Health and Safety Compliance Checklist: What Your Small Business Legally Needs

TL;DR: If you run a small business in the UK or Ireland, you are legally required to manage health and safety. At a minimum, you need risk assessments, a health and safety policy (or safety statement in Ireland), fire safety provisions, an accident reporting process, first aid arrangements, and employers’ liability insurance (UK, if you have employees). The exact requirements depend on your business size, sector, and whether you employ staff. This checklist walks you through every item so you know precisely where you stand.

Health and safety compliance can feel like a minefield when you are running a small business. There are regulations, acronyms, and what seems like an endless list of paperwork. It is easy to push it down the to-do list, especially when you are busy doing the actual work.

But here is the truth: most of what you need is straightforward. Once you know what applies to your business, getting compliant is far simpler than you might think.

This guide gives you a clear, item-by-item checklist of everything a small business in the UK or Ireland legally needs. No jargon. No guesswork. Just a practical list you can work through at your own pace.

Why Health and Safety Compliance Matters

Before we get into the checklist, it is worth understanding why this matters beyond the obvious. Yes, keeping people safe is the right thing to do. But there are also very practical reasons to take compliance seriously.

It is the law, not optional

In the UK, the Health and Safety at Work etc. Act 1974 (HSWA) places a duty on every employer to ensure, so far as is reasonably practicable, the health, safety, and welfare of their employees and anyone else affected by their work. In Ireland, the Safety, Health and Welfare at Work Act 2005 does much the same.

These are not suggestions. They are legal obligations. And they apply whether you have fifty employees or just one.

It protects your team and your business

Workplace injuries and illnesses cost businesses time and money. An employee off work with a preventable injury means lost productivity, potential compensation claims, and damage to morale. Proper health and safety measures reduce the likelihood of incidents in the first place.

Insurance often requires evidence of compliance

If you ever need to make an insurance claim related to a workplace incident, your insurer will almost certainly ask for evidence that you had appropriate health and safety measures in place. If you cannot provide that evidence, your claim could be reduced or rejected entirely. Employers’ liability insurance, which is a legal requirement in the UK if you have employees, expects you to be managing risks.

Inspectors can visit without notice

The Health and Safety Executive (HSE) in the UK and the Health and Safety Authority (HSA) in Ireland have the power to inspect any workplace at any time, without prior notice. They can turn up on a building site, walk into a salon, or visit your office. If they find that you are not complying with your legal duties, they can take enforcement action on the spot.

Penalties can be severe

This is not about scaremongering, but it is important to understand the reality. In the UK, health and safety offences can result in unlimited fines in the Crown Court and up to two years’ imprisonment. In Ireland, fines can reach up to three million euros, with imprisonment of up to two years. Even at the lower end, an improvement notice from an inspector creates stress, costs, and disruption you do not need.

The good news? Compliance is achievable. Let us get into what you actually need.

Your Health and Safety Compliance Checklist

This is the core of the article. Work through each item below. For each one, we explain what it is, who needs it, and when it applies.

1. Health and Safety Policy / Safety Statement

What it is: A written document that sets out your general approach to health and safety. It typically includes a statement of intent (your commitment to H&S), details of who is responsible for what, and the arrangements you have in place to manage health and safety day to day.

Who needs it: In the UK, every employer with five or more employees must have a written health and safety policy. If you have fewer than five employees, you still have the legal duty to manage health and safety, but you are not required to write it down (although it is strongly recommended). In Ireland, every employer must prepare a written safety statement, regardless of business size. There is no exemption for small employers.

When you need it: From the moment you start employing people. In Ireland, from the moment you become an employer. If you are a sole trader with no employees, a formal policy is not legally required in the UK, but having one shows professionalism and can help if you work on client sites or need to satisfy a principal contractor’s requirements.

For a step-by-step walkthrough, see our health and safety policy guide.

2. Risk Assessments (General)

What it is: A risk assessment is the process of identifying hazards in your work, evaluating who might be harmed and how, and deciding what precautions to take. It is not about creating mountains of paperwork. It is about thinking carefully about what could go wrong and taking sensible steps to prevent it.

