Author: Dr. Chizaram Nwankwo, Posted on: July 6th, 2026 | Reading time: 12 minutes

UK health and safety law requires every employer to ensure, so far as is reasonably practicable, the health, safety and welfare of employees. Key legislation includes the Health and Safety at Work Act 1974, the Management of Health and Safety at Work Regulations 1999, and workplace-specific regulations covering fire, COSHH, RIDDOR, and display screen equipment. Employers must appoint a competent person, conduct risk assessments, and maintain documented safety policies.

Health and safety compliance is not optional and it is not primarily about paperwork. It is a legal framework that governs how UK employers manage risk to people: their employees, contractors, visitors, and the public affected by their activities. Most business owners understand this in the abstract. Fewer understand which specific laws apply to their business, what those laws actually require them to do, or what happens when the Health and Safety Executive (HSE) finds that they haven't done it.

This guide covers the legislation that applies to most UK employers, the specific duties it creates, and the practical steps that satisfy those duties. It is written for business owners, operations managers, and company directors who are responsible for compliance and want to understand the legal landscape accurately rather than rely on guesswork.

What does UK health and safety law actually require?

The legal framework for workplace health and safety in the UK rests on two primary pieces of legislation: the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999. Everything else — RIDDOR, COSHH, the fire safety order, DSE regulations — sits beneath these two and applies specific requirements to specific hazards or sectors.

The core duty under UK health and safety law is expressed in Section 2(1) of the Health and Safety at Work Act: every employer must ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees. "So far as is reasonably practicable" is a legal test, not a get-out clause. It means that the cost and effort of a control measure can be weighed against the risk it addresses, but only where the risk is genuinely low. Where risk is significant, the duty is close to absolute.

For health and safety compliance for small business UK, the same legal framework applies as for large employers. There is no headcount threshold below which the duty of care disappears. What changes is the complexity of what compliance looks like in practice: a 5-person accountancy firm and a 200-person manufacturing site are both bound by the Health and Safety at Work Act, but the practical steps needed to comply are very different.

The HSE compliance requirements that most UK employers need to address cover five areas: risk assessment, a written health and safety policy (mandatory for five or more employees), appointment of a competent person, information and training for employees, and consultation with employees on H&S matters.

The Health and Safety at Work Act 1974 explained

The Health and Safety at Work Act 1974 is the primary piece of health and safety legislation in Great Britain. It places duties on employers, self-employed persons, manufacturers of equipment and substances, designers of workplaces, and employees themselves.

Section 2 sets out the employer's general duties, which include:

• Providing and maintaining plant and systems of work that are safe and without risks to health
• Making arrangements for the safe use, handling, storage, and transport of articles and substances
• Providing the information, instruction, training, and supervision necessary to ensure health and safety at work
• Maintaining the workplace and access to it in a condition that is safe and without health risks
• Providing and maintaining a working environment that is safe, without health risks, and has adequate welfare facilities

Section 3 extends the duty to non-employees. Employers must conduct their undertaking so that people who are not their employees but who may be affected by it (contractors, visitors, members of the public) are not exposed to risks to their health and safety. This is frequently overlooked by smaller businesses that focus on employee protection and fail to consider the risks their activities create for others.

Section 4 places duties on persons who have control of non-domestic premises. If a business controls the maintenance or operation of a building used by others, it has specific duties toward the people who use or work in that building.

Section 7 places duties on employees. Every employee must take reasonable care of their own health and safety and that of others who may be affected by their acts or omissions at work, and must cooperate with their employer on H&S matters. This does not transfer liability from employer to employee; it places a parallel duty on both.

The Act is enforced by the Health and Safety Executive for most industries and by local authorities for retail, offices, and some hospitality premises. Breach of the general duties is a criminal offence. Penalties on summary conviction can reach £20,000; on indictment, fines are unlimited and imprisonment for up to two years is possible.

Management of Health and Safety at Work Regulations 1999

If the Health and Safety at Work Act 1974 sets the general duties, the Management of Health and Safety at Work Regulations 1999 (MHSWR) translate those duties into specific obligations that must be discharged.

Regulation 3: Risk assessment

Every employer must carry out a suitable and sufficient assessment of the risks to the health and safety of employees and of others who may be affected by their work activities. Employers with five or more employees must record the significant findings of that assessment. A risk assessment that describes generic hazards without reference to the specific workplace, specific tasks, and specific people affected does not meet the "suitable and sufficient" test.

