A five-person nail salon and a two-hundred-person warehouse have almost nothing in common, except one legal duty. Risk assessment legal requirements in the UK apply to both, as well as almost every other employer.
These duties apply under two pieces of legislation: the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999.
Skipping the assessment, or doing it badly, risks exposure. This is not just an accident; it becomes a criminal offence, with an inspector, a paper trail, and a fine attached to it.
Legally, a risk assessment needs to cover and help you judge what could cause harm at work and what controls stop it from happening.
The general duty gets more specific from there. The types of risk assessment the law expects differ for chemicals, fire, young workers, and pregnant staff.
Key Takeaways
- UK employers and the self-employed must carry out a risk assessment under the Health and Safety at Work Act 1974 and the Management of Health and Safety at Work Regulations 1999, regardless of business size.
- A self-employed person whose work poses no risk to anyone else is exempt from this duty under the Deregulation Act 2015.
- Young workers and pregnant or breastfeeding staff need their own additional risk assessment, not just a mention inside the general one.
- "Suitable and sufficient" is not defined in the regulations themselves. It comes from HSE's Approved Code of Practice L21 and has been tested in court.
- The duty to assess mental harm, including work-related stress and sexual harassment risk, sits inside the same general legal duty as physical hazards.
- Employers with five or more staff must record the significant findings of a risk assessment in writing, though a fire risk assessment can trigger that same recording duty at a smaller headcount if the premises is licensed.
- Skipping or botching a risk assessment is a criminal offence under the Health and Safety at Work Act 1974, enforced through improvement notices, prohibition notices, and prosecution.
Which UK Laws Make Risk Assessment a Legal Requirement?
Risk assessment becomes a legal requirement through two pieces of UK legislation. The Health and Safety at Work etc. Act (HWSA) 1974 sets the general duty of care, and the Management of Health and Safety at Work Regulations 1999 spell out the assessment itself. Several other regulations add extra duties on top for specific hazards.
Health and Safety at Work etc. Act 1974
The HSWA 1974 puts a general duty of care on every employer. Section 2 covers your own employees: you must protect their health, safety, and welfare so far as is reasonably practicable. Section 3 extends that duty to people who are not your employees, including contractors, visitors, and members of the public who could be affected by your work.
Neither section uses the words "risk assessment." The duty to identify and control hazards is implied in the requirement to keep people safe, and the next piece of legislation makes that duty explicit.
Management of Health and Safety at Work Regulations 1999
The Management of Health and Safety at Work Regulations 1999 (MHSWR) is where the assessment duty itself appears. Regulation 3 requires every employer to make a suitable and sufficient assessment of the risks to employees and to anyone else affected by the work. This is the regulation an HSE inspector asks to see first, and every hazard-specific duty depends on meeting it first.
Other Regulations That Require Specific Risk Assessments
The 1999 Regulations set the floor. Several other regulations add a specific assessment duty for particular hazards, on top of the general one.
Work with hazardous chemicals carries its own duty under the Control of Substances Hazardous to Health Regulations 2002 (COSHH), which requires a separate assessment before that work starts. A COSHH assessment walks through what that specific assessment has to cover.
Construction work adds another layer under the Construction (Design and Management) Regulations 2015 (CDM 2015), which splits responsibility across clients, designers, and contractors instead of resting on one employer alone.
Three further regulations cover narrower ground, each triggered by one specific type of work:
- Lifting and carrying falls under the Manual Handling Operations Regulations 1992.
- Working at a screen falls under the Display Screen Equipment Regulations 1992.
- Working above ground level falls under the Work at Height Regulations 2005.
Who Is Legally Required to Carry Out a Risk Assessment?
Every employer in the UK is legally required to carry out a risk assessment. That includes anyone who is self-employed if their work could put someone else at risk. There is no exemption for a small business or a low-risk-looking workplace. The duty exists the moment you employ anyone, or run work that affects other people.
Employers
An employer's duty applies regardless of headcount. A sole trader with one part-time assistant carries the same Regulation 3 duty as a company with a thousand staff.
The rule about recording your risk assessment only kicks in once you have 5 or more employees. But the duty to actually do the assessment applies no matter how many employees you have; even with just one.
Self-Employed People
A self-employed person carries the same duty under Regulation 3(2) if their work could affect their own safety or someone else's. That covers most self-employed trades: a plumber working in a client's home, a gardener using power tools, a driving instructor sharing a car with a learner.
There's only one real exception. A 2015 law (Section 1 of the Deregulation Act) changed the rules so that self-employed people are exempt from health and safety duties. But only if their work can't harm anyone else.
So someone like a freelance writer working alone at home fits the exemption. But a self-employed scaffolder doesn't. That’s because their work could easily put other people at risk, so the duties still apply to them.
Who Your Risk Assessment Must Protect
A risk assessment has to protect two groups: your own employees (under Section 2 of the 1974 Act) and anyone else who could be harmed by your work (under Section 3). The latter group includes contractors, visitors, delivery drivers, and members of the public.
