Health and Safety Training: What UK Employers Are Legally Required to Provide

Of all the compliance training obligations a UK employer carries, health and safety is the one that applies without exception. It does not matter what sector you operate in, how many employees you have, or whether your workplace is an office, a warehouse, or a care setting. The duty to provide health and safety training is a baseline legal requirement for every business, from the day the first employee joins.

Despite that, health and safety training is one of the most inconsistently managed compliance obligations in smaller businesses. The requirements are spread across several pieces of legislation, the specific training needed varies by role and workplace risk, and many business owners default to a single induction session and assume that covers it. For most, it does not.

This guide sets out the main health and safety training obligations for UK employers, explains what each one requires in practice, covers who needs training and at what depth, how often it should be refreshed, what certificates actually prove, and the record-keeping that makes the difference between a compliant business and one that simply hopes it is. It sits alongside our wider guide to compliance training obligations for UK small businesses, which covers the full range of statutory training requirements in one place.

This guide provides general information, not legal advice. If you have specific concerns about your obligations, take advice from a health and safety professional or your sector’s trade body.

Is health and safety training a legal requirement?

Yes, without qualification, and it is worth being clear about that because most compliance training sits in a greyer area. Equality and cyber security training are strongly expected but not directly mandated. Modern slavery reporting applies only above a turnover threshold. Health and safety training is a direct statutory duty on every employer regardless of size, sector, or risk level.

The primary legislation is the Health and Safety at Work etc. Act 1974, which places a duty on employers to ensure, so far as is reasonably practicable, the health, safety, and welfare of their employees. The Management of Health and Safety at Work Regulations 1999 build on this by requiring employers to assess workplace risks, put appropriate control measures in place, and provide employees with adequate health and safety training.

The Health and Safety Executive enforces these requirements and has the power to investigate workplaces, issue improvement and prohibition notices, and pursue prosecutions where serious breaches are identified. Fines are uncapped in the Crown Court and can be substantial even for a small business. More commonly, the HSE issues improvement notices requiring specific remedial action within a set timeframe, including putting training in place that was not there before.

One point in the 1999 Regulations is regularly missed. Training must be provided on recruitment, when an employee’s responsibilities change, when new equipment or processes are introduced, and when risks change. It is not a one-time obligation discharged at induction. It is an ongoing requirement that moves with the business.

Who needs health and safety training?

Every employee needs a baseline, and several roles need considerably more. Getting this wrong in either direction is costly: training everyone to the same depth wastes money on people who do not need it and leaves the people who do underprepared.

All employees need induction covering the hazards specific to their workplace, emergency and evacuation procedures, how to report accidents and near misses, and who holds responsibility for health and safety in the organisation.

Managers and supervisors carry more, because the 1999 Regulations place the risk assessment duty on the employer and in practice that work is delegated to them. They need to understand how to conduct and record a risk assessment, what control measures are proportionate, and when to escalate.

Designated roles need formal, certificated training rather than awareness. That means first aiders, fire wardens or marshals, and anyone operating equipment that carries its own competence requirements. These are the roles where a certificate with an expiry date genuinely matters, and they are covered in more detail below.

Two groups carry specific duties under the 1999 Regulations that are frequently overlooked in smaller businesses. Young workers under 18 require a risk assessment that accounts for their inexperience and immaturity before they begin work. New and expectant mothers require a specific risk assessment once the employer has been notified in writing, with adjustments made where a risk is identified.

The training categories every employer should cover

Beyond the general duty to train, several specific regulations create requirements that apply to most workplaces regardless of sector.

Health and safety induction

Every new employee should receive induction training before they begin work, or as early as practicable after starting. This should cover the key hazards in their specific workplace, the emergency procedures in place, how to report accidents or near misses, and who is responsible for health and safety in the organisation. Content should be proportionate to the risk level of the role, but no employee should start work without it.

Fire safety

The Regulatory Reform (Fire Safety) Order 2005 requires employers to provide employees with appropriate instruction and training on fire safety measures. In practice, all staff should understand the evacuation procedure for their workplace, know where fire exits and assembly points are, and know what to do if they discover a fire. Training should be repeated periodically, and whenever the premises, procedures, or workforce change significantly. Records of who has completed fire safety training and when should be retained.

Manual handling

The Manual Handling Operations Regulations 1992 require employers to provide training to employees who carry out manual handling tasks, defined broadly as any transporting or supporting of a load by hand or bodily force. This applies well beyond warehousing and logistics. It covers office workers moving boxes or equipment, care workers assisting patients, hospitality staff carrying supplies, and anyone else who regularly lifts, lowers, pushes, pulls, or carries as part of their role. Training should cover safe technique, how to assess a load before handling it, and when to seek assistance or use mechanical aids.

