Is a risk assessment a legal requirement? What the law actually says

The short legal answer

If you are searching is a risk assessment a legal requirement, the answer is yes. UK law says you must assess risks to workers and anyone else who could be harmed by your work. That duty sits in the Health and Safety at Work etc. Act 1974 sections 2 to 3 and the Management of Health and Safety at Work Regulations 1999 regulation 3. This covers every employer and self‑employed person whose work could put someone at risk, which in construction is pretty much every job from fencing to façade installs.

There is a simple threshold for paperwork. If you have five or more employees you must record the significant findings in writing, which is stated in the Management of Health and Safety at Work Regulations 1999 regulation 3. Under the same regulation you must review and update the assessment if there is a reason to suspect it is no longer valid or if there has been a significant change in the matters to which it relates.

Plenty of small contractors ask if this bites the self‑employed. It does. The Management of Health and Safety at Work Regulations 1999 regulation 3 applies to self‑employed whose work may expose themselves or others to risk, and the Health and Safety at Work etc. Act 1974 section 3 places a duty to protect non‑employees affected by your work. If you are drilling, lifting, cutting, wiring or driving plant, you need a risk assessment.

If you want a longer explainer, see our plain guide on what is a RAMS document, which walks through how the two parts fit together on real jobs.

What suitable and sufficient looks like on site

The law says your risk assessment must be suitable and sufficient, which is the wording in the Management of Health and Safety at Work Regulations 1999 regulation 3. That does not mean a glossy folder. It means you have identified the significant hazards, who can be harmed and how, reasonably practicable controls, and any remaining residual risk. It should reflect the job, the site and the team, not last year’s boilerplate with a new logo pasted on page one.

On a wet Tuesday with a part‑loaded transom and a forklift beeping across a shared access, your assessment should show how you will separate pedestrians, secure materials, and stop slips. If you are cutting cement board and you can smell dust on your clothes, the assessment should have controls for silica, extraction and RPE, which aligns with the COSHH Regulations requirement to control exposure to hazardous substances. If you are up a MEWP, it should reference preventing falls in line with the Work at Height Regulations 2005.

Inspectors look for proportionate detail. A short low‑risk task might fit on one page with a couple of controls, while a multi‑crane lift will need more. What they do not accept is a generic 30‑page PDF that never mentions the live services you will be drilling near, or the school next door at home‑time. If the environment, neighbours, access, weather or programme change the risk, it must show in your document, or you review it before you crack on.

For client expectations and gate checks, our guide to Principal Contractor RAMS Requirements explains the common asks and why they link back to CDM 2015.

Do you have to write it down, and when you should anyway

The law only forces a written record if you have five or more employees, which is set out in the Management of Health and Safety at Work Regulations 1999 regulation 3. Many sole traders think that lets them off. It does not. If you work on a site run by a principal contractor, they will ask for a written assessment before they let you start, which sits within their duty to plan, manage and monitor under the Construction (Design and Management) Regulations 2015.

Even when the law does not force it, writing it down is smart. It wins work because most clients want to see a plan before you unload. It helps you brief the lads at the van door, and it proves what you considered if something goes wrong. After a near miss with a scaffold board kicked off a lift, the written assessment and the toolbox talk record show you were not making it up after the fact. That matters when an inspector asks questions.

There is another wrinkle. Count your head properly. The five‑employee threshold is your total employees across the business, not per site or per job, and labour‑only subbies on your books can push you over. If you are close to the line, treat yourself as if you must write it down. It saves arguments at the gate and there is little downside to having a short, clear record.

If you are wondering who writes the document in a small firm, read Who should carry out a risk assessment? which focuses on competence, not job titles.

What a risk assessment should cover on a typical job

Start with the task and location. Who is involved, what plant and materials, where and when. Then the hazards that matter for that job, not a parade of unlikely edge cases. Think people at height, fragile surfaces, temporary electrics, silica and wood dust, manual handling, moving vehicles, hot works, noise and vibration, live services, public interface, weather and housekeeping. If a hazard triggers specific regulations, reference them in your controls, for example Work at Height Regulations 2005 for MEWP or roof work, and the COSHH Regulations for resins, cement and solvents.

Next, who could be harmed. Your team, other trades, cleaners, security, visitors, neighbours and the public. Add anyone who might be at greater risk such as young workers, pregnant workers or new starters, which is expected within the Management of Health and Safety at Work Regulations 1999 regulation 3 duty to consider those who may be especially at risk. Name the controls you will use, such as physical separation, permits, isolations, dust extraction, RPE, edge protection, certified lifting accessories, trained operators and supervision.

