific operation, hazards, equipment, and chain of command at the facility.
- File the regulatory submittals. CERS for HMBP and APSA. SMARTS for the SWPPP annual report and NOI. DTSC for the biennial report. AER to the air district. The platform may remind you the deadline is coming. The person prepares the submittal and files it under their credentials.
- Deliver the training. Right-to-Know (at initial assignment and when new hazards are introduced), hazardous waste handler training where applicable, IIPP and WVPP refreshers, forklift, LOTO authorized employee training. Cal/OSHA accepts the format that meets the standard. The trainer has to be qualified for the topic.
- Stand in front of the inspector. When the CUPA (which may be a county environmental health department, fire department, or another local agency depending on jurisdiction) walks in unannounced, when Cal/OSHA arrives after a complaint, when the Regional Water Board does a stormwater inspection, the facility needs someone who knows the program, knows what is in the binder, and can answer the question without guessing.
- Translate regulatory change into facility action. When SB553 added the WVPP requirement, every California employer needed a written plan, a hazard assessment, and trained employees. Software did not write those plans. People did.
When we walk a facility for the first time, the most common pattern we see at sites that already have software is a clean dashboard with green checkmarks next to programs that are out of date in practice. The system is tracking a plan from 2019 that has not been reviewed against current operations. The deadlines are firing on time. The underlying compliance is not where the dashboard suggests.
Where Software and Services Overlap
The two categories do meet, and the overlap is where most confusion comes from.
| Function | What Software Does | What Services Do | Where They Overlap |
|---|---|---|---|
| Document storage | Holds the file | Writes the file, updates it, signs it | Both can be the system of record; services usually own the content |
| Deadline tracking | Reminds you it’s coming | Prepares and files the submittal | Calendar lives in software; ownership of the work lives with people |
| Inspection logs | Captures entries in a mobile form | Customizes the log, posts it, audits compliance with it | Software is the recording medium; services define and verify the log |
| Training records | Stores completion data | Delivers the training, signs the certificate | Both contribute; the qualified trainer is required for the delivery |
| Reporting | Generates a dashboard | Files the regulatory report with the agency | Software supports internal reporting; agency-facing reports are filed by people |
| Incident response | Routes the form | Investigates, writes the report, talks to the agency | Software triages; services close out |
The cleanest way to think about it: software is the system of record. Services are the work. The system without the work is a tidy index of nothing.
Comparing training options? LMS vs. in-person EHS training →
Have software in place but not sure whether your California programs are actually current? Call (925) 551-7300 or request a consultation. A short conversation about what your software is tracking versus what the regulations require is usually enough to identify the gap.
Why California Makes the Distinction Sharper
A few specifics of California regulation make the software-alone approach harder to sustain than the SERP suggests.
Inspections are physical. The CUPA inspector wants to see the binder, walk the haz waste accumulation area, look at the labels, and check the training records posted at the eyewash. Cal/OSHA reads the IIPP and asks the supervisor to explain how a specific hazard is communicated. Pulling a clean export from a dashboard does not answer those questions.
Plans have to match operations. The HMBP filed in CERS reflects what is actually stored on site. The SWPPP reflects current outfalls and BMPs. When a process changes, the plan changes, and the change has to be written by someone who has been on the floor.
Submittals require credentialed filers. CERS submittals are filed under a business contact or consultant account. SMARTS submittals require a Legally Responsible Person and Data Submitter assignment. SPCC plans above Tier 1 thresholds require a Professional Engineer’s certification. The software queue holds the file. The filing happens through a person.
Regulatory change is constant. SB553 (WVPP) took effect July 1, 2024. The Generator Improvements Rule reshaped federal hazardous waste requirements. SB14 source reduction runs on a multi-year cycle. Software vendors update features. Compliance professionals update programs.
For a deeper look at what these programs actually are, see what is EHS compliance management.
How They Fit Together at a California Facility
CDMS works alongside whatever software a facility already has. We are not selling a platform and we are not asking clients to replace one. When a client already has an EHS system, we are the people doing the work the system is tracking: walking the site, updating the plans, delivering training, filing submittals, and standing in front of the inspectors. The platform is the record. We are the activity.
When a client has no software, ongoing compliance management still works. The compliance binder, the calendar, the inspection logs, and the visit reports are the deliverables. Some clients move to a platform later; some never do. The compliance posture is the same either way. For the month-by-month view of the services side, see outsourced EHS services: what to expect.
What to Ask If You Are Comparing the Two
A practical filter for facilities trying to figure out whether they need software, services, or both:
- Who writes our plans, and is that person current with California regulations?
- Who files our CERS, SMARTS, and AER submittals?
- Who walks the facility and identifies deficiencies between inspections?
- Who delivers our annual trainings and signs the certificates?
- Who is on the phone with the CUPA or Cal/OSHA when there is a question?
If the answer to those questions is “the software,” the gap is on the services side. If the answer is “an internal person who is also doing two other jobs,” the gap is on capacity. If the answer is no one, the facility is exposed regardless of what platform is in the cloud.
Budgeting the program? How EHS compliance costs are determined →
Ready to figure out whether you need software, services, or both at your California facility? Call (925) 551-7300 or request a consultation. We will walk through your program count, what is in place, and where the actual gap is before any proposal is on the table.
