What compliance is actually required by law for a small business?

A recorded fire risk assessment (all sizes, England and Wales), a general health and safety risk assessment (recorded at five or more employees), a written health and safety policy at five or more, a legionella risk assessment if you control a water system, asbestos management if the building predates 2000, an annual gas check if you are a landlord, an EICR every five years if you let homes, adequate first-aid provision, and training for the risks staff face. Almost everything else is how you evidence those duties, and you have choices about how.

Do you actually need this?

Optional, often oversold

Seven compliance services small businesses are commonly oversold

The same seven items turn up on quotes, in packages and on renewal letters, described as legal requirements. None of them is. What each actually is, what the law actually asks for, and what to say next time.

Written by David SmithFounder and Editor, Compliance Buyer

Updated 29 October 2026

Everything below is sold to small businesses every day as a legal requirement. Here is the law and the honest answer for each.

1. Annual PAT testing of everything

Good practiceWhat's true

You must keep equipment safe. A test record is the cheapest proof. The interval is risk-based, not annual, and most office equipment needs a visual check, not a test.

Say: "Full test this year, visual next year, kitchen and tools annually. What's your minimum charge?"

2. A new fire risk assessment every year

Required by lawWhat's true

You must have one. In England and Wales it must be recorded in full. Review it yourself every year. A professional re-does it every three to five years for ordinary premises, annually where people sleep.

Say: "I'll review it. Book the re-assessment for three years' time, or when something changes."

3. A legionella certificate

Required by lawWhat's true

You must assess the risk and control it. There is no such thing as a legionella certificate. Water sampling is different. HSE only calls for it in some cases but we think it is worth paying for.

Say: "There is no certificate in law. Please quote for the assessment and water samples instead."

4. All the C3s on the EICR

Optional, often oversoldWhat's true

C1 and C2 must be put right. FI means further investigation is advised. C3 is a recommendation and a report with only C3s is satisfactory. Our advice is to do the C3s where you can. Doing them at the same time as other work often saves money. What is oversold is all the C3s quoted as required work.

Say: "Price the C1 and C2 work separately. Then quote the C3s as recommended work."

5. A "competent person" retainer

Required by lawWhat's true

You must have access to competent health and safety help. For a low-risk business that can be you or a trained manager. A retained consultancy is a choice, not a requirement.

Say: "Which regulation requires an external retainer?" (None does.)

6. Fire extinguisher replacement every five years

Good practiceWhat's true

Annual service. Extended service at five years (ten for CO2). Replacement when the unit fails or when it's cheaper than the extended service. Most last 10 to 20 years.

Say: "Extended service, not replacement. Give me both prices."

7. Training for every employee, every year

Required by lawWhat's true

Train people for the risks they face. Almost no named course is required for everyone. First aid certificates last three years. Refreshers follow the job, not the calendar.

Say: "Which regulation names this course for this role?"

What you shouldn’t be sold

The package. Seven services under one price, one term, one renewal date, so leaving one means leaving all, and you can't see what each costs.
The word "compliant". No supplier can make you compliant. They can deliver a service. Compliance is what you do with it.
Any term longer than a year. Nothing above needs one.

Quick answers

What compliance is actually required by law for a small business?: A recorded fire risk assessment (all sizes, England and Wales), a general health and safety risk assessment (recorded at five or more employees), a written health and safety policy at five or more, a legionella risk assessment if you control a water system, asbestos management if the building predates 2000, an annual gas check if you are a landlord, an EICR every five years if you let homes, adequate first-aid provision, and training for the risks staff face. Almost everything else is how you evidence those duties, and you have choices about how.

General information, written for the person paying the bill. Opinion is labelled as opinion. Not legal advice. See our editorial standards.