What Is a Health and Safety Policy and Does My Business Legally Need One?
By Summit Safety Solutions | Health and Safety Consultancy | Updated 2026
A health and safety policy is one of the most important legal documents a UK employer holds. Yet it is also one of the most misunderstood. Many business owners treat it as a form to fill in once and file away. In reality, a health and safety policy is a working document. It defines how your business manages risk, names the people responsible, and sets out what happens when things go wrong.
This guide explains what a health and safety policy is, what the law says it must contain, which businesses need a written one, and what the consequences are for getting it wrong.
What is a health and safety policy?
A health and safety policy sets out your general approach to health and safety at work. They explain how you, as an employer, will manage health and safety in your business. If done correctly, they should say clearly who does what, when, and how.
It is not simply a statement of good intentions. A well-written health and safety policy is a practical management tool. It should reflect the actual risks in your workplace, the people or positions responsible for managing them, and the specific procedures your business uses to keep employees and others safe.
A health and safety policy is also distinct from a risk assessment, a method statement, or a training record. All of these form part of the wider safety management system, but the policy sits at the top of it. For clarity on this, we recommend speaking to a qualified health and safety advisor
Is a written policy a legal requirement for UK businesses?
The short answer is yes, and for most businesses it must be written down.
The law says every business must have a policy for managing health and safety. If you have five or more employees, you must put it in writing. If you have fewer than five, you do not have to write it down, but it is sensible to do so.
This requirement comes from Section 2 of the Health and Safety at Work etc. Act 1974, which requires every employer to prepare a written statement of their general health and safety policy and bring it to the attention of all employees.
If your business employs five or more people, whether full-time, part-time, or on zero-hours contracts, a written, signed, and communicated health and safety policy is a legal obligation.
What about businesses with fewer than five employees?
Even without five employees, putting your policy in writing is still good practice. Without it, you may find it difficult to prove you have met your duties under the Act if you are ever questioned.
There is a commercial reason to have one too. Many insurers, contractors, and procurement teams now ask to see a health and safety policy before agreeing to work with a supplier, regardless of company size.
What must it contain? The three required parts
The Health and Safety at Work etc. Act 1974 requires a health and safety policy to contain three parts. These are a Statement of Intent, an Organisation section, and an Arrangements section.
Here is what each part must cover.
Part 1: Statement of intent
The statement of intent sets out your general commitment to health and safety and your aims for managing it. As the employer or most senior person in the business, you must sign it and review it regularly.
This section does not need to be long. Two or three focused paragraphs are enough. What matters is that it is specific and honest. Vague pledges to do everything possible to prevent accidents carry very little legal weight if they are ever scrutinised.
The statement must be signed by the most senior person in the business, typically the Managing Director or CEO. You should review it at least annually, or sooner after any significant incident or change to the business. For more on what the MD is personally responsible for, see our guide: [Health and Safety Requirements for Managing Directors]
Part 2: Organisation and responsibilities
The responsibilities section lists the names, positions, and roles of the people in your business who have specific health and safety duties.
Name individuals here wherever possible, not just job titles. It should be clear who conducts risk assessments, who manages contractor safety, who handles incident reporting, and who has been appointed as the competent person under the Management of Health and Safety at Work Regulations 1999.
This section must not contain overlapping or unclear responsibilities. Each named person needs to understand what they are responsible for and where those responsibilities end. Unclear accountability is one of the most common problems businesses face during HSE investigations.
Part 3: Arrangements for health and safety
The arrangements section describes the specific systems and procedures you have in place to control risk. This is typically the longest part of the policy.
It should cover the hazards relevant to your business. For example, manual handling, working at height, COSHH substances, lone working, or display screen equipment. For each one, it should explain what controls and procedures you have in place.
This section must be written for your business specifically. A generic template downloaded from the internet and left unchanged will not satisfy the legal requirement. It will not hold up if an inspector or court looks at it.
What happens if your policy is inadequate or missing?
The consequences range from an improvement notice at the lower end to criminal prosecution at the higher end.
If the HSE or local authorities visit your business, they will ask to see your policy. They check your safety commitments and whether staff follow them. In some cases, you can be prosecuted simply for not having a written policy where one is legally required.
The more serious risk, though, is not just the absence of a document. An inspector who finds no policy, or one that is out of date, uses that as evidence of a broader failure to manage health and safety. If a workplace accident or illness occurs, the health and safety policy is the first thing an HSE inspector will ask for. If it does not exist, or bears no relation to how your business actually operates, your legal position becomes significantly worse.
Businesses that have a policy on paper but have never communicated it, reviewed it, or put it into practice are, legally speaking, almost as exposed as those with no policy at all.
Five common mistakes businesses make with their health and safety policy
Working with businesses across the south of England, these are the failures we see most regularly.
Mistakes that weaken your position
1. Using an unmodified generic template
A downloaded template is a starting point, not a finished document. Your health and safety policy must reflect your specific workplace, your specific risks, and your named staff. A template that references hazards irrelevant to your business, or that misses hazards that are relevant, will not be treated as a valid policy if it is challenged.