Two groups within that wider scope get their own named legal duty, rather than just a mention inside the general assessment. Those are: Young persons (under 18) and new or expectant mothers.
Risk Assessment Requirements for Young Workers
Young workers get their own risk assessment requirement under Regulation 19 of the 1999 Regulations. The assessment has to account for their inexperience, their lack of awareness of existing or potential risks, and their immaturity, factors an adult-workforce assessment does not need to weigh. Regulation 19 also bans employers from putting anyone under 18 into certain hazardous situations altogether, rather than only controlling the risk.
Risk Assessment Requirements for New or Expectant Mothers
New and expectant mothers trigger a specific risk assessment duty under Regulations 16 to 18 of the 1999 Regulations. The trigger applies from the point when women of child-bearing age are already in the workforce.
Regulation 16 covers the assessment itself, whereas Regulation 17 covers medical advice on night work. On top of that, Regulation 18 sets out what happens once an employee notifies you in writing that she is pregnant, has given birth in the last six months, or is breastfeeding.
Until that written notification arrives, the specific duty does not switch on. A general assessment still has to consider the risk in principle, because women of child-bearing age are, by definition, already part of most workforces.
What Does "Suitable and Sufficient" Mean in a Risk Assessment?
"Suitable and sufficient" is not defined anywhere in the Management of Health and Safety at Work Regulations 1999. The phrase comes from HSE's Approved Code of Practice L21. It says a risk assessment should identify the risks the work actually creates.
Meaning that the level of detail should match the level of risk, not a fixed template.
That proportionality cuts both ways. Like a one-person office assessing a trip hazard from a loose carpet tile needs a short, plain document. On the other hand, a chemical plant assessing an explosion risk needs something far more detailed, and a copy-paste version of either would fail the standard.
Courts have tested the phrase further. In 2011, Uren v Corporate Leisure UK Ltd examined what a suitable and sufficient assessment actually required in practice. It confirmed that a generic, boilerplate assessment does not meet the standard, even where the paperwork exists.
An assessment copied from a template and never adapted to the actual premises is the single most common way this standard gets failed.
Reasonable practicability sits alongside this standard rather than replacing it. The law expects you to control a risk so far as is reasonably practicable, weighing the cost and effort of a control against the risk it removes.
Is a Psychological Risk Assessment a Legal Requirement?
Psychological harm is covered by the same general duty as physical harm. There is no separate law called a "psychological risk assessment." The Regulation 3 duty to make a suitable and sufficient assessment already extends to mental as well as physical risk. HSE treats stress and other psychosocial hazards as ordinary workplace risks to be assessed like any other.
Work-Related Stress and the HSE Management Standards
HSE's Management Standards break work-related stress down into six areas an assessment should look at: demands, control, support, relationships, role, and change. The Standards themselves are not law. They are HSE's own recommended method for meeting the general duty as it applies to stress.
An employer can use a different method as long as the resulting assessment is still suitable and sufficient.
Employers with five or more staff still have to write this assessment down, under the same five-employee threshold that applies to any other risk assessment. A stress risk assessment checklist works through each of the six areas in practice.
Sexual Harassment Risk Assessments
Sexual harassment prevention has carried its own risk assessment expectation since 26 October 2024, when the Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced a duty on every employer to take reasonable steps to prevent it.
From 30 October 2026, the Employment Rights Act 2025 raises that standard from "reasonable steps" to "all reasonable steps". It adds employer liability for harassment carried out by third parties such as customers or contractors.
The Equality and Human Rights Commission's own guidance directly names sexual harassment risk assessment as one of the expected steps. This means identifying where and how harassment could happen in your organisation before it happens; not just reacting after someone complains.
Who Can Carry Out a Risk Assessment? The Competent Person Rule
Anyone with enough training, experience, or knowledge to do the job properly can carry out a risk assessment, under Regulation 7 of the 1999 Regulations, known as the competent person rule.
A formal health and safety qualification is not required by law. What matters is whether the person understands the work being assessed and the principles of risk assessment well enough to do it properly.
Most small businesses can meet this rule from inside the business itself, often the owner or a manager who already knows the work. A safe system of work is usually the next document a competent person produces once the assessment has identified what needs controlling.
Do You Legally Have to Write Down a Risk Assessment?
No, you do not have to write a risk assessment legally unless you have 5 or more employees. Having fewer than five employees doesn't remove the duty to assess. It just removes the duty to write it down.
Even though it’s not a legal requirement for employers with fewer than five staff, most insurers and courts expect a written record anyway if something goes wrong and the assessment is ever challenged. A written record is also the only practical way to review an assessment later or hand it to a new manager, so most small businesses keep one regardless of the threshold.
Do You Have to Record a Fire Risk Assessment?
Yes, you do have to record a fire risk assessment, but only if one of three conditions applies:
- you employ five or more people, or
- a licence under an enactment is in force for the premises, or
- an alterations notice requiring it is in force.