Regulation 4: Preventive and protective measures

Where risks are identified, employers must implement preventive and protective measures following a hierarchy of controls: elimination first, then substitution, then engineering controls, then administrative controls, then personal protective equipment. PPE sits at the bottom of this hierarchy because it relies on human behaviour rather than system design. Using PPE as the primary control measure for a significant hazard is generally insufficient.

Regulation 5: Health and safety arrangements

Employers must establish and give effect to appropriate arrangements for the effective planning, organisation, control, monitoring, and review of protective and preventive measures. For smaller businesses, this is usually captured in the arrangements section of the H&S policy. For larger or more complex operations, it requires a documented safety management system.

Regulation 7: Competent persons

Every employer must appoint one or more competent persons to assist them in complying with health and safety law. A competent person has sufficient training, experience, knowledge, and other qualities to be able to identify the relevant risks and put appropriate controls in place. The preference under the regulation is to appoint from within the organisation where the competence exists; where it doesn't, an external appointment is explicitly permitted.

Regulations 8 and 9: Procedures and contacts

Employers must establish procedures for serious and imminent danger (evacuation, emergency response), and must make arrangements with external emergency services where necessary.

Regulations 10 and 13: Information and training

Employers must provide employees with comprehensible and relevant information about the risks they face and the measures in place to protect them. New employees, those changing roles, and those exposed to changed risk levels must receive appropriate training.

The competent person requirement: what it means for your business

Regulation 7 of the MHSWR 1999 is the provision that most frequently causes compliance problems for UK SMEs. Many businesses either haven't appointed a competent person at all, or have appointed someone with a job title but without the knowledge and experience the regulation requires.

The HSE's guidance on health and safety duties for employers UK states that the competent person should have the knowledge, skills, experience, and understanding of relevant current best practice to identify and address health and safety risks in the employer's specific work activities. A job title, a one-day training course, or access to a software platform doesn't automatically satisfy this requirement.

For most SMEs, the question is practical: where does the competence come from? Three sources are recognised:

Internal appointment. Where someone within the business has genuine knowledge of the relevant hazards and how to control them, they can be formally appointed. The key word is genuine; the appointment should reflect actual competence, not just availability.

External appointment. An external consultant or consultancy can be formally appointed as the competent person. This is the most common route for SMEs that don't have appropriate expertise in-house. The appointment should be documented, and the agreement with the consultant should confirm that they are acting as the Regulation 7 competent person, not just providing general advice.

Combined approach. Larger SMEs sometimes appoint an internal person with a good working knowledge of the business alongside an external specialist who provides deeper expertise and advisory support.

The HSE's position is that where internal competence is adequate, businesses should use it. The regulation is not designed to mandate external consultancy; it is designed to ensure that whoever is responsible for H&S advice has the knowledge to give it reliably.

For businesses that want to compare retained vs ad-hoc consultancy options, the competent person requirement is often the deciding factor. A retained consultant who formally accepts the Regulation 7 appointment gives the business ongoing, documented compliance with the requirement, not just ad-hoc advice.

RIDDOR, COSHH, fire safety and other key regulations

Below the primary legislation sit a series of regulations that apply to specific hazards, activities, or sectors. Most UK employers are subject to several of these simultaneously.

RIDDOR 2013: Reporting of Injuries, Diseases and Dangerous Occurrences

The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 require employers to report certain workplace incidents to the HSE. Reportable events include: deaths of workers or members of the public arising from work activities; specified injuries to workers (fractures, amputations, loss of sight, burns, and others listed in Schedule 1); over-7-day injuries where an employee cannot carry out their normal work for more than 7 consecutive days; occupational diseases (carpal tunnel, occupational asthma, hand-arm vibration syndrome, and others); and dangerous occurrences (near misses with serious potential consequences as listed in Schedule 2).

Reporting deadlines matter. Specified injuries must be reported immediately. Over-7-day injuries must be reported within 15 days of the incident. Failure to report is a separate offence from the incident itself.

COSHH 2002: Control of Substances Hazardous to Health

The Control of Substances Hazardous to Health Regulations 2002 require employers to assess and control exposure to substances hazardous to health. COSHH applies to a wider range of workplaces than most employers assume. Cleaning products, dusts generated by cutting or grinding, paints, adhesives, biological agents in healthcare and food processing, and welding fumes are all covered. A COSHH assessment for each relevant substance is a specific legal requirement separate from the general risk assessment.