Who needs it: Every employer and self-employed person must carry out risk assessments. In the UK, if you have five or more employees, the significant findings must be recorded in writing. In Ireland, risk assessments must form part of your written safety statement.

When you need it: Before you start work, and whenever something changes, such as a new process, a new workplace, new equipment, or after an incident.

Risk assessments are the foundation of everything else on this list. If you only do one thing today, make it this. Our risk assessment guide explains exactly how to carry out and document a proper risk assessment.

3. COSHH Assessments

What it is: COSHH stands for Control of Substances Hazardous to Health. A COSHH assessment identifies the hazardous substances used in your work (cleaning chemicals, paints, solvents, dusts, fumes, and so on), assesses the risks they pose, and sets out the control measures you use to protect people.

Who needs it: Any business that uses, stores, or produces hazardous substances. This is a legal requirement under the COSHH Regulations 2002 (UK). In Ireland, the equivalent obligations fall under the Chemical Agents Regulations within the General Application Regulations 2007. If you work with any chemicals at all, including everyday cleaning products, you almost certainly need COSHH assessments.

When you need it: Before any hazardous substance is used for the first time, and reviewed whenever a new product is introduced, a process changes, or at regular intervals (typically annually).

Many small businesses underestimate this one. If your team uses bleach, disinfectant, paint, adhesives, or any product with a hazard warning on the label, you need a COSHH assessment. Our COSHH assessment guide walks you through the process.

4. Fire Risk Assessment

What it is: A fire risk assessment evaluates the risk of fire in your workplace and identifies what you need to do to prevent fire and keep people safe if one occurs. It covers ignition sources, fuel sources, people at risk, fire detection and warning systems, escape routes, firefighting equipment, and emergency procedures.

Who needs it: In the UK, the Regulatory Reform (Fire Safety) Order 2005 (RRFSO) requires the “responsible person” (usually the employer or person in control of the premises) to carry out a fire risk assessment. This applies to virtually all non-domestic premises. In Ireland, fire safety obligations are set out in the Fire Services Acts and reinforced by workplace health and safety legislation.

When you need it: Before you occupy or use the premises, and reviewed regularly or when there are significant changes (layout changes, new processes, or after a fire-related incident).

If you share premises, the building landlord or managing agent may have carried out the fire risk assessment for common areas, but you are still responsible for your own workspace and your employees’ safety within it.

5. Method Statements / RAMS

What it is: A method statement is a document that describes how a particular task or activity will be carried out safely. RAMS stands for Risk Assessment and Method Statement, and the two documents are often produced together. Method statements are step-by-step descriptions of the safe system of work for higher-risk tasks.

Who needs it: Method statements are not universally required by law for every business, but they are a legal expectation in certain sectors, particularly construction. Under the Construction (Design and Management) Regulations 2015 (CDM 2015) in the UK, contractors must plan, manage, and monitor their work to ensure safety. In practice, most principal contractors and clients will require RAMS before you set foot on site. In Ireland, similar expectations apply under construction safety regulations.

When you need it: Before starting any high-risk task, particularly in construction, maintenance, or any work that involves significant hazards such as working at height, hot works, confined spaces, or demolition.

Even outside construction, having method statements for higher-risk activities demonstrates competence and helps protect your business. See our method statements and RAMS guide for templates and advice.

6. Accident Book / Incident Reporting

What it is: An accident book is a record of all workplace accidents, injuries, and near misses. In the UK, you also have legal obligations under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR) to report certain serious incidents to the HSE. In Ireland, incidents must be reported to the HSA under the Safety, Health and Welfare at Work (General Application) Regulations 2007.

Who needs it: Every employer should maintain an accident book. RIDDOR reporting applies when specific types of incidents occur, including fatalities, specified injuries (such as fractures, amputations, or loss of consciousness), injuries that result in more than seven days’ incapacitation, and certain occupational diseases.

When you need it: The accident book should be available from day one. RIDDOR reports must be submitted within specific timeframes: fatalities and specified injuries must be reported without delay, while over-seven-day injuries must be reported within fifteen days.

Keeping accurate records is not just a legal requirement. It helps you spot patterns, learn from incidents, and demonstrate to inspectors that you take safety seriously.

