ISO 22458 sets out how to design and deliver services that work for consumers in vulnerable circumstances. It is the standard behind a growing number of procurement questions in regulated sectors, and it is less about policy than most people expect.
What the standard covers
ISO 22458:2022 was published in April 2022, developed from earlier British Standard work on inclusive service provision. It specifies requirements for identifying consumers who may be in vulnerable circumstances and for designing services that do not disadvantage them.
The framing matters. The standard treats vulnerability as a circumstance rather than a characteristic. Someone is not permanently a vulnerable consumer. They may be in vulnerable circumstances because of bereavement, illness, a change in income, low digital confidence, language, or simply because the situation is stressful and the process is complicated.
That reframing has a practical consequence: you cannot solve it with a list of protected groups. A service that only works for a confident, healthy, financially stable customer with good English and a reliable internet connection is excluding far more people than any list would suggest.
What it asks for
In broad terms:
- Governance. Named responsibility, a policy, and evidence that senior management is engaged rather than nominally supportive.
- Inclusive design. Services designed so that they work for people in difficult circumstances by default, rather than relying on a special process that has to be requested.
- Identification and response. A way for staff to recognise when someone may need adjusted support, and the authority to provide it.
- Staff capability. Training, and crucially the discretion to depart from a script.
- Channels. Realistic alternatives for people who cannot use the default route, which in practice usually means a genuine non-digital option.
- Monitoring and improvement. Measurement of whether any of it works, and action when it does not.
Who is asking for it
Interest is concentrated where a regulator already expects fair treatment of customers in difficulty: financial services, utilities, water, telecoms, housing and increasingly public sector contracts. In those sectors ISO 22458 offers something regulatory principles do not, which is independently assessed evidence that the approach exists and functions.
It is also appearing in tenders as a differentiator rather than a requirement, which is generally the point at which businesses start asking about it.
What implementation actually involves
The gap in most organisations is not policy. It is that the policy exists and the service does not follow it.
The work tends to concentrate in four places. Mapping the customer journey to find where someone in difficulty would fall out of it, which is usually a specific step: an online-only form, a rigid identity check, a payment process with no flexibility. Giving frontline staff explicit authority to make adjustments, because training without authority produces staff who recognise the problem and cannot act. Fixing the default rather than adding a special route, since special routes require people to identify themselves as needing help, which many will not do. And recording adjustments so you can demonstrate the system works, without building a database of people's private circumstances.
That last point needs care. Evidence of process is what the standard wants. Collecting sensitive personal data about vulnerability creates a data protection problem that will cost you more than it solves.
Certification
ISO 22458 follows the familiar management system pattern, so a business already certified to another ISO standard has much of the underlying machinery. Document control, competence, internal audit, management review and corrective action all carry across. The subject matter is new; the structure is not.
A business with an existing certified system should expect a considerably shorter implementation than one starting from nothing.
Is it worth doing
If you are in a regulated sector where fair treatment of customers in difficulty is already an expectation, it turns something you are asserting into something you can evidence. If tenders in your market have started asking, it is a differentiator now and will be a requirement later.
If neither applies, the honest answer is that the underlying practice is worth adopting and the certificate may not be, yet.
Our ISO 22458 consultancy covers gap analysis, policy, journey mapping, staff training and support through certification. If you hold another standard already, adding this one is system implementation work rather than a fresh build, and our guide to adding a second standard explains why that is cheaper than it sounds.
‹ Back to all articles