Student Login
Julie Gent Health and safety compliance means meeting the duties UK law puts on every employer. You must keep people safe so far as is reasonably practicable, assess the risks, get competent help, train your staff and, with five or more employees, write down your policy and risk findings. You don't need an accident to be in breach. The offence is creating the risk, and courts set fines by your turnover and how far you fell short.
What the law asks of employers
Two pieces of law do most of the work. The Health and Safety at Work etc. Act 1974 sets the general duty. The Management of Health and Safety at Work Regulations 1999 spell out how to meet it.
Section 2 of the Act says every employer must protect the health, safety and welfare of all their employees at work, so far as is reasonably practicable. That includes safe equipment and systems of work, plus the "information, instruction, training and supervision" people need. It also asks for a health and safety policy. HSE says you must write it down once you have five or more employees.
Risk assessment
Regulation 3 says you must make a "suitable and sufficient" assessment of the risks to your employees and to anyone else your work affects. With five or more employees, you must record the significant findings and any group especially at risk.
You must review it when you suspect it's out of date, or when something significant changes. HSE sums up the minimum in three steps. Work out what could cause harm, decide how likely and how serious that harm is, then remove the hazard or control the risk.
Competent help
Regulation 7 says you must appoint one or more competent people to help you comply. Competent means they have enough training and experience or knowledge to do it properly.
If someone in your business is competent, the law prefers them over an outside consultant. HSE says that person can be you. Hiring a consultant doesn't hand over the duty. It stays with you as the employer.
Training
Regulation 13 names the moments training must happen. It's due when someone starts, and whenever they face new or bigger risks. That covers a change of job or responsibilities, new equipment, new technology and a new system of work.
Training must be repeated where appropriate and updated when risks change. It must happen in working hours, and HSE says it shouldn't come at your employees' expense.
Some laws add their own training duties. Anyone liable to be exposed to asbestos needs asbestos training under the Control of Asbestos Regulations 2012. Your first-aiders need training that suits your workplace.
On a construction site
CDM 2015 adds a construction layer. Regulation 15 says a contractor must not employ or appoint anyone on site who doesn't have, or isn't getting, the skills, knowledge, training and experience for their tasks. Each worker needs a suitable site induction, unless the principal contractor has already given one.
Where CSCS cards fit
Plenty of firms treat a CSCS card as proof they're compliant. It isn't. CSCS says holding a card is not a legal requirement. The principal contractor or client decides. Most principal contractors and major house builders do insist on one, so in practice your team won't get through the gate without it.
A card also covers less than people think. CSCS says it shows skills and knowledge. Experience and behaviour are part of competence too, and employers and contractors still have to assess them. The card gets a worker on site. Your risk assessments, inductions and training records show you've met your duties.
For a new labourer, the usual route is the Level 1 Award in Health and Safety in a Construction Environment, the CITB HS&E test, then the Labourer card. Our CSCS Green Card package covers all three for each worker. For the employer's side of cards, read why CSCS cards matter for your business.
What non-compliance costs
Enforcement isn't rare. In 2024/25, HSE's annual report shows it completed 246 prosecutions with a 96% conviction rate. It served more than 4,400 notices, around 3,200 of them improvement notices and 1,200 prohibition notices. Courts awarded more than £33 million in fines.
The bill starts before court. If an inspector finds a material breach and writes to tell you, you pay HSE's fee for intervention. From 1 April 2026 that's £188 an hour, for the visit, the follow-up and any investigation.
In court, a breach of the general duties can mean an unlimited fine for the business. An individual can face up to two years in prison.
Fines follow the Sentencing Council's guideline. The court weighs how far you fell short, the harm you risked and your turnover. Nobody has to be hurt. Ignoring "recognised standards in the industry" counts as high culpability.
| Business size | Annual turnover | Starting point | Range |
|---|---|---|---|
| Micro | Up to £2 million | £160,000 | £100,000 to £250,000 |
| Small | £2 million to £10 million | £250,000 | £170,000 to £1 million |
| Medium | £10 million to £50 million | £950,000 | £600,000 to £2.5 million |
| Large | £50 million and over | £2.4 million | £1.5 million to £6 million |
Starting points for a high-culpability breach that risked death (harm category 1), from the Sentencing Council guideline for organisations, accurate as of September 2026.
Even the smallest firm starts at six figures when it ignores a known standard and someone could have died.
The costs don't stop at fines. Directors can be prosecuted personally, which our guide to health and safety training for directors covers. If a death traces back to gross failings by senior management, the company itself can be charged with corporate manslaughter. HSE also estimates that injuries and new cases of work-related ill health cost Britain £22.9 billion in 2023/24, with £4.3 billion of that falling on employers.
Where to start this month
- Read your risk assessment. If it doesn't match the work you do now, review it. With five or more staff, write down the significant findings.
- Name your competent person. Check they have the training and the time.
- Keep a training record for every worker, with each course, its date and when it's due again.
- Book an induction for every new starter, and training for anyone changing role or using new kit.
- Check cards and certificates are in date. CSCS Smart Check verifies CSCS cards.
Compliance is a set of duties you can show you've met. Start with the gaps in that list.
If staff training is the gap, our employer training plans bundle online CPD courses for teams, including health and safety in the workplace, manual handling and working at height. Each completed course gives a dated certificate you can download straight away. For a mix that isn't in the bundles, ask about employer CPD training.
Frequently asked questions
Is health and safety training a legal requirement?
Yes. Section 2 of the Health and Safety at Work etc. Act 1974 says employers must give the information, instruction, training and supervision needed to keep employees safe. The Management Regulations 1999 say when, at recruitment and whenever risks change. Training must take place in working hours, and HSE says it shouldn't be at your employees' expense.
Do I need a written risk assessment?
Only if you employ five or more people. Then you must record the significant findings and any group of employees especially at risk. Every employer must still carry out a suitable and sufficient assessment, whatever the headcount. Writing it down anyway is sensible, because it's your best evidence when an inspector asks what you did.
Is a CSCS card a legal requirement?
No. CSCS says holding a card is not a legal requirement. The principal contractor or client decides whether workers need one on site, and most principal contractors and major house builders do. A card shows skills and knowledge. It doesn't replace your own duty to check experience, give an induction and train people for the task.
What happens if HSE finds a breach?
It depends how serious it is. An inspector can give advice, write to you about a material breach, or serve an improvement or prohibition notice. A written notice of a material breach means paying HSE's fee for intervention, £188 an hour from April 2026. Serious cases go to court. HSE completed 246 prosecutions in 2024/25.
How much can a business be fined for breaking health and safety law?
There's no upper limit. Fines for organisations are unlimited, and the Sentencing Council guideline sets starting points by turnover, culpability and the harm risked. For a micro business turning over up to £2 million, a high-culpability breach that risked death starts at £160,000. For the biggest firms, fines can go above the £10 million top of the range.
Who can be the competent person?
Anyone with enough training and experience or knowledge to help you meet your duties. HSE says it can be you, one or more of your workers, or someone from outside. The law prefers someone inside the business. Formal qualifications aren't usually needed, but for higher-risk work, like most construction, you may need specialist help.
How often should health and safety training be refreshed?
Whenever risks change, and periodically after that. The law doesn't set one interval for general training. Regulation 13 says training must be repeated where appropriate and updated for new or changed risks. Some cards and courses carry their own expiry dates. Keep a record of dates so you can see who's due next.