The UK carries some of the most specific duties of the three jurisdictions, and two of them changed recently. The preventative duty on sexual harassment is anticipatory — you are expected to have acted before anything happens — and engaging a barred person in regulated activity is a criminal offence, not a civil exposure.
Each requirement below gates certification for the functions it covers. Nobody completes a role path in UK without clearing the items that apply to them first.
Employers must assess risks and provide adequate health and safety training on recruitment and on exposure to new or increased risks. Employers with five or more staff must record their risk assessment.
A designated Responsible Person must carry out a fire risk assessment and ensure staff receive adequate fire safety training, including on evacuation procedures. Enforcement can include prohibition notices and prosecution.
Food handlers must be supervised, instructed and trained in food hygiene commensurate with their role. Local authority inspection ratings are published, so the consequence of failure is commercial as well as regulatory.
Personal data must be handled lawfully and securely by staff who understand their obligations, with breach reporting to the ICO within 72 hours where the threshold is met.
In force since 26 October 2024, employers must take reasonable steps to prevent sexual harassment of their workers. The duty is anticipatory: you are expected to identify risk and act in advance. A tribunal can uplift compensation by up to 25% where the duty has been breached.
Workers making a protected disclosure are protected from dismissal and detriment, and an employer is liable for how a disclosure is handled, including by other staff. FCA and PRA regulated firms must operate a formal whistleblowing channel. All other employers: operate a documented channel, because without one there is no record of what was raised or how it was handled.
Roles meeting the definition of regulated activity with children require an Enhanced DBS check including the Children’s Barred List. It is a criminal offence for a barred person to carry out regulated activity, and for an employer to knowingly engage one. Scotland uses the PVG scheme; Northern Ireland uses AccessNI.
Employers must provide adequate and appropriate first aid equipment, facilities and people, determined by a first aid needs assessment covering the nature of the work and the hazards present.
This summary is built from publicly available regulatory sources and is not legal advice. It is not a determination that a given requirement does or does not apply to your organization, and requirements change. Confirm applicability with local legal counsel.
The requirement set is decided by two things: the cluster your business sits in, and the function each person performs. The same method applies in all three jurisdictions — only the statutes underneath change.
Which relationship your people are in decides which mandatory layer they carry.
Every function resolves to one of two seats, on a single test: direct contact with guests, minors, cash or confidential records.
Sports functions — Employee, Manager & Supervisor, Contractor, and Non-Employee or Volunteer with Access to Minors — resolve the same way. Access to minors puts a function in the high-contact seat regardless of employment status.
Groups running across borders get one process built to the strictest applicable standard, rather than three parallel programmes that drift apart. Tell us where you operate and we will map it.