Employers in Great Britain are responsible for assessing and controlling the risks to health that arise from how work is designed and managed, which includes risks to mental health, and for recording the significant findings in writing once they employ five or more people. They are not responsible for their employees' mental health itself, and no law requires them to buy any product, service or programme.
Those two sentences look similar and they are not. The distinction between them is where most of the confusion in this subject lives, and it is worth twenty minutes.
Health and safety law asks about conditions, not people. Section 2 of the Health and Safety at Work etc. Act 1974 requires employers to ensure, so far as is reasonably practicable, the "health, safety and welfare at work" of employees. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient assessment of the risks to their health and safety. Neither of those is a duty to make anybody well. Both are duties about the hazard.
HSE points the effort in the same direction, in terms: "It is more effective to remove a stressor or significantly reduce its impact than it is to manage lots of individual cases."
And HSE is careful about the vocabulary in a way that employer-facing writing usually is not. It defines stress as "the adverse reaction people have to excessive pressures or other types of demand placed on them", and says plainly: "Stress is not an illness, but it can make you ill." That sentence is the boundary of this entire subject. Everything an employer is responsible for sits on the pressures-and-demands side of it.
This surprises people, and it is worth knowing because it changes how you read everything else.
Search the full text of the 1974 Act and you find no occurrence of "stress", "psychosocial", "psychological" or "wellbeing". The 1999 Regulations are the same. The Act does not define "health" at all.
So how does mental health get inside the duty? Through four links, each of which can be checked separately.
Section 2(1) covers "health, safety and welfare" without distinguishing between them, and the list of particulars that follows is expressly non-exhaustive. Regulation 3(1) requires assessment of risks to "health and safety", again undifferentiated. HSE, the regulator, states that the duty covers stress: "Employers have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it. This is the same duty you have to protect people from other health and safety risks." And the courts have held that the ordinary principles of employers' liability apply to psychiatric injury caused by work.
That chain is sound. It is also not the same thing as a statute saying employers must protect mental health, and anyone who tells you the Act says that has not read it.
Assess. The duty to carry out the risk assessment applies to every employer, from the first employee. There is no headcount threshold on it.
Record, at five. Regulation 3(6) requires employers with five or more employees to record the significant findings of the assessment, and any group of employees identified as being especially at risk. Below five, HSE's own words: "If you have fewer than five workers, you don't have to write anything down." The commonest error in this territory is reading that backwards and concluding that small employers need not assess. They must. They need not record. For an employer who has just made the hire that crosses the threshold, the practical version of this is the day you hire your fifth employee.
Act on what you find. This is the part liability turns on. Under Hatton v Sutherland [2002] EWCA Civ 76, the threshold question is "whether this kind of harm to this particular employee was reasonably foreseeable", and to trigger a duty to act "the indications of impending harm to health arising from stress at work must be plain enough for any reasonable employer to realise that he should do something about it" (propositions (2) and (7), as reproduced in Easton v B&Q plc [2015] EWHC 880 (QB) at [50]). Under those propositions, the employer most exposed is the one who saw plain indications and did not act.
Review. Regulation 3(3) requires the assessment to be reviewed if there is reason to suspect it is no longer valid, or after a significant change. There is no fixed interval in the Regulations.
This list is longer than most employers expect, and every item on it is routinely sold as an obligation.
You are not required to provide counselling or an employee assistance programme. No statutory provision imposes it and there is no Approved Code of Practice on stress that could. The nearest thing in the case law points the other way: Hatton proposition (11) says an employer who offers a confidential advice service "is unlikely to be found in breach of duty".
Nor, and this matters just as much, does providing one discharge the duty. The Court of Appeal held in Intel Corporation (UK) Ltd v Daw [2007] EWCA Civ 70 at [45] that "the reference to counselling services in Hatton does not make such services a panacea by which employers can discharge their duty of care in all cases". It dismissed the employer's appeal despite the counselling service, because a short-term service could not reduce the claimant's workload. Where the underlying problem is a management one, counselling does not cure it. It is a factor a court weighs, not a shield.
