Regulation 13 of the Management of Health and Safety at Work Regulations 1999: Training Must Take Place in Working Hours

Most UK workplace health and safety training is bought against a calendar. An annual refresher, booked each year, ticked off each year. The statute that actually creates the training duty says something different, and one of its requirements is quietly breached by the way a great deal of e-learning is deployed.

The Management of Health and Safety at Work Regulations 1999 are the general framework sitting beneath every topic-specific health and safety regime, and regulation 13 is where training lives.

What the Regulations are

They are S.I. 1999 No. 3242, running to 30 regulations and two Schedules — Schedule 1 setting out the general principles of prevention, Schedule 2 consequential amendments. Regulation 28 provides that they have effect as health and safety regulations.

The structure is the management layer rather than the hazard layer:

• Regulation 3 — risk assessment
• Regulation 4 — principles of prevention to be applied
• Regulation 5 — health and safety arrangements
• Regulation 6 — health surveillance
• Regulation 7 — health and safety assistance
• Regulation 8 — procedures for serious and imminent danger and for danger areas
• Regulation 10 — information for employees
• Regulations 11 and 12 — co-operation and co-ordination, and persons working in host employers' undertakings
• Regulation 13 — capabilities and training
• Regulation 14 — employees' duties
• Regulation 15 — temporary workers
• Regulations 16 to 18 — new or expectant mothers
• Regulation 19 — protection of young persons

Regulation 13, in full

It has three paragraphs and they do three different jobs.

13(1) — capabilities. When entrusting tasks to employees, an employer must "take into account their capabilities as regards health and safety". This is a duty about task allocation, not about training.

13(2) — when training is owed. Employees must receive adequate health and safety training in two situations: on their being recruited into the employer's undertaking; and on being exposed to new or increased risks because of a transfer or change in responsibilities, new work equipment or a change to existing equipment, new technology, or a new or changed system of work.

13(3) — how it must be delivered. Training must be repeated periodically where appropriate, be adapted to take account of any new or changed risks, and take place during working hours.

Three things employers get wrong

First: the annual refresher is a convention, not a requirement. The wording is "repeated periodically where appropriate". Annual may well be the right interval, but it is a judgement the employer makes and should be able to justify, not a figure the Regulations set. More importantly, an annual cycle can miss the thing the statute actually cares about. Regulation 13(2) is trigger-based: new equipment, changed responsibilities, new technology, a changed system of work. An employer running a tidy annual programme who introduces new machinery in March and trains nobody until the following January has complied with their calendar and breached the regulation.

Second: training must take place during working hours. Regulation 13(3)(c) says so plainly, and it is the most commonly breached provision in the whole regulation. Issuing e-learning modules with an instruction to complete them "when you get a chance", expecting staff to finish them at home, or rostering no time for them, does not satisfy it. The shift to self-paced online training has made this easier to get wrong, because nothing about an e-learning licence signals that the time has to be found and paid for.

Third: capabilities and training are separate duties. Training someone does not discharge regulation 13(1). If a task still exceeds what an employee can safely do, the answer is to change the task allocation, not to add another module. Records that show completion but no consideration of capability answer only half the regulation.

Regulation 3 is what tells you the training is needed

Regulation 13 is often read on its own, which is why it gets treated as a standalone training rule. It is not. The trigger in 13(2) is exposure to "new or increased risks", and the mechanism that identifies a new or increased risk is the regulation 3 risk assessment.

So the two provisions are coupled. An employer who assesses risk properly will know when new equipment or a changed system of work has altered the picture, and the training obligation follows automatically from that finding. An employer whose risk assessment is a document reviewed once a year will discover the trigger late or not at all — and will usually discover it after an incident, when the assessment is the first thing an inspector asks for.

Regulation 5 completes the loop by requiring arrangements for the effective planning, organisation, control, monitoring and review of preventive and protective measures. Training is one of those measures, so the adequacy of the arrangements is itself inspectable.

Information is not training

Regulation 10 requires employers to provide employees with comprehensible and relevant information on risks and protective measures. Regulation 13 requires training. These are different duties and they are frequently collapsed into one.

Circulating a policy, emailing a safety bulletin or putting a procedure on the intranet discharges regulation 10. None of it is training, and none of it answers regulation 13(2) when someone has just been exposed to a new risk. The distinction matters at the point where an employer is asked to show what it did after a change: a distribution list is evidence of information, not of training.

Regulation 7 is a different duty again

Regulation 7, health and safety assistance, requires the appointment of one or more competent persons to assist in complying with health and safety law. This is routinely conflated with training, and it should not be: it is about securing competent assistance for the organisation, not about equipping individual employees for their own tasks.

An employer can have an excellent training programme and still be in breach of regulation 7, and can have a well-qualified safety adviser and still be in breach of regulation 13.

The duties that catch people who are not your employees

Three regulations extend the obligation beyond the standing workforce, and they are the ones most often missed in shared or contracted settings.

Regulations 11 and 12 deal with co-operation and co-ordination between employers sharing a workplace, and with people working in host employers' undertakings. Regulation 15 covers temporary workers. Regulation 19 covers young persons, and regulations 16 to 18 deal with new or expectant mothers, including risk assessment and notification.

The practical point is that a contractor, an agency worker or a visiting engineer does not fall outside the framework because they are not on the payroll. Our guide to psychosocial risk assessment covers how the same assessment logic extends to risks that are not physical.

How the topic-specific regimes sit on top

The 1999 Regulations are deliberately general. The detailed duties live in the hazard-specific regimes, and each carries its own training expectations: fire safety training requirements, COSHH for hazardous substances, display screen equipment, including for hybrid working, and workplace first aid, where the distinction between the main qualifications matters — see first aid at work versus emergency first aid at work.

Where premises rather than people are the focus, the duties attach differently again, as set out in our guide to the responsible person's fire risk assessment duties.

Our suggestions

Build the training record around triggers, not dates. A log that captures "new work equipment introduced, training delivered, date" evidences regulation 13(2) directly. A log that shows only annual completion evidences a habit.

Check how your e-learning is actually consumed. If completion data clusters outside rostered hours, you have a regulation 13(3)(c) problem regardless of what your policy says, and the data is the evidence against you.

And record the capability judgement separately from the training record. Regulation 13(1) asks what you considered before allocating the task — a question no completion certificate answers.