The employer duty of care in Great Britain: what is actually required

That is the whole answer in one sentence. The rest of this page unpacks each part, quotes the actual legal texts, and sets out what the law does not require, because a good deal of worry, and a good deal of selling, happens in the gap between the two.

A note on where these duties apply. The 1974 Act does not extend to Northern Ireland, which has its own regime, and the 1999 Regulations extend to England, Wales and Scotland only. Where this page says Great Britain, it means Great Britain.

Where the duty comes from

There are two sources, and they run in parallel.

The first is the common law. An employer owes each employee a duty to take reasonable care to avoid causing foreseeable injury through their work. A breach grounds a civil claim for compensation by the injured employee, and the courts have held that this duty covers psychiatric injury as well as physical injury.

The second is statute. Section 2(1) of the Health and Safety at Work etc. Act 1974 provides:

"It shall be the duty of every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all his employees."

A breach of the statutory duty is a criminal matter, enforced by the Health and Safety Executive or the local authority.

So one set of facts, an employer who could reasonably have foreseen harm and did nothing, can produce both a civil claim and a regulatory response.

How mental health gets inside a statute that never mentions it

This part usually gets skipped, and skipping it is why so much writing on the subject is wrong.

Neither the Health and Safety at Work etc. Act 1974 nor the Management of Health and Safety at Work Regulations 1999 uses the words "stress", "mental health" or "psychosocial". The duty reaches psychosocial risk because it is framed around "health" without qualification, and because HSE and the courts have applied it that way. The Act does not define "health" at all.

The chain has four links, and it is worth seeing them separately. The compressed version, "the law requires employers to protect mental health", is not something the statutory text says. The same four links, written for a reader who wants to know what an employer is and is not responsible for, are set out at mental health at work.

Section 2(1) covers health, safety and welfare undifferentiated, and the list of particulars that follows it is expressly non-exhaustive. Regulation 3(1) requires assessment of "the risks to the health and safety" of employees, again undifferentiated. HSE, the regulator, states in terms that the duty covers stress: "Employers have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it. This is the same duty you have to protect people from other health and safety risks" (HSE, Work-related stress and how to manage it: Overview, hse.gov.uk/stress/overview.htm, updated 4 June 2024). And the courts have held that the ordinary principles of employers' liability apply to psychiatric injury caused by work, with no special control mechanisms for stress claims.

One wording point that survives into practice: HSE's stress pages say "workers", while the Act and the Regulations say "employees". Those are not the same category in Great Britain law. Where this page states a legal threshold it uses the statutory word.

The written-record threshold: regulation 3

The 1974 Act sets the general duty. The 1999 Regulations say how it is to be discharged. Regulation 3(1) requires every employer to make "a suitable and sufficient assessment of… the risks to the health and safety of his employees to which they are exposed whilst they are at work".

The written-record threshold sits in regulation 3(6), which is worth quoting precisely:

"Where the employer employs five or more employees, he shall record" the significant findings of the assessment, and any group of his employees identified by it as being especially at risk. (MHSWR 1999, reg. 3(6))

Read those two provisions together and the position is the opposite of what most employers below the threshold believe. The duty to assess applies to every employer, with no minimum number of employees. The five-employee threshold governs recording only. HSE puts the recording half plainly: "If you have fewer than five workers, you don't have to write anything down." What crossing that threshold involves in practice, for an employer who has just made the hire that does it, is the day you hire your fifth employee.

Regulation 3(3) adds that the assessment must be reviewed if there is reason to suspect it is no longer valid, or if there has been a significant change. The assessment is a continuing obligation, not a document you produce once.

Regulation 3(6) says nothing about format. It does not prescribe a template, a standalone document, or a retention period. There is no Approved Code of Practice for these Regulations, and none anywhere on stress, so nothing else fills that gap either.

A separate five-employee threshold sits in section 2(3) of the 1974 Act, which requires a written statement of general health and safety policy; employers of fewer than five employees are excepted by the Employers' Health and Safety Policy Statements (Exception) Regulations 1975. Three five-person thresholds exist across this body of law and they are easily confused, so it is worth naming which one you are looking at.

What "reasonably practicable" means

The statutory duty is qualified by the phrase "so far as is reasonably practicable", and the qualification is not a loophole. The accepted formulation comes from Edwards v National Coal Board [1949] 1 KB 704 at 712. As Smith LJ reproduced it in Baker v Quantum Clothing Group [2009] EWCA Civ 499 at [82], the employer must place "the quantum of risk… on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time or trouble)… in the other", and a precaution may be forgone only where "there is a gross disproportion between them".

