You sign off a contractor to clear a blocked gutter or inspect a roof, and you assume the legal risk has moved with them. It has not. The work at height regulations name facilities managers and building owners as duty holders, and that duty cannot be fully delegated to whoever you hire.
This matters because the numbers are unforgiving. Falls from height killed 35 workers in 2024/25, over 28% of all workplace fatalities recorded that year. When something goes wrong on a roof you commissioned, the enforcement spotlight often falls on the person who appointed the work, not just the person who carried it out.
This guide is written for facilities managers and property managers responsible for UK commercial buildings. It covers what actually counts as work at height, what the Work at Height Regulations 2005 require of you specifically, how to verify a contractor is genuinely competent, what records you need to keep and for how long, and what HSE enforcement looks like on the ground in 2026.
Get these five things right and you turn a legal exposure into a system you can defend.
Why You Stay a Duty Holder When You Appoint a Contractor
The HSE could not be clearer on who is in scope. Its guidance states that “if you are an employer or you control work at height, for example facilities managers or building owners who may contract others to work at height, the Regulations apply to you.” Appointing a contractor does not remove you from that sentence.
Regulation 3 of the Work at Height Regulations 2005 spells it out, listing building owners, landlords, managing agents and facilities managers as duty holders alongside employers and contractors. In a commercial property, more than one party can hold the duty at the same time. The contractor carries duties for how they execute the work, and you carry duties for how you plan, appoint and oversee it. In multi-occupied buildings the lines blur further, so confirm in writing who holds the duty before work starts rather than after an incident.
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 reinforces this. It requires you to assess risks to people who are not your employees, which expressly includes contractors, subcontractors and visitors. You cannot contract that obligation away.
Three points define what staying a duty holder means in practice for facilities managers under the work at height regulations.
First, you retain a duty to plan the work, supervise it appropriately for the risk, and satisfy yourself the contractor is competent before they start. Second, appointing competently is how you discharge that duty. It is not a loophole for escaping it. Third, Section 37 of the Health and Safety at Work etc. Act 1974 means directors and managers can be prosecuted personally where an offence flows from their consent, connivance or neglect.
The courts apply this. In one Manchester logistics case, a host employer was fined £180,000 after failing to verify a contractor’s competency before allowing them onto dangerous work. The contract did not shield them, because the duty to check was theirs to begin with.
So the question is not whether you hold a duty. You do. The rest of this guide is about discharging it properly.
What Counts as Work at Height: It Is Broader Than You Think
What does a roofer on a steep pitched roof have in common with a cleaner standing on a kick stool to reach a high shelf? Under the law, the answer is everything. Both are working at height, and both trigger the same legal obligations on the person who controls the work.
The Work at Height Regulations 2005 set no minimum height threshold. Work at height is any place where a person could fall a distance liable to cause personal injury. There is no magic figure of two metres below which the rules switch off. A fall from a kick stool onto a hard floor can break a wrist, a hip or a skull.
That definition catches more of your estate than most facilities managers expect when they first read the work at height regulations. A low-level dock edge counts. A warehouse mezzanine counts. An unguarded floor opening at ground level counts, because the fall is into the void below.
Duration changes nothing. A two-minute task on a stepladder to swap a lamp carries the same legal weight as a full day on a scaffold. The law looks at the risk of the fall, not the length of the job.
Map this against your real estate of risk and the footprint grows fast. Gutter clearing, rooflight inspection, plant access on flat roofs, signage installation, window access, and ladder work for lighting and CCTV all sit inside the regime. So do tasks that look mundane, such as a driver climbing onto a lorry trailer bed to secure goods, or a stockroom worker on airport-style ladders picking stock at height. Fragile surfaces deserve their own attention, and the HSG33 section below covers why they kill.
The injury numbers show why this scope matters. RIDDOR recorded 4,684 non-fatal falls from height in 2024/25, yet self-reported surveys put the real figure near 44,000, roughly nine times higher. Most happen on the everyday tasks managers wave through.
Before you can control the risk, you have to recognise the full size of it. Underestimate the footprint and you will under-plan the controls.
The Hierarchy of Controls: What the Law Requires You to Do First
Here is a framework you can apply to any height task on the schedule on Monday morning. Regulation 6 of the Work at Height Regulations 2005 sets a strict order of priority, and it tells you what good looks like before a single contractor quotes for the job.
The hierarchy runs in three mandatory stages. First, avoid working at height where it is reasonably practicable to do so, for example by using a drone or camera for inspection, a long-reach pole for cleaning, or designing out the need for access altogether. Second, where you cannot avoid it, prevent falls using collective protection such as guardrails, permanent edge protection, scaffolds or MEWPs fitted with guardrails.