Display screen equipment

The Health and Safety (Display Screen Equipment) Regulations 1992 require employers to provide training to employees who habitually use display screen equipment as a significant part of their normal work. With hybrid and remote working now standard, the proportion of employees this covers has grown substantially. DSE training should cover correct workstation setup, posture, screen positioning, lighting, and the importance of regular breaks. Employers also have a duty to carry out workstation assessments for qualifying users, and training should explain how to request one.

First aid

The Health and Safety (First Aid) Regulations 1981 require employers to make adequate and appropriate first aid provision. For low-risk workplaces such as offices, this typically means appointing a sufficient number of trained first aiders or emergency first aid at work certificate holders, keeping a stocked first aid kit accessible, and making sure all staff know where it is and who the first aiders are. Higher-risk workplaces require more qualified provision. The HSE’s first aid needs assessment guidance helps employers determine what is appropriate for their circumstances.

SkillsCircle includes a pre-built Health and Safety learning programme covering induction, fire safety, manual handling, and DSE training, ready to assign to your team from day one, with completion recorded automatically. See what’s included.

Sector-specific obligations

The categories above apply to most workplaces. Depending on your sector, additional requirements may apply on top of them.

Food businesses must ensure that food handlers are supervised, instructed, and trained in food hygiene to a level appropriate to their role. The underlying duty comes from retained EU food hygiene regulation and is enforced in England through the Food Hygiene (England) Regulations 2006. It is a distinct obligation from general health and safety training and requires specific food safety content.

Construction businesses are subject to the Construction (Design and Management) Regulations 2015 and a range of additional requirements covering working at height, use of plant and machinery, and personal protective equipment.

Care providers regulated by the Care Quality Commission are subject to specific training standards covering moving and handling, infection control, and the safe use of equipment, which sit alongside the general framework.

If your business operates in a regulated sector, the sector-specific requirements take precedence and should be mapped separately from the general obligations covered here.

Certification: what a health and safety certificate actually proves

Health and safety differs from the rest of the compliance training set in one important way. Most compliance certificates have no formal validity period, and the refresh interval is a convention rather than a rule. Here, some certificates genuinely expire.

First aid at work and emergency first aid at work certificates are valid for three years, after which the holder must requalify rather than simply refresh. The HSE also recommends annual refresher training during that period to maintain competence. This is the one fixed interval in the whole compliance set, and it is the one most often missed, because a certificate quietly lapsing does not announce itself. If you have designated first aiders, their expiry dates belong in a system that flags them, not in someone’s memory.

Fire warden or marshal training sits between the two. There is no statutory expiry, but the role carries specific responsibilities during an evacuation and the conventional refresh is annual or biennial depending on premises risk.

For general awareness training, certificates work the way they do elsewhere. They evidence that a named individual completed a defined course on a specific date and, where assessment is included, met the pass threshold. They do not establish competence in a role, nor that the training was adequate for your particular risks. Where competence is what matters, as with plant operation or working at height, the qualification rather than the awareness certificate is what an inspector will look for.

Qualifications such as IOSH Working Safely or Managing Safely, and NEBOSH awards, sit in a different category again. They are recognised professional qualifications rather than compliance completions, and they are relevant where a business needs someone who can own health and safety rather than simply comply with it.

Can health and safety training be completed online?

For most categories, yes. The HSE does not prescribe how training must be delivered. What it expects is that you can demonstrate the employee is competent, and online delivery satisfies that for induction, fire safety awareness, manual handling theory, and display screen equipment, provided the content is appropriate to your workplace, and the completion is recorded.

There are limits, and it is worth knowing them before you buy anything. First aid at work and emergency first aid at work certification requires practical assessment, which cannot be completed online alone. Anything where competence is physical rather than informational sits in the same category: working at height, plant operation, and equipment handling need assessment in the workplace, and an online module is preparation rather than proof.

The practical position for most employers is a mixed one. Online delivery handles the awareness layer, which is the bulk of the requirement by volume, and it handles it better than a once-a-year briefing because it produces an individual dated record automatically. The physical competence layer needs someone watching the person do the thing.

How often does health and safety training need to be refreshed?

The 1999 Regulations do not specify a fixed renewal interval for most health and safety training. They require training to be repeated periodically where appropriate, and whenever the risk assessment identifies a need. In practice, most advisers recommend an annual refresh for fire safety awareness and a periodic refresh for manual handling and DSE, with the interval determined by the risk level of the role.

