How to Write a Health and Safety Policy (And Keep It Compliant)

Picture this: a workplace accident happens, and someone asks to see your health and safety policy. You open your files, only to find a dusty, outdated document that barely covers the basics. Not a great situation, right?

If you’re a business owner or manager just starting out, writing a health and safety policy can feel overwhelming. Where do you even begin? What needs to be included? And how do you make sure it actually stays compliant as rules and regulations change over time?

The good news is that creating a solid health and safety policy doesn’t have to be complicated. With the right guidance, you can put together a clear, practical document that protects your employees and keeps your business on the right side of the law.

In this guide, we’ll walk you through everything you need to know, from understanding what a health and safety policy actually is, to writing one from scratch, to keeping it up to date. By the end, you’ll feel confident tackling this important task without needing a legal degree to do it.

What Is a Health and Safety Policy?

A health and safety policy is, at its core, a formal written document that sets out your organisation’s commitment to protecting the health, safety, and welfare of everyone who works for or with you. Think of it as your business’s promise, on paper, that safety is taken seriously. It outlines what you intend to do, who is responsible for doing it, and how it will be carried out in practice. If you are new to this, do not let the formal language put you off. It is simply a structured way of saying: “Here is how we keep people safe around here.”

From a legal standpoint, the requirement is clear. Under the Health and Safety at Work etc. Act 1974, any employer with five or more employees must have a written health and safety policy. This is not optional, and the Health and Safety Executive (HSE) has the powers to inspect, issue enforcement notices, and pursue prosecutions against businesses that fail to meet the standard. The British Safety Council’s HSWA explainer notes that the Act fundamentally changed employer obligations, introducing proactive duties that did not previously exist in UK law.

It is also worth knowing that the policy covers more than just your employees. Contractors, visitors, delivery drivers, and anyone else affected by your business activities all fall within scope. This is particularly relevant if you regularly bring external workers onto your site.

Beyond simply ticking a legal box, a well-written policy actively reduces workplace incidents, sets clear expectations for your team, and demonstrates due diligence to insurers, regulators, and clients. If this all feels a little overwhelming, do not worry. This guide is designed specifically for SMEs and newly appointed safety leads who are building their approach from scratch, without a dedicated EHS team to lean on.

Who Is Required to Have One and What Happens If You Don’t

So, who actually needs a health and safety policy? Under Section 2(3) of the Health and Safety at Work etc. Act 1974, if your business employs five or more people, having a written health and safety policy is a legal requirement, full stop. It is not optional, and it is not something you can put off until you feel more organised. If you are a sole trader or run a very small team below that threshold, you are not legally compelled to write it down, but you should absolutely still document your approach. Why? Because clients, contractors, and accreditation bodies will often ask for it regardless of your headcount. A two-person team bidding for a subcontract on a commercial site will face exactly the same policy request as a fifty-person firm.

If you are wondering what happens when businesses ignore this requirement, the answer is: quite a lot, and none of it is pleasant. The Health and Safety Executive (HSE) has serious teeth when it comes to enforcement. It can issue an Improvement Notice, giving you a set timeframe to fix the problem. It can issue a Prohibition Notice, which stops your operations immediately if there is a risk of serious injury. And it can prosecute, with unlimited fines available in Crown Court. In 2024/25, the HSE secured over £33 million in fines across 246 prosecutions, with a 96% conviction rate. Once a prosecution is brought, the odds are firmly stacked against you.

Beyond the legal exposure, there is a very real commercial risk to consider. In construction, manufacturing, and energy, clients routinely check for a valid health and safety policy before awarding contracts. Accreditation schemes like CHAS will scrutinise your policy in detail, and a generic template often gets rejected. You can read the HSE’s own guidance on preparing your policy to understand what a compliant document actually looks like.

One more thing worth highlighting: the Worker Protection (Amendment of Equality Act 2010) Act 2023 is now fully in effect in 2026. It places a proactive duty on employers to prevent sexual harassment, including harassment by third parties such as contractors and customers. If your policy has not been updated to reflect these obligations, it is already out of date. For a helpful overview of what businesses need to know in 2026, it is worth reviewing your current document against the latest requirements sooner rather than later.

What a Health and Safety Policy Must Contain

The HSE is very clear on this: every written health and safety policy must contain three distinct sections. Think of them as three layers that build on each other, moving from broad commitment down to the practical detail of day-to-day safety management. Get all three right and you have a policy that genuinely protects your people. Miss any one of them and you have a document that looks good on paper but leaves your business exposed.