The Regulatory Reform (Fire Safety) Order 2005

This requires the responsible person (the employer, or the person with control of the premises) to carry out a fire risk assessment covering the premises, remove or reduce fire risks, provide adequate fire detection and warning, and maintain escape routes. For premises with sleeping accommodation or complex layouts, a qualified fire risk assessor is normally required. For straightforward lower-risk premises, a competent person with appropriate knowledge can carry out the assessment.

The Display Screen Equipment Regulations 1992

Employees who use display screen equipment as a significant part of their work are entitled to a DSE assessment, regular breaks, and eye tests if requested. The Regulations apply to home workers as well as office workers; the legal duty on the employer follows the employee regardless of where they work.

The Manual Handling Operations Regulations 1992

Employers must avoid hazardous manual handling operations where reasonably practicable, and where this is not possible, must carry out a suitable assessment and reduce the risk. The assessment should consider the load, the task, the working environment, and the individual.

Workplace (Health, Safety and Welfare) Regulations 1992

These cover the physical workplace itself: lighting, ventilation, temperature, cleanliness, space, floors, doors and windows, welfare facilities (toilets, washing, rest areas, and facilities for meals). These are baseline requirements; failing them will attract an improvement notice from an HSE inspector.

Most UK employers are subject to several of these simultaneously. A manufacturing business might face COSHH, RIDDOR, manual handling, workplace welfare, and fire safety obligations as a minimum, each with its own specific requirements and documentation demands.

What happens during an HSE inspection?

The HSE carries out two types of inspection activity: proactive inspections (planned, targeting sectors or topics identified as priorities) and reactive inspections (triggered by a complaint, a report of an incident, or a referral from another enforcing authority).

HSE inspectors do not give advance notice of proactive inspections. They have powers under Section 20 of the Health and Safety at Work Act to enter premises at any reasonable time; to examine, investigate, and take samples; to require persons to answer questions; and to inspect and copy documents. Obstructing an inspector is a criminal offence.

During an inspection, the inspector will typically want to see: the written health and safety policy; the risk assessment records; the competent person appointment; RIDDOR records; training records; COSHH assessments for relevant substances; and the fire risk assessment. They may walk the workplace, talk to workers (often privately), and observe work in progress.

The outcome of an inspection can be: no action required; verbal advice; an improvement notice (requiring specific action within a defined timeframe); a prohibition notice (stopping an activity that poses a risk of serious personal injury, with immediate effect); or prosecution.

Prosecution rates have been rising. The HSE secured 246 criminal prosecutions in 2024/25 with a 96% conviction rate. Total fines exceeded £33 million. These are not outliers. The cases that result in prosecution typically involve a serious incident, a history of enforcement activity, or significant management failures; they also include smaller businesses where fundamental compliance was absent.

Download our compliance checklist to audit your current setup before an inspection. Knowing what an inspector will ask for is the first step to being prepared when they arrive.

Fee for Intervention: the cost of non-compliance

Where an HSE inspector identifies a material breach of health and safety law, the Fee for Intervention (FEI) scheme allows the HSE to recover the cost of the regulatory time spent dealing with it. The current FEI hourly rate is £163 (2024/25 figure). The fee applies from the point at which the inspector identifies the material breach.

A material breach is defined as a contravention that requires the inspector to serve an improvement or prohibition notice, send a notification of contravention, or take other formal enforcement action. The scope is broad; it can include failures to have a written H&S policy, missing COSHH assessments, or inadequate risk assessment records, as well as more serious physical hazards.

The total FEI bill depends on how much HSE time is spent. An initial visit with a follow-up inspection and correspondence might generate a bill of £1,500 to £3,000 or more. Prohibition notices that require ongoing HSE involvement can result in bills significantly higher than that.

The FEI scheme changed the financial calculus for many businesses. Before its introduction in 2012, the direct financial cost of an HSE visit that didn't result in prosecution was limited. Now, finding a material breach generates an immediate fee, regardless of whether prosecution follows.

FEI charges sit on top of, not instead of, civil liability. An employer found in breach of their statutory duties and facing a RIDDOR-reportable incident is exposed to both: HSE enforcement costs and a civil claim from the injured worker. Employer's liability insurance covers the civil claim; it does not cover FEI charges, fines, or prosecution costs.

When to engage a health and safety consultancy

Understanding UK health and safety law is one thing. Applying it consistently, keeping documentation current, managing changes in the business, and being ready for an HSE inspection without notice is another. For most SMEs, the gap between understanding the obligation and discharging it reliably is where compliance failures occur.

