Risk Assessments for GP Surgeries: What UK Law Requires and What CQC Will Check in 2026

A risk assessment for GP surgeries is a legal requirement under the Health and Safety at Work Act 1974, not a clinical nicety. Any practice with five or more employees must document its assessments in writing. Fail to do this and you face simultaneous enforcement from two separate bodies: the Health and Safety Executive and the Care Quality Commission. That is the double jeopardy that catches practice managers off guard.

At least 16 core risk assessments are required to satisfy both HSE law and CQC Fundamental Standards. From March 2026, CQC is reviewing lower-risk practices last inspected between 2017 and 2022, with only 5 working days' notice. One premises failure creates simultaneous legal and regulatory exposure — two enforcement bodies, one breach.

Why Is a Risk Assessment for GP Surgeries a Legal Obligation?

The legal duty sits in two places. Section 2(3) of the Health and Safety at Work Act 1974 requires employers to prepare and keep up to date a written statement of health and safety policy. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to carry out a suitable and sufficient assessment of risks. Practices with five or more employees must record the significant findings in writing. There is no discretion here.

What many practice managers miss is the premises dimension. The clinical team owns patient safety protocols. The practice manager — or the premises owner — owns the physical environment. Risk assessments for the building, the water system, the fire safety equipment, and the workstations are property obligations. When something goes wrong in those areas, the person named as the responsible party for premises management is the one who gets the enforcement notice.

The 16 Core Risk Assessments a GP Surgery Must Have

At least 16 core risk assessments are required to satisfy both HSE law and CQC Fundamental Standards. Five are directly mandated by specific legislation. The remaining eleven are required to demonstrate compliance with CQC's safety and well-led quality statements. Missing any single one creates a documented gap that inspectors will record.

The 5 Statutory Assessments Required by Law

1. General health and safety risk assessment — required under Regulation 3, Management of Health and Safety at Work Regulations 1999. Must cover all significant hazards.
2. Fire risk assessment — required under the Regulatory Reform (Fire Safety) Order 2005. Must be carried out by a competent person and reviewed regularly.
3. COSHH assessment — required under the Control of Substances Hazardous to Health Regulations 2002. Covers cleaning chemicals, clinical waste, sterilisation fluids.
4. Legionella risk assessment — required under the Health and Safety at Work Act 1974 and ACoP L8. Water systems including taps, showers, and stored water must be assessed.
5. Display screen equipment (DSE) assessment — required under the Health and Safety (Display Screen Equipment) Regulations 1992 for any employee who regularly uses a screen.

The 11 Additional CQC-Required Assessments

• Manual handling assessment
• Lone worker assessment
• Violence and aggression risk assessment
• Slips, trips, and falls assessment
• Electrical safety assessment
• Asbestos survey or management plan (where applicable)
• Sharps and clinical waste assessment
• Environmental risk assessment (including ventilation)
• Medical gas assessment (where nitrous oxide or oxygen are stored)
• Infection prevention and control risk assessment
• Business continuity and premises failure assessment

What Does CQC Actually Check When They Inspect?

CQC does not simply ask whether assessments exist. The inspection process looks for three things: that assessments are specific to the premises, that they are current, and that actions identified have actually been completed. Generic downloaded templates are a known weakness that CQC inspectors flag explicitly. A fire risk assessment that names no specific rooms and identifies no specific hazards tells an inspector nothing about the actual practice.

Inspectors will typically ask to see: the date of the most recent assessment for each category; who carried out the assessment and what their competency was; what actions were identified; evidence that those actions were completed; and a review schedule showing when the next assessment is due.

The 2026 Urgency for GP Surgeries

From March 2026, CQC is reviewing lower-risk GP practices — those rated Good or Outstanding — that have not been inspected since between 2017 and 2022. These practices receive five working days' notice. For a practice that has not updated its risk assessments since its last inspection, five working days is not enough time to commission, complete, and document sixteen separate assessments. The legionella assessment alone requires a qualified water hygiene specialist to attend site and produce a written report, a process that typically takes two to four weeks.

The "Double Jeopardy" Risk for GP Premises

A single risk assessment failure in a GP surgery creates exposure to two separate enforcement bodies at the same time. The Health and Safety Executive enforces HASAWA 1974 and can issue improvement notices, prohibition notices, and in serious cases pursue prosecution. Fines for health and safety breaches in the UK have no upper limit for Crown Court cases. The Care Quality Commission enforces the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. A breach can result in conditions on registration, suspension, or cancellation of registration.

These two enforcement regimes are entirely separate. CQC does not replace HSE. A practice can receive enforcement action from both bodies for the same underlying failure. Practice managers who treat risk assessments as a CQC tick-box exercise, rather than a genuine legal obligation, are misunderstanding the risk profile. Both regulators have teeth. Both are active in 2026.