2. Failing to sign and date it
The policy must be signed by the most senior person in the business. An unsigned policy has no legal standing. It also signals that leadership has not formally accepted the obligations within it.
3. Never reviewing it
The policy must be kept up to date. Review it at least annually, or after any significant change to the business, and then communicate any updates to all employees and relevant third parties such as contractors.
A policy reviewed three years ago that refers to staff who have left, premises you no longer use, or equipment you no longer operate is effectively out of date. Reviewing it annually is not a formality. It is a legal obligation.
Mistakes that affect your people
4. Not sharing it with employees
You are legally required to share your health and safety policy with your staff. All employees should be told where to find it and how to raise health and safety concerns, typically as part of their induction.
The policy must be actively communicated. It is not enough to leave it in a folder somewhere. Many businesses share it via an intranet or onboarding pack. That approach works, provided employees can show they received and understood it.
5. Treating it as separate from day-to-day operations
The most useful health and safety policy is one that people actually refer to. It should come up in inductions, toolbox talks, risk assessment reviews, and incident investigations. If your staff do not know what the policy says, it is not doing its job, and if something goes wrong, that will be clear.
How often must it be reviewed?
There is no fixed legal interval, but [HSE guidance] is clear that the policy should be reviewed regularly and updated whenever it no longer reflects how the business operates. In practice, this means reviewing it:
- At least once a year as a minimum
- After any significant change, such as new premises, new processes, new equipment, or new staff in key roles
- Following any workplace incident or near-miss
- When relevant legislation changes
Do you need professional help to write one?
Not necessarily. The HSE provides a free template and guidance for smaller, lower-risk businesses. However it is still strongly recommended you contact a health and safety consultant.
For businesses in higher-risk sectors, or those with more complex operations, a generic template will never be enough.
A qualified health and safety consultant writes a policy for your specific workplace, your industry, and the hazards your employees actually face. They make sure it connects properly with your risk assessments, training programme, and wider compliance arrangements, rather than sitting as a standalone document that nobody reads.
At Summit Safety Solutions, writing and reviewing health and safety policies is a core part of our work. We help Managing Directors and business owners across the south of England produce policies that are legally sound, practical, and actually used.
In summary
Here are the key points to take away from this guide:
- Every UK business must have a health and safety policy, regardless of size
- If you employ five or more people, it must be in writing
- It must contain three parts: a statement of intent, a section on responsibilities, and a section on arrangements
- It must be signed by a senior representative, communicated to all staff, and reviewed regularly
- A generic, unreviewed, or uncommunicated policy offers very little legal protection
- The HSE will ask to see it during any inspection or investigation
If you are not confident your current health and safety policy would stand up to scrutiny, or if you do not yet have one, address it sooner rather than later.
Book a free 30-minute Compliance Gap Review and we will assess your policy and tell you exactly where you stand.
Frequently asked questions about health and safety policies
Common questions
Is a health and safety policy a legal requirement?
Yes. Under Section 2(3) of the Health and Safety at Work etc. Act 1974, every employer must have a policy for managing health and safety. If you employ five or more people, then it legally must be written down and brought to employees’ attention.
What are the three parts of a health and safety policy?
A health and safety policy must contain a statement of intent, an organisation section, and an arrangements section. The statement of intent covers your commitment and aims and must be signed by the most senior person. The organisation section names who is responsible for what. The arrangements section describes the specific procedures and controls in place for the risks in your business.
Who should sign the health and safety policy?
The most senior person in the business, typically the Managing Director, CEO, or business owner. Their signature shows that leadership has formally accepted the obligations within the policy. A policy signed by a junior manager, or left unsigned, does not satisfy the legal requirement.
How long should a health and safety policy be?
There is no minimum or maximum length. A small, low-risk business may produce a policy of two or three pages. A larger or higher-risk organisation may produce something considerably more detailed. What matters is that the content is specific, accurate, and relevant to your business.
Understanding the scope of your policy
What is the difference between a health and safety policy and a risk assessment?
A health and safety policy sets out your overall approach, responsibilities, and commitment to managing health and safety across the business. A risk assessment is a specific document identifying hazards in a particular area or activity and the controls in place to manage them. Risk assessments feed into the arrangements section of your policy. Both are legal requirements, but they serve different purposes.
Can I use a free health and safety policy template?
You can use the HSE’s free template as a starting point. However, you must customise it thoroughly to reflect your specific business, your actual staff, your premises, and the hazards relevant to your work. Unmodified templates are a no-go. They will not automatically satisfy your legal requirement. Meaning you might not be covered if it is checked during an investigation.
Summit Safety Solutions is a health and safety consultancy based in the south of England. We help UK businesses produce compliant, practical health and safety policies and embed them into daily operations.
Book a free 30-minute Compliance Gap Review
Related reading:
