Contractor safety management: who pays when a contractor you never hired causes the harm

Table of Contents

The roof needed doing. That was the whole of it, as far as the managing director was concerned. A leak above the packing line had been getting worse through the winter, the insurer had started asking questions, and the quote from the roofing firm was sensible enough that he signed it without a second read. They were established, they had the certificates, and they sent through a method statement that ran to fourteen pages. Someone in the office filed it.

The man who fell through the fragile panel eight weeks later did not work for the roofing firm. He worked for a labour supplier the roofer used when they were stretched, and he had been on site for four days. The MD had never met him. He could not have picked him out of a line-up. He had no contract with him, no relationship with his employer, and no idea he was on the premises until the ambulance was in the yard.

Six months on, the letter from HSE was addressed to the company, and a second one was addressed to the Managing Director personally.

The reaction at that point is almost always the same, and it is worth saying out loud because it is the assumption on which the whole of contractor safety management in the UK turns. He did not employ the man. He did not control the work. He hired a competent firm precisely so that he would not have to. Surely the liability follows the contract.

It does not. And the gap between that instinct and the actual legal position is where a great many UK SMEs in construction and manufacturing are quietly exposed right now.

The duty you cannot hand over

Section 3(1) of the Health and Safety at Work etc. Act 1974 is the provision that catches this, and it is worth reading in the original because a paraphrase softens it:

"It shall be the duty of every employer to conduct his undertaking in such a way as to ensure, so far as is reasonably practicable, that persons not in his employment who may be affected thereby are not thereby exposed to risks to their health or safety."

Notice what is absent. There is no requirement that the person be your employee. No requirement that you control them. No requirement that you have any contractual relationship with them at all. The only question the section asks is whether the activity that harmed them formed part of the conduct of your undertaking.

The House of Lords settled the point in R v Associated Octel Co Ltd [1996], in which a chemical company engaged a specialist contractor to repair a chlorine tank during the annual shutdown, and the contractor's employee was badly burned. Octel argued, reasonably enough on the face of it, that it had engaged competent specialists and could not be expected to supervise their trade. Lord Hoffmann held that the duty under section 3 is personal to the employer and cannot be delegated. The employer who engages a contractor to do work forming part of its undertaking must stipulate the conditions needed to avoid the risks, so far as reasonably practicable, and, having failed to do so, cannot then argue that it was in no position to exercise control.

Maintenance of your premises is part of conducting your undertaking. So is repair, cleaning, plant installation and the removal of the machine you replaced last year. Whether the work is done by your own people, by a firm you appointed, or by someone three links down a subcontracting chain you never saw, the duty stays with you.

That is the first thing an MD tends to get wrong. The second one costs more.

The burden of proof runs the wrong way

In an ordinary criminal case, the prosecution proves guilt beyond a reasonable doubt, and the defendant sits back. Health and safety law does not work that way, and section 40 of the same Act is why:

"In any proceedings for an offence under any of the relevant statutory provisions consisting of a failure to comply with a duty or requirement to do something so far as is practicable or so far as is reasonably practicable... it shall be for the accused to prove... that it was not practicable or not reasonably practicable to do more than was in fact done to satisfy the duty or requirement."

Once HSE establishes that you owed the duty and that a risk existed, the burden shifts to you. You must prove, on the balance of probabilities, that it was not reasonably practicable to have done more. The Court of Appeal upheld the compatibility of that reverse burden with the right to a fair trial in R v Davies [2002], a case that itself arose from the death of a subcontractor.

Read that again with your own business in mind, because it changes what "being careful" has to look like in practice. You are not defending yourself by showing you acted in good faith. You are defending yourself by producing evidence, created before the incident, that demonstrates you did everything that could reasonably have been done. If the evidence does not exist, you cannot discharge the burden, and the fact that you were a decent operator who trusted a good contractor carries no weight at all.

The standard you are proving yourself against comes from Edwards v National Coal Board [1949], and it is deliberately demanding. The risk goes in one scale, the cost of averting it goes in the other, and unless there is a gross disproportion between the two, the measure was reasonably practicable and you should have taken it. A visit to the roof before work started, a check that the man on it was the man named in the method statement, and an hour of someone's time. Weigh those against a fall through a fragile panel, and the disproportion runs the other way.

