Health and Safety Law: Your Initial Responsibilities

Health and safety law is non-negotiable for every UK employer – including the smallest startups and family businesses. Whether you have one employee or fifty, you have legal duties that start the moment you begin trading. This guide cuts through the jargon and tells you exactly what you need to know and do to stay compliant, protect your team, and avoid costly mistakes. Read on for a clear, step-by-step breakdown of your initial responsibilities, from legal basics to practical first steps.

The foundation of health and safety law in the UK is the Health and Safety at Work etc. Act 1974. This law places a duty of care on all employers to protect the health, safety, and welfare of their employees and anyone else affected by their work—think customers, contractors, and even members of the public. The Health and Safety Executive (HSE) is the main body overseeing enforcement, but local authorities also have powers, especially for retail, hospitality, and certain service businesses.

What does 'duty of care' mean in practice? It’s about taking reasonable steps to prevent harm. The law doesn’t expect you to eliminate every possible risk, but it does expect you to anticipate and control the risks that are foreseeable in your line of work. The phrase 'so far as is reasonably practicable' crops up repeatedly—meaning you must balance the level of risk against the measures needed to control it in terms of cost, time, and effort, but you can’t just ignore a risk because it’s inconvenient or expensive.

It’s not just about serious injuries. You’re also legally obliged to protect people from ill health caused by your business activities—whether that’s repetitive strain, stress, exposure to hazardous substances, or something else. Crucially, these duties apply from the moment you employ anyone (even part-time or temporary) or have non-employees affected by your work. The law is not just for big companies: the HSE and the courts have prosecuted sole traders and microbusinesses for breaches.

The instant you become an employer, certain health and safety responsibilities land on your desk. First, you must have a health and safety policy if you employ five or more people. This doesn’t have to be a huge document—just a clear statement of your commitment to managing health and safety, plus who’s responsible for what and how risks will be managed. If you have fewer than five employees, you’re not legally obliged to write it down, but it’s still best practice.

Next, you’re required to carry out 'suitable and sufficient' risk assessments for your work activities. This means thinking through what could cause harm, who could be affected, how likely it is, and what you’re doing (or should be doing) to control those risks. The findings must be recorded if you have five or more staff, but even smaller businesses should document their assessments: it’s your main defence if something goes wrong.

You must also display the HSE-approved health and safety law poster where all staff can see it, or provide the approved leaflet to every worker. This isn’t optional—it’s a legal requirement, and there are fines for getting it wrong. The poster is available to buy from the HSE or authorised suppliers. It must be legible and display up-to-date information, including the name of your appointed health and safety contact.

• Draft a health and safety policy if you have 5+ employees
• Carry out and record risk assessments relevant to your work
• Display the HSE health and safety law poster or provide leaflets
• Appoint a competent person to help manage health and safety
• Set up basic accident and incident reporting procedures

Risk assessment is not just a box-ticking exercise—it’s the heart of your health and safety responsibilities. Under the Management of Health and Safety at Work Regulations 1999, every employer must assess the risks to employees and anyone else who could be affected by their business activities. This includes obvious hazards (like machinery) and less visible ones (such as stress or slips on wet floors).

A proper risk assessment involves identifying hazards (things that could cause harm), deciding who might be harmed and how, evaluating the risks and deciding on precautions, recording your findings (if you employ five or more), and reviewing the assessment regularly. The law expects you to be systematic and honest—ignoring a risk because it’s awkward or assuming 'it’ll never happen to us' is not a defence if something goes wrong.

Some risks are industry-specific. For example, a hairdresser needs to assess risks from chemicals, while a café must consider hot surfaces and food hygiene. The HSE offers free templates and examples for most sectors, but you must adapt them to your own business. Copying someone else’s assessment word-for-word won’t protect you. If you share a premises or work alongside other employers (such as in a shared office), you must coordinate your risk controls with them.

Every UK business, regardless of size, must appoint at least one 'competent person' to help meet health and safety duties. This person needs enough knowledge and experience to spot hazards and put sensible controls in place. For most small businesses, the owner or a manager takes on this role—there’s no need for formal qualifications unless your work is high-risk (like construction or chemicals).

If you don’t feel confident or your business is more complex, you can get help from an external consultant or your trade association. What matters is that the competent person understands both the law and your actual business activities. If you’re found to have ignored key risks or delegated responsibility to someone unqualified, you’re still personally liable as the employer.

You must ensure your competent person stays up to date—for example, by reading HSE updates or attending occasional training. Failing to appoint or consult a competent person is a breach of Regulation 7 of the Management of Health and Safety at Work Regulations, and is one of the first things inspectors look for.

• Owner or manager can be the competent person for most low-risk businesses
• External consultants are common for high-risk or regulated sectors
• Competent person must understand actual work activities and risks
• Keep up with changes in law and best practice (e.g. sign up to HSE newsletters)
• Document who your competent person is (even if it’s yourself)

Having a policy and risk assessment is only the starting point. You must also put practical safety arrangements in place—real, day-to-day measures that control risks. This includes things like providing suitable first aid equipment, making sure fire exits are clear, training staff on safe working practices, and setting up a way for employees to report hazards or accidents.

