Is a risk assessment a legal requirement in the UK?
Updated · UK law and HSE guidance
Short answer
Yes. Every UK employer must make a suitable and sufficient assessment of risks to employees and other people affected by the business. Relevant self-employed people also have duties. An employer with five or more employees must record the significant findings, but the duty to assess applies regardless of workforce size.
| Main law | Management of Health and Safety at Work Regulations 1999, regulation 3 |
|---|---|
| Employer threshold | No minimum size for carrying out the assessment |
| Recording threshold | 5 or more employees |
| Required standard | Suitable and sufficient |
| Review triggers | Reason to suspect invalidity or significant change |
Who has the duty
Regulation 3 places the assessment duty on every employer. The assessment must cover risks to employees while at work and risks to people who are not employees arising from the undertaking. Relevant self-employed people must assess risks to themselves and others where their work falls within the prescribed scope. Contractors may each have duties even when a client or principal contractor coordinates the site.
- Small employers are not exempt from assessing risk
- Workers, visitors, contractors and members of the public may need consideration
- Appointing an adviser does not remove the employer's responsibility
What suitable and sufficient means in practice
The assessment should identify the significant hazards and support the measures needed to comply with health and safety law. Its depth should be proportionate to the risk and complexity of the work. It must reflect real activities, including non-routine work, and consider people with particular requirements. Generic paperwork can help as a starting point but must be checked and adapted.
- Identify who might be harmed and how
- Evaluate existing precautions and further controls
- Put the findings into practice
- Record significant findings if five or more people are employed
When to review it
The law requires review where there is reason to suspect an assessment is no longer valid or there has been a significant change. HSE also advises review when controls may not be effective, workers identify problems, or an accident or near miss occurs. Amend the assessment when the review shows changes are needed, then communicate the revised controls. SitePaper can generate a record for competent review.
- Do not rely only on an arbitrary annual date
- Review before changed work creates exposure
- Keep action status and version information clear
Sources
This guide summarises UK law and HSE guidance for small businesses. It is not legal advice; check the sources and your own circumstances.