Health and safety requirements by business size

Risk assessment

Every employer must carry out a suitable and sufficient risk assessment of workplace hazards under Regulation 3 of the Management of Health and Safety at Work Regulations 1999 (MHSWR). Self-employed persons must also assess risks if their work could affect others.

A suitable and sufficient assessment means you have:

• Identified the significant hazards arising from your work activities
• Decided who might be harmed and how
• Evaluated the risks and determined what precautions are needed
• Recorded the significant findings (mandatory if you have 5 or more employees)
• Implemented the control measures identified

You do not need to account for every trivial risk. Focus on hazards that could cause real harm, and take proportionate steps to control them.

When to review your risk assessment

Risk assessment is not a one-off exercise. You must review and update it when:

• There has been an accident, near miss, or case of work-related ill health
• You introduce new equipment, substances, or processes
• Your workplace layout or work patterns change
• New information about hazards comes to light (such as an HSE safety alert)
• You employ young workers (under 18), new or expectant mothers, or workers with disabilities who may face additional risks

As a minimum, review at least annually even if nothing has visibly changed.

Written health and safety policy

Section 2(3) of the Health and Safety at Work etc. Act 1974 requires every employer with 5 or more employees to prepare and keep up to date a written health and safety policy. Even if you have fewer than 5 employees, having a policy is good practice.

What the policy must contain

A compliant H&S policy has three parts:

1. General statement of intent - a signed and dated commitment from the most senior person, setting out the business's overall approach to managing health and safety
2. Organisation - who has responsibility for what. Name the people responsible for risk assessment, first aid, fire safety, training, reporting incidents, and maintaining equipment
3. Arrangements - the practical systems you have in place, including how you conduct risk assessments, what training is provided, how you consult employees, emergency procedures, and how you monitor and review performance

The policy must be brought to the attention of all employees. Review it whenever there are significant changes to your work activities, staffing, or premises.

First aid provision

The Health and Safety (First-Aid) Regulations 1981 require all employers to provide adequate and appropriate first aid equipment, facilities, and personnel. There is no fixed formula; what you need depends on a needs assessment considering your workplace hazards, the number of employees, your workplace layout, shift patterns, and distance from emergency services.

Appointed persons and first aiders

There are three main types of first aid personnel:

• First Aid Appointed Person - takes charge in an emergency and calls the emergency services. No formal training required, though awareness training is recommended. Suitable for lower-risk workplaces with fewer than 25 employees
• Emergency First Aid at Work (EFAW) - provides emergency first aid. Requires a 1-day training course. Certificate valid for 3 years. Suitable for low-risk workplaces such as offices and shops
• First Aid at Work (FAW) - provides full first aid including treatment of injuries and illness. Requires a 3-day training course. Certificate valid for 3 years. Suitable for higher-risk workplaces and larger organisations

Equipment

You must provide at least one suitably stocked first aid kit. HSE does not mandate exact contents, but recommends items including sterile dressings, bandages, safety pins, disposable gloves, eye pads, plasters (where not a food-handling environment), and a first aid guidance leaflet. Review and restock kits regularly.

RIDDOR: Reporting injuries, diseases and dangerous occurrences

The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) require employers, the self-employed, and people in control of premises to report certain workplace incidents to HSE.

What you must report

• Deaths - any death arising from a work-related accident
• Specified injuries - fractures (other than fingers, thumbs and toes), amputations, crush injuries to the head or torso, loss of sight (temporary or permanent), severe burns covering more than 10% of the body, scalping, loss of consciousness caused by head injury or asphyxia, and any injury requiring admittance to hospital for more than 24 hours
• Over-7-day incapacitation - where an employee is unable to carry out their normal duties for more than 7 consecutive days (not counting the day of the accident)
• Non-fatal injuries to non-workers - injuries to members of the public or others not at work who are taken directly to hospital for treatment
• Occupational diseases - including occupational dermatitis, occupational asthma, carpal tunnel syndrome, hand-arm vibration syndrome, tendonitis, and any occupational cancer, when a doctor confirms the diagnosis and the disease is linked to work
• Dangerous occurrences - near-miss events that could have caused serious harm, including collapse of scaffolding, failure of lifting equipment, explosion or fire causing work stoppage exceeding 24 hours, accidental release of biological agents, and electrical incidents causing fire or explosion

How and when to report

• Deaths and specified injuries: Report without delay by the quickest practicable means. Follow up with a completed online report form within 10 days
• Over-7-day injuries: Report within 15 days of the accident
• Occupational diseases: Report as soon as a doctor gives written confirmation
• Dangerous occurrences: Report without delay

Report online at the HSE RIDDOR reporting website. For fatal or specified injuries only, you can also telephone 0345 300 9923.