Third, where a fall risk remains, minimise the consequences using collective measures first, such as nets or airbags, before personal measures such as fall arrest harnesses. Collective protection guards everyone in the area at once. Personal protection only guards the person wearing it correctly.
As specialist health and safety lawyers at Shoosmiths stress, this hierarchy is mandatory, not advisory. Personal protection must never substitute for collective protection where collective protection is reasonably practicable. A harness is the fallback, not the first answer.
This gives facilities managers a fast test for any contractor’s method statement. Ask the RAMS to demonstrate the hierarchy. A RAMS that jumps straight to harnesses, without showing why avoidance and collective measures were ruled out, is a red flag that the contractor has skipped the legal sequence.
The cost of getting this wrong is concrete. In one case involving a MEWP and a bus, a £215,000 fine followed where harness use was not enforced and traffic was not properly segregated. The control measures existed on paper but were not made to happen on site.
That gap between paper and practice is exactly what HSG33 addresses for roof work.
HSG33 and Roof Work: What HSE Expects From Building Owners
Roof work accounts for around a quarter of all construction deaths, and many of those killed are maintenance workers rather than roofers. These are precisely the people facilities managers commission to inspect, clean and repair. The risk does not sit with a distant construction site. It sits on your roof, with a contractor you appointed.
HSG33 is the HSE’s definitive guidance on health and safety in roof work, now in its 5th edition, published 2020. It is written explicitly for clients, designers, building owners and specifiers, not just the contractors holding the tools. If you commission roof work, HSG33 is addressed to you.
Three duties from HSG33 land directly on facilities managers.
First, treat all roofs as fragile until a competent person confirms otherwise in writing. Rooflights, asbestos cement sheets and aged surfaces are repeat killers, and some rooflights are effectively invisible in certain light conditions. Assume fragility until evidence says otherwise.
Second, provide contractors with the hazard information you hold. That means fragile surfaces, the asbestos register, previous surveys and known access points. Withholding what you know, even by omission, leaves a worker walking onto a roof blind.
Third, plan the work and confirm safe access before anyone goes up. Access arranged on the day, by whoever happens to be on site, is how falls happen.
The consequences are current, not historic. In December 2025, J Smith Construction was fined £80,000, with a director given a 3-month suspended sentence, after a 29-year-old worker fell 15ft through a fragile skylight. The fragile surface was the killer, exactly the hazard HSG33 tells building owners to flag.
If you manage buildings with roofs that need regular access, a planned roof maintenance programme builds this duty into routine rather than leaving it to ad hoc call-outs. Knowing the duty is one thing. Discharging it depends on appointing a genuinely competent contractor.
How to Verify a Contractor Is Actually Competent
Use this as a checklist you can run before any contractor sets foot on a roof or steps into a MEWP. Competence is not a feeling you get from a confident sales call. It is something you verify and keep on file.
Start with recognised cards for the specific task. The IPAF PAL Card covers MEWP and powered access operators and carries a 5-year validity. PASMA covers mobile access towers. CISRS covers scaffolders. At company level, CITB registration and CHAS or an equivalent SSIP accreditation show a baseline of safety management. Check the card matches the task, and check the expiry date. An expired card is no card.
The second pillar is the RAMS, and it must be site-specific. A competent contractor’s risk assessment and method statement names this building’s actual hazards, the fragile rooflights, the asbestos, the unprotected edges, the live plant, and shows how the hierarchy of controls applies to each. A generic template that could describe any building in the country is a warning sign, not a reassurance.
The third pillar is a documented site induction and a rescue plan. The rescue plan must name who recovers a person who falls into a harness, because suspension trauma is time-critical and the safe window can be as short as 15 minutes. A harness with no rescue plan is a hazard wearing the costume of a control.
Skipping induction has a price. A Birmingham manufacturer was fined £250,000 after contractors were given only minimal induction, with the judge ruling that legal responsibility cannot be transferred through contracts. The duty to brief people on site hazards stayed with the host.
Build all of this into procurement, and keep copies of cards, RAMS and insurance on file. Where your buildings rely on fall arrest systems, independent fall arrest systems testing confirms the anchors and lifelines a contractor clips into are themselves safe to use.
Everything you verify only protects you if you can prove it. That leads straight into record-keeping.
Record-Keeping: What You Must Document and How Long to Keep It
If an HSE inspector walked into your office tomorrow and asked for your work at height paperwork, could you produce it on the spot? If the honest answer is no, you are exposed, even if nothing has gone wrong and nobody has been hurt. Missing records are a finding in their own right.
Scaffold records are specific. Scaffolding must be inspected before first use, after any event that could affect its stability such as adverse weather, and at intervals not exceeding every 7 days while in use. The written report stays on site until the next inspection, then is retained for 3 months after the work is complete, in line with HSE guidance CIS47.
