Part 6 of 8

Law & Compliance

Employer responsibilities, relevant legislation, feasible controls, organisational liability and the importance of documented risk assessment.

Workplace health and safety legislation establishes duties to assess relevant risks and implement appropriate protective measures. Psychological health can form part of these responsibilities. The precise legal requirements vary between jurisdictions, and the availability of a particular support tool does not independently determine whether an organisation has satisfied every legal condition. WMHSA provides a practical assessment resource to assist organisations in examining relevant support arrangements.

Employer Health & Safety Responsibilities

Occupational health and safety management generally involves:

  1. Identifying foreseeable hazards.

  2. Evaluating the risks they create.

  3. Identifying appropriate control measures.

  4. Implementing suitable controls.

  5. Monitoring their effectiveness.

  6. Reviewing arrangements when circumstances change.

These principles apply to relevant psychological risks as well as physical hazards. Appropriate controls may include prevention, organisational changes, training, professional support, emergency procedures and other practical measures.

A key consideration is whether the controls adequately address the relevant risk. An organisation cannot necessarily establish adequate protection merely by showing that a policy exists. Its arrangements must be appropriate to the circumstances.

WMHSA is designed to help organisations examine one part of this responsibility: the practical availability of mental-health support and response.

United Kingdom

The United Kingdom has established legislation covering workplace health and safety.

Health and Safety at Work etc. Act 1974

Section 2(1) establishes a general employer duty to protect employees' health, safety and welfare at work, so far as reasonably practicable. This duty is not limited to visible physical injuries. Relevant work-related psychological risks must also be considered.

Section 3 addresses duties concerning people who are not employees but may be affected by an organisation's undertaking. Its application depends on the relevant circumstances.

Management of Health and Safety at Work Regulations 1999

Regulation 3 requires employers to assess relevant health and safety risks for the purpose of identifying necessary preventive and protective measures. Assessments must be reviewed when there is reason to suspect they are no longer valid or when significant changes occur.

Work-Related Stress

The Health and Safety Executive confirms that employers have a legal duty to assess and act on risks from work-related stress. The HSE's Management Standards address six important areas:

  • Demands
  • Control
  • Support
  • Relationships
  • Role
  • Change

These standards help organisations identify and manage causes of work-related stress.

Reasonably Practicable Controls

The legal concept of reasonable practicability involves weighing the level of risk against the measures required to control it, including the time, trouble and cost involved. It does not mean that every theoretically possible precaution must automatically be implemented.

However, the availability of practical and effective controls can be relevant to determining what an organisation is reasonably expected to do. A control that becomes easier or less expensive to implement may affect that assessment.

Relationship to WMHSA

WMHSA can help identify gaps in the support arrangements considered within an organisation's broader health and safety management. It does not replace the legally required assessment of work-related hazards or the selection of suitable preventive measures.

Official sources:

United States

Workplace health and safety in the United States is governed by federal and state requirements. The federal Occupational Safety and Health Act of 1970 establishes important employer responsibilities.

OSHA General Duty Clause

Section 5(a)(1), commonly known as the General Duty Clause, concerns recognised workplace hazards causing or likely to cause death or serious physical harm.

For a General Duty Clause violation, relevant requirements include the recognition and seriousness of the hazard and the existence of feasible and effective means of abatement.

The clause does not create an unrestricted obligation to eliminate every form of workplace stress or psychological discomfort. Its application depends on the facts and the legal requirements governing the particular hazard.

Workplace Stress

OSHA separately publishes information and guidance concerning workplace stress and mental health. The guidance recognises that workplace stress can affect workers and organisational functioning.

Employers should consider relevant hazards and appropriate measures within the occupational-safety framework applicable to their operations.

Feasible Means of Abatement

OSHA's enforcement guidance recognises the importance of feasible and effective measures for addressing qualifying hazards. The availability of a particular measure may be relevant when considering the means by which a recognised serious hazard can be controlled.

However, the General Duty Clause does not ordinarily require the purchase of a particular named commercial product. The legal question concerns compliance with the applicable duty and whether the hazard is adequately addressed.

Relationship to WMHSA

WMHSA can assist organisations in examining whether relevant support and response arrangements exist. Its findings may inform broader risk-management decisions.

