When the Safety Provider Is Prosecuted: Article 32(10) Explained
HSE has served its first prohibition notice on an occupational health provider, stopping the company an employer hired to keep workers safe. In fire, prosecuting the assessor rather than only the building owner has been possible since 2005, and has been happening for a decade.
INFIRISK Team·10 min read·
Carlesmari, CC BY 3.0, via Wikimedia Commons
On 3 July 2026 the Health and Safety Executive did something it had never done before. It served a prohibition notice on an occupational health service provider, stopping the provider from carrying out health surveillance because the surveillance itself was creating a risk.
Not on an employer. On the company the employer had hired to keep its workers safe.
There is no fire in this story. But there is a pattern in it that fire safety professionals should recognise immediately, because the same thing has been happening in fire enforcement for a decade and most responsible persons still do not know it.
What HSE actually did
The regulator's own account is short and specific. Inspectors found the provider was delivering health surveillance through personnel who were inadequately trained, unqualified and unsupervised. Because the surveillance was ineffective, early signs of serious occupational disease, including occupational asthma, dermatitis and noise induced hearing loss, were at risk of going undetected. Workers were left exposed to wood dust and noise without appropriate intervention.
A prohibition notice was issued to stop the activity on the grounds that it created a risk of serious personal injury. HSE then served an improvement notice after finding the provider's arrangements were fundamentally unsuitable, identifying a lack of competent occupational health oversight, inadequate clinical governance, no quality assurance processes, and no clear procedures for escalating adverse findings or reviewing workplace controls.
HSE Occupational Health Inspector Julie Wood said: "This is the first time HSE has taken enforcement action of this kind against an occupational health service provider, and we have not done so lightly."
She went on to make the point that carries across into fire. "Health surveillance exists to protect workers from work-related health conditions that can cause permanent, life-changing harm. When it is carried out poorly, employers are given false assurance and workers are left unknowingly at risk."
False assurance. That is the whole problem with a bad assessment of any kind. A missing control is a gap. A bad report about a missing control is a gap plus a document telling you there isn't one.
The provider has not been named, and there is a reason
HSE's release does not identify the company. That is not evasion. The release states that to account for the appeals process and internal quality assurance, enforcement notices are published five weeks after they are served.
This is worth holding onto, because the same mechanic operates in fire and it causes a lot of confused commentary. Fire and rescue authorities publish enforcement registers, but entries appear only after the statutory appeal period has run, and notices under appeal are withheld. If you search a register today and find nothing, you have learned that nothing is currently published. You have not learned that nothing was served.
If you commission occupational health or fire safety services, the practical step is to check the relevant public register periodically rather than once at procurement, and to ask a prospective provider directly whether they have ever been served with a notice. The second question is more useful than the first, because it is on them to answer honestly and a false answer is its own problem.
The fire equivalent has been law since 2005
The Regulatory Reform (Fire Safety) Order 2005 contains a provision that most responsible persons have never read and most assessors would rather not think about.
Article 32(10) reads: "Where the commission by any person of an offence under this Order, is due to the act or default of some other person, that other person is guilty of the offence, and a person may be charged with and convicted of the offence by virtue of this paragraph whether or not proceedings are taken against the first-mentioned person."
Read the last clause again. The assessor can be convicted whether or not the building owner is prosecuted at all.
Sitting immediately after it, article 32(11) closes the other side of the door. Nothing in the Order operates so as to afford an employer a defence in criminal proceedings by reason of any act or default of an employee, or of a person nominated under article 13(3)(b) or 15(1)(b), or appointed under article 18(1).
Put the two together and the position is unforgiving in both directions. Hiring a consultant does not move your liability. Being hired as a consultant does not shelter you behind your client.
Two cases that show how this works
Cranleigh House, Southampton. At Southampton Crown Court on 1 June 2021, company director Charles Morgan pleaded guilty to providing a fire risk assessment that was not suitable or sufficient. His company, UK Fire Consulting Ltd, was fined £20,000 with costs of £19,952 for the same offence. Morgan personally received a £2,750 fine, a three month prison sentence suspended for 18 months, and the same £19,952 costs order.
Prosecuting for Hampshire and Isle of Wight Fire and Rescue Service, Klentiana Mahmataj told the court that Morgan had not lifted ceiling tiles or even opened riser cupboard doors to check for fire safety risks at the three storey block of fully occupied flats. A fire safety inspector visiting the block found electrical wiring penetrating the compartment walls with no apparent fire stopping, meaning smoke or fire could travel into the communal escape routes. In a building operating a stay put policy, that is the failure that matters most.