The common misreading is that this makes the duty a cost-benefit sum. HSE's own explanation says otherwise:

"Thus, the process is not one of balancing the costs and benefits of measures but, rather, of adopting measures except where they are ruled out because they involve grossly disproportionate sacrifices."

(HSE, ALARP at a glance. The page has been withdrawn from HSE's live site; this is the National Archives capture of 6 December 2024.)

The decision is weighted toward doing the thing, and the burden of showing it was not reasonably practicable to do more sits with the employer. An employer with no record of having considered the question starts that argument from a difficult place.

What the courts have decided

Three cases carry this territory, and each is narrower than it is usually described.

Walker v Northumberland County Council [1995] is the first. As the Court of Appeal later described it in Yapp v Foreign and Commonwealth Office [2014] EWCA Civ 1512 at [88], the court held that no risk was foreseeable before the employee's first breakdown, and found the council liable for the consequences of the second, once it had not taken reasonable steps to reduce a risk that had by then become foreseeable. Walker is a first-instance decision, so it is persuasive rather than binding; its weight comes from the Court of Appeal having approved it seven years later. It did not create a duty to prevent stress in the abstract, and it did not require anyone to buy anything.

Hatton v Sutherland [2002] EWCA Civ 76 is the one that governs. Hearing four conjoined employers' appeals, the Court of Appeal held that no special control mechanisms apply to work-stress psychiatric injury claims, and set out sixteen practical propositions. Three of them do most of the work. The threshold question is "whether this kind of harm to this particular employee was reasonably foreseeable", which has two components: "an injury to health (as distinct from occupational stress)" that "is attributable to stress at work (as distinct from other factors)". An employer "is usually entitled to assume that the employee can withstand the normal pressures of the job unless he knows of some particular problem or vulnerability". And to trigger a duty to act, "the indications of impending harm to health arising from stress at work must be plain enough for any reasonable employer to realise that he should do something about it". (Propositions (2), (3) and (7), as reproduced in full in Easton v B&Q plc [2015] EWHC 880 (QB) at [50].)

Barber v Somerset County Council [2004] UKHL 13 took one of those four appeals to the House of Lords, which allowed it and restored the trial judge's finding of liability. Lord Walker described the Hatton propositions as "useful practical guidance", adding that they "must be read as that, and not as having anything like statutory force" (as quoted in Hartman [2005] EWCA Civ 6 at [8]). It is worth taking him at his word. The propositions are guidance from a court, not a checklist you can pass.

The thread through all three is foreseeability, and foreseeability attaches to knowledge. An employer that has never looked for psychosocial risk has a harder time arguing harm was unforeseeable, because the test asks what it ought to have known. An employer that looked, saw a signal and did nothing is in a worse position again.

The scale of the underlying issue is a matter of official record. HSE estimates that 964,000 workers in Great Britain suffered from work-related stress, depression or anxiety in 2024/25, a rate of 2,770 per 100,000 workers, and that 22.1 million working days were lost to it, an average of 22.9 days per case (HSE, Work-related stress, depression or anxiety statistics in Great Britain, 2025, published 20 November 2025). Those are self-reported estimates from the Labour Force Survey: they capture conditions that workers themselves attribute to their work, not clinical diagnoses.

The trend behind them is less dramatic than it is usually reported. The rate rose sharply at the pandemic and then moved without statistically significant year-on-year change for four years, from 2,480 per 100,000 in 2019/20 to 2,800 in 2021/22, falling to 2,290 in 2023/24, before rising significantly to 2,770 in 2024/25.

What the law does not require

The duty is often described as if it obliged employers to buy things. It does not, and each supposed obligation is worth taking separately.

Start with counselling and employee assistance programmes. There is no legal duty to provide either. Neither appears in the Act or the Regulations, and there is no Approved Code of Practice that could impose one. The nearest thing in the case law runs the other way: Hatton proposition (11) says an employer who offers a confidential advice service "is unlikely to be found in breach of duty".

