Employee safety software: the records the law makes you produce

Most buying conversations about safety systems start at the wrong end. Someone demonstrates a mobile incident form, a near-miss dashboard and a traffic-light training matrix, and the question becomes which looks best. The question that decides whether a system is worth anything is narrower: can it produce, on demand and with dates attached, the documents an employer is required by law to hold?

So this is a category post written backwards. It starts from what the law tells an employer to write down, how long to keep it and who can demand to see it, then asks what that implies for a system. No products are named and nothing is ranked, because the duties are the same whatever you buy. It is general information about the position in the United Kingdom, drawn from Great Britain instruments, and not legal advice.

Records only help if they are created while the work happens. See how New Dynamics workflows let you set the stages, participants and reminders, so a dated step has an owner before the deadline arrives.

Five provisions, five different records

They share no threshold, no retention period and no audience. A system that treats them as one folder fails on at least one of the three.

The written policy. Section 2(3) of the Health and Safety at Work etc. Act 1974 requires every employer, "Except in such cases as may be prescribed", to prepare and revise "a written statement of his general policy with respect to the health and safety at work of his employees and the organisation and arrangements for the time being in force for carrying out that policy". The exception is the Employers' Health and Safety Policy Statements (Exception) Regulations 1975, in operation since 1 November 1975, which excepts "Any employer who carries on an undertaking in which for the time being he employs less than five employees".

The significant findings. Regulation 3(6) of the Management of Health and Safety at Work Regulations 1999, in force since 29 December 1999: "Where the employer employs five or more employees, he shall record (a) the significant findings of the assessment; and (b) any group of his employees identified by it as being especially at risk." HSE words the threshold the same way on steps needed to manage risk: "If you employ 5 or more people, you must record your significant findings". Our post on risk assessment covers the duty itself.

The arrangements. The one most buyers have never heard of. Regulation 5(2) adds: "Where the employer employs five or more employees, he shall record the arrangements referred to in paragraph (1)." Those arrangements cover "the effective planning, organisation, control, monitoring and review of the preventive and protective measures", so monitoring and review are themselves recordable. A system holding assessments with nowhere to show that anyone reviewed them answers half of these Regulations.

The incident record. Regulation 12(1) of RIDDOR 2013 requires a record of each reportable incident, each reportable diagnosis, and each injury incapacitating a worker for routine work for more than three consecutive days. No employee-number threshold applies.

The health record. Regulation 11(3) of the Control of Substances Hazardous to Health Regulations 2002 requires a health record "containing particulars approved by the Executive" for every employee under health surveillance.

RIDDOR is a deadline problem before it is a record problem

Under RIDDOR 2013, deaths, specified injuries, injuries to people not at work taken to hospital for treatment and dangerous occurrences are notified without delay with a report received inside 10 days; an over-seven-day incapacity is reported within 15 days of the accident; a diagnosed occupational disease is reported without delay. Our post on RIDDOR reporting sets out each category and the counting rules.

One correction is worth making, because the 1995 Regulations are still cited in buying documents. Table 1 of Schedule 4 to RIDDOR 2013 revokes S.I. 1995/3163, "The whole instrument". Regulation 18(3) keeps its records alive, though: "Any record or register required to be kept under any instrument revoked by these Regulations must be kept for the same period as if these Regulations had not been made." A migration that silently drops pre-2013 entries can remove something still legally required.

What a record has to carry is on HSE's page on what records do I need to keep: "If you do not keep a copy of the online form your records must include the date and method of reporting; the date, time and place of the event; personal details of those involved; and a brief description of the nature of the event or disease." Date and method of reporting are not incident data. They are evidence about your own process, and they are the fields home-made forms leave out.

Two retention clocks, not one

RIDDOR regulation 12(2) is the short clock: an entry "must be kept for at least three years from the date on which it was made". HSE's printed accident book, series code BL510, 2018 edition, is one way to keep the injury side, and HSE notes a separate method is needed for cases of disease.

COSHH regulation 11(3) is the long clock. The health record, "or a copy thereof", must be "kept available in a suitable form for at least 40 years from the date of the last entry made in it". The date of the last entry, not the date employment ended, so one late entry restarts four decades of retention.