His Honour Judge Burrell QC said: "The job of a fire risk assessor is a highly responsible one. Lives are in their hands and their judgement is crucial. It is not a job to be taken lightly." He added: "It is important to hold risk assessors to account and these are serious breaches. I find it odd that there exists no regulatory framework in regard to Fire Risk Assessors."
The managing agent did not escape. Denfords Property Management had already pleaded guilty at magistrates' court to failing to comply with an enforcement notice to provide a suitable fire risk assessment, and was fined £10,000 with £6,000 costs. The individual manager responsible for the premises received a conditional discharge and a £1,800 costs order.
The service's own summary of the case is the clearest statement of the principle you will find on a fire authority website. The Fire Safety Order places the onus on the responsible person to comply. However, in this case, the managing agents had placed their trust in the professionalism and competency of the consultancy to complete the assessment to a satisfactory standard. Both were convicted.
Tower Chambers, Hartlepool. This one went further, because the whole outsourcing chain ended up in the dock.
A fire broke out in a flat in the early hours of 2 February 2021. Seventeen people were evacuated and five were rescued by Cleveland Fire Brigade, two of them by ladder. Asset Property Management North East Ltd had contracted Total Safety Events Ltd to complete the fire risk assessment on its behalf, and Total Safety Events had subcontracted the work to Mr Justin Morgan.
At Teesside Crown Court, following convictions on 11 September 2023, sentencing took place on 26 October 2023. Asset Property Management was fined £25,000 for four offences, including failing to provide adequate general fire precautions, failing to make a suitable and sufficient fire risk assessment, failing to provide adequate fire doors to protect the escape route, and failing to maintain the fire detection and warning system. Total Safety Events Ltd was fined £10,000 for failing to make a suitable and sufficient fire risk assessment. Justin Morgan received a six month custodial sentence suspended for 18 months with 120 hours of unpaid work, having pleaded guilty to failing to make a suitable and sufficient assessment and to failing to cooperate and coordinate his activities with other responsible persons. Costs of £29,782.91 were awarded to the fire authority.
Client, contractor and subcontractor. Three layers of paperwork between the building and the person who actually walked it, and every layer convicted.
Ian Hayton, Chief Fire Officer at Cleveland Fire Brigade, said: "Where individuals responsible for building fire safety completely disregard their duty and place people at risk, Cleveland Fire Authority will not hesitate to use all of its powers and prosecute offenders where necessary."
A note on precision, because trade coverage often gets this wrong. Neither fire authority states which article was used to charge the external professionals, and it would be wrong to assert that either case was brought specifically under article 32(10). What the cases show is the outcome the Order permits, which is the point that matters commercially.
Judge Burrell's complaint is still unanswered
Five years on from that remark about there being no regulatory framework for fire risk assessors, the position has moved but has not arrived.
Section 156 of the Building Safety Act 2022 introduced a requirement that a person appointed to make or review a fire risk assessment must be competent. Government guidance is explicit that this requirement will be brought into force at a later date. It is not in force today. There is still no licence, no mandatory qualification and no statutory approved provider list.
The Ministry of Housing, Communities and Local Government consulted on regulating the fire risk assessor profession between 26 March and 18 June 2026, covering the powers needed to regulate it and how competency requirements might be implemented in England. The consultation has closed. The response has not yet been published.
So the current state is that an assessor needs no formal permission to trade and can be sent to prison for the work. That is an odd place for a profession to sit, and it is exactly the gap the HSE notice illustrates from the occupational health side.
What to do about it this week
If you commission assessments:
Ask what the assessor actually looked at, not just what they concluded. The Southampton case turned on ceiling tiles and riser doors that were never opened. That is checkable from a report.
Ask whether the work will be subcontracted, and to whom. The Hartlepool chain had two companies between the client and the person on site.
Keep the assessment under review yourself. Article 32(11) means you own the outcome regardless.
Check the enforcing authority's public register before appointment, and remember it lags by weeks.
If you sell assessments:
Your professional indemnity insurer is not the relevant risk. A suspended custodial sentence is not an insurable event.
Declining work outside your competence is protective. When South Yorkshire Fire and Rescue prosecuted an assessor at Sheffield Magistrates' Court in August 2019, the judge summed up by saying that competence is knowing when you yourself are not able to do something, and that risk assessors should recognise the limits of their experience and expertise.
Document your inspection method and your access limitations. An assessment that records what you could not reach is defensible. One that quietly omits it is not.
The HSE notice is a first in occupational health. In fire, it stopped being a first a long time ago.
