Your Contractors, Your Prosecution: The Legal Reality of Third-Party Safety Liability in UK Workplaces
The Assumption That Ends in the Dock
There is a belief, widespread across UK industry, that engaging a contractor transfers safety responsibility along with the work itself. It is a comfortable assumption — commercially convenient, administratively tidy, and legally wrong. When a contractor's worker is injured on your premises, when a subcontracted electrical team installs equipment that later causes a fire, or when a cleaning company's employee is harmed by a hazard your organisation controlled, the question of who bears criminal liability is rarely as straightforward as the contract suggests.
The Health and Safety at Work etc. Act 1974 imposes a duty of care on employers that extends, in explicit terms, to persons not in their direct employment. Section 3 of the Act requires every employer to conduct their undertaking in such a way as to ensure, so far as is reasonably practicable, that persons not in their employment who may be affected by that undertaking are not exposed to risks to their health and safety. Contractors, subcontractors, and supply chain workers fall squarely within the scope of that provision.
The phrase 'not our responsibility' has never been an adequate legal defence. In the current enforcement environment, it is barely worth articulating.
Where the Law Draws the Line — and Where It Doesn't
Understanding contractor liability requires appreciating a distinction that courts and enforcement authorities apply carefully: the difference between what a contractor does independently and what they do within an environment, system, or process that the principal employer controls.
A business cannot be held responsible for a contractor's specialist technical failure in an area entirely outside the client's knowledge or control. But a business can — and regularly is — held responsible where the hazard arose from conditions on premises the employer controlled, where the risk was foreseeable and the employer failed to act, or where the employer's own management systems failed to identify or mitigate a danger to which the contractor was exposed.
The CDM Regulations 2015, applicable to construction work, are instructive here. They create explicit duties for clients, principal designers, and principal contractors that cannot be delegated away by contract. A property owner who engages a principal contractor and assumes their obligations end at appointment will find the CDM framework disagrees — and so will the HSE.
Similarly, the Management of Health and Safety at Work Regulations 1999 require employers to coordinate with contractors on shared workplaces, exchange relevant safety information, and ensure that arrangements for managing risk are mutually understood and implemented. These are not aspirational guidelines. They are enforceable duties.
Published Prosecutions: What the Record Shows
HSE prosecution records provide an unambiguous picture of how contractor-related liability plays out in practice. Businesses across manufacturing, facilities management, retail, and construction have faced prosecution — and conviction — for incidents involving workers they did not directly employ.
In several documented cases, principal contractors have been prosecuted alongside subcontractors following fatal incidents, with courts finding that the principal's failure to adequately supervise, induct, or risk-assess the subcontractor's activities constituted a breach of duty. The fact that the subcontractor also faced charges did not diminish the principal's liability. Shared culpability is not reduced culpability.
Property owners and facilities managers have faced similar outcomes. Where a maintenance contractor was injured due to a hazard the property owner knew about — or ought to have known about — the owner's failure to communicate that hazard has been found to constitute a criminal breach, irrespective of the contractual arrangements in place.
The Vetting Gap: Where Liability Begins
For many businesses, the contractor liability problem begins not with inadequate supervision but with inadequate selection. Engaging a contractor without verifying their safety credentials, training records, and compliance history is itself a failure of the duty of care — and one that courts have repeatedly found to be unreasonable.
Effective contractor vetting requires more than checking a certificate. It requires understanding what that certificate covers, whether it remains current, and whether the contractor's documented competence matches the specific work being commissioned. A contractor holding a generic health and safety qualification may not be competent to work with hazardous substances, at height, or in confined spaces — and the business engaging them is expected to know the difference.
Pre-qualification questionnaires, reference checks, insurance verification, and review of the contractor's own safety management documentation are the minimum components of a defensible vetting process. Businesses that rely solely on a contractor's self-declaration of compliance are building their liability exposure on foundations that will not survive scrutiny.
Ongoing Monitoring: The Obligation That Doesn't End at Appointment
Even where vetting is thorough, the duty of care continues throughout the contractor's engagement. Employers are expected to monitor contractor activity on their premises, ensure that site inductions have been completed, verify that method statements and risk assessments are being followed, and intervene where unsafe practices are observed.
This does not require employers to micro-manage every aspect of a contractor's work. It does require them to exercise reasonable oversight — and to document that oversight. An employer who can demonstrate that they conducted regular site inspections, reviewed contractor risk assessments, and acted promptly when concerns arose is in a materially stronger position than one who issued a purchase order and assumed compliance would follow.
The practical tools for ongoing monitoring are not complex: contractor management registers, site induction records, permit-to-work systems, periodic safety walkthroughs, and documented review meetings. What they require is consistency and organisational commitment to treating contractor safety as a live responsibility rather than a contractual formality.
Supply Chain Depth: The Subcontractor Problem
The liability question becomes considerably more complex where principal contractors engage subcontractors of their own — a routine arrangement in construction, facilities management, and logistics. Businesses that engage principal contractors should understand that their duty of care does not automatically attenuate through layers of subcontracting.
Where a business has engaged a principal contractor and has visibility of, or influence over, the subcontracting arrangements, courts have found that a residual duty of care persists. The practical implication is that businesses should contractually require their principal contractors to apply equivalent safety standards to their subcontractors, and should seek assurance — in writing — that this requirement is being met.
Reframing Contractor Safety as Organisational Risk Management
The businesses that manage contractor liability most effectively are those that have ceased to regard it as a procurement or legal matter and have integrated it into their broader safety management framework. Contractor safety is not a clause in a contract. It is an operational reality that requires the same attention, resource, and governance as any other element of workplace safety.
For UK businesses operating in any sector where contractors are routinely engaged, the question is no longer whether you bear responsibility for their safety performance. The law settled that question decades ago. The question is whether your management systems are sophisticated enough to demonstrate that you discharged that responsibility — and whether, when an inspector or a court examines those systems, they will find substance or assumption.