You are probably a CDM client and do not know it

Here is the finding from the research that surprises manufacturing MDs most, and it deserves its own space.

The Construction (Design and Management) Regulations 2015 apply to you if you have construction work carried out for you as part of your business. That makes you a commercial client, with statutory duties of your own, entirely separate from anything your contractor owes.

The instinctive objection is that you do not do construction. You make things, or you install things, or you run a distribution operation. Construction is what happens on the site down the road with the hoarding around it.

Look at how CDM 2015 actually defines construction work. Regulation 2(1) includes the alteration, conversion, fitting out, renovation, repair, upkeep, redecoration or other maintenance of a structure. It includes demolition and dismantling. It includes the installation, commissioning, maintenance, repair or removal of mechanical, electrical, gas, compressed air, hydraulic and similar services normally fixed within or to a structure.

Your roof repair is construction work. Your mezzanine going in is construction work. Rewiring the workshop, replacing the fixed extraction system, taking out the old line and putting a new one in, refurbishing the offices: all construction work, all bringing CDM duties with them, none of it dependent on the project being big enough to notify HSE. The regulations apply regardless of size or duration. When Osborne Clarke assessed the reach of CDM 2015 at the time it came into force, the estimate was that up to 85 per cent of businesses affected by the new law did not consider themselves construction businesses at all.

The client duties under Regulation 4 are short and pointed. You must make appropriate arrangements to manage the project, including allocating sufficient time and resources. You must provide pre-construction information to every designer and contractor, including those you are still only considering. And under Regulation 4(6), you must take reasonable steps to ensure that the principal designer and principal contractor comply with their own duties.

That last one is the killer. It is a continuing duty to check, not a one-off act of appointment. Under Regulation 5, if more than one contractor is involved, or is foreseeably likely to be, you must appoint a principal designer and a principal contractor in writing before the construction phase begins. If you fail to appoint them, you assume their duties yourself. A great many SMEs have unknowingly done exactly that.

If you want a picture of where this ends, look at Taylor Grange Developments, prosecuted as the client in a demolition case. HSE's finding was that the client had set the tone for the project by failing to make suitable arrangements to ensure the work would be carried out safely, and by failing to ensure that the principal contractor it appointed was complying with its legal duties. The dangerous work itself was carried out by a plant hire firm using untrained workers, engaged through an intermediary several steps away from the client. The client was prosecuted anyway. Or look at Sherwood Homes, fined £170,000 as the client for asbestos failings on a mill demolition, where the director, Peter Kiely, was prosecuted personally under section 37 for the company's client-duty breach and fined a further £6,500 with £7,000 in costs.

What "reasonable steps" actually means when HSE asks

Ask a UK SME what it has in place for contractor safety management, and the answer, nine times out of ten, is a folder. Insurance certificates, an accreditation logo, a risk assessment and a method statement. The paperwork was requested, the paperwork arrived, and the paperwork was filed.

None of that is worthless. All of it is necessary. And it will not, on its own, discharge your responsibilities, because a RAMS is a plan for how work is intended to be done, and the question after an incident is what was actually done. We've written before about the gap between having a contractor safety system and having one that works under pressure, and nothing in the Act allows you to transfer a duty by collecting a document.

What an inspector looks for after a contractor is hurt on your premises is narrower and harder than most businesses expect. Did your own risk assessment, required under Regulation 3 of the Management of Health and Safety at Work Regulations 1999, address the risks this work created for people who are not your employees? Did you co-operate and co-ordinate with the contractor as Regulation 11 requires where a workplace is shared? Did you give them comprehensible information about your risks under Regulation 12? Did anyone competent check that the work in front of them matched the method statement they had been sent? Was there a permit to work for the fragile roof, the hot works, and the isolation of the steam line? Who was supervising at the point of work, and what did they do when the crew changed? The difference between a contractor who has been checked on paper and one who is genuinely under control is exactly the ground we covered in what HSE expects beyond a signed RAMS, and it is the same ground the cases below turn on.

