Managing mental health, wellbeing and stress at work: is there an ever-emerging enforcement risk?

Mental health, wellbeing and the management of work-related stress are no longer peripheral concerns. Given that the extent of the Health and Safety at Work etc. Act 1974 (HSWA) applies very much to the ‘health and welfare’ of workers, it can certainly be said that they sit squarely within core legal duties under UK health and safety law and are increasingly becoming a greater enforcement priority for the national safety regulator, the Health and Safety Executive (HSE). 

For senior leaders, the issue is not whether to act – but whether existing systems would withstand regulatory scrutiny. The below analysis considers the legal framework, key standards and emerging expectations based on recent HSE enforcement action, and provides insights and a comparison with some of the international approaches in this area. 

The UK legal framework: a risk-based duty

At the foundation sits the HSWA 1974. This imposes a general duty on employers to ensure, so far as is reasonably practicable, the health, safety and welfare of their employees. 

Crucially, this duty is not limited to physical harm – it also extends to occupational health, and indeed employee mental health and wellbeing from exposure to risks that are foreseeable within the workplace.

Furthermore, the Management of Health and Safety at Work Regulations 1999 require employers to:

• Undertake suitable and sufficient risk assessments of all health and safety hazards 
• Implement preventive and protective measures
• Ensure effective planning, organisation, control, monitoring and review
• Provide employees with health and safety information, instruction and training.

Work-related stress is explicitly recognised within this framework. The obligation is not reactive – it is proactive: organisations must identify any stress risks that are foreseeable and could be caused by their operations, assess them, and implement controls before harm occurs.

The UK’s regulatory model is deliberately goal-setting rather than prescriptive. Employers are expected to determine what is “reasonably practicable” based on the risk of harm, the organisation’s resources and applicable industry standards.

 

The HSE Management Standards: benchmark for compliance

How should employers look to deliver this? Most employers should not be unfamiliar with risk assessment generally, and – where they have more than five employees – risk assessments and workplace policies, procedures and arrangements should be recorded in writing. 

In relation to this area, HSE has developed the Management Standards for work-related stress, which provide the clearest articulation of regulatory expectations and what is best practice in this area.

The standards identify six key risk areas for work-related stress:

• Demands (workload, work patterns, environment)
• Control (autonomy and influence)
• Support (resources and management support)
• Relationships (conflict, bullying, behaviours)
• Role (clarity and expectations)
• Change (how organisational change is managed).

It is therefore expected that employers consider all the above factors when conducting an overarching workplace stress risk assessment. 
While the Management Standards are not law, they can be highly influential.

In practice, they are often considered as a leading benchmark against which effective compliance is assessed.

Failure to consider or align with them could indicate a breach of the underlying legal duties and may give rise to further scrutiny in the event of an HSE investigation into possible failures to reduce the risk of ill health arising from workplace stress. 

Critically, in line with the Management Standards approach, HSE expects organisations to:

• Engage employees in identifying stress risks at work 
• Use data (such as absence, staff turnover and workforce surveys) to inform assessments and identify trends or common themes 
• Develop targeted action plans to reduce and control stress
• Monitor the effectiveness of the adopted stress management controls over time.

The consistent regulatory message is that documentation alone is insufficient – implementation and effectiveness are what matter.

Psychological safety and suicide prevention: expanding expectations

Further to the above, organisations are increasingly expected to consider broader psychological health and safety frameworks, especially if the business follows – or is already accredited to – the ISO (International Organization for Standardization) management standards for quality (9001), environmental compliance (14001) or 27001 (information security).

There is also now ISO 45001, the relevant standard for managing occupational health and safety risks and improving workplace safety. In addition, in June 2021, ISO published ISO 45003, the first internationally recognised standard for psychological health and safety at work. 

Furthermore, a new British Standard, BS 30480 Suicide and the Workplace, was launched in November 2025, providing a framework for organisations to consider and address suicide risk. 

