Risk Assessment Legal Requirements in the UK

Risk assessments aren't optional in the UK — they're a legal requirement for virtually every employer and self-employed person. But what exactly does the law require? This guide sets out the key regulations and what they mean in practice. For the document that pairs a risk assessment with a method statement on construction sites, see what a RAMS document is and our guide on how to write a RAMS document.

The legal framework

Several pieces of legislation establish the duty to carry out risk assessments:

Health and Safety at Work etc. Act 1974

The foundation of UK health and safety law. Section 2 places a general duty on employers to ensure, so far as is reasonably practicable, the health, safety, and welfare of their employees. Risk assessment is the primary mechanism for demonstrating compliance with this duty.

Management of Health and Safety at Work Regulations 1999

Regulation 3 makes risk assessment an explicit requirement. Every employer must carry out a suitable and sufficient assessment of the risks to the health and safety of employees and anyone else affected by their work. Employers with five or more employees must record the significant findings.

Construction (Design and Management) Regulations 2015

CDM 2015 adds specific duties for construction projects. Principal contractors must plan, manage, and monitor the construction phase, and risk assessment is a fundamental part of that planning. Designers must also consider and communicate risks that cannot be eliminated through design.

What does "suitable and sufficient" mean?

The HSE describes a suitable and sufficient risk assessment as one that:

• Identifies the significant hazards — not every trivial risk
• Addresses who might be harmed and how
• Evaluates whether existing controls are adequate
• Leads to proportionate action where controls need improving
• Is appropriate to the nature of the work — not overly complex or bureaucratic

In other words, the law doesn't require perfection or excessive paperwork. It requires a thoughtful, practical assessment that focuses on real risks.

Who must carry out risk assessments?

• Employers — for all work activities that could affect employees or others
• Self-employed persons — for risks arising from their own work
• Controllers of premises — for risks to visitors and contractors

The assessment must be carried out by a competent person — someone with sufficient training, experience, and knowledge to identify hazards and evaluate risks. This doesn't necessarily require formal qualifications.

Recording and reviewing

If you employ five or more people, you must record the significant findings of your risk assessment. Even if you employ fewer, recording your assessments is strongly recommended — it demonstrates due diligence and helps with consistency.

Risk assessments must be reviewed:

• When the work activity changes
• After an incident or near miss
• When new information about hazards becomes available
• At regular intervals appropriate to the level of risk

Consequences of non-compliance

Failing to carry out adequate risk assessments can result in:

• HSE enforcement notices (improvement or prohibition)
• Criminal prosecution under health and safety legislation
• Civil liability claims if someone is injured
• Reputational damage and loss of contracts

Practical steps

Meeting the legal requirements doesn't have to be complicated. A structured approach helps:

1. Walk through the work and identify hazards
2. Consider who could be affected
3. Evaluate whether current controls are enough
4. Record your findings clearly
5. Set a review date

If you need help structuring your risk assessments, a risk assessment generator can provide a framework that aligns with HSE guidance and helps you produce consistent, professional documents.

Summary

UK law requires employers to assess workplace risks, record significant findings, and review assessments regularly. The standard is "suitable and sufficient" — practical, proportionate, and specific to the work being done.

See it in practice

"Suitable and sufficient" is easier to understand when you see it applied to a specific activity. These worked risk assessments show the level of detail HSE inspectors and principal contractors actually look for:

• Risk assessment for roofing work — fall prevention, edge protection, and rescue planning evaluated against likelihood and severity
• Risk assessment for confined-space tank entry — atmospheric, physical, and rescue hazards scored individually
• Risk assessment for electrical work — isolation, stored energy, and arc-flash controls considered for the task

Related guides

• Risk Assessment Generator — HSE-aligned 5-step builder
• RAMS Generator UK — risk assessment + method statement combined
• HSE structured risk assessments — meeting the HSE standard
• Risk assessment examples (UK) — real examples by activity type
• Who needs a risk assessment? — legal obligations by business type
• How often to review risk assessments — review frequency requirements
• Site risk assessments — site-specific assessment guidance