The volume sits on the long clock. HSE's key figures for Great Britain 2024 to 2025 record "1.9 million working people suffering from a work-related illness" against 59,219 injuries to employees reported under RIDDOR. Our post on employee records retention sets out a schedule, our employee data protection guide covers the health data involved, and our HR statistics hub has the wider picture.

Training records: required, or only advised

Regulation 13(2) of the Management Regulations requires adequate health and safety training "on their being recruited into the employer's undertaking", and again on exposure to new or increased risks from a transfer, a change of responsibilities, new or changed work equipment, new technology or a new or changed system of work. Regulation 13(3) adds that it "take place during working hours". Competence has its own test in regulation 7(5): a person is competent where "he has sufficient training and experience or knowledge and other qualities to enable him properly to assist".

Note what that does not say. The duty is to train, not to keep a training record. HSE's leaflet Health and safety training: A brief guide, INDG345(rev1), published 11/12, puts records as advice: "It can help you manage training if you keep records, even if it is in-house training", and "You should monitor training records so that refresher training can be given when needed."

So a vendor calling a training matrix a legal requirement has overstated it. The honest case is narrower and still strong: regulation 13(2) triggers on events a people system already knows about, and an employer who cannot evidence that training followed a start date or a role change has no answer when asked.

Your records are somebody else's right of access

This is the requirement buyers discover after they have bought. Regulation 7(1) of the Safety Representatives and Safety Committees Regulations 1977, in operation since 1 October 1978, entitles union-appointed safety representatives, on reasonable notice, to "inspect and take copies of any document relevant to the workplace or to the employees the safety representatives represent which the employer is required to keep by virtue of any relevant statutory provision ... except a document consisting of or relating to any health record of an identifiable individual."

Read that as a specification: everything you are statutorily required to keep is inspectable, and health records of identifiable individuals are carved out. A system that mixes surveillance results into the incident file, visible to the same people, cannot honour the carve-out without redaction by hand.

Where there is no recognised union, regulation 5(2)(b) of the Health and Safety (Consultation with Employees) Regulations 1996, in force since 1 October 1996, requires an employer consulting representatives of employee safety to make available information "contained in any record which he is required to keep by regulation 12 of the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013". The RIDDOR record is consultation material by statute.

HSE's Consulting employees on health and safety, INDG232(rev2), published 04/13, sets the standard for serving it: "There is no need for you to present this information in a different format and provide it as a separate package". The record should be readable as it stands. Our post on the safety representative role covers which consultation regime applies to you.

What a regulator and an insurer will ask to see

An inspector's document power is section 20(2)(k) of the 1974 Act: "to require the production of, inspect, and take copies of or of any entry in (i) any books or documents which by virtue of any of the relevant statutory provisions are required to be kept; and (ii) any other books or documents which it is necessary for him to see". Not only the statutory records, then.

Two duties go further and make you hand material over. RIDDOR regulation 12(3): "The responsible person must send to the relevant enforcing authority such extracts from the record required to be kept under paragraph (1) as that enforcing authority may require." COSHH regulation 11(4)(b) requires the employer to "provide the appropriate authority with copies of such health records as the appropriate authority may require". Filtered extracts are a different capability from a folder of files.

How often that happens is not something we can give you a number for. HSE states on its enforcement statistics page that "Enforcement statistics are no longer published as part of HSE's annual statistical release relating to work-related ill health and workplace injuries", and treats them as management information in its annual report and accounts. No official release publishes an inspection-request rate, so treat any vendor figure for one with suspicion.

Insurers are a separate channel, and nothing happens automatically. HSE is explicit: "Information supplied to HSE in a RIDDOR report is not passed on to your insurance company. If you think your insurer needs to know about a work-related accident, injury or case of ill health, please remember to contact them separately." On the policy itself, HSE's guide Employers' Liability (Compulsory Insurance) Act 1969: A brief guide for employers, HSE40(rev4), published 12/12, lists conditions an insurer cannot impose: it cannot refuse to pay compensation purely because "you do not keep specified records or cannot provide the insurer with information from those records". The same guide still advises keeping a complete record of your employers' liability insurance, "because some diseases can appear decades after exposure to their cause".