While none of the above standards have been implemented into UK law (meaning they are not a legal requirement), these frameworks and standards do emphasise the importance of approaches like: 

• Leadership behaviours and culture
• Early identification of vulnerability among the workforce
• Trauma-informed responses
• Integration of mental health into enterprise risk management.

For senior leaders, this represents a shift from compliance to organisational maturity. The question is no longer whether such risks are assessed, but whether the organisation’s management systems, work process and culture have been designed from the outset (including at the point of the organisation’s establishment), to prevent such harm. 

Therefore, when startup businesses are established, their founders must ensure they are aware of health and safety risks such as stress, in addition to the more core, day-to-day risks arising from their operations. 

Enforcement is here: UK position in practice – a sea change 

Enforcement activity on management of work-related stress has been slow to materialise from regulators like HSE. One possible reason is the fact that many issues relating to mental health, wellbeing, suicide or stress management are caused by factors outside work.

It is difficult to categorically say whether someone’s mental ill health has been caused (or aggravated) by work factors alone, and there may be other factors at play, perhaps connected to the individual’s personal life, or their general mental health. 

There can also be major differences in individual tolerance levels for stress and pressure – and what individuals may consider a stressor or trigger – and many occupations will have a certain level of stress embedded within the role or certain expectations around work pressure that can affect personal stress levels and individual tolerance to stress. 

However, if employers are aware of individual employees with pre-existing mental health conditions that could be aggravated by stressors at work – or become aware that individuals have concerns about their mental wellbeing in relation to their work – the organisation does have a positive duty to review the impact of work activities on these individuals to ensure they are not exposed to any unnecessary and foreseeable workplace risk that could cause or worsen any mental ill health. 

Also, recent HSE enforcement action on work-related stress demonstrates that we are starting to see a clear shift from mere guidance to regulatory intervention.

There can be major differences in individual tolerance levels for stress and pressure – and what individuals may consider a stressor. Photograph: iStock

University of Birmingham – Notice of Contravention

In December 2025, HSE issued a formal Notice of Contravention to the University of Birmingham following an investigation into work-related stress. HSE found that inadequate risk assessments for work-related stress had resulted in a ‘material breach’ of the Management of Health and Safety at Work Regulations 1999. 

Key findings included:

• A failure to fully implement the organisation’s stress management policy 
• Inadequate and overly generic stress risk assessments
• Ineffective control measures that were also not implemented
• A lack of monitoring and review systems 
• A failure to involve employees in risk assessment processes.

Importantly, the organisation did have policies in place for managing work-related stress. However, the failure which led to enforcement was in relation to poor operational execution – a critical distinction for senior leaders.

East of England Ambulance Service 

Prior to this in April 2025, HSE had also issued a Notice of Contravention on East of England Ambulance Service after an announced visit and staff interviews identified ‘material breaches’ of health and safety legislation in relation to the management of work-related stress. This related to: 

• Regulation 3 – failure to have a suitable and sufficient assessment of risks to the health and safety of employees at work 
• Regulation 4 – failure to implement preventative and protective measures in line with the principles of prevention and the hierarchy of risk control
• Regulation 5 – failure to have adequate arrangements for the effective planning, organisation, control, monitoring and review of the preventative and protective measures, taking into account the nature of the activities and the size of the undertaking. 

The above breaches reflect a broader regulatory focus on high-risk sectors where psychological demands and stress risk are inherent in the workplace and job roles.

As a result, the direction of travel is unmistakable:

• Mental health is a core health and safety risk, not just an HR issue (although the responsibility for managing or navigating these issues may require a joined-up and collaborative approach from HR and occupational safety and health) 
• HSE is moving from awareness to enforcement
• Organisations must demonstrate effective, not theoretical, controls
• Failure to act may lead to enforcement, reputational damage and civil liability.

International comparisons: Australia and Scandinavia

As some of the management standards for work-related stress and employee mental wellbeing mentioned above have international reach, it is worth noting how other countries are approaching the challenge of workplace stress and mental wellbeing. This could be relevant if you operate a global business or have operations in other jurisdictions. 