Lifting equipment carries its own regime. Under LOLER, MEWPs, scissor lifts and personnel-lifting equipment need a thorough examination every 6 months, and the same 6-month interval applies to fall arrest harnesses and lanyards used to support people. Keep the examination reports.
Training records need active management. Track expiry dates rather than filing certificates and forgetting them, because a certificate that lapsed last month means the worker is not currently qualified, and the work should not begin until it is renewed.
Then there are the records you hold as the appointing duty holder. Risk assessments, RAMS, permits to work, contractor competence evidence and induction records all belong in your file. Keep copies even when the contractor generates the document, because you are the party demonstrating oversight, and oversight you cannot evidence is oversight a court will assume you did not exercise.
Permits to work need their full lifecycle on file, including the handback or cancellation record, because an open-ended permit proves nothing about control. Record near misses too. A logged near miss is evidence of a live safety culture, and RIDDOR-reportable falls, those causing specified injuries or more than 7 days’ incapacity, must be reported within the statutory timescale.
This is where Section 37 due diligence becomes personal. A clear, dated, retrievable documentary trail is the practical protection for managers if responsibility is ever tested. Good records are exactly what 2026 HSE enforcement now scrutinises.
What Compliance Looks Like Under HSE Enforcement in 2026
A business that fitted guardrails five years ago and has never revisited them is not considered compliant in 2026. The hardware being present is no longer the test. The HSE now looks for evidence that you manage the system over time, and it treats documentation failures as standalone non-compliance, even where no fall has occurred.
This is the shift facilities managers need to absorb. Inspectors want proof of ongoing management, not a one-time installation certificate gathering dust. As ThinkWorksafe summarises the 2026 expectation, duty holders must show up-to-date risk assessments reflecting current access patterns and building changes, documented inspection records for all fall protection systems, and evidence of ongoing worker training.
Run this five-point self-check across your portfolio. First, are your risk assessments current and site-specific, reflecting how each building is actually accessed today? Second, is every fall protection system inspected and certified on schedule? Third, are training and competency records current for everyone working at height? Fourth, do you hold a documented rescue plan? Fifth, are all these records retained and retrievable immediately, not in a week.
The financial stakes are real. Since the 2016 Sentencing Council guidelines, fines scale with company turnover, which puts six and seven-figure penalties within reach for ordinary businesses, and custody is possible for individuals. Enforcement notices carry weight too. In the RS Rendering case, a firm that ignored a Prohibition Notice was prosecuted and fined.
Keeping a compliance system live across a whole portfolio, building by building and inspection by inspection, is demanding work. This is where a specialist maintenance partner earns its place, by holding the schedule, the records and the competence in one managed system. If you want a candid view of where your portfolio stands, talk to the NSS team and treat it as an expert consultation rather than a sales call.
Frequently Asked Questions
Am I still responsible for safety if I hire a contractor to work at height?
Yes. The Work at Height Regulations 2005 name facilities managers and building owners as duty holders, and the HSE confirms the rules apply to anyone who controls work at height. You can delegate the task, but not your own duty to plan the work, check competence and provide hazard information.
Is there a minimum height at which Work at Height Regulations apply?
No. There is no minimum height threshold. The regulations apply to any place where a person could fall a distance liable to cause personal injury, including a kick stool, a dock edge or a mezzanine. A short task on a stepladder carries the same legal obligation as a full day on a scaffold.
What makes a contractor competent to work at height?
Competence means recognised training cards for the specific task, IPAF for MEWPs, PASMA for mobile towers and CISRS for scaffolding, all in date. It also means a site-specific RAMS naming this building’s actual hazards, a documented induction, and a rescue plan identifying who recovers someone who falls into a harness.
How long must I keep work at height records?
It depends on the record. Scaffold inspection reports stay on site until the next inspection, then for 3 months after the work finishes. LOLER thorough examinations run every 6 months for MEWPs and fall arrest equipment. Keep training records current, and retain your own copies of all contractor documents because you are the duty holder evidencing oversight.
Does HSG33 apply to me as a facilities manager?
Yes. HSG33 is the HSE’s roof work guidance, 5th edition 2020, and it addresses building owners and clients directly, not just contractors. It requires you to appoint competent contractors, give them the roof hazard information you hold, and agree safe access before work starts.
Can I be personally prosecuted as a facilities manager?
Yes. Section 37 of the Health and Safety at Work etc. Act 1974 allows managers and directors to be prosecuted personally where an offence flows from their consent, connivance or neglect. Penalties include unlimited fines, director disqualification and imprisonment. A clear documentary trail and a structured QHSE approach are your strongest personal protection.