Health and safety law applies to every UK business with employees, from a two-person sole trader setup to a large company, in the same way GDPR compliance applies regardless of business size, and it is actively enforced through both random inspections and complaint-triggered visits. For a small, low-risk business, staying compliant is generally straightforward, but skipping it entirely, on the assumption it only matters for larger companies, is a genuine legal and financial risk.
This guide covers the core UK workplace health and safety requirements for small businesses and how to meet them without unnecessary complexity.
The Legal Foundation
The Health and Safety at Work etc. Act 1974 is the main piece of UK legislation, requiring every employer to protect the health, safety and welfare of employees, and anyone else affected by the business, so far as is reasonably practicable. This duty extends to contractors, visitors, customers and members of the public, not just direct employees.
Who Actually Holds Responsibility
The law places ultimate responsibility on the employer or “dutyholder,” which applies to sole traders and limited companies alike. Even where day-to-day safety management is delegated to someone else, the business owner retains legal responsibility, and this extends to contractors, agency staff and volunteers working on the premises.
Conducting a Risk Assessment
Risk assessments are mandatory for all UK businesses under the Management of Health and Safety at Work Regulations 1999. The process does not require expert-level knowledge, just a careful, honest look at your workplace.
Step 1: Identify Hazards
Walk around the workplace and consider what could realistically cause harm, from trailing cables and manual handling tasks through to less obvious risks such as workplace stress.
Step 2: Determine Who Might Be Harmed
Consider not just employees, but contractors, delivery drivers, visitors and members of the public who might be affected by your business activities.
Step 3: Evaluate the Risks
Assess how likely each hazard is to cause harm and how serious that harm could be, which helps prioritise which risks need addressing first.
Step 4: Decide on Control Measures
For each identified risk, note the specific measure that reduces it, whether that is training, better signage, PAT testing, or personal protective equipment.
Written Policy Requirements
Businesses with five or more employees are legally required to have a written health and safety policy under Section 2(3) of the Health and Safety at Work Act 1974. This needs to genuinely reflect your actual activities rather than being a generic downloaded template, since a policy that does not match your real operations is itself a compliance failure. Businesses with fewer than five employees are not legally required to put it in writing, though doing so is still strongly recommended.
Training Requirements
Providing adequate health and safety training is a legal requirement under Section 2 of the Health and Safety at Work Act, covering induction training for new starters, job-specific training for particular risks, and periodic refresher training. Training does not need to be a formal classroom session; a structured briefing, toolbox talk, or online course is sufficient, provided it genuinely covers the relevant risks and is properly recorded.
First Aid and Emergency Preparedness
The Health and Safety (First-Aid) Regulations 1981 require employers to provide adequate first aid equipment, facilities and personnel appropriate to their workplace. For most small, low-risk businesses, having at least one person trained in Emergency First Aid at Work provides solid, proportionate cover. Employers must also have plans in place for fire and other emergencies, alongside required fire safety training under the Regulatory Reform (Fire Safety) Order 2005.
Employers’ Liability Insurance
Any business that employs staff is legally required to hold Employers’ Liability Insurance with a minimum cover level, part of the wider cover discussed in our business insurance guide, and the certificate must be displayed in the workplace or made available electronically.
Reporting Serious Incidents
Certain workplace injuries, diseases and dangerous occurrences must be reported to the Health and Safety Executive under RIDDOR. Keeping accurate records of incidents, near misses and training is essential both for compliance and for demonstrating good practice if inspected.
Comparing Key Requirements by Employee Count
| Requirement | Fewer Than 5 Employees | 5 or More Employees |
|---|---|---|
| Risk assessments | Required, need not be written | Required, must be written |
| Health and safety policy | Not legally required in writing | Must be written (Section 2(3) HSWA) |
| Employers’ liability insurance | Required if any staff employed | Required |
| First aid provision | Required, proportionate to risk | Required, proportionate to risk |
| RIDDOR reporting | Required for reportable incidents | Required for reportable incidents |
Common Compliance Mistakes to Avoid
- Assuming health and safety law only applies to larger businesses
- Downloading a generic policy template that does not reflect actual workplace activities
- Treating risk assessment as a paperwork exercise rather than genuinely walking the workplace
- Failing to keep training records, making compliance difficult to demonstrate if inspected
- Overlooking responsibilities toward contractors, visitors or agency staff
Frequently Asked Questions
Does health and safety law apply to a business with only one or two employees?
Yes. All employers, regardless of size, must meet the basic requirements of UK health and safety law, though the specific obligations, such as a written policy, scale with the number of employees.
Do sole traders need to worry about health and safety compliance?
Yes, if they employ anyone, or if their business activities could affect others such as customers, contractors or the public, health and safety duties still apply.
Is a written health and safety policy always required?
Only for businesses with five or more employees, though having one in writing is recommended even for smaller businesses, since it helps demonstrate genuine compliance if ever questioned.
What happens if a business fails a health and safety inspection?
Enforcement action can range from advice and improvement notices through to prosecution for serious or repeated failures, making proactive compliance considerably less risky than reacting after an inspection.
Final Thoughts
Workplace health and safety compliance for a small UK business does not need to be complicated, but it does need to be genuine. A proper risk assessment, appropriate training, adequate insurance and accurate records cover the large majority of what is legally required, and getting these fundamentals right protects both the business and the people affected by it.
