Health and safety | UK Regulatory Outlook April 2026

Occupational health and safety 

HSE increases cost recovery rates from 1 April 2026 

The Health and Safety Executive has increased its hourly rates across a number of cost recovery regimes with effect from 1 April 2026, following a review designed to ensure full cost recovery for its enforcement and regulatory activities. 

The most widely applicable change is to the Fee for Intervention (FFI) rate, which rises from £183 to £188 per hour. Other revised rates include: 

• Control of Major Accident Hazards (COMAH): £212 to £218;
• offshore safety: £322 to £332;
• gas safety: £173 to £178;
• oil, gas and chemical pipelines: £173 to £178;
• onshore oil, gas and geothermal operations: £204 to £210;
• wind and marine energy: £246 to £253;
• explosives regulation: £145 to £149;
• ionising radiation consents: £227 to £234; and
• carriage of dangerous goods: £75 to £77. 

The new rates do not apply retrospectively to interventions that span the 1 April 2026 implementation date. Businesses and duty holders in sectors subject to FFI or other cost recovery regimes should review their exposure to regulatory intervention costs in light of the revised rates. 

HSE consults on first major overhaul of RIDDOR in over a decade 

The Health and Safety Executive has launched a consultation on proposed changes to the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR), open for responses until 30 June 2026. This is the most significant review of the regime since 2013 and reflects how substantially working practices and workplace risks have evolved in the intervening period. 

The legislative proposals include expanding the list of reportable occupational diseases from six to 19, with new conditions covering lung disease linked to asbestos and silica exposure, noise-induced hearing loss and emerging risks from modern workplaces.  

The HSE is also proposing to widen who can formally diagnose a reportable condition to include registered health practitioners beyond GMC-registered doctors, to update the list of reportable dangerous occurrences to reflect modern industry risks, and to clarify key definitions where ambiguity has contributed to both over- and under-reporting. The online reporting form is also proposed to be simplified to reduce administrative burden. 

Employers, the self-employed and those in control of work premises should consider reviewing the proposals and whether to respond before the 30 June 2026 deadline. Any legislative changes are unlikely to take effect before 2028. 

SIA consults on how it will regulate Martyn's Law ahead of spring 2027 commencement 

The Security Industry Authority has opened a consultation on its draft section 12 statutory guidance, setting out how it intends to regulate compliance with the Terrorism (Protection of Premises) Act 2025. The consultation closes on 12 June 2026. 

Martyn's Law introduces obligations on those responsible for certain publicly accessible premises and events to put in place measures to protect people in the event of a terrorist attack, with enhanced duties for larger venues.  

The SIA's draft guidance has been published alongside the Home Office's final section 27 statutory guidance, which sets out what responsible persons must do to comply with the Act. Together, the two documents give responsible persons a clearer picture of both what compliance requires and how the regulator intends to oversee and enforce it, including through fines of up to £18 million or 5% of worldwide turnover, whichever is higher. 

The SIA will finalise its guidance following the consultation and publish details of its notification system ahead of the spring 2027 commencement date. 

Building safety 

New building safety regime takes shape in Wales 

Wales is forging its own distinct approach to building safety reform, and Osborne Clarke has published two Insights covering the changes.  

The first looks at the new design and construction stage obligations, including a dutyholder regime applying to all buildings subject to building regulations, a Gateway hard stop regime and Golden Thread requirements for higher-risk buildings, all enforced by local authorities from 1 July 2026.  

The second covers the Building Safety (Wales) Bill's new in-occupation regime, which goes further than its English equivalent by applying to all multi-occupied residential buildings regardless of height, introducing a three-tier category system, duties on Accountable Persons, and Welsh equivalents of remediation orders. 

Single construction regulator: where things stand 

The government is proposing a single construction regulator (SCR) to consolidate oversight across three pillars: buildings and building safety, construction products, and built-environment professions. The SCR implements the Grenfell Tower Inquiry Phase 2 recommendation that fragmentation in the regulatory system be addressed. The SCR consultation prospectus closed on 20 March 2026, with the government's response expected in summer 2026. 

On construction products, the Construction Products Reform white paper sets out how the national regulator for construction products will take on significantly expanded enforcement and oversight responsibilities, including improved transparency through a public test-data library with a separate consultation on general safety requirements for construction products also open. Both close on 20 May 2026, with regulations expected to be introduced by the end of 2026 and to come into force in late 2027.  

On built-environment professions, a call for evidence is expected in spring 2026, covering proposals such as licensing of principal contractors for higher-risk buildings and mandatory accreditation of fire risk assessors, with a professions strategy to follow in spring 2027. 

An independent review of the building safety regulatory regime is also due to be commissioned by April 2027, with legislation to formally establish the SCR expected in spring 2027 and the new system anticipated to come into effect in 2028.  

Online safety 

New regulations require user-to-user services to report child sexual abuse content to the NCA 

The Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026, made under the Online Safety Act 2023, came into force on 7 April 2026. They require providers of regulated user-to-user services to report child sexual exploitation and abuse (CSEA) content detected on their services to the National Crime Agency (NCA) via its dedicated industry reporting portal. 

The duty applies regardless of service size or assessed risk level. UK-based providers must report all detected and unreported CSEA content; providers based outside the UK must report UK-linked content. Content is "unreported" for these purposes only where it has not already been submitted to an equivalent foreign body such as NCMEC.  

Services already reporting all relevant content to NCMEC will not need to duplicate those reports to the NCA, as NCMEC passes UK-linked referrals to the NCA directly. The regulations set out the required report format, timeframes and data retention obligations. Ofcom is responsible for enforcement and may impose penalties of up to 10% of qualifying worldwide revenue or £18 million, whichever is greater, for non-compliance. 

Providers of user-to-user services should confirm whether they are in scope, register for the NCA reporting portal and review their content moderation and detection processes to ensure compliance. 

Ofcom consults on amending illegal harms regulatory documents under the Online Safety Act 

See digital regulation section.