Duty of Care at Work: The 3 Legal Routes Employers Confuse
"Duty of care" is used in workplaces to mean roughly everything: a legal obligation, a moral position, an HR policy, and a phrase in a wellbeing brochure. Used that loosely it cannot be managed, because nobody can say what would satisfy it.
In practice there are three distinct legal routes by which an employer can be held to account for harm to a worker. They have different tests, different consequences, different timescales and different people bringing them. An organisation confident about one may be exposed on another, and the most common version of that mistake is treating a clean regulatory record as evidence of low exposure.
Three routes.
1. The statutory duty: criminal, regulator-enforced
The one health and safety professionals mean.
Section 2 of the Health and Safety at Work etc. Act 1974 places a duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees. Section 3 extends a parallel duty to persons not in the employment who may be affected by the conduct of the undertaking.
Three features define this route.
It is criminal. The consequence is prosecution, a fine, and in some cases imprisonment, not compensation to an injured person. It is brought by the regulator rather than by the person harmed, and it can be brought whether or not anyone was actually injured, because the duty is to ensure safety rather than to avoid outcomes.
And the burden operates unusually. Where a duty is qualified by reasonable practicability, it is for the accused to show that it was not reasonably practicable to do more, which is a case made in writing or not made at all.
Employees carry their own statutory duty under section 7, to take reasonable care of themselves and others and to cooperate with the employer, which is worth stating in any policy because it is frequently omitted.
2. The common law duty: civil, compensation, and a longer tail
The route an injured person actually uses, and the one that produces the bill.
Separately from the statute, an employer owes its employees a duty of care at common law, established long before the 1974 Act. The traditional formulation covers competent staff, a safe place of work, adequate plant and equipment, and a safe system of work. Breach plus resulting injury produces a claim in negligence, brought by the individual, resolved in the civil courts, and paid by the employer's employers' liability insurance.
Two features matter and both are widely misunderstood.
The civil shortcut was removed. Section 69 of the Enterprise and Regulatory Reform Act 2013 amended the position so that breach of most health and safety regulations no longer gives rise to civil liability in itself. Claimants must generally establish negligence rather than simply pointing to a regulatory breach. That sounds helpful to employers and largely is not: the regulations remain powerful evidence of the standard a reasonable employer should meet, and the practical effect has been to change the route rather than the destination.
The tail is long. Section 11 of the Limitation Act 1980 sets a three-year period for personal injury claims, running from the date of the injury or from the claimant's date of knowledge, whichever is later. For conditions that develop slowly, that second limb can put the starting point many years after the exposure, which is why old records matter and why insurance history matters more than most organisations assume.
3. The contractual duty: employment, tribunal, and the one HR meets
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
The third route, and the one that reaches situations the other two often do not.
An employment contract contains implied terms, including a duty of trust and confidence and a duty to take reasonable care for the employee's health and safety. Breach of those terms is an employment matter, resolved in the tribunal system, with consequences including constructive dismissal claims.
This route is where organisational and psychosocial issues surface most often. Sustained excessive workload, a failure to act on repeated complaints about a manager, an unaddressed harassment situation, or a refusal to make adjustments will rarely produce a regulatory prosecution and may not produce an actionable personal injury claim. They can readily produce a tribunal claim.
Two adjacent duties belong alongside it. Employers can be liable for things done by employees in the course of employment, which is what makes conduct at work events and between colleagues an employer issue rather than a private one. And the reasonable adjustments duty operates independently of all three routes.
For professional and financial firms, this is the route most likely to bite, because their significant risks are organisational rather than physical.
The three, compared
| Statutory | Common law | Contractual | |
|---|---|---|---|
| Nature | Criminal | Civil, negligence | Employment |
| Brought by | The regulator | The injured person | The employee |
| Requires injury? | No | Yes | No |
| Consequence | Fine, imprisonment | Compensation | Tribunal award, constructive dismissal |
| Insurable? | No, fines are not | Yes, through employers' liability | Generally not |
| Timescale | Prosecution follows investigation | Three years from injury or knowledge | Short tribunal limits |
| Typical trigger in an office | Regulator inspection or reportable event | An accident, or a condition emerging later | Workload, conduct, adjustments |
Read the bottom row across. The three routes are triggered by different things, which is why an organisation can have an unblemished record on one and a live problem on another.
And read the insurable row. Criminal fines are not insurable, tribunal exposure generally is not covered by employers' liability, and the only column with a funding mechanism behind it is the middle one. That is worth knowing before treating insurance as the answer to any of this.
What this means practically
Three conclusions.
A clean regulatory record proves less than it appears to. No enforcement action means no regulator has looked, or has looked and found nothing actionable at that moment. It says nothing about civil exposure sitting in a limitation period or about tribunal exposure building in a team.
The same evidence serves all three. A current risk assessment, records of what was decided and why, evidence that concerns were received and acted on, and documentation of adjustments will help in a prosecution, a negligence claim and a tribunal alike. That is the practical reason documentation matters, rather than because a regulator might visit.
Records outlive people. Given the limitation position, a decision taken today may need to be explained by somebody who was not there, from records nobody has curated. Holding assessments, decisions and actions in one durable place across every entity is where health and safety consultants and software are worth more together than either alone, and periodic health and safety audits test whether the evidence would survive being asked for.
For international groups
The three-route structure is British, and the underlying pattern is not.
Most jurisdictions in this series separate regulatory enforcement from compensation, though the mechanisms differ sharply. Several run work injury compensation through statutory schemes rather than civil litigation, which changes the second route substantially: Germany, South Africa, Argentina, the Philippines and Saudi Arabia all operate variants of that. Others attach personal criminal liability to named individuals in ways Great Britain does not, as Korea, Australia, New Zealand and South Africa do.
The practical consequence is that a group cannot assume its home understanding of consequence travels. What travels is the evidence, and an entity that can show what it assessed, decided and did is better placed under every one of these systems.
Where Arinite fits
Arinite produces the arrangements and the evidence that hold up across all three routes, which is a different objective from satisfying any one of them. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years. Our health and safety consultants work extensively with legal, finance and banking and insurance organisations, where the third route is usually the live one and the least examined.
Where entities sit in several countries, our global health and safety consultants establish how each jurisdiction separates enforcement from compensation, and our international health and safety consultants keep that current.
If your organisation's confidence rests on never having had an enforcement issue, a free gap analysis will show you what the other two routes would find.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