Recording a fire risk assessment follows its own trigger, separate from the general five-employee rule for other risk assessments. Under Article 9(6) of the Regulatory Reform (Fire Safety) Order 2005.
That third condition matters for smaller sites. Take a four-person premises that holds a licence; a late-night bar or a care home, for example. It still has to write down its fire risk assessment, even though its general risk assessment under the 1999 Regulations doesn't legally need to be in writing.
Construction sites often produce this fire record alongside a wider risk assessment method statement, since both documents tend to get requested at the same site inspection.
How Often Does a Risk Assessment Need to Be Reviewed by Law?
The law does not set a fixed interval for how often a risk assessment needs to be reviewed. Many employers use twelve months as a working default for this, even though the law itself doesn't set it.
Regulation 3 only requires that the assessment stays valid, so it has to be reviewed whenever there is reason to think it no longer reflects the real risk.
Three events reliably trigger a review in practice:
- An accident or near miss. This suggests a gap in the existing controls.
- A significant change to the work, the equipment, or the people doing it. This makes the old assessment out of date.
- Enough time passing that nobody can say with confidence the assessment still holds.
What Happens If You Don't Comply With Risk Assessment Law?
If you don't comply with risk assessment law, then you're committing a criminal offence under Section 33 of the HSWA 1974. It is enforced through a graduated set of powers rather than an automatic fine.
HSE inspectors typically move through three stages:
- An improvement notice: requires a specific fix within a set deadline.
- A prohibition notice: stops a dangerous activity immediately if the risk is serious enough.
- Prosecution: follows where the breach is severe, repeated, or where someone has already been harmed.
That means: if there's a specific fix needed, HSE issues an improvement notice with a deadline. If the risk is serious enough to warrant immediate action, HSE issues a prohibition notice stopping the activity outright. And, finally, if the breach is severe, repeated, or has already harmed someone, HSE prosecutes.
What happens when HSE prosecutes: a conviction can mean an unlimited fine, up to two years in prison, or both. And it's not just the company that can be held liable.
If a director, manager, or other officer knew about the offence, was involved in it, or neglected to stop it, they can be held personally liable too, under Section 37.
HSE's most recent enforcement data, for 2024/25, recorded 246 prosecutions with a 96 percent conviction rate and fines exceeding £33 million. The underlying incident behind a prosecution is often already reportable under RIDDOR, a separate reporting duty that runs alongside the risk assessment itself.
Risk Assessment Compliance: What to Get Right First
None of the legal requirements for risk assessment in the UK ask for a perfect document. It just asks for an honest, proportionate judgement about what could actually hurt someone in a workplace.
EHS Solutions by SDS Manager keeps those judgements on record, each assessment with an owner and a review date.
Where an assessment covers hazardous substances, it draws on your chemical inventory and SDS library on the same unified platform, via SDS Manager, so the data behind it stays current.
Frequently Asked Questions
Do I Need a Risk Assessment If I Am Self-Employed With No Staff?
Yes, you need a risk assessment if you are self-employed with no staff if your work could put anyone else at risk. That includes clients, customers, or members of the public. The only exemption is for self-employed work that poses no potential risk of harm to anyone but yourself.
Do Part-Time Staff Count Towards the Five-Employee Threshold?
Yes, part-time staff count the same as full-time staff towards the five-employee threshold. The regulation's own wording counts five or more employees without adjusting for hours worked. This reads as a straight headcount rather than a full-time-equivalent calculation.
Can I Use a Template or Generic Risk Assessment?
No, you cannot use a template or a generic risk assessment, at least not on its own. A risk assessment has to be suitable and sufficient for your specific workplace and tasks. HSE inspectors treat an unmodified template as a sign the assessment was never properly carried out.
Do Employees Have to Sign the Risk Assessment?
No, there is no legal requirement for an employee to sign a risk assessment. What the law does require is consultation: employers must involve employees and safety representatives in the risk assessment process, a separate duty from a signature that is not satisfied by simply asking staff to sign a document they have not discussed.
Do I Need a Risk Assessment for Staff Working From Home?
Yes, you need a risk assessment for staff working from home. The general duty to assess risk extends to any location where work happens, including a home office. Display screen equipment is usually the main practical risk for home-based staff, and the same Display Screen Equipment Regulations 1992 duty applies wherever the screen is set up.
Does Risk Assessment Law Apply in Scotland and Northern Ireland?
Yes, risk assessment law applies in Scotland, since the HSWA 1974 and the Management of Health and Safety at Work Regulations 1999 apply across Great Britain. However, Northern Ireland has separate but equivalent legislation: the Health and Safety at Work (Northern Ireland) Order 1978 and the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, enforced by the Health and Safety Executive for Northern Ireland rather than the HSE.
Arysha Alif Khan
Arysha Alif Khan is an EHS and chemical safety specialist with a background in biochemistry, biotechnology, and public health. She works closely with the product and regulatory teams to turn complex chemical regulations, SDS requirements, and workplace safety standards into clear, practical guidance for people.