The Statement of Intent

This is the opening declaration of your policy, and it needs to mean something. The Statement of Intent sets out your organisation’s overall commitment to health and safety, and it must be signed by the most senior person in the business, typically the MD, CEO, or owner. Not a delegated safety manager, not a director, but the person who holds ultimate financial and operational control. The HSE is specific about this because the signature signals that health and safety has genuine buy-in at the top.

The statement should confirm your commitment to preventing accidents and work-related ill health, your intention to comply with relevant legislation, and your commitment to reviewing the policy regularly. Speaking of which, it must be reviewed and re-signed at least once a year, and also after any significant change to the business such as a restructure, a new site, or a serious incident. An unsigned or undated statement is one of the most common reasons businesses fall foul of an HSE inspection.

Organisation (Responsibilities)

This section answers the question: who is responsible for what? And it needs to be specific. Listing job titles is not enough; you need to name actual individuals at every level of the business, from the owner or board level right through to managers, supervisors, team leaders, and individual employees. Each named person should have their responsibilities clearly described, and you should include named deputies so there are no gaps when someone is absent.

This section should reflect your health and safety management structure, not just a copy of your general org chart. Employee responsibilities also belong here, covering things like reporting hazards, following safety procedures, and attending required training.

Arrangements (Procedures)

This is the most detailed section of your policy, and often the most neglected. Arrangements sets out the specific systems and procedures you have in place to manage risk in practice. At a minimum, it should cover risk assessment, incident and near-miss reporting (including your RIDDOR obligations), fire safety and evacuation, first aid provision, PPE, manual handling, and hazardous substances. For your industry, you may need to add further topics. Crucially, this section must also address contractors and visitors, covering how they are inducted, supervised, and kept safe on site. This is a gap that many businesses miss entirely, and it is one that a structured approach to health and safety can help you close.

Common Mistakes to Avoid

Before you check your own policy, here are the pitfalls that catch most businesses out:

• A vague or unsigned Statement of Intent
• Responsibilities listed by job title only, with no named individuals
• An Arrangements section copied from a generic template that does not reflect what actually happens in your workplace
• No mention of contractors or visitors
• A policy that has not been reviewed since it was first written

Minimum Content Checklist

Use this to audit your existing policy right now:

Statement of Intent

• States the organisation’s commitment to health and safety clearly
• Signed by the MD, CEO, or owner (not a delegated director)
• Dated, with a review date included
• Reviewed and re-signed at least annually or after any significant change

Organisation

• Names specific individuals at every level (not just job titles)
• Reflects the health and safety management hierarchy
• Includes named deputies
• Captures employee responsibilities

Arrangements

• Risk assessment process documented
• Incident and near-miss reporting procedure, including RIDDOR
• Fire safety and evacuation procedure
• First aid: named first aiders and kit locations
• PPE provision and maintenance
• Manual handling procedures
• Hazardous substances and COSHH controls
• Equipment inspection and maintenance schedule
• Training and induction process
• Provision for contractors and visitors
• Supporting forms and templates referenced or appended

If you are ticking most of these boxes already, you are in good shape. If several are blank, it is time to update your policy before those gaps become a liability.

What’s Changed in 2026 and Why Your Policy Needs a Review

If your health and safety policy hasn’t been touched in a couple of years, 2026 is the year that catches up with you. The compliance landscape has shifted significantly, and businesses that treat their policy as a “write it once, file it away” document are increasingly finding themselves exposed, whether at audit time, during client due diligence, or in the event of an incident.

The biggest shift is the move from periodic compliance to continuous compliance. Regulators and major clients no longer just want to see a policy document when something goes wrong or when an audit is scheduled. They want evidence of ongoing adherence. According to EHS Insight’s 2026 compliance guidance, EHS teams are now expected to treat compliance as a continuous operational function, not a calendar event. That’s a meaningful change for small and mid-sized businesses that have historically reviewed their policy every few years and considered that sufficient.

One of the most significant legal developments now fully active in 2026 is the Workers Protection Act. This legislation places a proactive duty on employers to prevent sexual harassment in the workplace. Critically, having a reactive complaints process is no longer enough. Your policy must include documented risk assessments, clear preventive provisions, and evidence of staff training. The obligation is to show you took “reasonable steps” before an incident occurred, which makes a regularly reviewed, living policy document an essential compliance artefact rather than a formality.

