No single official publication tells you how well UK employers comply with the legal duty to assess workplace risks — the numbers sit scattered across the Health and Safety Executive’s annual statistics, its Annual Report and Accounts, the public enforcement registers, the CIPD’s Health and Wellbeing at Work survey and the EU-OSHA ESENER workplace survey. This page pulls them together into one citable reference: what the law requires, how much ill health the risk assessment duty has to manage, how many employers actually assess risk, and what happens to those that don’t. Every figure is drawn from a named source, with the data period alongside it.

Key facts and figures

  • 1.9 million workers were suffering from work-related ill health in 2024/25 — the risk every employer’s assessment has to manage.
  • 964,000 workers experienced work-related stress, depression or anxiety in 2024/25 — the single biggest category the duty now covers.
  • 40.1 million working days were lost to work-related ill health and workplace injury in 2024/25.
  • £22.9 billion — the estimated annual cost of workplace injuries and new cases of work-related ill health (2023/24 cost model).
  • 246 criminal prosecutions were completed by the HSE in 2024/25, with a 96% conviction rate and fines exceeding £33 million.
  • 4,400+ enforcement notices were issued by the HSE in 2024/25 — around 3,200 improvement and 1,200 prohibition notices.
  • £6 million — the fine imposed on Cambridgeshire County Council in April 2025 after deaths on a busway for which no risk assessment had been carried out.
  • £183 per hour — the HSE’s Fee for Intervention rate from 1 April 2025, charged when an inspector finds a material breach.

All figures are the latest available as of July 2026, and this page is updated when new data is released — principally each November, when the HSE publishes its annual health and safety statistics for Great Britain.

Employers with five or more employees must record the significant findings of their risk assessment in writing. That threshold comes from regulation 3 of the Management of Health and Safety at Work Regulations 1999, which requires every employer — of any size — to make a “suitable and sufficient” assessment of the risks to employees and to anyone else affected by the business. Smaller employers must still carry out the assessment; they simply aren’t obliged to write it down.

The regulation has been in force since 1999, sitting under the general duty in section 2 of the Health and Safety at Work etc. Act 1974, and “suitable and sufficient” is the standard that enforcement action is measured against. When inspectors or prosecutors cite a risk assessment failing, that is the phrase that appears. For what the duty involves in practice, see our guides to what a risk assessment is and the five-step process.

One thing UK law does not create is a compliance register. No official body publishes a running count of how many businesses have a valid risk assessment. What does exist is the HSE’s public register of enforcement notices, which records the specific regulation breached — including breaches of the Management Regulations — for notices served since April 2001. Notices are published five weeks after they are served and stay on the register for five years, which makes the register the closest thing the UK has to a public record of risk-assessment non-compliance.

How much work-related ill health does the duty cover?

1.9 million workers in Great Britain were suffering from a work-related illness — new or long-standing — in 2024/25, according to the HSE’s annual statistics. That is the scale of the harm that risk assessments exist to anticipate and control, and it explains why the duty is enforced as seriously as it is.

Within that total, 964,000 workers experienced work-related stress, depression or anxiety in 2024/25 — roughly half of all reported work-related ill health, and the clearest evidence that the assessment duty now extends well beyond physical hazards. Work-related ill health and injury together cost Great Britain an estimated £22.9 billion a year (2023/24 cost model, published with the November 2025 statistics release), with ill health accounting for around 72% of the total — about £16.4 billion. In 2024/25, 40.1 million working days were lost to work-related ill health and workplace injury.

These figures are context for the duty rather than the subject of this page — we deliberately keep injury-by-injury analysis out of scope. For the full breakdown of the largest single slice, see our work-related stress statistics page.

How many businesses actually carry out risk assessments?

76% of establishments across the EU-28 reported carrying out regular workplace risk assessments in ESENER-3 (2019) — the last edition of the EU-OSHA workplace survey to include the UK. That is worth stating plainly: the UK has not been covered by an official establishment-level risk-assessment survey since 2019. The ESENER 2024 wave covers the EU-27 plus Iceland, Norway and Switzerland only, so the one recurring international measure of “how many businesses assess risk” no longer has a UK refresh path.

What the UK does have is recurring practice data on specific slices of the duty. The CIPD’s Health and Wellbeing at Work survey (2025 edition, published September 2025) found that 64% of organisations reported stress-related absence in the previous year, and that 58% of public-sector employers run stress risk assessments or stress audits — one of the few regularly refreshed measures of UK employers actually applying the assessment duty to a specific hazard. The same survey found that only around half of the organisations taking action on stress believe their efforts are effective.

The honest summary: the legal duty is universal, the ill-health burden is measured every year, but how many UK businesses hold a suitable and sufficient risk assessment at any given moment is not officially counted. What can be measured is what happens when they don’t — which is where the enforcement data comes in.

