UK health and safety law applies to every business from the day it employs its first person, and parts of it apply to the self-employed as well. The good news is that for a small, low-risk business the requirements are proportionate and mostly common sense. The difficulty is knowing which of the many regulations actually apply to you, and what has to be written down. This guide sets that out as a checklist you can work through.
It covers the general position in Great Britain. Northern Ireland has parallel legislation with the same structure. Fire safety law differs between England and Wales, and Scotland, and that is noted where it matters.
The duties that apply to every employer
The Health and Safety at Work etc. Act 1974 places a general duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare of employees, and to protect other people affected by the work, such as customers, visitors, contractors and the public. "Reasonably practicable" means the effort and cost of a precaution should be weighed against the risk. You are not expected to eliminate every risk, but you are expected to control the significant ones.
The Management of Health and Safety at Work Regulations 1999 turn that general duty into specific management tasks. Every employer, whatever its size, must:
- carry out a suitable and sufficient risk assessment of the risks to employees and others,
- have arrangements in place for planning, organising, controlling, monitoring and reviewing health and safety,
- appoint one or more competent persons to help, who can be the owner or an employee where they have the knowledge,
- give employees understandable information about risks and precautions,
- provide adequate training, on recruitment and when risks change,
- consult employees on matters that affect their health and safety, and
- cooperate with other employers sharing a workplace.
What changes at five employees
Several recording duties start when a business has five or more employees. The count is of employees across the whole business, not per site, and includes part-time staff. At that point you must:
- have a written health and safety policy, with a statement of intent, the responsibilities of named roles, and the arrangements for managing the main risks,
- record the significant findings of your risk assessments and any group of employees identified as especially at risk, and
- record your health and safety arrangements.
Below five employees you still have to assess risks, have arrangements and be able to explain them. You just do not have to write them down. In practice most businesses with two or three staff find it easier to write them down anyway, and anyone bidding for work will be asked for them regardless of size.
The small business checklist
Insurance and information
- Employers' liability insurance. Required by the Employers' Liability (Compulsory Insurance) Act 1969 for almost every employer, with the certificate displayed or made available electronically to staff.
- The health and safety law poster or leaflet. The Health and Safety Information for Employees Regulations 1989 require you to display the approved HSE poster or give each worker the equivalent leaflet.
- Registration with the enforcing authority is not generally needed for ordinary premises, but some activities, such as food businesses, must register with the local authority for other reasons.
Documents
- Health and safety policy (written at five or more employees).
- Risk assessments for your activities, recorded at five or more employees.
- COSHH assessments where you use or produce hazardous substances, under the Control of Substances Hazardous to Health Regulations 2002. Cleaning chemicals count. See COSHH for small businesses.
- A fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005 in England and Wales. Since October 2023 it must be recorded in full regardless of how many people you employ. Scotland's fire safety duties are under separate legislation with the same effect.
- Training records showing who has been trained in what and when.
- Maintenance and inspection records for equipment, including statutory thorough examinations of lifting equipment and pressure systems where you have them.
People and competence
- A named competent person for health and safety. See whether you need a consultant.
- Induction for every new starter, and job-specific training where the risk assessment calls for it.
- Consultation with employees, directly or through representatives, under the Health and Safety (Consultation with Employees) Regulations 1996.
First aid, accidents and reporting
- A first aid needs assessment, a suitably stocked kit and at least an appointed person, under the Health and Safety (First-Aid) Regulations 1981. See first aid at work requirements.
- An accident book or equivalent record. A formal accident book is required where you have ten or more employees, and sensible for everyone.
- Reporting of specified injuries, over-seven-day injuries, occupational diseases and dangerous occurrences to HSE under RIDDOR 2013.
The workplace itself
- Welfare facilities: toilets, washing facilities, drinking water, somewhere to rest and eat, under the Workplace (Health, Safety and Welfare) Regulations 1992. These also cover lighting, temperature, ventilation, space, floors and traffic routes.
- Safe electrical systems under the Electricity at Work Regulations 1989, maintained in proportion to the risk. See electrical safety at work.
- Work equipment that is suitable, maintained and inspected under the Provision and Use of Work Equipment Regulations 1998.
- Display screen equipment assessments for staff who use screens as a significant part of their work. See DSE assessments explained.
- Manual handling assessed and reduced where it carries a risk of injury. See manual handling requirements.
- If you own or are responsible for non-domestic premises built before 2000, a duty to manage asbestos under the Control of Asbestos Regulations 2012, which usually means finding out whether it is present and keeping a record.
Specific activities
Beyond the common set, the regulations that apply depend on what you do: work at height, noise, vibration, confined spaces, lone working, driving for work, construction (where the Construction (Design and Management) Regulations 2015 add client, designer and contractor duties), and so on. Your risk assessment is the tool that tells you which of these matter in your business.
Who enforces the rules
Enforcement is split between the Health and Safety Executive and local authorities. Broadly, HSE covers higher-risk sectors such as construction, manufacturing and agriculture, while local authority environmental health officers cover offices, shops, hospitality, leisure and similar premises. Fire and rescue authorities enforce fire safety. Inspectors can visit without notice, require documents, and issue improvement or prohibition notices. See how to prepare for an HSE inspection.
Putting it in place without drowning in paper
The mistake most small businesses make is to buy or download a large generic manual, file it and forget it. Enforcing officers and clients see through this quickly, because the documents do not describe the real work. The better approach is a small set of documents that match what you actually do, a named person who owns them, and a routine for keeping them current: a monthly check of outstanding actions and an annual review of the whole set.
If you want this set up properly once, a compliance pack gives you the policy, arrangements, risk assessments and registers sized to your business. To keep it live afterwards, Featherstone Safety Hub holds your risk assessments, training matrix, actions and evidence in one place, from £49 a month per site. And if you are not sure where you stand today, a compliance review from £395 tells you, with the actions in priority order.
Frequently asked questions
Does health and safety law apply to a business with only one or two employees?
Yes. The general duties under the Health and Safety at Work Act and the Management Regulations apply from the first employee. What changes at five employees is the duty to write down the policy, the significant findings of risk assessments and the arrangements. Below five you must still do them.
Do I count part-time staff towards the five employees?
Yes. The threshold counts employees, however many hours they work, across the whole business rather than per site. Agency workers and contractors are not your employees for this purpose, although you still have duties towards them.
Do I need a written fire risk assessment if I have fewer than five employees?
In England and Wales, yes. Since October 2023 the responsible person must record the fire risk assessment in full regardless of the number of employees. In Scotland the duty to assess fire risk applies under separate legislation, and recording it is strongly recommended and expected in practice.
What documents will a client or tender usually ask a small business for?
Typically a health and safety policy, relevant risk assessments and method statements, evidence of training and competence, your employers' liability insurance, accident and enforcement history, and sometimes membership of a contractor approval scheme. Having these current and matching your real work is what makes the difference.
How long do I need to keep health and safety records?
It varies by record. Accident book entries are kept for three years, health surveillance records far longer, and risk assessments for as long as they are current plus a sensible period afterwards. See the guide on how long to keep health and safety records for the detail.