The exception is first aid certification, which does carry a fixed three-year validity as described above. Do not fold that into a general annual cycle and assume it is covered.

Beyond the periodic cycle, training should be revisited when an employee moves to a role with different hazards, when new equipment or processes are introduced, when a near miss or incident reveals a gap in staff knowledge, or when a risk assessment is updated. New starters should always receive induction training before they begin work, regardless of where they fall in the cycle.

For a smaller business, the simplest defensible approach is an annual refresh cycle for all core categories, additional training triggered by role changes and new equipment as they arise, first aid expiry tracked separately, and a platform that flags renewals automatically rather than relying on a calendar reminder.

What good record-keeping looks like

The HSE does not prescribe a format for training records, but it does expect employers to demonstrate that training has taken place. In the event of a workplace accident, an HSE investigation, or an insurance claim, the quality of those records will be examined. An assurance that training generally happens is not the same as evidence that a specific employee completed specific training on a specific date.

At a minimum, records should show who received the training, what it covered, when it was completed, who delivered it, and when renewal is due. For a business managing this through a spreadsheet or a paper system, producing that evidence consistently across a changing workforce is harder than it sounds. Renewal dates slip, records go missing when staff leave, and the person who owns the spreadsheet is rarely the person an investigator wants to speak to.

A platform that automates the renewal reminder cycle and produces individual-level completion records on demand resolves this structurally rather than relying on someone to maintain it manually.

Health and safety training for small businesses: where the gaps usually are

The duties do not scale with headcount. A business of twelve people carries the same obligations under the 1974 Act as a business of twelve thousand. What differs is that nobody owns the work full time, and the resulting gaps are consistent enough to be predictable.

Induction happens reliably, because it attaches to a hiring process that already exists. Refresh training has no trigger and quietly stops. Role changes go untrained, because a promotion or a shift to a new task does not feel like a hiring event even though the Regulations treat it as a retraining trigger. First aid certificates lapse. And the risk assessment, which is the foundation the entire training programme is supposed to be built on, gets written once and never revisited.

None of these are knowledge problems. They are administrative ones, which is why the answer is usually a system rather than more training. What the system needs to do is modest: hold the courses, record completions against named individuals, flag renewals and certificate expiries before they lapse, and produce evidence on demand.

What is coming: Martyn’s Law and publicly accessible premises

One forthcoming obligation is worth flagging because it will reach businesses that do not think of themselves as having a security responsibility, and because it lands on whoever already owns health and safety.

The Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law, received Royal Assent in April 2025 with an implementation period of at least 24 months, and commencement is currently anticipated around 2027. The Home Office has published statutory guidance during that period.

It applies to publicly accessible premises and events where 200 or more people may be present, with a standard tier covering premises for 200 to 799 people and an enhanced tier above that. The standard tier reaches retail, restaurants, entertainment venues, museums, galleries, and places of worship, which is a much wider net than most small business owners assume.

Training is explicitly part of it, and the guidance is clear that it should be tailored to role rather than delivered uniformly: all staff need a baseline understanding of what to look out for and how to respond and report, while those with specific responsibilities, and particularly anyone who would activate procedures, need more detailed instruction.

There is no requirement to comply until the Act commences. If your premises are likely to fall within scope, the practical step now is to establish whether you are in the standard or enhanced tier, since the obligations differ substantially between them, and to plan the training rollout rather than to complete it.

How SkillsCircle helps

SkillsCircle is a ready-made LMS built specifically for businesses with fewer than 200 employees, and it is designed to be operational in hours rather than days. Courses come pre-loaded and organised into ready-to-use learning programmes including Compliance Essentials, Health and Safety, Cyber Security, Mental Health, and Safeguarding, so there is no content to build and no learning pathways to design before a single employee can start.

Bulk user upload means an entire team can be onboarded in minutes, and assigning someone to a team automatically enrols them in that team’s learning programme and sets their deadline dates, which makes new joiners and role changes a one-step process. From that point, the platform runs the compliance cycle: reminder emails, recurrence scheduling, and course assignments are handled without manual intervention.

Progress and engagement are tracked through pre-configured, filterable reports that give admins a view by team, user, or course, downloadable in multiple formats, so the training record is ready to produce without preparation if an inspector or insurer asks for it. For businesses using Salesforce, a live integration can synchronise user data between systems.

Tiered pricing means the cost per user reduces as more licences are purchased, with no setup costs, no content fees, and no implementation project. You can browse the compliance course catalogue, find out more about SkillsCircle, or book a demo.