Health and Safety in Higher Education: The 5 Capacities a University Is Liable In
A commercial office has one health and safety question to answer: are we looking after the people we employ. A university has five, because it is five different legal entities occupying the same postcode.
It employs academics, technicians, cleaners, security staff and professional services teams. It occupies a large and often elderly estate, and is frequently the residential landlord of several thousand people aged eighteen and nineteen. It authorises research involving substances, machinery and now autonomous systems. It sends students and staff off campus, on placement, into the field and overseas. And it lets its buildings to conference organisers, sports clubs, commercial tenants and a student union that is usually a separate legal body altogether.
Each capacity carries a distinct duty with its own characteristic failure. Universities rarely get into difficulty because the policy is missing. They get into difficulty because the policy was written for the first capacity and quietly assumed to cover the other four.
Why section 3 is the clause that reframes everything
Most organisations manage health and safety through the employment relationship. Section 2 of the Health and Safety at Work etc. Act 1974 makes an employer responsible for the health, safety and welfare of its employees, and for the overwhelming majority of businesses that is where the analysis ends.
For a university it is where the analysis starts. Section 3 of the same Act requires every employer to conduct its undertaking so as to ensure, so far as is reasonably practicable, that persons not in its employment are not exposed to risks to their health or safety. Students are not employees. Neither are visitors, applicants on open days, conference delegates, contractors, or the public walking through a campus that has no gates.
That clause is why headcount-based compliance consistently understates a university's exposure: an institution with 3,000 staff may have 25,000 people on site, and the Act protects almost all of them. Higher education is also enforced directly by the HSE rather than by local authority inspectors, and the HSE maintains dedicated guidance for the education sector.
These are the five capacities, in the order they generate claims.
1. As an employer
The conventional duty, and usually the best managed. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient risk assessment, and regulation 7 requires the appointment of one or more competent persons. Most institutions satisfy both on paper.
Two things reliably go wrong. The first is devolution. Health and safety in higher education is almost always delegated to faculties and schools, so the central team writes the framework and thirty departments interpret it differently. A central policy with no mechanism for verifying local implementation is a governance document, not a control, and where the central function is thin the competent person duty rests on one or two individuals covering an estate they cannot visit often enough.
The second is workload. Academic work has pronounced, predictable peaks around admissions, examinations, marking and research funding deadlines, and the HSE Management Standards treat demands, control, support, relationships, role and change as assessable hazards rather than wellbeing themes. An assessment that does not mention any of them has a documented gap. Screen work is the quieter version: a DSE assessment covering professional services staff but not academics working three days a week at home is incomplete.
2. As an occupier and residential landlord
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
The capacity carrying the largest capital exposure, because university estates are old, mixed and frequently listed.
Fire is the headline. Under article 9 of the Regulatory Reform (Fire Safety) Order 2005 the responsible person must carry out a fire risk assessment, and on a campus that means one per building. A lecture theatre, a library with high-density shelving, a laboratory block, a sports hall and a hall of residence present entirely different evacuation problems, and halls add the hardest variable in the sector: several thousand young adults asleep in a building they moved into three weeks ago. Reviewing each fire risk assessment after any change of use is where institutions fall behind.
Water systems come next. Halls empty for long periods over the summer, creating exactly the stagnation conditions that legionella control is designed to prevent. The HSE's guidance on legionnaires' disease is clear that infrequently used outlets require active management, and a vacation flushing regime that exists as a habit rather than a record will not evidence control.
Then the fabric. Regulation 4 of the Control of Asbestos Regulations 2012 imposes a duty to manage asbestos in non-domestic premises, which on a post-war estate is rarely a question of whether any is present. An asbestos register and management plan has to be live and accessible to anyone drilling a wall, and refurbishment running through a summer vacation is where it gets tested.
3. As a controller of research and practical activity
The capacity with the most severe potential consequences and the least central visibility.
Research holds hazards no office encounters, and the person closest to the risk is a principal investigator whose primary accountability runs to a funder rather than to the estates department. Regulation 6 of the Control of Substances Hazardous to Health Regulations 2002 requires a suitable and sufficient assessment before work with a hazardous substance begins, and in a research environment the substances change with the project. A COSHH assessment written for a grant that ended in 2022 is not an assessment of current work.