7. First Aid Provision and Assessment

What it is: A first aid needs assessment determines what first aid equipment, facilities, and trained personnel your business requires. The level of provision depends on the nature of your work, the number of employees, and the specific hazards present.

Who needs it: Every employer must provide adequate first aid arrangements. The Health and Safety (First-Aid) Regulations 1981 (UK) require employers to provide equipment, facilities, and personnel to ensure employees receive immediate attention if they are injured or taken ill at work. In Ireland, similar requirements apply under the General Application Regulations 2007.

When you need it: From the start. Even a sole trader working alone should have a basic first aid kit appropriate to the risks of their work. The level of provision scales with the number of employees and the level of risk.

At a minimum, you need a suitably stocked first aid kit and an appointed person to take charge of first aid arrangements. Higher-risk workplaces or those with more employees may need trained first aiders.

8. Employee Training Records

What it is: Records that demonstrate your employees have received appropriate health and safety training. This includes induction training for new starters, task-specific training (such as manual handling, working at height, or using specific equipment), and refresher training at appropriate intervals.

Who needs it: Every employer. Under both UK and Irish law, employers must provide employees with adequate health and safety training. You must ensure that training is provided when employees start work, when they are exposed to new or changed risks, and at regular intervals as refresher training.

When you need it: Training should begin at induction and continue throughout employment. Records should be kept for the duration of employment and ideally for a reasonable period afterwards.

Training records do not need to be complicated. A simple log showing who was trained, on what topic, when, and by whom is sufficient. The key is having evidence that training happened.

9. PPE Assessment and Provision Records

What it is: Personal Protective Equipment (PPE) includes items such as safety boots, gloves, eye protection, high-visibility clothing, hard hats, hearing protection, and respiratory equipment. A PPE assessment determines what PPE is needed based on the risks identified in your risk assessments.

Who needs it: Every employer whose risk assessments identify risks that cannot be adequately controlled by other means. PPE should always be the last resort after you have considered eliminating the hazard, substituting for something less hazardous, and implementing engineering or administrative controls. The Personal Protective Equipment at Work Regulations 1992 (amended 2022 to include workers) set out the requirements in the UK. In Ireland, PPE requirements are covered under the General Application Regulations 2007.

When you need it: Whenever your risk assessments identify that PPE is necessary. You must ensure PPE is suitable, properly fitting, maintained, and that employees are trained in its use.

Keep records of what PPE has been issued to whom, along with any assessments of suitability and fit.

10. Employers’ Liability Insurance

What it is: Employers’ liability (EL) insurance covers the cost of compensation claims made by employees who are injured or become ill as a result of their work.

Who needs it: In the UK, employers’ liability insurance is a legal requirement under the Employers’ Liability (Compulsory Insurance) Act 1969 if you employ anyone, including part-time staff, temporary workers, and apprentices. You must have at least five million pounds of cover (most policies provide ten million pounds). The certificate must be displayed where employees can see it or made available electronically. In Ireland, while there is no specific employers’ liability insurance act, it is considered essential and is effectively required through the common law duty of care and the expectation of the courts.

When you need it: From the moment you employ your first member of staff. You can be fined up to two thousand five hundred pounds for every day you are without cover in the UK.

11. Health and Safety Law Poster

What it is: A poster that sets out the key points of health and safety law. In the UK, the Health and Safety Information for Employees Regulations 1989 require employers to either display the approved HSE poster or provide each employee with a copy of the equivalent leaflet.

Who needs it: Every employer in the UK. The poster must be displayed in a prominent position where employees can easily read it, or each employee must be given a copy of the approved leaflet. In Ireland, the HSA publishes equivalent guidance, and employers have a duty to provide employees with information about health and safety.

When you need it: From the moment you have employees. If you move premises, do not forget to put it up in the new location.

This is one of the simplest items on the list, yet it is frequently missed during inspections.

12. Emergency Procedures and Evacuation Plan

What it is: A documented plan that sets out what to do in the event of an emergency, such as a fire, gas leak, chemical spill, or bomb threat. It should cover how the alarm is raised, evacuation routes, assembly points, who is responsible for what, and arrangements for anyone who may need assistance evacuating.

