Health and safety for small businesses: what UK law requires
For an office, shop, studio or small site, health and safety law comes down to about a dozen duties. This handbook sets each one out with its threshold, its deadline and the record you have to keep, checked against the Health and Safety Executive and the regulations themselves.
Every UK employer must assess the risks in its work, have a health and safety policy, appoint a competent person, train its staff free of charge, provide first aid, display the law poster and hold employers' liability insurance. At five or more employees the policy and the significant findings of the risk assessment must be written down. Certain injuries must be reported under RIDDOR: an injury that keeps a worker off normal duties for more than seven days must be reported within 15 days of the accident, and records kept for at least three years.
Download the handbook PDF · 5 pages · no sign-up
What does health and safety law require of a small business?
| Duty | Applies to | Record required |
|---|---|---|
| Health and safety policy | Every employer | In writing at 5 or more employees, and shared with staff |
| Risk assessment | Every employer | Significant findings, and groups especially at risk, at 5 or more |
| Competent person | Every employer | None specified; name them in the policy |
| Information and training | Every employer | None specified; keep training records |
| Consult employees | Every employer | None specified |
| Law poster or leaflet | Anyone who employs anyone | The approved poster displayed, or the leaflet given to each worker |
| First aid | Every employer | None for the needs assessment |
| Fire risk assessment | The responsible person for the premises | Recorded in full, whatever the headcount (England and Wales) |
| Accident record | 10 or more people normally employed on the same premises | Each accident, kept at least 3 years |
| RIDDOR reports | Every employer and person in control of premises | Reportable incidents, kept at least 3 years |
| Employers' liability insurance | Most employers | Certificate displayed where employees can access it |
Start with the policy: the health and safety policy template is laid out in the three parts the Health and Safety Executive (HSE) asks for.
How do you do a risk assessment?
The duty is to make a suitable and sufficient assessment of the risks to your employees and to anyone else affected by your work. HSE sets the process out as steps:
- Identify hazards. Walk the workplace, ask the people who do the work, and read your accident record.
- Assess the risks. Who could be harmed, how, and how likely and serious it is.
- Control the risks. Remove the hazard if you can; if not, reduce the risk.
- Record your findings. Required at five or more employees.
- Review the controls. After an accident or near miss, when work changes, and on a regular date.
The law does not say how long a general risk assessment must be kept. Keep the current version and its predecessors for as long as they could be needed to show what you knew and did.
Who has to be appointed, trained and consulted?
A competent person. You must appoint one or more competent persons to help you meet your health and safety duties. HSE says this can be you, and that if there is a competent person within your workforce you should use them in preference to someone from outside. Competence means the skills, knowledge and experience to recognise the hazards in your business and help you control them.
Training. You must provide the information, instruction, training and supervision needed for people to work safely. Training must take place during working hours, be given on recruitment and when someone is exposed to new or increased risks, and be repeated periodically where appropriate. It must be free: section 9 of the 1974 Act forbids charging employees for anything done to meet a specific health and safety requirement.
Consultation. You must consult your workforce on health and safety. Two sets of regulations cover it: the Safety Representatives and Safety Committees Regulations 1977, where a recognised trade union has appointed safety representatives, and the Health and Safety (Consultation with Employees) Regulations 1996 for employees not covered by them. You consult either directly or through representatives the employees elect; HSE is clear that the employer cannot decide who the representative will be.
What must be recorded and reported after an accident?
Two separate regimes apply, with different thresholds.
The accident record. Under social security law, an employer who normally employs 10 or more people at the same time on or about the same premises must keep a record of accidents, in a book or electronically, and preserve each entry for at least three years. HSE publishes an accident book you can buy, but your own system is acceptable. Below that number most employers are not required to keep one (mines, quarries and factories are caught regardless), though you will need the same information to decide whether RIDDOR applies.