Write the residual risk and what to do if things go off plan. If you will cut GRP in a plant room, state the LEV you will use, the RPE type and the face‑fit requirement, and then what you will do if the fan fails. If you will drill near services, note the scans, permits and isolation checks, then what the stop work looks like if you hit something. Review triggers belong here too, for example change of access route, change of method, new operatives, new weather or a near miss.

Risk assessment versus RAMS, and why clients ask for both

Risk assessment and method statement are not the same document. The assessment identifies what could cause harm and how you will control it, required by the Management of Health and Safety at Work Regulations 1999 regulation 3. The method statement then explains the sequence of work, the plant, the materials and the controls in place step by step, which is good practice and often required by principal contractors to help them plan, manage and monitor under the Construction (Design and Management) Regulations 2015.

Put the two together and you have RAMS. The assessment answers why and what, the method answers how and who. On site that might look like a two‑page assessment for installing a steel, and a method that covers lift plan references, slinging, exclusion zones, fixings, torque checks and temporary propping until the engineer signs off. When you read it out on a cold morning and the team can picture the job, that is RAMS working.

If you want a longer explainer, see our plain guide on what is a RAMS document, which walks through how the two parts fit together on real jobs.

What inspectors and principal contractors actually check

On a live job, inspectors and principal contractors care less about formatting and more about whether the controls match the work in front of them. An HSE inspector can ask for your assessment under the Management of Health and Safety at Work Regulations 1999 regulation 3, then walk with you to see if the edge protection, isolation or LEV you promised is actually in place. If it is not, the document will not save you. They are looking for reality, not ring binders.

Principal contractors tend to check a few specific things. Is the assessment recent and site specific. Are the right people named, with training or certificates where needed. Has the assessment dealt with the big hitters, for example working at height, plant and traffic, COSHH substances, live services and fire. Does the method match the sequence in the programme and the permit to work system. All of that ties back to their duty to plan, manage and monitor under the Construction (Design and Management) Regulations 2015.

If you want to avoid the awkward conversation at the gate, brief your team and sign the brief. Keep a copy on the device everyone carries, not buried in email. If anything changes, pause, update and re‑brief. That habit is part of keeping an assessment suitable and sufficient, which is the legal test set by the Management of Health and Safety at Work Regulations 1999 regulation 3.

Questions we get asked

Do I legally need a risk assessment if I am self‑employed?

Yes, if your work could put anyone at risk you must assess it, which is required by the Health and Safety at Work etc. Act 1974 section 3 and the Management of Health and Safety at Work Regulations 1999 regulation 3. Most construction work meets that bar. If you have five or more employees you must also record the significant findings in writing under the Management of Health and Safety at Work Regulations 1999 regulation 3.

What does suitable and sufficient actually mean?

It means proportionate, specific and practical. Identify the significant hazards, who could be harmed, the controls, residual risk and review triggers, as required by the Management of Health and Safety at Work Regulations 1999 regulation 3. The content must fit the work, for example include Work at Height Regulations 2005 controls for roof work, and COSHH controls where you use substances that can harm health.

Do I have to write the risk assessment down if I have fewer than five employees?

The law only requires a written record at five or more employees, which is in the Management of Health and Safety at Work Regulations 1999 regulation 3. In practice, most principal contractors will still require a written risk assessment before allowing you on site under their Construction (Design and Management) Regulations 2015 duties. Writing it down also helps you brief the team and prove what you considered if there is an incident.

Is a method statement a legal requirement like a risk assessment?

The legal duty is to assess risk, required by the Management of Health and Safety at Work Regulations 1999 regulation 3. A method statement is not named in that regulation, but principal contractors commonly require it to help them plan, manage and monitor work under the Construction (Design and Management) Regulations 2015. Most construction clients expect RAMS, which is the risk assessment and method statement together.

How often should I review a risk assessment?

Review when there is reason to think it is no longer valid or when there is a significant change, which is the wording in the Management of Health and Safety at Work Regulations 1999 regulation 3. Common triggers include a change of access route, new plant, a different sequence, new operatives, new neighbours, bad weather or a near miss. On long jobs, set a periodic review date even if nothing changes.

The short version

Yes, you must assess risks. The duty sits in HSWA 1974 sections 2 to 3 and the Management of Health and Safety at Work Regulations 1999 regulation 3. If you have five or more employees, write the significant findings down. Keep it suitable and sufficient, which means proportionate, site specific and reviewed when things change.

On site, principal contractors will want to see a current, job specific assessment and a matching method statement, linked to their CDM 2015 duties. Keep it short, real and briefed. That is what gets you through the gate and keeps the work moving without nasty surprises.