First aid is a legal requirement for all UK workplaces, even if you have just one employee or volunteer. At a minimum, you must have a well-stocked first aid box and someone appointed to take charge of first aid arrangements. For most low-risk offices and shops, you don’t need a fully trained first aider, but you should assess your needs. In higher-risk environments, trained first aiders are essential.

Fire safety is another critical area. You must have a fire risk assessment, keep exit routes clear, and provide appropriate fire extinguishers and alarms. The law also requires you to inform employees about fire procedures and carry out regular fire drills. If you operate from shared premises, coordinate your arrangements with the building management and other tenants.

• Provide a stocked first aid box and appoint a first aid lead
• Complete a fire risk assessment and keep exits clear
• Train staff on basic safety procedures relevant to your business
• Set up a workplace accident book (mandatory if you have 10+ employees)
• Establish a system for reporting hazards or near-misses

Good record-keeping is both a legal requirement and your best defence if something goes wrong. The HSE and local authorities expect to see records of your risk assessments, staff training, maintenance checks, and accident reports. If you employ five or more people, you must keep written records of your health and safety policy and risk assessments. Even with fewer staff, it’s wise to document everything you do.

The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR) require you to formally report certain workplace incidents to the HSE. This includes major injuries (like fractures), occupational diseases (such as carpal tunnel syndrome), dangerous occurrences (for example, fire or equipment failure), and any accident resulting in more than seven days’ absence from work. Reports are made online via the HSE’s RIDDOR portal.

You’re also required to keep an accident book if you have 10 or more employees, but it’s good practice for all employers. This log should record every injury, however minor, as it helps identify patterns and can provide vital evidence if a claim is made. Under data protection law, you must keep these records secure and only share them on a need-to-know basis.

• Keep risk assessments up to date and review after incidents or changes
• Report serious incidents to the HSE under RIDDOR
• Maintain staff training records and evidence of briefings
• Securely store accident and incident reports for at least 3 years
• Be ready to show records to inspectors on request

Many small business owners fall into the trap of treating health and safety as a one-off task, rather than an ongoing process. The law expects you to keep your arrangements under review—especially if you change premises, introduce new equipment, or have a workplace accident. Complacency is one of the top reasons small firms get caught out by inspectors.

Another frequent mistake is underestimating less obvious risks such as stress, lone working, or manual handling. These are among the most common causes of sickness absence and injury in the UK, and the HSE pays close attention to them—even for apparently 'low-risk' businesses like offices and shops. Ignoring the mental health aspects of work (workload, bullying, poor communication) can also land you in trouble.

Documentation is another weak spot. Verbal policies and informal briefings are not enough if you’re investigated after an incident. If you can’t produce written risk assessments or proof of training, it’s assumed you didn’t do it. Always err on the side of over-documentation, and keep digital backups as well as paper copies.

• Review your risk assessments at least annually and after any incident
• Don’t ignore 'hidden' risks like stress or repetitive strain injuries
• Make sure staff actually understand safety procedures (not just sign a form)
• Coordinate with landlords and other tenants in multi-occupancy buildings
• Budget for safety equipment and training from the outset

Health and safety law is enforced by the HSE and local authorities. Inspectors have wide powers to enter your premises, review records, and interview staff. They can issue improvement notices (to fix breaches) or prohibition notices (to stop dangerous activities). If you ignore these or commit serious breaches, you could face unlimited fines or even prison.

Fines are not just for big businesses. The HSE routinely prosecutes small firms and sole traders—often after relatively minor accidents that expose wider failings. In 2022/23, the average health and safety fine in the UK was over £100,000, but many small businesses have been fined £10,000 or more for failures like not having risk assessments or failing to report incidents. In the worst cases, directors and owners have received custodial sentences.

Beyond legal penalties, non-compliance brings reputational risk. A health and safety prosecution is a matter of public record and can appear in local and national press. Claims from injured staff or customers can drive up insurance premiums or even make it impossible to get cover. In short, the cost of ignoring your responsibilities is far higher than the time and money needed to meet them.

{'type': 'stat', 'variant': 'stat', 'title': 'The cost of non-compliance', 'text': 'According to the HSE, total fines for health and safety breaches exceeded £35 million in 2022/23.'}

You don’t have to do it all alone. The HSE website (hse.gov.uk) is the best starting point for practical, up-to-date guidance and free templates. Look for their 'Health and Safety Made Simple' guide, which is specifically aimed at small businesses. Most trade associations also provide sector-specific advice and model policies—useful, as long as you adapt them to your situation.

Your local authority environmental health team can offer advice, particularly for retail, leisure, and hospitality businesses. Some business support organisations—such as the Federation of Small Businesses (FSB)—include legal and safety helplines as part of their membership. For more complex issues, consider hiring a qualified health and safety consultant (look for membership of bodies like IOSH or the British Safety Council).

Don’t rely on internet forums or overseas templates. UK health and safety law is specific and the penalties are real. If you’re ever in doubt, go direct to the source: HSE, your local authority, or a reputable UK-based expert.

• HSE: Free guides, templates and sector advice (hse.gov.uk)
• Federation of Small Businesses: Legal and safety helplines
• Trade associations: Industry-specific model documents
• Local authority environmental health: Retail/hospitality support
• Accredited health and safety consultants: For complex or high-risk businesses