Who needs it: Every employer. The Management of Health and Safety at Work Regulations 1999 (UK) require employers to establish and, where necessary, give effect to appropriate procedures to be followed in the event of serious and imminent danger. In Ireland, the Safety, Health and Welfare at Work Act 2005 places similar obligations on employers.

When you need it: Before anyone starts working in the premises. Emergency procedures should be communicated to all employees and practised regularly through drills.

If you work on client sites rather than your own premises, you need to be familiar with the site-specific emergency procedures and ensure your team knows them too.

13. Consultation with Employees on Health and Safety Matters

What it is: Employers have a legal duty to consult with their employees on health and safety matters. This means involving them in decisions about risk management, changes to processes or equipment that could affect their health and safety, the introduction of new technology, and the planning of health and safety training.

Who needs it: Every employer, regardless of size. In the UK, this duty comes from the Health and Safety (Consultation with Employees) Regulations 1996 and the Safety Representatives and Safety Committees Regulations 1977. In Ireland, the 2005 Act requires employers to consult with employees on health and safety matters and, where requested, to facilitate the selection of safety representatives.

When you need it: This is an ongoing obligation, not a one-off task. You should consult employees whenever there are changes that affect their health and safety, and provide a means for them to raise concerns at any time.

Consultation does not need to be formal. In a small business, it might be as simple as a regular conversation about safety, a standing item at team meetings, or an open-door policy for raising concerns.

Feeling overwhelmed? Our compliance kits bundle all the essential documents — risk assessments, COSHH assessments, H&S policy, and method statements — tailored to your specific trade. One download, and you’re covered.

Compliance by Business Size

Your legal obligations change depending on how many people you employ. Here is a quick breakdown.

Sole Traders with No Employees

If you work entirely on your own with no employees, your obligations are lighter but they still exist. You must:

Carry out risk assessments for your work (you do not have to write them down in the UK, but it is good practice)
Comply with COSHH if you use hazardous substances
Follow CDM 2015 requirements if you work in construction
Have appropriate first aid arrangements for yourself
Report RIDDOR-reportable incidents

You do not need employers’ liability insurance, a written H&S policy, or the health and safety law poster. However, many sole traders find that clients and principal contractors require evidence of risk assessments and method statements before they will allow you on site.

Businesses with 1 to 4 Employees

Once you take on even one employee, your duties increase significantly:

You must have employers’ liability insurance (UK)
You must provide health and safety training
You need to consult with employees on H&S matters
You must display the health and safety law poster or provide the leaflet
You must carry out and act on risk assessments
You must provide adequate first aid arrangements
You must have emergency procedures in place
You must keep an accident book

In the UK, you do not have to write down your risk assessments or H&S policy if you have fewer than five employees. However, having written records makes it far easier to demonstrate compliance if you are inspected and is considered best practice by the HSE.

Businesses with 5 or More Employees

In the UK, once you reach five employees, you must:

Have a written health and safety policy
Record the significant findings of your risk assessments in writing
Record any group of employees identified as being especially at risk

Everything else that applied at the smaller size continues to apply. The threshold of five employees is specifically about the requirement to document things in writing, not about whether the underlying duties exist.

Ireland: All Employers Need a Safety Statement

In Ireland, the rules are different. Every employer must prepare a written safety statement, regardless of how many employees they have. There is no exemption for small businesses. The safety statement must be based on the identification of hazards and the risk assessment, and it must specify the manner in which the safety, health, and welfare of employees will be secured and managed.

Compliance by Industry

Different trades face different risks, and the emphasis of your compliance paperwork will shift accordingly. Here is a quick look at four common sectors.

Cleaning Businesses

If you run a cleaning business, your key compliance priorities include:

COSHH assessments are critical. Cleaning involves constant contact with chemicals, from bleach and disinfectant to specialist degreasers and sanitisers. Every product with a hazard warning needs a COSHH assessment.
Lone working policy. Cleaners frequently work alone, often in empty buildings or outside normal hours. You need to assess the risks of lone working and put appropriate safeguards in place, such as check-in procedures and emergency contacts.
Manual handling assessments. Moving heavy equipment, carrying buckets, and repetitive tasks like mopping all create manual handling risks that need to be assessed and managed.
Slip and trip hazards. Wet floors are an obvious risk. Your risk assessments should cover how you manage this, including signage, work sequencing, and footwear.