You are not required to run a staff survey. HSE says so about its own instrument: "A survey is not an essential step and for smaller organisations it would not be proportionate to run such a survey, particularly where the same data can be gathered in other ways."
You are not required to follow the HSE Management Standards, or to hit a score against them. HSE frames the approach conditionally and publishes an equivalence checklist for employers doing something else. It also states that it "does not expect an employer to meet all the standards".
You are not required to adopt ISO 45003, and you cannot hold accredited certification to it. BSI, the UK national standards body, states that "your organization cannot be awarded an accreditation in the same way as ISO 45001", and describes what it sells as "unaccredited certification to ISO 45003".
You are not required to appoint mental health first aiders. The Health and Safety (First-Aid) Regulations 1981 name no mental-health-specific role or training.
You do not report work-related stress to HSE. RIDDOR 2013 regulation 8 lists six reportable occupational diseases and none of them is psychological.
And no law mentions a wellbeing app, platform, resilience course or mindfulness programme. Not one product category appears in any of it.
Skipping every item on that list is compatible with the law, provided the four things in the previous section are happening.
Three edges are worth marking, because employers regularly walk over them in good faith.
HSE is not the body for bullying and harassment. It says so, and refers those matters to Acas, the Equality and Human Rights Commission and the police. The Relationships Management Standard covers unacceptable behaviour, and separate equality duties apply, but the enforcement route is not this one.
HSE will not generally investigate an individual case. It publishes its own filter: it "will only consider investigating potential issues of work-related stress where it is evident that several employees are experiencing work-related stress or related ill health", where there is evidence of a wider organisational failing, and where the concern has already been raised with the employer.
And your responsibility stops at the work. Nothing in this body of law asks you to diagnose, screen, monitor or treat anyone. The instruments the regulator publishes are pointed at conditions of work, and HSE named its own survey an "indicator tool" precisely to keep that distinction visible.
HSE estimates 964,000 workers in Great Britain with work-related stress, depression or anxiety in 2024/25, a rate of 2,770 per 100,000, and 22.1 million working days lost to it (HSE, Work-related stress, depression or anxiety statistics in Great Britain, 2025, published 20 November 2025). Those figures come from the Labour Force Survey and are self-reported: they count conditions workers themselves attribute to their work, not diagnoses.
Two things about that number get misreported so consistently that it is worth correcting both.
The trend is not an explosion. The rate stepped up once, at the pandemic, from 1,810 per 100,000 in 2018/19 to 2,480 in 2019/20. It then moved without statistically significant year-on-year change for four years, and 2023/24 was lower than 2021/22, before rising significantly to 2,770 in 2024/25. HSE's own language for the longer run is "had shown signs of increasing".
And absences are not getting longer. Days lost per case has fallen over the long term, from around 28.5 days in the early 2000s to 21.3 across 2022/23 to 2024/25. More total days are lost because there are more cases, not because each one lasts longer.
One further correction, because it cuts against a claim this industry makes constantly. HSE publishes a workplace-size breakdown, and it says the opposite of the intuitive thing: workplaces with fewer than 50 people have a statistically significantly lower rate of work-related stress, depression or anxiety than the all-sizes average, and workplaces of 250 or more have a significantly higher one. That is workplace size rather than company size, and it is not evidence that anyone manages stress better; sector and occupation mix confound it, and HSE offers no causal explanation.
Five things, and none of them requires a budget.
A dated assessment that includes psychosocial risk. Something systematic underneath it, whether that is repeated measurement or structured, recorded conversations. Documented actions with owners and dates. A review cycle. And someone senior who has actually seen the findings.
The full legal position, with the statutory text and the case law behind each of these, is in the employer duty of care guide. If you want the version you can work through rather than read, it is the duty of care checklist.
Alltoogether's broking work funds a free anonymous wellbeing pulse, so the measurement side costs employers nothing. Results appear as averages of five or more people. It measures working conditions, not anyone's health.
The free strategy audit takes twenty minutes and gives you your gaps in writing. No card, no call booked at the end of it unless you ask for one.
Start the free audit →