The case for external H&S consultancy rests on three practical realities.

Competence is specific. A general knowledge of health and safety law is not the same as the ability to identify the specific risks in a welding workshop, a care home, a chemical laboratory, or a food processing plant and put appropriate controls in place. The Regulation 7 competent person requirement exists because general awareness is insufficient. The question for any business is whether the competence required for their specific activities exists internally or needs to come from outside.

Documentation goes stale. Risk assessments written when a business launched and not reviewed since are a liability, not an asset. They represent a documented record of hazards the business identified but has not actively managed. An external consultant provides the scheduled review cycle that keeps documentation current and defensible.

Business change creates compliance gaps. New premises, new equipment, new processes, new workers, and new contractors all create H&S implications that need to be assessed. For a business owner managing growth, compliance reviews are often the last item on the list. A retained consultant puts them on a schedule rather than leaving them to chance.

The practical choice for most SMEs is between a retained arrangement (a fixed monthly fee covering ongoing support, scheduled visits, and advisory access) and project-based fees for specific pieces of work. Both models are legitimate; the right choice depends on the frequency with which the business needs H&S support and whether the competent person requirement is being met. At Nancheez, the retained service includes a formal Regulation 7 appointment, scheduled inspections, documentation review, and unlimited advisory access. A free 30-minute gap analysis establishes what your business currently has in place and what it needs.

Frequently asked questions

What are my health and safety responsibilities as an employer?

Under the Health and Safety at Work Act 1974, you must ensure the health, safety and welfare of your employees so far as is reasonably practicable. This means: providing a safe workplace and safe systems of work; providing information, instruction, training, and supervision; appointing a competent person under Regulation 7 of the MHSWR 1999; conducting and recording risk assessments; maintaining a written H&S policy if you employ five or more people; and consulting with employees on H&S matters. Specific additional duties apply depending on the hazards present in your workplace.

Do health and safety regulations apply to small businesses?

Yes. The Health and Safety at Work Act 1974 applies to every employer regardless of size. Some specific regulations have thresholds — the requirement to have a written H&S policy applies to businesses with five or more employees, for example — but the general duty of care exists from the first employee. Health and safety compliance for small business UK is governed by the same primary legislation as for large organisations; the difference is in the complexity and depth of what compliance looks like in practice.

What is the HSE and what does it do?

The Health and Safety Executive is the national regulator for workplace health and safety in Great Britain. It sets policy, publishes guidance, enforces legislation in most industry sectors, investigates serious incidents, and prosecutes employers who breach health and safety law. Local authorities enforce health and safety legislation in some sectors including retail, offices, and parts of hospitality. The HSE operates the Fee for Intervention scheme, which allows it to recover costs from employers where a material breach of health and safety law is identified.

What is a risk assessment and is it a legal requirement?

A risk assessment is a structured examination of what in your workplace or work activities could cause harm, who could be harmed and how, and what steps are in place to prevent that harm. It is a specific legal requirement under Regulation 3 of the Management of Health and Safety at Work Regulations 1999. Employers with five or more employees must record the significant findings. The assessment must be suitable and sufficient — generic assessments that don't reflect the specific activities and hazards of your business do not meet this test.

How often should a health and safety policy be reviewed?

The Health and Safety at Work Act 1974 requires the written H&S policy to be revised whenever it is no longer appropriate. In practice this means reviewing it whenever there is a significant change in the business (new premises, new processes, new equipment, significant changes in workforce) and at minimum annually. An annual review date should be recorded on the policy itself, with evidence that the review was carried out.

What is RIDDOR and when do I need to report?

RIDDOR is the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013. It requires employers to report specified workplace incidents to the HSE. You must report: deaths and specified injuries (fractures, amputations, loss of sight, serious burns, and others) immediately; over-7-day injuries within 15 days; certain occupational diseases once diagnosed; and dangerous occurrences (near misses with serious potential consequences listed in Schedule 2 of the Regulations). Reports are submitted to the RIDDOR online reporting service on the HSE website.

Dr. Chizaram Dagogo-Nwankwo is a Chartered Ergonomist (C.ErgHF, CIEHF) with over 20 years of experience across oil and gas, healthcare, and high-hazard UK operations. He leads every engagement at Nancheez Ltd personally. Published author in human factors and process safety.

A free 30-minute gap analysis is available at nancheez.co.uk. We review what you have in place and tell you what — if anything — needs to change.