Record keeping

Keep records of all RIDDOR-reportable incidents for at least 3 years from the date of the event. You must also maintain an accident book (BI 510) for recording all workplace injuries, however minor. Accident book entries are subject to data protection requirements; use the current version which separates individual entries as tear-out sheets.

Health and safety training

Employers must provide employees with adequate health and safety training under Section 2 of the Health and Safety at Work Act 1974 and Regulation 13 of the MHSWR 1999. Training must be:

• On recruitment - induction training covering workplace hazards, emergency procedures, fire exits, first aid arrangements, and how to report concerns
• When exposed to new or increased risks - for example when starting a new task, using new equipment, working with a new substance, or transferring to a different role
• Repeated periodically - refresher training to maintain competence and awareness, particularly for high-risk activities
• During working hours - training must be provided at no cost to the employee and during their paid working time

Competent person

Regulation 7 of the MHSWR 1999 requires every employer to appoint one or more competent persons to assist with health and safety. In a low-risk workplace (a simple office, for example), the employer can often fulfil this role themselves after completing HSE guidance. In higher-risk environments, formal qualifications such as NEBOSH or IOSH Managing Safely may be needed. The law gives preference to appointing someone from within the workforce over using an external consultant.

Consulting employees on health and safety

You have a legal duty to consult your employees on matters affecting their health and safety. The regulations that apply depend on whether your workforce is unionised:

• Unionised workplaces: The Safety Representatives and Safety Committees Regulations 1977 apply. Recognised trade unions appoint safety representatives who have rights to inspect the workplace, investigate complaints, attend safety committee meetings, and be consulted on any changes affecting health and safety. If two or more safety representatives request it, you must establish a safety committee within 3 months
• Non-unionised workplaces: The Health and Safety (Consultation with Employees) Regulations 1996 apply. You must consult employees directly, or they may elect representatives of employee safety. You must consult on introducing measures affecting health and safety, planning and organising H&S training, the health and safety consequences of introducing new technology, and the appointment of competent persons

In either case, you must provide representatives with the time, facilities, and information they need to fulfil their role.

Display requirements: the H&S law poster

The Health and Safety Information for Employees Regulations 1989 require employers to either:

• Display the HSE-approved health and safety law poster in a location where all workers can easily read it, or
• Provide each worker with a copy of the equivalent pocket card (available as a free download from HSE)

The current version of the poster was introduced in 2014. Earlier versions are no longer legally compliant. The poster explains basic health and safety rights and responsibilities for both employers and employees. If your workers are spread across multiple sites or work remotely, the pocket card may be more practical.

Enforcement and penalties

Health and safety law is enforced by the Health and Safety Executive (HSE) and local authorities. HSE typically covers higher-risk sectors (construction, manufacturing, agriculture, chemicals), while local authorities cover lower-risk premises (offices, shops, hospitality, leisure).

Enforcement actions

• Improvement notice: Requires you to remedy a contravention within a specified period. Commonly issued for risk assessment failures, lack of written policy, or missing training records
• Prohibition notice: Immediately stops an activity that involves a risk of serious personal injury. Takes effect at once and cannot be continued until the risk is removed
• Prosecution: Criminal proceedings for serious breaches. Fines are unlimited in the Crown Court. Individuals (directors, managers) can face up to 2 years imprisonment. Gross negligence manslaughter carries a maximum of life imprisonment

Fee for Intervention

When HSE identifies a material breach during an inspection, it recovers its costs through the Fee for Intervention (FFI) scheme. The current rate is £183 per hour (from April 2025). This covers the inspector's time spent identifying the breach, investigating, and helping you put things right. You will be invoiced and must pay, though you can dispute the finding. FFI does not apply to local authority enforcement.

Sentencing guidelines

Since February 2016, fines for health and safety offences have been set according to the Sentencing Council's definitive guideline. Fines are proportional to the offending organisation's turnover and the level of culpability. Large organisations (turnover £50 million or more) can face fines from £250,000 up to £10 million or more for the most serious offences.