What this implies for a system

• A date and a method on every notification, because HSE's record list names both.
• Two retention clocks, three years under RIDDOR regulation 12(2) and 40 years from the last entry under COSHH regulation 11(3), applied per record type rather than per folder.
• Health records of identifiable individuals held apart, so the regulation 7(1) carve-out works without manual redaction.
• Filtered extracts by site, date range and incident type, because regulation 12(3) asks for extracts, not archives.
• Review events as records in their own right, because regulation 5(2) makes monitoring and review recordable.
• A separate insurer notification step, since a RIDDOR report never reaches your insurer.

When a shared drive is still adequate

Sometimes it genuinely is, and saying otherwise would be selling. RIDDOR regulation 12(4): "Any record of injuries, deaths, dangerous occurrences or diseases which the responsible person keeps for any other purpose satisfies the requirements of paragraph (1) if it covers the injuries recordable under these Regulations and includes the particulars specified in Part 2 of Schedule 1." A spreadsheet with the right columns complies. An employer with fewer than five employees has no written policy duty and no recording duty under regulations 3(6) or 5(2). HSE warns against the opposite error too: "Do not rely purely on paperwork as your main priority should be to control the risks in practice."

A shared drive stops being adequate at identifiable points rather than at a headcount. When the retention clocks diverge and nobody tracks which file sits on which. When an inspection right means redacting health data by hand. When the person who files the incident is not the person watching the seven-day threshold. When an enforcing authority asks for an extract and the answer is a week of copying.

Frequently asked questions

What is employee safety software?

It is a category name rather than a defined product, covering systems that hold risk assessments, incident and accident records, training and competence records, and the evidence of review and consultation. Nothing in UK law requires software. The duties are to assess, record, report, retain and produce.

What safety records must an employer keep?

In Great Britain, five are named directly: the written policy under section 2(3) of the 1974 Act, the significant findings under regulation 3(6) of the Management Regulations, the arrangements under regulation 5(2), the incident and disease record under RIDDOR regulation 12, and the health surveillance record under COSHH regulation 11(3) where surveillance applies.

Do you need safety software with fewer than five employees?

Not for the written thresholds. The 1975 Exception Regulations except an employer with less than five employees from the written policy duty, and regulations 3(6) and 5(2) apply only at five or more. The RIDDOR regulation 12 recording duty has no threshold, so even the smallest employer needs somewhere dated and durable to record reportable incidents.

How long do accident records have to be kept?

At least three years. RIDDOR regulation 12(2) requires an entry to be kept "for at least three years from the date on which it was made". That is a floor rather than a target, since a claim can arrive later and a COSHH health record runs for at least 40 years from its last entry.

Is a training record a legal requirement?

Not as a general duty. Regulation 13 of the Management Regulations requires the training and says nothing about recording it. HSE's leaflet INDG345(rev1) puts records as advice: "It can help you manage training if you keep records". Without one, though, you cannot show that training followed a start date, a role change or a new piece of equipment.

Can safety representatives see our incident records?

Yes, within limits. Regulation 7(1) of the 1977 Regulations entitles union-appointed safety representatives to inspect and take copies of any document the employer must keep by statute, excluding health records of an identifiable individual. Under the 1996 Regulations, regulation 5(2)(b) requires information in the RIDDOR record relating to a representative's workplace or group to be made available.

Your next step

Before you watch a single demonstration, write down the five records above and, next to each, where it lives today, who last changed it, when it is next due for review and how long it has to be kept. The gaps in that table are your requirements, and they will be shorter than any feature list.

Then take the one record with no owner, usually the regulation 5(2) arrangements or the review date on an assessment, and give it one. Read and download our employee handbook guide for how to keep the policy around it short enough that people use it.

If you want the thresholds and review dates inside the process rather than beside it, Book a New Dynamics demo and bring your current incident form and training matrix. You can also email contact@new-dynamics.com.