What compliance is actually required by law for a small business?

A recorded fire risk assessment (all sizes, England and Wales), a general health and safety risk assessment (recorded at five or more employees), a written health and safety policy at five or more, a legionella risk assessment if you control a water system, asbestos management if the building predates 2000, an annual gas check if you are a landlord, an EICR every five years if you let homes, adequate first-aid provision, and training for the risks staff face. Almost everything else is how you evidence those duties, and you have choices about how.

Do you actually need this?

Written by David SmithFounder & Editor, Compliance Buyer

Technical review in progressLegal position checked 15 September 2026Updated 15 September 2026

Seven compliance services small businesses are commonly oversold

The same seven items turn up on quotes, in packages and on renewal letters, described as legal requirements. None of them is. What each actually is, what the law actually asks for, and what to say next time.

Everything below is sold, every day, to small businesses as a legal requirement. Here's the law, and the honest answer, for each.

1. Annual PAT testing of everything

Good practiceWhat's true

You must keep equipment safe. A test record is the cheapest proof. The interval is risk-based, not annual, and most office equipment needs a visual check, not a test.

Say: "Full test this year, visual next year, kitchen and tools annually. What's your minimum charge?"

2. A new fire risk assessment every year

Required by lawWhat's true

You must have one, recorded in full. Review it yourself every year. A professional re-does it every three to five years for ordinary premises, annually where people sleep.

Say: "I'll review it. Book the re-assessment for three years' time, or when something changes."

3. Legionella sampling

Required by lawWhat's true

You must assess the risk and control it. Sampling is for specific situations the assessment identifies. There is no legionella certificate.

Say: "Which finding in the assessment justifies sampling?"

4. All the C3s on the EICR

Optional, often oversoldWhat's true

C1, C2 and FI must be fixed. C3 is a recommendation. A report with only C3s is satisfactory.

Say: "Price the C2 work separately. Which C3s would you fix in your own building?"

5. A "competent person" retainer

Required by lawWhat's true

You must have access to competent health and safety help. For a low-risk business that can be you or a trained manager. A retained consultancy is a choice, not a requirement.

Say: "Which regulation requires an external retainer?" (None does.)

6. Fire extinguisher replacement every five years

Good practiceWhat's true

Annual service. Extended service at five years (ten for CO2). Replacement when the unit fails or when it's cheaper than the extended service. Most last 10 to 20 years.

Say: "Extended service, not replacement. Give me both prices."

7. Training for every employee, every year

Required by lawWhat's true

Train people for the risks they face. Almost no named course is required for everyone. First aid certificates last three years. Refreshers follow the job, not the calendar.

Say: "Which regulation names this course for this role?"

What you shouldn’t be sold

The package. Seven services under one price, one term, one renewal date, so leaving one means leaving all, and you can't see what each costs.
The word "compliant". No supplier can make you compliant. They can deliver a service. Compliance is what you do with it.
Any term longer than a year. Nothing above needs one.

Quick answers

What compliance is actually required by law for a small business?: A recorded fire risk assessment (all sizes, England and Wales), a general health and safety risk assessment (recorded at five or more employees), a written health and safety policy at five or more, a legionella risk assessment if you control a water system, asbestos management if the building predates 2000, an annual gas check if you are a landlord, an EICR every five years if you let homes, adequate first-aid provision, and training for the risks staff face. Almost everything else is how you evidence those duties, and you have choices about how.

This is general information about UK compliance, written for the person paying the bill. It isn’t legal advice. If your situation is unusual, get a professional to look at it.