From the day you employ five people, the law in Great Britain requires you to write down the significant findings of your health and safety risk assessment, and risks to health from workload and stress belong in that written record (Management of Health and Safety at Work Regulations 1999, regulation 3(6)).
That is the short version. Here is the human one.
You remember the first four hires as people, probably in order. The one who took a pay cut to join. The one you found through a friend of a friend and still cannot quite believe said yes. By hire four you know everyone's coffee order and roughly how their weekend went. Then the fifth offer letter goes out, and when it comes back signed, something in you relaxes: payroll has five names on it now. You did that.
What nobody mentions at the celebratory lunch is that a sentence written in 1999 started applying to you the same day.
The Management of Health and Safety at Work Regulations 1999 have technically been your problem since your first hire. Regulation 3(1) requires every employer to make a "suitable and sufficient" assessment of the risks to employees' health and safety, with no minimum number of employees anywhere in it. You may well have been doing a version of this informally all along: noticing the trailing extension lead, or asking whether someone's chair is hurting their back.
Regulation 3(6) is the sentence that changes on the day of the fifth hire:
"Where the employer employs five or more employees, he shall record" the significant findings of the assessment, and any group of his employees identified by it as being especially at risk.
The assessment duty was already there. At five, it has to be written down. HSE puts the same thing the other way round, which is the version most people find reassuring: "If you have fewer than five workers, you don't have to write anything down."
For completeness, the same headcount triggers a written health and safety policy statement under section 2(3) of the Health and Safety at Work etc. Act 1974; employers of fewer than five are excepted by the Employers' Health and Safety Policy Statements (Exception) Regulations 1975. Both thresholds, and the wider duty they sit inside, are set out with the statutory text and the case law in the employer duty of care guide. So the fifth hire is the day the duties you already had have to go on paper.
Less than you fear.
Regulation 3(6) asks for two things: the significant findings, and any group of employees identified as being especially at risk. It prescribes no format, no template, no standalone document and no retention period, and there is no Approved Code of Practice for these Regulations that could add one. HSE publishes free templates and worked examples if you want a starting shape, and it is clear that for most low-risk workplaces this does not need to be complicated. If you would rather have it as a list of what a record tends to contain, with the legally required items marked off from the rest, that is the duty of care checklist.
In practice, for an office of five, it looks like this. You walk the space with a notepad. The extension lead snaking past the printer. The kettle balanced near the sink. The storeroom stepladder with the wobbly foot. Screen setups, because people at laptops all day get sore necks and the fix is usually a £30 riser. You note each hazard and who it affects. You note the fix and when you made it. Then you date the document, save it somewhere findable, and set a reminder to look again when something changes.
That is genuinely most of it. An afternoon's work, not a consultancy project.
Here is the bit that surprises people: "health" in this body of law covers mental health as well as physical health.
It does not say so in as many words. Neither the 1974 Act nor the 1999 Regulations uses the word "stress" anywhere. The duty reaches it because both are framed around health without qualification, and because HSE, the regulator, applies them that way. HSE's stress risk-assessment page, updated 20 January 2026, says you "should assess the risk of stress, and its impact on mental and physical ill-health, in the same way as you assess other work-related health and safety risks".
HSE's Management Standards set out six areas to look at: demands, control, support, relationships, role and change. Its own definition of the thing is deliberately unclinical, and worth borrowing: stress is "the adverse reaction people have to excessive pressures or other types of demand placed on them", and "stress is not an illness, but it can make you ill".
The scale explains why the regulator cares. HSE estimates 964,000 workers in Great Britain with work-related stress, depression or anxiety in 2024/25, and 22.1 million working days lost to it (published 20 November 2025). Those are self-reported figures, counting what workers themselves attribute to their work.
The courts care too, and in a way that makes the written record more useful than it first appears. The case law on workplace stress, from Walker v Northumberland County Council [1995] through Hatton v Sutherland [2002] EWCA Civ 76, turns on foreseeability: what did the employer know, or what ought it to have known, about the risk of harm to this person? A dated record showing you looked at workload and stress and did something reasonable about what you found is close to a direct answer to that question.
The Court of Appeal in Hatton also said that an employer offering a confidential advice service "is unlikely to be found in breach of duty", which is worth knowing when you come to choose benefits later. Worth knowing alongside it: that is not a shield on its own. The same court held in Intel Corporation (UK) Ltd v Daw [2007] EWCA Civ 70 that counselling services are no "panacea by which employers can discharge their duty of care in all cases", and found against an employer that had one. It counts. It does not cover for the rest.
So workload and stress belong inside the same afternoon's document. A short section: how we keep an eye on demands and workload, what support exists, when we last checked, what we changed.
And there is the snag. The physical walk-round is easy at five people. The stress part is hard at five people, precisely because there are only five of them. Hand out a survey and everyone can guess who wrote what; ask face to face and you get the polite answer.
Two things make that less awkward than it sounds.
The first is that no survey is required. HSE says so about its own instrument: "A survey is not an essential step and for smaller organisations it would not be proportionate to run such a survey, particularly where the same data can be gathered in other ways." HSE publishes a Talking Toolkit of six conversation templates, one per area in the six HSE Management Standards, built for exactly this situation, on the basis that conversations can gather what a larger organisation would gather through a survey. Recorded, dated conversations are evidence.
The second is that if you do want numbers, honesty at this size needs anonymity a founder with a spreadsheet cannot credibly promise. This is the one place I would not do it by hand, mostly because you no longer have to. The IWE pulse is a free, anonymous wellbeing check-in that asks about the things the Management Standards care about, workload and demands included. Results appear as averages of five or more people. I did not plan the symmetry, but it is a happy one: the anonymity floor is the same number as the legal threshold that put you here. Each pulse is dated, and repeating it gives your written record the review cycle regulation 3(3) expects, without you chasing anyone.
You hired your fifth employee because the work grew. The written record came with them, and you can do nearly all of it yourself this week.
Alltoogether funds the IWE pulse through its work as an employee-benefits broker, which is why the measurement side costs your company nothing. You can open your first pulse with a free IWE signup.
The free strategy audit takes twenty minutes and gives you your gaps in writing. No card, no call booked at the end of it unless you ask for one.
Start the free audit →