The broader regulatory picture adds further pressure. New rules around AI use in the workplace, cybersecurity obligations, and expanded worker protection standards mean your policy must evolve alongside your business. As EHS professionals are being advised for 2026, the organisations that will stay ahead are those treating their health and safety policy as a living document, updated as operational and legal conditions change.

Contractor safety management has also moved up the agenda sharply. Businesses managing contractor networks across multiple sites are now expected to demonstrate that contractors meet the same standards as direct employees. This is no longer just a procurement concern; it has become a board-level governance issue.

All of this is reflected in the rapid growth of the EHS software market, which is forecast to follow a significant upward trajectory from 2026 through to 2035. That market signal matters: digital compliance tools are increasingly how businesses evidence, manage, and demonstrate their health and safety obligations in real time.

What Your Health and Safety Policy Needs to Say About Contractors

If your health and safety policy only references your directly employed staff, it has a significant gap. Under the Health and Safety at Work etc. Act 1974, your duty of care extends to anyone affected by your business activities, and that absolutely includes contractors, subcontractors, and labour hire workers operating on your site. A policy that ignores this is not just incomplete, it is legally exposed. Real-world UK policy documents published as recently as March 2026 explicitly extend health and safety responsibilities to contractors, service users, and visitors as a matter of course. If yours does not, it needs updating now.

What Your Policy and Supporting Arrangements Should Cover

Getting contractor coverage right in your policy means going beyond a single line that says “contractors must follow site rules.” Your policy and its practical arrangements should specifically address the following areas:

• Contractor pre-qualification: Assessing a contractor’s competence and safety standards before you engage them, not after they have already started work on site.
• Verification of qualifications and certifications: Confirming that relevant licences, such as gas safety registrations or specialist trade certifications, are current and valid.
• Site induction requirements: Every contractor should understand your site-specific hazards before work begins. This is not optional.
• Permit-to-work processes: High-risk activities need controlled access. Your policy should reference how these are managed.
• Incident reporting obligations: Contractors must know their responsibilities under RIDDOR (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013), including what to report and to whom.

According to The Ultimate Guide to Contractor Management in Safety, robust contractor safety management means planning, selecting, onboarding, supervising, and reviewing contractors as an ongoing process, not just ticking a box at the start of an engagement.

The Problem With Spreadsheets and Paper

Here is where many businesses run into real trouble. Managing one or two contractors is manageable with a spreadsheet. Managing dozens of contractors across multiple sites, each with different certifications, induction records, permit logs, and visit histories, is a different challenge entirely. The documentation gaps that appear when you rely on manual systems are precisely where regulatory investigations and legal liability tend to find their footing. According to workplace health and safety guidance updated for 2026, the scale of workplace incidents in Great Britain remains significant, with 124 fatal injuries and 680,000 non-fatal injuries recorded in 2024/25 alone. Contractors frequently operate in the highest-risk environments.

This is the exact problem that Contractor Genie is built to solve. It is a purpose-built software tool that centralises all of your contractor management in one place, tracking qualifications, documentation expiry dates, and every site visit with a clear, auditable record. No more hunting through folders or chasing emails to confirm whether a contractor’s certification is still valid. Everything is accessible, organised, and up to date.

The wider market is heading firmly in this direction. The Contractor Safety Management Software sector is forecast to grow at a CAGR of 5% from 2026 to 2033, which tells you that digital contractor oversight has moved from being a nice-to-have into a mainstream compliance expectation. Businesses still relying on manual systems are not just creating internal headaches; they are falling behind what regulators and industry peers now consider standard practice.

How to Write (or Rewrite) Your Health and Safety Policy: A Step-by-Step Guide

Now that you understand what your health and safety policy needs to contain and why 2026 makes updating it so urgent, let’s get practical. Whether you’re starting from scratch or dusting off a document that hasn’t been touched in years, these six steps will walk you through the process clearly and without unnecessary complexity.

Step 1: Audit what you already have

Pull out your existing policy and run it against the HSE’s three-section structure: Statement of Intent, Responsibilities, and Arrangements. Check whether all three sections are actually present and populated with current information. Look for outdated job titles, unnamed responsible persons, and procedures that no longer match how your business actually operates. If you don’t have a policy at all, the HSE provides a free template and example document that gives you a solid starting point. Your audit checklist should confirm there’s a signature, a review date, named individuals in each role, and arrangements covering every significant hazard in your workplace.

