Lone working law in the UK is not one statute. There is no Lone Workers Act, and the duty comes from two general instruments that never use the phrase. Here is what actually creates the obligation, where the law requires a second person, and the three things landing between now and 2027.
Yes, for most roles. Nothing prohibits working alone in general, and millions of people do it every day without incident.
What the law does is put the risk on the employer to assess and manage before anyone works alone, and there are a handful of specific jobs where a second person is required outright. We cover the question itself in more depth in our guide to whether working alone is legal and safe. This page is about the instruments behind the answer.
Two, and neither mentions lone working anywhere in its text.
The Health and Safety at Work etc. Act 1974. Section 2(1) sets the general duty:
“It shall be the duty of every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all his employees.”
“So far as is reasonably practicable” is doing a lot of work in that sentence. It does not mean you can skip a safety measure because it costs money. The bar is higher than that: a measure can only be left out if the effort of taking it would be grossly disproportionate to the risk it addresses. In our experience that leaves very little room, and the safer reading is to act and to keep a written record of your reasoning wherever you did not. Section 2(2)(c) then extends it to “the provision of such information, instruction, training and supervision as is necessary”. Training and supervision are the two things a lone worker gets least of, and both are named in the Act.
The Management of Health and Safety at Work Regulations 1999. Regulation 3(1) is the one that creates the risk assessment duty, and it has two limbs:
“a suitable and sufficient assessment of the risks to the health and safety of his employees to which they are exposed whilst they are at work” and of “the risks to the health and safety of persons not in his employment arising out of or in connection with the conduct by him of his undertaking”.
That second limb is the one people miss. A support worker visiting somebody’s home engages both at once: your duty to your own employee, and your duty to the person they are visiting. Our guide to lone working risk assessments covers how to build one.
Regulation 3(6) adds a recording threshold. An employer with five or more employees must record the significant findings and identify any group of employees especially at risk. Note that this is about writing it down. An employer with four staff still owes the assessment duty in full; they simply are not required to record it.
Remember, as an employer, you are responsible for the ‘health, safety and welfare at work of all your workers, and this applies to any contractors, volunteers or self-employed people’.
Five kinds of work, and the Health and Safety Executive lists them plainly. Certain high-risk work requires at least one other person, including work:
Outside that list there is no legal prohibition on working alone, only the duty to assess and manage. Plenty of roles that are not on it still warrant a second person once you have done the assessment honestly.
The HSE’s position is short: “As an employer, you must manage any health and safety risks before people can work alone.”
On what that looks like in practice, it says employers should provide “training, supervision, monitoring and support for lone workers”, including “adequate and reliable means of communication and a way to call for help”. Where necessary, that may include “devices designed to raise the alarm in an emergency which can be operated manually or automatically”.
Read that middle phrase carefully, because reliable is the part that gets skipped. A mobile phone in a pocket is a means of communication until the worker cannot reach it, cannot use it discreetly, or has no signal.
Safepoint is built around those three failures. When there is no time to reach for the phone and dial, a one-tap SOS from the lock screen or a tactile SOS button on the lone worker device raises the alarm in a single press. When using the phone openly would make things worse, a discreet silent alarm sends for help with nothing showing on the screen. And when one network has no coverage, the device’s multi-network roaming SIM connects through whichever network does.
The alarms above all need the worker to raise them, and someone in trouble cannot always do that. Two more raise the alarm on their own. Timed task check-ins fire if a worker does not check in by the end of a task, and fall detection, sometimes called man-down, does the same if they collapse or take a hard fall. These are the “operated automatically” half of what the HSE describes.
One more thing worth knowing. The copper phone network is being switched off in January 2027, which matters if any of your alarm equipment still dials out over a landline. We have written separately about the PSTN and 2G switch-offs.
For a complete introduction to lone working, and how you can keep your team safe, look at our free guide to lone working.
On 30 October 2026, employers become responsible for protecting their staff from harassment by third parties. It is the biggest change to this area in over a decade, and it does not come from health and safety law at all.
Section 21 of the Employment Rights Act 2025 inserts a new duty into section 40 of the Equality Act 2010:
“An employer (A) must not permit a third party to harass a person (B) who is an employee of A.”
You only “permit” it if the harassment happened in the course of the employee’s employment and you failed to take all reasonable steps to prevent it. A third party means anyone who is not you and not your own staff, so customers, patients, tenants, contractors and the public all count. Section 20 of the same Act separately raises the existing sexual harassment duty from “reasonable steps” to “all reasonable steps”. The government’s implementation timeline gives 30 October 2026 for both.
For lone workers this is an evidence problem before it is a policy one. “All reasonable steps” gets judged after an incident, and a shift worked alone is exactly where the record runs out. Task history, check-in logs, alert records and how each one was resolved are the kind of material that helps answer it, and Safepoint’s management portal keeps them as a matter of course, categorised against RIDDOR injury standards where relevant. None of that makes an employer compliant on its own. It is the difference between showing your work and remembering it.
This is where most coverage of lone working law goes wrong, so it is worth being precise. Royal Assent and commencement are two different events, and an Act can sit on the statute book for years without any of it being operative.
Section 21 above has not commenced. It is marked “not in force at Royal Assent”, and the first commencement instrument under the Act did not include it. What exists is a published government timetable, not a live duty.
Assaulting a retail worker is not yet a specific offence. Section 45 of the Crime and Policing Act 2026 creates one, and the government’s retail crime factsheet gives the maximum as “six months in prison, and/or an unlimited fine”, with a presumption of a Criminal Behaviour Order on first conviction. The section is marked not in force at Royal Assent and no commencement order has been made. We have seen the maximum reported elsewhere as two years, which it is not.
Martyn’s Law has not commenced either. The Terrorism (Protection of Premises) Act 2025 puts public protection duties on premises above a capacity threshold, with standard duty premises at 200 or more individuals present at the same time and enhanced duty at 800 or more. Government expects it to take effect in spring 2027 without confirming a date, and the Security Industry Authority will be the regulator.
So three instruments, all real, all passed, none of them currently imposing anything. If you are budgeting or writing policy, that distinction is the whole point: plan for the dates, but none of this is a live duty yet.
If you employ anyone who works out of sight or earshot of a colleague, the sequence is the same as it has been since 1999. Assess the risk under regulation 3, record it if you have five or more employees, give people training and a reliable way to call for help, and keep enough of a record that you could show what you did.
What is new is that from 30 October the record has a second job. It is not only evidence that you managed a safety risk, it is evidence of what steps you took to protect people from third parties, and that is judged with hindsight.
The instruments themselves are shorter than most of the commentary about them. Regulation 3 runs to a page, and section 21 to a paragraph. Both are worth reading directly if you are the person who has to answer for this.
Award-winning safety management tools and a fully accredited response team.