Construction

Construction is one of the most heavily regulated sectors, and for good reason. Key requirements include:

CDM 2015 compliance (UK). The Construction (Design and Management) Regulations 2015 set out duties for clients, designers, principal designers, principal contractors, and contractors. Even if you are a sole trader sub-contractor, you have duties under CDM.
Method statements and RAMS. You will need these for virtually every task on a construction site. Principal contractors will not let you start work without them.
Site-specific risk assessments. Generic risk assessments are a starting point, but every site has unique hazards. Your assessments need to reflect the specific conditions you are working in.
Working at height, manual handling, and noise assessments. These are among the most common specific risk assessments required on construction sites.
CSCS cards and competence records. While not strictly a health and safety document, demonstrating competence through recognised training and certification is a practical requirement on most sites.

Beauty and Grooming

Salons, barbershops, and mobile beauty therapists have their own set of compliance considerations:

Infection control procedures. Preventing the spread of infection through proper sterilisation, hygiene practices, and waste disposal is fundamental.
COSHH assessments for chemical handling. Hair dyes, nail products, tanning solutions, and cleaning chemicals all require COSHH assessments.
Client safety considerations. Patch testing for allergies, consultation records, and ensuring treatments are performed safely are all part of your duty of care.
Electrical safety. Regular PAT testing of electrical equipment (hairdryers, clippers, UV lamps) and visual inspections contribute to a safe working environment.
Ventilation. Adequate ventilation is essential where chemical products are used, particularly in nail services and hair colouring.

Office-Based Businesses

Even if your work takes place entirely in an office, you still have health and safety obligations:

Display Screen Equipment (DSE) assessments. If your employees use computers habitually as a significant part of their work, you must carry out workstation assessments and act on the findings. This includes ensuring proper seating, screen positioning, and regular breaks.
Fire safety. Every office needs a fire risk assessment, suitable fire detection and warning systems, fire extinguishers, clear escape routes, and practised evacuation procedures.
Stress and mental health. Employers have a duty to assess and manage risks to mental health, including work-related stress. This is an increasingly important area of compliance.
Slips, trips, and falls. Trailing cables, wet entrance areas, uneven flooring, and cluttered walkways are all common hazards in office environments.
First aid. Even low-risk offices need at least an appointed person and a suitably stocked first aid kit.

What Happens if You Are Not Compliant

Understanding the consequences of non-compliance is not about creating fear. It is about understanding the stakes so you can prioritise appropriately.

HSE and HSA Enforcement Actions

When an inspector visits your workplace, they have significant powers. They can enter premises at any reasonable time (or at any time if they believe there is a dangerous situation), take photographs and samples, require areas to be left undisturbed, and interview anyone they consider appropriate.

Improvement Notices

If an inspector identifies a breach of health and safety law, they can issue an improvement notice. This requires you to remedy the breach within a specified time, usually twenty-one days or more. Failure to comply with an improvement notice is a criminal offence.

Prohibition Notices

If an inspector considers there is a risk of serious personal injury, they can issue a prohibition notice. This takes immediate effect and stops the activity until the risk has been adequately addressed. A prohibition notice on a construction site, for example, can halt work entirely until the issue is resolved. The financial impact of that alone can be devastating for a small business.

Prosecution and Fines

For more serious breaches, or where improvement or prohibition notices have been ignored, prosecution can follow.

In the UK, health and safety offences heard in the Magistrates’ Court can attract unlimited fines. In the Crown Court, fines are also unlimited, and individuals can face up to two years’ imprisonment. Corporate defendants face sentencing under guidelines that take into account the seriousness of the harm risked and the turnover of the business.

In Ireland, conviction on indictment under the Safety, Health and Welfare at Work Act 2005 can result in a fine of up to three million euros and imprisonment for up to two years.

These are not theoretical penalties reserved for large corporations. Small businesses and individuals are prosecuted regularly. The HSE publishes details of prosecutions, and small traders and sole traders feature alongside larger firms.