Step 2: Map your hazards and risks

This step is where sector-specific thinking matters most. In construction, working at height will be a primary hazard. In manufacturing, machinery and moving parts require clear control arrangements. In utilities or facilities management, lone working and chemical handling need direct attention. Don’t overlook psychosocial risks either; excessive workload, job insecurity, and burnout are now considered legitimate workplace hazards and should be reflected in your arrangements. Every hazard you identify needs a corresponding control measure written into the policy. If a risk exists but has no arrangement, your policy has a gap.

Step 3: Assign and confirm responsibilities

Don’t write this section from an org chart alone. Speak to your managers, supervisors, and team leaders to find out who is actually doing what when it comes to day-to-day safety tasks. The person listed as responsible for pre-start checks, for example, needs to be the person who genuinely carries them out. A policy that doesn’t reflect operational reality creates blurry accountability and leaves employees unsure of who to go to when something goes wrong.

Step 4: Write the arrangements in plain language

Your arrangements section should be readable by everyone, from a new apprentice to a visiting contractor. Avoid legal jargon and write in clear, direct sentences. For most small and medium businesses, two to three focused pages will cover everything needed without overcomplicating things. If someone has to read a sentence twice to understand what they’re supposed to do, rewrite it.

Step 5: Get the policy signed and communicated

The Statement of Intent must be signed by the most senior person in the organisation, as required by the HSE. Once signed, communicate it to all staff through induction packs, your internal systems, or toolbox talks. Crucially, document that everyone has received it; signed acknowledgement forms or digital confirmation records are your evidence if questions ever arise.

Step 6: Set a review schedule

Commit to reviewing the policy at least once a year as a minimum. Beyond that, schedule an unplanned review whenever something significant changes; a RIDDOR-reportable incident, new equipment, a shift in workforce composition, or updated legislation all warrant a fresh look. A review schedule that’s formalised and followed is what separates a living policy from a forgotten document sitting in a drawer.

How to Digitise Your Health and Safety Policy (And Why It Matters)

If your health and safety policy currently lives in a folder on someone’s desktop, or worse, in a filing cabinet, you are not alone. The majority of small and medium-sized businesses in the UK still manage their H&S documentation through a combination of Word documents, spreadsheets, and printed copies. It feels manageable, until it isn’t.

The Real Problem with Paper and Word-Based Systems

Here is a scenario that plays out more often than you might think. An HSE inspector arrives unannounced. They ask to see the current risk assessment for a specific task. Someone rushes to find it, pulls up a Word document saved locally on a laptop, and hands it over. The problem? It was last updated two years ago, there is no record of who approved the current version, and there is nothing to show that staff actually read it. That single gap can be the difference between a compliant business and an enforcement notice. The HSE carried out over 13,200 workplace inspections in 2024/25, a 47% increase on the previous year, so the odds of that scenario happening to your business are genuinely rising. You can read more about the current inspection landscape in this overview of top health and safety software solutions for 2026.

Paper and Word-based systems share three structural weaknesses. Documents go out of date silently, with no automatic trigger to flag that a COSHH assessment is overdue for its annual review. Version control is practically impossible to maintain reliably across a team, because someone always has an older copy saved somewhere. And there is no audit trail, so you cannot prove that employees read, understood, and acknowledged the policy before an incident occurred.

What a Digital H&S System Should Actually Do

A proper digital H&S system solves all three problems at once. It centralises every policy document and risk assessment in one place, so everyone is always working from the current version. It automates review reminders, prompting you when a document is approaching its expiry date rather than leaving it to memory. Critically, it records who has read and acknowledged each policy, creating a timestamped audit trail that you can present to an inspector with confidence. It should also link directly to incident reporting and contractor management, so your compliance picture is joined up rather than scattered across separate tools.

Why Compliance Genie Makes This Accessible for SMEs

This is exactly what Compliance Genie, built by be-safetech.com, is designed to do. It is a SaaS platform that digitises your entire H&S process, replacing fragmented paperwork with a single, accessible, auditable system. Unlike enterprise-tier platforms that carry annual price tags starting at tens of thousands of pounds, Compliance Genie is built with SMEs in mind, businesses that need a professional-grade compliance system but do not have a dedicated IT department to set one up.

The common objections to going digital are cost, setup time, and whether staff will actually use it. Compliance Genie is designed to address all three. It requires no internal technical infrastructure, the onboarding process is straightforward, and the interface is built to be used by people who manage safety as part of a broader role, not as their only job.