That proposition should never be read on its own, and the second half matters as much as the first. Providing counselling is not a defence. The Court of Appeal held in Intel Corporation (UK) Ltd v Daw [2007] EWCA Civ 70 at [45] that "the reference to counselling services in Hatton does not make such services a panacea by which employers can discharge their duty of care in all cases", and dismissed the employer's appeal despite the counselling service it had provided; a short-term service could not reduce the claimant's workload. In Dickins v O2 plc [2008] EWCA Civ 1144, reliance on the same proposition "serves to demonstrate how dangerous it is to apply guidance given by the court as though it were a statutory provision". So counselling is not required, and providing it does not discharge the duty by itself. What it is, on the Hartman framing, is a factor a court will weigh.

There is no legal requirement to run a staff survey, including HSE's own Indicator Tool. HSE says so about its own instrument: "A survey is not an essential step and for smaller organisations it would not be proportionate to run such a survey, particularly where the same data can be gathered in other ways." Regulation 3(1) requires an assessment that is suitable and sufficient. It does not prescribe the method.

The HSE Management Standards are not required either. HSE's own page on the question is titled "Do I have to follow the Management Standards approach?" and answers conditionally: "If you follow the Management Standards approach correctly, you will be adopting an approach that is considered suitable and sufficient." HSE publishes an equivalence checklist for employers using a different method, and states that the Standards "are not new laws" while employers "already have duties" to assess and control the risk. Nor is there a score to hit. HSE "does not expect an employer to meet all the standards", describing them as goals to work towards.

Whether you use the Standards is a separate question from what they point at. The risks that arise from how work is organised and managed sit inside the duty this page sets out, not alongside it, and psychosocial risk at work is that same duty written for whoever has to carry out the assessment.

There is no legal obligation to adopt ISO 45003. It is a voluntary international guidance standard, and ISO's own rules state that its standards "do not include contractual, legal or statutory requirements" and "do not replace national laws, with which standards users are understood to comply and which take precedence". Nor can an organisation hold accredited certification to it: BSI, the UK national standards body, states that "your organization cannot be awarded an accreditation in the same way as ISO 45001" and describes what it offers as "unaccredited certification to ISO 45003".

There is no legal requirement to appoint mental health first aiders. The Health and Safety (First-Aid) Regulations 1981 require equipment, facilities and suitable persons "for enabling first-aid to be rendered to his employees if they are injured or become ill at work", and name no mental-health-specific role or training.

Work-related stress is not reportable to HSE under RIDDOR. Regulation 8 of RIDDOR 2013 lists six reportable occupational diseases: carpal tunnel syndrome, cramp of the hand or forearm, occupational dermatitis, hand-arm vibration syndrome, occupational asthma, and tendonitis or tenosynovitis. None is psychological.

And there is no obligation to provide a wellbeing app or platform. Nothing in the Act or the Regulations mentions any product category, and the Management Standards describe conditions of work design rather than services to be bought.

The trap runs the other way from where employers expect. Skipping all of the above is compatible with the law, provided the underlying duties are being met: assess the risk, record the significant findings at five or more employees, act on what you find, keep it under review.

What evidencing it looks like

Across the 1974 Act, regulation 3, the Hatton foreseeability test and the Management Standards, the same elements of a defensible record keep recurring. Only the two marked as statutory are statutory; the rest are what a record that survives scrutiny tends to contain. Each is taken in turn, with who asks to see it and in what form, in how to evidence your duty of care.

1. A dated risk assessment that includes psychosocial risk. Recording the significant findings in writing is required at five or more employees (reg. 3(6), statutory); the assessment itself is required at any size (reg. 3(1), statutory).
2. Something systematic to base it on, not anecdote. HSE's own position is that a survey is one option and not an essential step, so this can be structured, recorded conversations as readily as an instrument.
3. Documented, dated actions taken in response to what was found. This is the part foreseeability turns on: action following knowledge.
4. A review cycle, because regulation 3(3) makes the assessment an ongoing duty.
5. A named owner senior enough to act on what the findings say, so the "ought to have known" limb has somewhere sensible to land.

None of this needs to be elaborate. A tired office manager holding a dated document and a note of what changed as a result is in a stronger position than an employer with a large wellbeing programme and no record of ever having assessed anything. If you would rather work through it than read about it, the same ground is laid out as items to check, with the statutory ones marked, in the duty of care checklist.

The first of the five elements above, a dated aggregate measure of psychosocial risk, is the one Alltoogether provides without charge through the free IWE wellbeing pulse, funded by our work as an employee-benefits broker. Results appear as averages of five or more people. You can sign up for it if a starting point would help.