Legal Requirements for Risk Assessments in the UK

Risk assessments are not optional in the UK. They are a legal obligation for every employer, most self-employed persons, and controllers of premises. Yet the regulations are spread across multiple pieces of legislation, and the practical meaning of phrases like "suitable and sufficient" is rarely explained clearly.

This guide sets out every legal requirement you need to know, who it applies to, what the consequences of non-compliance look like, and provides a compliance checklist you can use immediately.

The legal framework: every regulation that matters

UK risk assessment duties don't come from a single law. They're built from overlapping legislation, each adding specific requirements. Here's the complete picture.

Health and Safety at Work etc. Act 1974 (HSWA)

The foundation of all UK workplace safety law. Section 2 places a general duty on every employer to ensure, so far as is reasonably practicable, the health, safety, and welfare of their employees. Section 3 extends this to anyone affected by the employer's undertaking — contractors, visitors, members of the public.

Risk assessment is the primary mechanism for demonstrating compliance with these duties. Without a documented assessment, you cannot demonstrate that you've identified hazards or taken reasonable precautions. In enforcement proceedings, this matters enormously.

Management of Health and Safety at Work Regulations 1999 (MHSWR)

Regulation 3 is the cornerstone. It requires every employer to carry out a "suitable and sufficient" assessment of risks to employees and non-employees arising from their work. Self-employed persons must assess risks from their own undertaking.

Regulation 3(6) adds the recording duty: if you employ five or more people, you must record the significant findings of the assessment and any group of employees identified as being especially at risk.

Construction (Design and Management) Regulations 2015 (CDM)

CDM applies to all construction work in Great Britain, regardless of size. It places specific duties on clients, principal designers, principal contractors, designers, and contractors. Risk assessment underpins multiple CDM duties — from the client's obligation to provide pre-construction information to the principal contractor's duty to plan and manage the construction phase.

Hazard-specific regulations

Several regulations require assessments for particular types of risk:

• Control of Substances Hazardous to Health Regulations 2002 (COSHH) — assessment of exposure to hazardous substances
• Work at Height Regulations 2005 — assessment before any work at height
• Manual Handling Operations Regulations 1992 — assessment of manual handling tasks that cannot be avoided
• Control of Noise at Work Regulations 2005 — noise exposure assessment
• Control of Vibration at Work Regulations 2005 — vibration exposure assessment
• Control of Asbestos Regulations 2012 — assessment before any work liable to disturb asbestos
• Regulatory Reform (Fire Safety) Order 2005 — fire risk assessment for non-domestic premises

Each of these requires a specific, documented assessment tailored to the hazard in question. A general risk assessment does not satisfy these requirements on its own.

What "suitable and sufficient" actually means

This phrase is the legal standard for risk assessments in the UK, and it's frequently misunderstood. It does not mean perfect, exhaustive, or zero-risk. The HSE has provided clear guidance on what it does mean:

• Identifies significant hazards — the ones that could realistically cause harm in the specific work being assessed, not every theoretical possibility
• Addresses all affected persons — employees, contractors, visitors, vulnerable groups, and members of the public where relevant
• Evaluates whether existing controls are adequate — and identifies what additional measures are needed
• Is proportionate to the level of risk — a simple, low-risk activity needs a simple assessment; a complex, high-risk task needs greater depth
• Remains valid — is reviewed and updated when circumstances change

The critical test is practical: would the assessment, if followed, prevent foreseeable harm? If the answer is yes, it's likely suitable and sufficient. If the assessment is so generic it could apply to any workplace, it almost certainly isn't.

Who must carry out risk assessments?

Employers

Every employer, regardless of size, must assess risks to employees and anyone else affected by their work. The five-employee threshold only applies to the recording requirement — the duty to assess exists from the first employee.

Self-employed persons

Self-employed workers must assess risks from their work that could affect themselves or others. This applies whether working alone or as part of a larger team.

Controllers of premises

Anyone who controls non-domestic premises has duties under the HSWA to ensure the premises are safe for people using them. This includes landlords, managing agents, and facilities managers.

The "competent person" requirement

Regulation 7 of MHSWR requires employers to appoint competent persons to assist with health and safety. The assessment itself must be carried out by someone with sufficient training, experience, knowledge, and other qualities to do it properly. This doesn't require formal qualifications — but it does require genuine understanding of the work and its risks.

Recording and documentation duties

The legal recording requirements are specific:

• Five or more employees — you must record the significant findings of risk assessments
• Fewer than five employees — no legal obligation to record, but strongly recommended (and practically essential for demonstrating compliance)
• What to record — the hazards identified, who is at risk, existing controls, additional controls needed, who is responsible, and the review date
• Format — there is no prescribed format. Paper, digital, or any system that works for your organisation

A risk assessment generator can help structure these records consistently, ensuring nothing is missed and documents are professional enough for client or inspector review.

UK Compliance Checklist for Risk Assessments

Use this checklist to verify your risk assessments meet UK legal requirements:

• ☐ All significant hazards identified for the specific task or workplace
• ☐ All persons who could be affected are considered (employees, contractors, public)
• ☐ Vulnerable groups specifically addressed (young workers, pregnant workers, disabled workers, lone workers)
• ☐ Existing control measures documented and evaluated for adequacy
• ☐ Additional control measures identified where existing ones are insufficient
• ☐ Risk ratings applied using a consistent methodology (likelihood × severity)
• ☐ Residual risk levels recorded after controls are applied
• ☐ Assessment is specific to the actual workplace or site conditions
• ☐ Carried out by a competent person with relevant knowledge
• ☐ Significant findings recorded in writing (mandatory for 5+ employees)
• ☐ Findings communicated to relevant employees and contractors
• ☐ Review date set and documented
• ☐ Assessment reviewed after any significant change, incident, or near miss
• ☐ Hazard-specific assessments completed where required (COSHH, manual handling, noise, etc.)
• ☐ Assessment is proportionate — detailed enough without being excessive

This checklist covers the requirements of the MHSWR 1999, HSWA 1974, and related regulations. It does not replace professional judgement, but it provides a reliable framework for self-audit.

