AI and Software Startups: 8 Stages That Trigger New Duties
Nobody founds an AI or software company thinking about health and safety, and for a while that is entirely reasonable. Four people, laptops, a rented desk somewhere.
The problem is that the obligations do not arrive with an announcement. They attach when you cross a line, and the lines are things you already celebrate: the first hire, the first office, the first person in another country, the first enterprise contract. Growth is the mechanism, and nothing in a fundraise or a hiring plan flags it.
Eight stages. Each one adds something, and none of them removes what came before.
Stage 1: your first employee
The moment the framework attaches, and it is earlier than most founders assume.
Once you employ anybody, the general duty under section 2 of the Health and Safety at Work etc. Act 1974 applies: to ensure, so far as is reasonably practicable, the health, safety and welfare at work of your employees. Alongside it, regulation 7 of the Management Regulations requires the appointment of one or more competent persons to assist in complying with statutory duties, and compulsory employers' liability insurance applies with the certificate accessible to employees.
Two practical points at this stage. The risk assessment duty applies from the first employee; what changes later is the obligation to write it down. And if your first hires work from home, their homes are where the work happens, which is the assessment you actually need rather than one about an office you do not have.
Stage 2: five employees
The recording threshold, and the one most commonly crossed without notice.
At five or more employees you need a written health and safety policy, and you must record the significant findings of your risk assessment. Fire risk assessment recording obligations bite at the same number.
The policy has three parts and startups typically write one: the statement of intent, the organisation showing who is responsible for what, and the arrangements showing how things actually happen. A single page signed by the founder is a third of what the section asks for.
This is a two-hour job at five people and a two-week job at fifty. Doing it early is the cheapest health and safety decision a company ever makes.
Stage 3: your first office
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
Where the volume of obligations jumps, and where the landlord relationship starts to matter.
Taking premises brings fire risk assessment under article 9 of the Regulatory Reform (Fire Safety) Order 2005, workstation assessment under regulation 2 of the Display Screen Equipment Regulations, first aid provision sized to your actual population, evacuation arrangements including for anyone who would need assistance, and welfare facilities.
It also brings a set of documents you do not own. In a leased or serviced building the premises fire risk assessment, alarm and emergency lighting testing, extinguisher servicing and asbestos information sit with the landlord or operator. Ask for current copies at the point of signing, when you have leverage, rather than two years later when you need them for a customer questionnaire.
If you move into coworking, the split is different again and worth establishing in writing rather than assuming the operator has it covered.
Stage 4: your first thing that is not a desk
The stage AI and hardware-adjacent companies reach without noticing.
A device lab, a robotics test area, a battery bench, a 3D printer, a soldering station, a server rack in a cupboard, or a room full of GPUs each change the risk profile of the space. So do the cleaning products under the sink and the boiling water tap in the kitchen.
Two specific consequences. Your fire risk assessment was written about the space before the equipment arrived, and article 9 requires review on significant change. And a room containing racks, batteries or suppression is a genuinely hazardous environment that usually sits outside everyone's remit, because it belongs to IT, the space belongs to facilities, and the systems belong to the landlord.
Stage 5: your first out-of-hours rota
The point at which working time and night work provisions engage.
An on-call rota, a support desk running late, a team covering another region, or engineers deploying at three in the morning all raise the question of who meets the night worker definition, whether the free health assessment entitlement has been offered, and how rest is protected when an incident interrupts it.
This is the stage most software companies pass through entirely unaware, because on-call feels like an engineering practice rather than a work pattern.
Stage 6: twenty to fifty people
Where informal arrangements stop working, and where an internal owner becomes necessary.
Below twenty, most things can be held in somebody's head. Above it they cannot, and the failure modes are consistent: training certificates lapse because nobody tracks renewal, actions from incidents stay open because nobody owns the list, the assessment describes the previous office, and a fire drill produces a time and nothing else.
At this stage the competent person appointment from stage one needs to be a real, named, resourced arrangement rather than a founder's assumption. Whether that is an internal hire or an external provider is a commercial judgement; having neither is not an option.
Stage 7: your first person in another country
The stage where the cost of getting it wrong rises sharply, and where British instincts mislead.
Great Britain attaches very few obligations at low headcounts. A great many countries do the opposite. Belgium, Bulgaria, Slovakia and Greece attach appointment or service obligations from the first employee. Estonia requires the risk analysis to be filed into a state database. Lithuania requires the head of the entity to pass a state knowledge test before the business operates. Latvia elects worker representatives from five employees. France, Morocco, Japan and Greece cluster major obligations at fifty.
Whether you hire through an employer of record, open a branch or incorporate a subsidiary changes who holds what, and none of those routes removes your duty to the person. This is the point at which a group needs a view of its entities rather than a policy, which is where health and safety consultants and software are worth more together than either alone.
Stage 8: your first enterprise customer
The commercial stage, and the one that usually forces everything above to happen at once.
Large customers run supplier assurance. Their questionnaires ask for your policy, your assessments, your insurance certificate, your training records, your incident procedure and increasingly your position on the wellbeing of people doing content review or annotation work. Procurement will not accept "we are a startup" as an answer, and the questionnaire arrives with a deadline attached to a deal.
Companies that have done stages one to seven answer it in an afternoon. Companies that have not spend three weeks assembling documents while the deal waits, and produce something visibly retrofitted.
That asymmetry is the honest commercial argument for doing this early. Not the risk of enforcement, which is genuinely low for a twelve-person software company, but the cost of being asked at the worst possible moment. Periodic health and safety audits keep the answer ready rather than assembled.
The eight stages, in short
| Stage | What attaches |
|---|---|
| First employee | General duty, competent person, EL insurance, assessment |
| Five employees | Written policy, recorded assessments, recorded fire assessment |
| First office | Fire, DSE, first aid, evacuation, welfare, landlord documents |
| First non-desk equipment | Fire assessment review, hazardous spaces, ownership |
| First out-of-hours rota | Working time, night work, health assessment, rest |
| Twenty to fifty | Named owner, tracked training, owned actions |
| First person abroad | National obligations, frequently from the first employee |
| First enterprise customer | Everything above, on a deadline |
Read the right-hand column downwards and the pattern is clear. Nothing here is expensive at the stage it first attaches. All of it is expensive later, and the compounding is what catches companies at Series B with a document set describing a company they stopped being two years ago.
HSE's introduction to managing health and safety covers the underlying framework in a form proportionate to a small business.
Where Arinite fits
Arinite works with companies at each of these stages, which for a growing business means doing the proportionate thing now rather than the comprehensive thing later. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years. Our health and safety consultants work extensively with IT and software and AI and data organisations, from first office to first international entity.
When you reach stage seven, our global health and safety consultants establish what attaches in each country you hire into, and our international health and safety consultants keep that current as you grow.
If you are between stages and not sure which obligations you have already crossed, a free gap analysis will tell you where you actually are.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