Australia: explicit psychosocial risk regulation

Australia has taken a more prescriptive and explicit approach to psychosocial risks than the UK. Under Australia’s ‘model Work Health and Safety’ laws: 

• Psychosocial hazards are specifically and explicitly recognised in law (there have been calls for the UK to adopt this approach, to avoid any doubt about whether the UK’s HSWA 1974 requires employers to manage the risk of ill health arising from stress at work)
• Employers must identify, assess and control these risks
• Regulators have issued detailed codes of practice.

This approach creates greater clarity but also higher expectations. In essence, Australian employers cannot rely on general duties alone – they must actively demonstrate compliance with defined psychosocial risk frameworks.

Norway and Sweden: cultural and structural integration

Furthermore, Scandinavian jurisdictions, particularly Norway and Sweden, embed psychosocial risk within broader labour and safety frameworks.

In summary, some of the key features in Norway and Sweden include:

• A strong emphasis on worker participation and consultation
• Legal expectations around work organisation and workload design
• Integration of wellbeing into collective agreements and governance structures.

In Sweden, for example, organisational and social work environment regulations require employers to actively manage workload, working hours and workplace relationships. These systems reflect a preventative, systemic approach, where psychological health is embedded into how work is designed – not treated as a secondary risk.

Across the two jurisdictions, three themes emerge: 

1. Increased recognition: psychological health is a legitimate safety risk
2. Structure: increasingly formalised expectations and frameworks
3. Greater accountability: clear regulatory willingness to enforce.

The UK remains more principles-based, but HSE’s recent enforcement activity suggests it is moving closer to the practical intensity seen internationally.

What this now means for senior leaders

For UK boards and senior management, the implications are significant. This is not simply a compliance exercise; it is a governance issue, with direct implications for:

• Potential legal liability
• Regulatory exposure
• Workforce productivity and retention
• Organisational culture and reputation.

During the course of my legal practice, common failures around ensuring compliance with legal duties on stress management that I witness are often consistent with:

• Over-reliance on generic policies without implementation or regular review 
• Generic or superficial risk assessments
• Lack of ownership and accountability for this issue – people within the business not knowing where responsibility for work-related stress sits within the organisation’s structure and teams
•  Absence of meaningful data and monitoring
• A failure to involve employees in assessing and managing psychosocial risks. 

In short, organisations may often know what to do, but as the recent HSE enforcement examples highlighted above show, may then fail to implement or embed the necessary risk controls effectively.

Conclusions  

In my view, to move from compliance to effective control, senior leaders should focus on five core areas:

1. Risk identification – ensure psychosocial risks are clearly defined and understood across the organisation. 
2. Robust risk assessment – move beyond generic templates. Assess real operational pressures and hotspots. Consider and apply the management standards to the company’s operations.
3. Targeted control measures – design interventions that address root causes, such as workload, resourcing and management capability.
4. Leadership ownership – assign clear accountability at senior level; the stress management policy and controls cannot sit solely within HR. 
5. Monitoring and assurance – use data to track effectiveness, and regularly review and adapt controls.

This five-step approach aligns with HSE’s regulatory expectations and reduces both the legal and operational risks to the business from work-related stress and mental ill health. In short, the critical question for any organisation is: “Can you demonstrate – today – that you are effectively managing the risks associated with work-related stress, mental health and wellbeing in your workplace?”

If you are unsure or the answer is uncertain, it may be that further review or action is required. 

Organisations that act now will not only mitigate legal risk, but build stronger, more resilient and more productive workplaces. The approach taken to managing stress and supporting mental wellbeing can also be a key indicator of a proactive, positive leadership approach and culture. It will also help the organisation to become a more psychologically safe organisation, a more sustainable business, and help the company achieve more in relation to its people, safety and ESG agenda and goals.

Emma Evans is a health and safety partner at Bexley Beaumont law firm. Contact her at:
[email protected] 
T. 07738 007652
bexleybeaumont.com