Common mistakes that create legal exposure

These are the errors that most frequently lead to enforcement action or undermine an employer's legal position after an incident:

• Assessments that are too generic — a risk assessment that could apply to any workplace doesn't demonstrate you've assessed your risks. Inspectors look for site-specific detail.
• Failing to assess non-routine activities — maintenance, cleaning, emergency procedures, and seasonal variations are often overlooked
• No evidence of review — if your assessment hasn't been updated in years, it suggests risks haven't been reconsidered despite changing conditions
• Control measures that exist on paper only — documenting controls that aren't actually implemented is worse than not documenting at all. It demonstrates awareness of the risk and a failure to act.
• Ignoring vulnerable groups — young workers, agency workers, pregnant workers, and lone workers have specific risk factors that must be addressed
• Confusing risk assessment with RAMS — on construction sites, a standalone risk assessment often isn't enough. Understanding the difference between RAMS and risk assessments prevents submitting incomplete documentation.
• Not involving workers — the HSE expects employers to consult with employees about health and safety matters, including risk assessment findings

Enforcement and consequences

The HSE and local authorities enforce risk assessment requirements through:

• Improvement notices — requiring specific improvements within a set timeframe
• Prohibition notices — stopping work immediately where there's a risk of serious personal injury
• Criminal prosecution — for serious breaches, with unlimited fines for organisations and potential imprisonment for individuals
• Fee for intervention (FFI) — where HSE identifies a material breach, the employer is charged for the inspector's time at £163 per hour (2024 rate)

Beyond regulatory enforcement, inadequate risk assessments create civil liability. If a worker is injured and the risk assessment didn't identify the hazard or specify adequate controls, the employer's legal position is significantly weakened.

For construction projects, the consequences are amplified — principal contractors may remove subcontractors from site, and CDM breaches can affect future tendering.

Practical steps for getting it right

1. Walk the workplace — identify hazards by observing the actual work, not imagining it from a desk
2. Consult your workers — they know the risks better than anyone
3. Be specific — name the hazards, the controls, and the people responsible
4. Use a structured format — consistency makes assessments easier to write, review, and audit
5. Record everything — even if you have fewer than five employees
6. Set review dates and honour them — put them in your calendar
7. Use tools that help — a RAMS generator provides structured frameworks so you're not starting from blank

For a practical walkthrough of the document itself, see our guide on how to write a RAMS document. And for construction-specific requirements, our construction RAMS guide covers every document type you'll encounter on a UK site.

Create your RAMS instantly with Riskora →

How UK risk assessment law compares with other jurisdictions

The UK's "suitable and sufficient" standard is broadly aligned with the EU framework directive 89/391/EEC, which the MHSWR 1999 originally transposed. Post-Brexit, the duties remain in force in Great Britain unchanged, and Northern Ireland mirrors them through the Management of Health and Safety at Work Regulations (Northern Ireland) 2000. Contractors who work across borders should note that Ireland's Safety, Health and Welfare at Work Act 2005 uses the more prescriptive "Safety Statement" concept; Australian WHS law requires a SWMS for 18 high-risk construction activities; and US OSHA enforces a Job Hazard Analysis (JHA / JSA) approach. A UK risk assessment is generally accepted on a UK site only — clients in those other jurisdictions will expect the local document type.

Sector-specific recording duties most employers miss

Beyond the headline MHSWR duty, several sectors carry additional, named recording requirements that inspectors check for separately:

• Construction (CDM 2015) — pre-construction information, construction phase plan and (on notifiable projects) the health and safety file. The risk assessment underpins all three.
• Healthcare and care (CQC, HSCA) — risk assessments must be linked to care plans and incident records. The CQC's "safe" key question is judged on the quality of these assessments.
• Education (DfE, HSE schools guidance) — separate assessments are expected for trips, off-site activity, lone working and safeguarding.
• Hot work, confined space, work at height — permit-to-work systems are not a legal requirement on their own, but if a permit system is your declared control, the absence of the permit is treated as a control failure.
• Lone working — there is no separate Act, but the HSE expects a documented lone-worker assessment and a check-in/escalation procedure.

Each of these is enforceable through the parent regulator — the HSE for industrial sites, local authorities for retail and offices, the CQC for regulated care, Ofsted for childcare and education, and the Fire and Rescue Authority for the Fire Safety Order. Where multiple regulators have jurisdiction, the strictest requirement applies.

Digital risk assessments — are they legally valid?

Yes. There is no requirement in UK law for a risk assessment to exist on paper. Digital records satisfy the recording duty provided they are retrievable, attributable to a competent person, dated, and version-controlled. Platforms that timestamp changes, capture electronic signatures and store an audit trail are now widely accepted by principal contractors, the HSE and the major insurers. The risks to manage are: relying solely on a generic template library, losing access on rotation of staff, and failing to brief the assessment to the people doing the work — none of which are caused by the digital format itself.

Summary

UK employers have a clear legal duty to assess workplace risks, record significant findings, implement controls, and review regularly. The standard is "suitable and sufficient" — not perfect, but practical, proportionate, and specific. The compliance checklist above provides a reliable framework for self-audit. The common mistakes section highlights the gaps that most frequently lead to enforcement action. Getting risk assessment right is not about paperwork — it's about demonstrating that you've thought through the risks and taken reasonable steps to protect people.