The assessment does not establish, by itself, that an OSHA violation has occurred or that a specific legal remedy is required.

Official sources:

International Frameworks

Workplace psychological health and safety is addressed through a range of international frameworks and national laws.

International Labour Organization

The ILO's Occupational Safety and Health Convention, 1981 (No. 155), establishes an international framework for occupational safety and health.

The ILO also recognises psychosocial hazards and the importance of incorporating them into workplace risk management.

ISO 45003

ISO 45003:2021 provides guidance for managing psychosocial risks within an occupational health and safety management system based on ISO 45001. It addresses the management of risks associated with work organisation, social factors and the working environment.

ISO 45003 is guidance rather than a universal legal requirement. Its status within an organisation or jurisdiction depends on the relevant arrangements and laws.

World Health Organization
The WHO's Guidelines on Mental Health at Work provide recommendations covering organisational interventions, manager and worker training, individual support and return-to-work arrangements.
National Requirements

Individual countries may establish additional duties through occupational health and safety law, employment legislation, healthcare regulation or other applicable frameworks.

Organisations operating internationally should evaluate the requirements relevant to each location.

WMHSA can serve as a practical supplementary resource, but it does not replace jurisdiction-specific compliance assessment.

Feasible Controls & Changing Expectations

Risk management must account for the controls that are reasonably available. New technologies, improved infrastructure and changes in cost can affect what organisations are able to implement.

A support gap that was previously difficult to address may become more manageable when a practical solution becomes available.

For example, an organisation may previously have relied entirely on trained personnel and professional services to provide mental-health assistance. The availability of private self-use stabilisation tools adds another potential measure for situations where a person cannot or does not wish to ask for help.

The introduction of Second Aid in April 2026 is relevant to the three support gaps highlighted in WMHSA items 4, 5 and 8. Because Second Aid is accessed through a printed QR code and web application, it can be deployed without dedicated physical equipment or requiring staff to administer its exercises. This may make it a practical control in suitable settings.

However, the existence of a feasible option is one element of risk management. An organisation must still consider:

  • The foreseeable risk.
  • The potential consequences.
  • The effectiveness of existing controls.
  • The suitability of the proposed measure.
  • Applicable legal duties.
  • Practical implementation and accessibility.
  • Other feasible and effective alternatives.

Where a legal duty requires a risk to be controlled, the availability of a practical solution may strengthen the case for implementing an effective measure.

The assessment should focus on achieving adequate protection.

Organisational Liability

Failure to assess or adequately control relevant workplace risks can create legal consequences. Depending on the jurisdiction and circumstances, these may include:

  • Regulatory investigation.
  • Enforcement notices.
  • Penalties.
  • Civil claims.
  • Compensation liability.
  • Other legal or organisational consequences.

The existence of liability depends on the applicable law and relevant facts. Important considerations may include whether the risk was foreseeable, what duties applied, whether suitable precautions were available and whether the failure contributed to the harm alleged.

WMHSA can assist organisations in identifying support arrangements that require examination. Its findings may also form part of the organisation's documentation of risk-management decisions.

However, an A, P or U classification is not itself a legal determination. The assessment should be treated as a practical resource rather than a substitute for qualified legal advice.

Organisations that fail to address health and safety risks they are legally required to control may face enforcement action or liability for resulting harm.

Documenting Compliance

Documentation helps demonstrate what an organisation has assessed and how it responded to the findings. Useful records may include:

  • Assessment date and scope.
  • Person responsible.
  • Existing controls.
  • Evidence supporting each classification.
  • Identified limitations.
  • Corrective actions.
  • Responsible owners.
  • Implementation dates.
  • Verification of completed actions.
  • Reassessment findings.

Documentation should be proportionate to the risks and organisational requirements.

Sensitive personal information should not be collected unnecessarily. For example, an assessment can record that workers lack access to an appropriate crisis procedure without documenting the private circumstances of individual employees.

Where applicable, organisations should incorporate WMHSA findings into the risk-assessment records and procedures already required by law.

Completing WMHSA does not guarantee legal compliance. It provides structured evidence relevant to one part of workplace mental-health support and response.