The Bigger Picture: An Integrated Compliance Stack

The shift toward integrated SaaS compliance platforms is not just a trend, it is becoming the standard way businesses manage regulatory risk. SaaS stacks are growing again in 2026, with companies consolidating their compliance toolsets into fewer, more connected platforms rather than stitching together separate point solutions. An all-in-one approach removes duplication, reduces the risk of gaps between systems, and makes it far easier to demonstrate continuous compliance rather than scrambling to prepare for audits.

For businesses that also manage on-site contractors, pairing Compliance Genie with Contractor Genie creates a genuinely joined-up compliance system. Contractor Genie handles contractor onboarding, documentation, and site visit management, while Compliance Genie covers your internal H&S processes. Together, they close the loop between your workforce and the contractors working alongside them, which is exactly where compliance gaps tend to appear.

Health and Safety Policy Considerations by Sector

While the core structure of a health and safety policy is the same regardless of what your business does, the Arrangements section is where sector differences really matter. A generic template downloaded from the internet gives you a skeleton, but it cannot do the heavy lifting for you. Here is how the key considerations break down by industry.

Construction

Construction sits at the high-risk end of the spectrum, and your policy needs to reflect that honestly. The Arrangements section must explicitly cover working at height, excavation safety, plant and machinery operation, and your obligations under the CDM (Construction Design and Management) Regulations 2015. CDM creates layered responsibilities across clients, principal designers, and principal contractors, so your policy should make clear who holds each duty and how coordination happens on site.

Contractor documentation management is one of the biggest pain points in construction. When you have multiple subcontractors working on a single site simultaneously, keeping track of inductions, competency records, insurance certificates, and method statements becomes a significant operational challenge. Your policy must set out how contractor documentation is collected, verified, and maintained, not just that it should be.

Manufacturing

In manufacturing, your Arrangements section should define safe systems of work for every production process, not just a general statement that machinery must be operated safely. Key areas to address include machinery guarding, COSHH (Control of Substances Hazardous to Health) assessments for any hazardous substances in use, manual handling procedures, and compliance with the Control of Noise at Work Regulations 2005. Shift-working arrangements also need attention; fatigue is a genuine risk factor that too many policies completely overlook.

Energy and Utilities

Sites in energy and utilities carry high inherent risk, and your policy must reflect that through detailed Arrangements covering lone working, confined space entry, electrical safety, and emergency procedures. Third-party contractor management is particularly critical here, because the consequences of a contractor attending an unprepared site are potentially catastrophic.

Applies to Every Sector

One addition that must appear in every policy updated in 2026, regardless of industry, is a clear reference to your obligations under the Worker Protection (Amendment of Equality Act 2010) Act 2023. This legislation introduced a proactive duty on employers to take reasonable steps to prevent sexual harassment in the workplace. It is not optional, and it belongs in your Arrangements section.

A Health and Safety Policy That Actually Works for Your Business

If you employ five or more people, the law is straightforward: you need a written health and safety policy with three clear sections, signed by your most senior person, communicated to your team, and reviewed on a regular basis. That is the baseline, and it is not optional.

What makes 2026 different is the weight of pressure converging at once. The Workers Protection Act has expanded employer duties. Contractor networks are growing more complex, with documentation demands that paper systems simply cannot keep up with. And compliance is no longer something you revisit once a year; it is an ongoing process that needs to be embedded into how your business actually operates day to day.

The most practical thing you can do right now is use the checklist in this guide to audit what you currently have. Check that all three sections are present, that ownership is clearly assigned, and that a review date is booked before the end of this quarter. Small, deliberate steps make a real difference.

When you are ready to move beyond Word documents and shared drives, Compliance Genie makes it straightforward to digitise your entire H&S process. If you are also managing contractors on site, Contractor Genie sits alongside it, keeping qualifications, documentation, and site visit records in one place. Both are available at be-safetech.com.

Getting your health and safety policy right is not just about ticking a legal box. It is one of the most practical, meaningful things you can do to protect your people, your business, and your reputation. You have got this.

Conclusion

Writing a strong health and safety policy doesn’t have to feel overwhelming. To recap the key takeaways: start with a clear structure that covers your statement of intent, responsibilities, and procedures; review and update your policy regularly to stay compliant; and make sure every employee understands and has access to it.

A well-written policy isn’t just a legal requirement. It’s a genuine commitment to the people who show up to work for you every day. When your workplace is safer, your team is more confident, and your business is better protected.

Ready to get started? Download a health and safety policy template, set a reminder to review it annually, and take that first step today. Your future self (and your employees) will thank you for it.