The pattern repeats across workshops, studios, engineering labs, media facilities and the increasingly common robotics and autonomous systems spaces, where the risk profile has moved faster than most institutional frameworks. Postgraduate researchers working alone late at night in a building with no reception cover are the recurring theme, and the recurring answer is a local arrangement nobody has written down. The Universities Safety and Health Association publishes sector-specific material that is more useful here than generic corporate guidance, because it is written by people who understand that a department cannot be instructed in the way a business unit can.
4. As an organiser of off-site, field and overseas activity
Fieldwork, placements, study abroad, conference travel, overseas research partnerships and transnational campuses all move the duty somewhere the institution does not control the premises, and the duty travels with the activity. A geography field course, a nursing placement, a term in Madrid and a research visit to a partner institute are all university-organised activity, and the assessment has to address the actual destination rather than the category. Where the activity is abroad, local law applies on top: a campus or research office in an EU member state sits under that state's implementation of the EU Framework Directive 89/391/EEC, and the documentation it requires is national, not translatable.
Placements are the sharpest version, because the duty is shared and neither party reliably owns it. The host controls the workplace. The university placed the student there. Both have a defensible view that the other is responsible, which is why agreements specifying who assesses what, who inducts, who reports an incident and who is told about it are worth more than any policy clause.
5. As a host to third parties
The capacity that almost never appears in a health and safety strategy, and commercially significant because the revenue is real.
University buildings host summer schools, conferences, exhibitions, sports fixtures, commercial tenants, spin-out companies, external contractors and a student union that is typically an independent charity with its own staff, licensed premises and events programme. Each relationship raises the same two questions: whose risk assessment governs the activity, and who records an incident when one happens.
Shared premises require coordination between the parties occupying them, which in practice means written agreements rather than assumptions. Incident reporting is where the gap shows: a conference delegate injured in a university lecture theatre may generate a duty under RIDDOR, and an institution whose reporting route only works for staff and students will discover this late. The plan, do, check, act framework in the HSE's HSG65 applies as readily to a letting as to an employee.
The five capacities at a glance
| Capacity | Who is protected | Primary instrument | Where it usually fails |
|---|---|---|---|
| Employer | Staff, including hybrid academics | HSWA s.2, MHSWR reg 3 and reg 7 | Devolution with no verification. Workload not assessed as a hazard |
| Occupier and landlord | Students in halls, visitors, the public | Fire Safety Order art 9, CAR 2012 reg 4, legionella control | Fire assessments stale after change of use. Vacation flushing undocumented |
| Research and practical activity | Researchers, technicians, postgraduates | COSHH reg 6, machinery and lone working arrangements | Assessments tied to expired projects. Out-of-hours lone working unrecorded |
| Off-site and overseas | Placement, field and study abroad students, travelling staff | HSWA s.3, plus local national law | Category-level rather than destination-level. Placement duties unallocated |
| Host to third parties | Delegates, tenants, contractors, union members | HSWA s.3, shared premises coordination | No written allocation of duties. Reporting route excludes non-members |
Score each row honestly. Most institutions are strong on the first, improving on the second, variable on the third because it is devolved, weak on the fourth because it is seasonal, and silent on the fifth because it sits with commercial services.
For international groups and transnational provision
Higher education has internationalised faster than its compliance frameworks. A UK institution may now run a branch campus in Dubai or Malaysia, validated provision delivered by a partner abroad, and research offices attached to an overseas funder. A US or Australian institution arriving in the UK faces the mirror image, and usually underestimates how prescriptive the fire and asbestos duties are.
Running each as a separate compliance island is expensive and does not survive the second country. The workable pattern is the one multinational employers arrive at: one methodology and one register across the group, with the local statutory instrument produced properly in each jurisdiction by someone qualified there. That is where health and safety consultants and software are worth more in combination than either is alone, because the register is what lets a governing body see thirty departments and four countries in one view. Periodic health and safety audits then verify each entity against its own national test rather than a translated central standard, and certification to ISO 45001 gives the institution one framework each site can sit inside.
Where Arinite fits
Arinite has spent 15+ years helping organisations run one coherent health and safety system across many sites and many countries. We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention. Our health and safety consultants work across the education sector alongside offices and AI and data clients, which matters for a university because a modern campus contains all three environments at once.
Where provision spans more than one country, our global health and safety consultants coordinate locally qualified practitioners in each jurisdiction while the institution keeps one point of contact and one view of compliance, and our international health and safety consultants can tell you which national rules apply to a branch campus or partner arrangement before it opens rather than after.
Work through the five capacities and count the rows you could evidence tomorrow. Then book a free gap analysis and we will tell you, in one call, which of the five would hold up under scrutiny.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