RIDDOR. The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 require the responsible person to report certain incidents to the enforcing authority.
| Incident | What counts | Deadline |
|---|---|---|
| Death | Of a worker or non-worker from a work-related accident | Notify without delay; report within 10 days |
| Specified injury | The injuries listed in the regulations, such as most fractures and amputations | Notify without delay; report within 10 days |
| Over-seven-day injury | A worker away from work, or unable to do their normal duties, for more than 7 consecutive days. The count excludes the day of the accident and includes weekends and rest days. | Report within 15 days of the accident |
| Over-three-day injury | More than 3 consecutive days away or unable to do normal duties | Record only. No report. |
| Injury to a non-worker | A member of the public taken directly from the scene to hospital for treatment. Examinations and diagnostic tests do not count as treatment. | Notify without delay; report within 10 days |
| Occupational disease | The diseases listed, where linked to the work | As soon as a diagnosis is received |
| Dangerous occurrence | The near-miss events listed in Schedule 2 | Notify without delay; report within 10 days |
Two details catch employers out. Someone back at work on light duties is still "unable to do their normal work duties", so the seven-day clock keeps running. And RIDDOR records must be kept for at least three years from the date they were made.
What are the rules on display screen equipment?
The Health and Safety (Display Screen Equipment) Regulations 1992 protect "users": in the regulations, an employee who habitually uses display screen equipment as a significant part of their normal work. HSE's working description is workers who use it daily, for continuous periods of an hour or more. For each user you must:
- Carry out a workstation assessment and reduce the risks it finds.
- Make sure work is broken up by breaks or changes of activity. There is no legal rule on how long or how often; HSE's examples are guidance.
- Provide an eye test if a user asks for one, at your cost. You pay for glasses only if the test shows the employee needs special glasses prescribed for the distance the screen is viewed at; if an ordinary prescription is suitable you do not.
- Provide training and information.
HSE says the law applies to users at a fixed workstation, mobile workers, home workers and people who hot-desk.
What about first aid, fire and electrical equipment?
First aid. You must provide equipment, facilities and people that are adequate and appropriate in the circumstances. HSE's minimum is a suitably stocked first-aid kit, an appointed person to take charge of first-aid arrangements, and information for all employees about those arrangements. There is no fixed legal ratio of first-aiders to staff: the number depends on your own assessment of need. An appointed person does not need formal training and is not the same as a first-aider.
Fire. In England and Wales the responsible person for the premises must carry out a fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005. Since 1 October 2023 the assessment, including all its findings, and the fire safety arrangements must be recorded in full in all circumstances; the old five-employee threshold for recording no longer applies. Scotland and Northern Ireland have their own fire safety law.
Electrical equipment. The Electricity at Work Regulations 1989 require electrical systems to be maintained so as to prevent danger. HSE states plainly that this does not make portable appliance testing a legal requirement, nor require it annually. How often to inspect or test depends on the type of equipment and where it is used. A simple way to keep track is a column in the asset register.
What about home workers, stress and new mothers?
Home workers. You have the same health and safety responsibilities for people working at home as for any other worker, and your risk assessment must cover them. In most cases you do not need to visit. HSE asks you to consider stress and poor mental health, using equipment safely and the working environment. Clauses for this are in the hybrid working policy template.
Work-related stress. Employers have a legal duty to protect employees from stress at work by doing a risk assessment and acting on it. HSE's Management Standards give six areas to assess: demands, control, support, relationships, role and change. Using the Standards is not compulsory, but HSE treats an assessment that follows them as suitable and sufficient. Our stress risk assessment template is built on the six.
New and expectant mothers. HSE says you must carry out an individual risk assessment covering the worker's specific needs once she has told you in writing that she is pregnant, is breastfeeding or has given birth in the last six months. If a risk cannot be controlled you must adjust her conditions or hours, then offer suitable alternative work on the same terms, and failing that suspend her on full pay. See the maternity leave employer guide.
Young workers. Before employing anyone under 18 your risk assessment must take account of their inexperience and immaturity.
What about insurance and enforcement?
Employers' liability insurance. Most employers must hold cover of at least £5 million from an authorised insurer and display the certificate where employees can access it, which can be on an intranet. You can be fined £2,500 for every day you are not properly insured, and £1,000 for not displaying the certificate or refusing to make it available to inspectors. The main exemptions are a business that employs only close family members, which is lost if the business is a limited company, and a company whose only employee owns 50% or more of its shares.
Who enforces. HSE inspects higher-risk workplaces such as factories, farms and building sites. Local authorities enforce in offices, shops, hotels, restaurants and leisure premises.