How is the risk assessment duty enforced?

246 criminal prosecutions were completed by the HSE in 2024/25, with a 96% conviction rate and fines from convictions exceeding £33 million, according to the HSE’s Annual Report and Accounts for that year. Alongside the prosecutions, the HSE issued more than 4,400 enforcement notices in 2024/25 — around 3,200 improvement notices and 1,200 prohibition notices — and completed over 13,200 proactive workplace inspections.

The notice numbers are falling: analysis of the public notices register by Construction News (April 2026) found 2024/25 notices at a five-year low, down from around 7,000 in 2023/24. Where an inspector finds no suitable and sufficient assessment, the breach is typically cited under regulation 3 of the Management Regulations 1999, and the register records the regulation breached for every notice served.

Measure2024/25 figureContext
Prosecutions completed by HSE246248 in 2023/24
Conviction rate96%—
Fines from convictions£33 million+—
Enforcement notices issued~4,400Down from ~7,000 in 2023/24 — a five-year low
Improvement notices~3,200~5,200 in 2023/24
Prohibition notices~1,200~1,800 in 2023/24
Proactive inspections13,200+—
Fee for Intervention rate£183/hourEffective from 1 April 2025

The full fines-and-notices series — trends since the 2016 sentencing guideline, the largest penalties and Fee for Intervention in detail — is on our HSE enforcement statistics page.

What is the biggest fine for a risk assessment failure?

£6 million, plus £292,460 in costs — the fine imposed on Cambridgeshire County Council in April 2025 following an HSE prosecution over deaths on the Cambridgeshire guided busway. The council had not carried out a risk assessment for the operational busway until 2016, years after it opened, and the case has become the flagship modern example of the missing assessment itself being the failing — not a technicality attached to some other breach.

It is also among the largest fines imposed on any single organisation in recent years. Health and safety fines have no fixed statutory maximum for cases heard in the Crown Court; since the sentencing guideline that came into force in February 2016, they are scaled to the offender’s turnover and culpability, which is why the biggest penalties now run into millions of pounds. For duty-holders, the practical lesson from the case law is blunt: “we never got round to assessing it” is treated by the courts as a serious aggravating failure, not an administrative oversight.

How much does an HSE intervention cost?

£183 per hour is the HSE’s Fee for Intervention (FFI) rate from 1 April 2025. Under the scheme, which has run since October 2012, a business found in material breach of health and safety law pays for the inspector’s time spent identifying the breach, helping to put it right and following up — and a missing or inadequate risk assessment can itself amount to a material breach.

The rate is reviewed annually and has risen year on year. Industry summaries of FFI invoicing put a typical single-breach invoice in the £500 to £2,000 range — small next to a prosecution, but charged without any court involvement. FFI is, in effect, the price of being found without a suitable and sufficient assessment on an ordinary inspection day.

Frequently asked questions

How many businesses do risk assessments in the UK?

There is no official UK-wide count. The last establishment survey to include the UK — ESENER-3 in 2019 — found 76% of establishments across the EU-28 carried out regular risk assessments. The UK was excluded from the 2024 wave, so recurring UK evidence now comes from practice surveys such as the CIPD’s, which cover specific hazards like stress.

What is the fine for failing to carry out a risk assessment?

There is no fixed maximum in the Crown Court: fines are scaled to turnover and culpability under the 2016 sentencing guideline. The largest recent penalty where the absence of a risk assessment was central is the £6 million fine imposed on Cambridgeshire County Council in April 2025. Across all convictions, HSE prosecutions produced more than £33 million in fines in 2024/25.

Do risk assessments have to be written down?

Only for employers with five or more employees, who must record the significant findings under regulation 3 of the Management of Health and Safety at Work Regulations 1999. Employers with fewer than five employees must still carry out a suitable and sufficient assessment — the written record is what’s waived, not the duty.

What are the stress risk assessment statistics?

964,000 workers experienced work-related stress, depression or anxiety in 2024/25 — around half of all work-related ill health. On the practice side, the CIPD’s 2025 survey found 64% of organisations reported stress-related absence in the previous year and 58% of public-sector employers run stress risk assessments or audits.

How often are these statistics updated?

The HSE publishes its annual health and safety statistics each November, and its enforcement figures appear in the HSE Annual Report and Accounts each year. The CIPD survey is annual, and the HSE’s enforcement registers update continuously. This page is reviewed against each release, and figures here are the latest available as of July 2026.

Sources & references

Put the numbers to work — train your team to carry out suitable and sufficient risk assessments.

Explore the Risk Assessment Training course →
Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about workplace health & safety, risk assessment and accredited online training for Risk Assessment Training, part of Online CPD Academy.