The pattern in the recent prosecutions is remarkably consistent, and it is always the same shape. In December 2025, Axis Europe was fined £640,000 as the principal contractor after a labourer working for its subcontractor was pulled over the edge of a scaffold during an unplanned lift in north London. HSE's finding was that Axis had failed to manage and monitor the work, had not challenged insufficient detail in the lifting plan, and had not prevented the use of untested lifting accessories. Its subcontractor, Premier, was fined a further £160,000. In June 2026, following a platform collapse at a City of London site that left a worker with a fractured neck and a bleed on the brain, HSE found that the method statements provided in advance had been inconsistent, that requirements for crash decks had been unclear, that there had been no supervision of the drilling team in the week before the incident or on the day, and that there was a lack of clarity about who should have been working where.

In each case, documents existed. In each case, they were not the same thing as the control.

The cost trail, followed to the end

Fines for health and safety offences have been set by turnover since the Sentencing Council's definitive guideline came into force on 1 February 2016, which is what took them from an irritation to a solvency question. The court fixes culpability, fixes harm, then reads the figure off the table for your turnover band.

For a small organisation, with turnover between £2 million and £10 million, a high-culpability offence in the most serious harm category carries a starting point of £250,000, with a range up to £1 million. Drop to the next harm category; the starting point is £100,000, with a range up to £450,000. A micro business with under £2 million turnover still faces a starting point of £160,000 at the top of the scale. The guideline is explicit that the fine must be substantial enough to have a real economic impact and bring home to management and shareholders the need to comply. HSE brought 246 prosecutions in 2024/25, achieving a 96 per cent conviction rate and securing over £33 million in fines.

Then come the additions. HSE's Fee for Intervention is charged at £188 an hour from 1 April 2026, and it runs from the moment a material breach is identified through every hour of inspection, investigation, statement-taking, notice-drafting and follow-up until the matter is closed. Prosecution costs are awarded separately and routinely reach five figures. Civil claims follow. Insurance premiums move. The conviction goes on HSE's public register, where it stays visible for a decade to every prospective client and every pre-qualification scheme that checks, which in construction and manufacturing supply chains is all of them.

And then the point that stops the conversation every time I raise it with an MD who assumed the policy already covered it. A criminal fine cannot lawfully be insured against in the UK. Public policy has forbidden it since Askey v Golden Wine in 1948, restated by the House of Lords in Gray v Thames Trains and by the Court of Appeal in Safeway Stores v Twigger. Your liability insurer may well pay the compensation claim and may fund your defence costs. The fine comes out of retained profit. At a £250,000 starting point and a ten per cent net margin, the business has to turn over £2.5 million to stand still.

The director's exposure is separate and personal. Under section 37, where an offence by the company is attributable to any neglect on the part of a director or manager, that individual is guilty of the offence as well as the company. Neglect does not require you to have known. It captures the failure to take steps you ought to have taken. The maximum on indictment is two years' custody, and the sentencing range for the most serious combination of culpability and harm has a starting point of eighteen months. Courts have been using it. In April 2025 a director received four months, suspended, after a fatal fall through a fragile roof on work that had been planned from photographs without a site visit. In December 2025, another received three months, suspended, after a subcontractor fell through a skylight. Disqualification from acting as a director for up to 15 years in the Crown Court comes on top.

What control actually looks like

The businesses that come through an HSE investigation intact are rarely the ones with the thickest folders. They are the ones who can answer a single question with a name and a record: who was checking this work at the point it was being done?

In practice, building contractor control that holds up under HSE scrutiny means knowing whether the job you have commissioned makes you a CDM client, and appointing a principal contractor in writing when it does.. It means someone competent is present at the point of work before high-risk activity starts, confirming that what is about to happen matches what the method statement said would happen, with the authority to stop it if it does not. It means a permit system for work at height, hot works, confined spaces and energy isolation. It means knowing who is on your site today, including the two men the roofer brought in on Friday, and it means that supervision, induction, and co-ordination exist as records rather than intentions, because under section 40 the burden of proving they happened is yours.

There is a version of contractor safety management that consists of asking for the paperwork and hoping. It works until the day it does not, and on the day it does not, the letter comes to you.

If you use contractors on your site and you are not certain your arrangements would hold up if HSE asked who was in control at the point of work, send a short message describing the type of work you put out and how you currently check it. You will get a direct read on where your contractor control would stand up under scrutiny and where it would not, along with the two or three things that would matter most in an investigation.

It comes back from Nick or the team, usually the same day, from someone who has stood on the site rather than a call centre working from a script.