Penalties. In England and Wales there is no upper limit on the fine for most health and safety offences committed on or after 12 March 2015, in either the magistrates' court or the Crown Court. Individuals can also be imprisoned for many offences.
A first-year checklist
- Take out employers' liability insurance and display the certificate.
- Display the health and safety law poster.
- Carry out and record the fire risk assessment.
- Put a stocked first-aid kit in place and name an appointed person.
- Name your competent person.
- Write the health and safety policy, sign it and share it.
- Record the significant findings of your risk assessment.
- Record your arrangements for managing health and safety.
- Review the policy and each risk assessment.
- Check training records and refresh what is due.
- Review the accident record for patterns.
- Re-do workstation assessments for anyone who has moved or reported a problem.
Frequently asked questions
What health and safety documents does a small business need by law?
A health and safety policy and a risk assessment, both written down at five or more employees; a fire risk assessment recorded in full; the law poster or leaflet; an employers' liability insurance certificate; and records of any incidents reportable under RIDDOR.
Do I need a health and safety policy with fewer than five employees?
You must still have a policy, but you do not have to write it down. The Health and Safety Executive says every business must have a policy and that it is useful to write it down even below five employees.
When does an accident have to be reported under RIDDOR?
Deaths, specified injuries, dangerous occurrences and injuries to non-workers taken directly to hospital for treatment must be notified without delay and reported within 10 days. An injury that keeps a worker off normal duties for more than seven days must be reported within 15 days of the accident.
Is an accident book a legal requirement?
Where 10 or more people are normally employed at the same time on or about the same premises, the employer must keep a record of accidents and preserve each entry for at least three years. The record can be a book or electronic.
How many first-aiders does a small business need?
There is no fixed legal number. The minimum is a suitably stocked first-aid kit, an appointed person to take charge of first-aid arrangements and information for employees. Whether trained first-aiders are needed depends on your own assessment of need.
Is PAT testing a legal requirement?
No. The Health and Safety Executive says the law requires electrical equipment to be maintained to prevent danger but does not make portable appliance testing compulsory or require it every year.
Sources
Checked against the primary source on 4 October 2026.
- Health and Safety at Work etc. Act 1974, s.2 - the general duties, the written policy and training
- Health and Safety at Work etc. Act 1974, s.9 - no charge to employees
- Management of Health and Safety at Work Regulations 1999, reg 3 - risk assessment and recording at five or more; see also regs 5, 7, 13, 16 and 18
- HSE: steps needed to manage risk - the five steps
- HSE: get competent advice - who can be the competent person
- HSE: the law on consulting employees - the two sets of consultation regulations
- HSE: display the law poster - poster or leaflet
- HSE: types of reportable incidents - what RIDDOR covers and how the seven days are counted
- HSE: when to report - the 10-day and 15-day deadlines
- RIDDOR 2013, reg 12 - records kept for at least three years
- Social Security (Claims and Payments) Regulations 1979, reg 25 - the accident record at 10 or more on the same premises
- HSE: working safely with display screen equipment - who is a user and what employers must do
- HSE: eye tests for DSE users - when the employer pays for glasses
- HSE: first aid, what employers need to do - the minimum provision and no fixed numbers
- Home Office: fire safety responsibilities under section 156 - recording the fire risk assessment in full
- HSE: portable appliance testing FAQs - testing is not compulsory
- HSE: home working - the same responsibilities for home workers
- HSE: Management Standards for work-related stress - the six areas
- HSE: risk assessment for pregnant workers and new mothers - the individual assessment
- gov.uk: employers' liability insurance - the minimum cover and the fines
- HSE: is HSE the correct enforcing authority? - HSE or the local authority, by type of premises
- Legal Aid, Sentencing and Punishment of Offenders Act 2012, s.85 - removal of the magistrates' court fine limit in England and Wales
This is general guidance for UK employers and is not legal advice. Take advice on anything contested, unusual or expensive.
Keep reading: All 3 handbooks · Everything for employers · 44 free templates
Registers that stay up to date on their own
CoDash keeps the accident and incident log, training and certificate expiry dates, and policy acknowledgements in one place, with reminders before anything lapses.
Explore a live, safe sandbox