Impact on Insurance Claims

If you suffer a workplace incident and you do not have adequate compliance documentation in place, your insurer may reduce or refuse your claim. Employers’ liability claims, public liability claims, and even professional indemnity claims can all be affected if it is found that you were not managing health and safety as required by law.

Reputational Damage

In an age of online reviews and social media, a prosecution or serious workplace incident can cause lasting damage to your reputation. Clients, particularly larger companies and public sector organisations, increasingly require evidence of health and safety competence before awarding contracts. A poor compliance record can lock you out of opportunities.

How to Get Compliant Quickly

If you have read this far and realised you have gaps, do not panic. Most small businesses can get their core compliance in order within a few days. Here is how to approach it.

Prioritise: Start with Risk Assessments and Your H&S Policy

These are the foundation of everything else. Your risk assessments identify the hazards and control measures, and your health and safety policy sets out your commitment and arrangements. Once these are in place, much of the other documentation flows naturally from them.

Use Templates to Save Time

You do not need to start from a blank page. Well-designed templates give you a structure to follow, prompt you to consider the right hazards for your trade, and ensure you cover the legal requirements. The key is to make sure any template you use is relevant to your specific work and that you tailor it to your actual circumstances. A generic template that does not reflect your business is worse than useless because it gives a false sense of security.

Do Not Overcomplicate It

Health and safety documentation does not need to be long, complicated, or full of technical jargon. In fact, the HSE explicitly encourages simplicity. A risk assessment should be a practical document that your team can actually use, not a thesis that sits in a drawer. Write in plain English. Be specific about what you actually do. Keep it real.

Set a Review Schedule

Compliance is not a one-off task. Your documents need to be reviewed and updated regularly. Set a minimum annual review date, and review sooner if anything changes: new equipment, new processes, a new workplace, new employees, or after any incident or near miss. Put the review dates in your calendar now so you do not forget.

Train Your Staff

Documents alone are not enough. Your employees need to understand the risks they face and the precautions they must take. Training does not have to mean expensive courses for every topic. Toolbox talks, on-the-job demonstrations, and simply walking through your risk assessments with your team all count. What matters is that people know what they need to know, and you can demonstrate that you provided the training.

Start by seeing the quality of our templates. Download our free sample — it includes a sample risk assessment and COSHH assessment.

Compliance Alignment

This guide covers requirements under the following legislation:

United Kingdom:

Health and Safety at Work etc. Act 1974 (HSWA 1974)
Management of Health and Safety at Work Regulations 1999 (MHSWR 1999)
Regulatory Reform (Fire Safety) Order 2005 (RRFSO 2005)
Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR 2013)
Control of Substances Hazardous to Health Regulations 2002 (COSHH 2002)
Construction (Design and Management) Regulations 2015 (CDM 2015)
Health and Safety (First-Aid) Regulations 1981
Employers’ Liability (Compulsory Insurance) Act 1969
Personal Protective Equipment at Work Regulations 1992 (amended 2022)
Health and Safety (Consultation with Employees) Regulations 1996

Ireland:

Safety, Health and Welfare at Work Act 2005 (SHWW Act 2005)
Safety, Health and Welfare at Work (General Application) Regulations 2007

Key Takeaways

Health and safety compliance is a legal duty, not optional. It applies to every business, from sole traders to larger employers.
Risk assessments are the foundation. Everything else builds on a proper understanding of the hazards in your work.
Your obligations increase with your workforce size, but even sole traders have duties under the law.
In Ireland, all employers need a written safety statement, regardless of size. There is no small-employer exemption.
Different industries have different priorities. Focus on the risks that are most relevant to your specific trade.
Non-compliance carries real consequences: fines, imprisonment, insurance issues, and reputational damage.
Getting compliant is simpler than you think. Start with risk assessments and your H&S policy, use good templates, keep it simple, and review regularly.
Documentation is evidence. If it is not written down, you will struggle to prove you did it. Written records protect you during inspections, insurance claims, and contract applications.

If you are not sure where to start, our compliance kits are designed specifically for small trades and sole traders in the UK and Ireland. Each kit includes risk assessments, COSHH assessments, a health and safety policy, and method statements tailored to your trade. You can also download a free sample to see the quality before you commit.