On 11 December 2025 the Health and Safety Executive wrote to the Vice-Chancellor of the University of Birmingham. The letter said the university was in material breach of health and safety law over work-related stress. Not over a chemical, or a scaffold, or a machine with a guard missing. Over stress.

I’ve read the letter. Birmingham getting it wrong isn’t the story. The story is how little of the letter is new. Every standard the inspector measured them against has existed for years. Some of them for decades. The knowledge was never the problem.

The rules have been there all along

Employers in Britain have had a legal duty to assess and control the risks to their workers since 1999. HSE says it plainly: the duty to protect people from stress at work is “the same duty you have to protect people from other health and safety risks”. A risk assessment, acted on.

In 2004 HSE published the Management Standards, six areas of work that cause harm when they go wrong: demands, control, support, relationships, role and change. Twenty-two years old this year.

Safety people have used the hierarchy of controls for longer than that. Eliminate the hazard if you can. If you can’t, redesign the work. If you can’t do that, adjust it. Only after all of those do you get to training people to cope with it. With stress, the order is the same. Change the workload before you send anyone on a resilience course.

And in 2021 the International Organization for Standardization published ISO 45003, the first global standard for managing psychological health and safety at work. It maps out the psychosocial hazards, the things about how work is organised that harm people, how to identify them, how to control them, how to check the controls are working.

So by December 2025 an employer wanting to manage work-related stress had a legal duty, a regulator’s method, a decades-old rule about what to fix first, and an international standard. None of it was hidden.

What the inspector actually found

The Birmingham letter is public, and it’s worth reading in full, because the failures are so ordinary.

The university had a stress management policy. It wasn’t being followed. Stress risk assessments were meant to happen at college and school level. They weren’t. The organisational risk assessment was, in the inspector’s word, “too generic” to catch the pressures on academic staff. The university had concluded stress was not a significant issue, using sickness absence, occupational health referrals and use of the employee assistance programme, and had read that data “in isolation” from what staff were reporting locally.

The controls on paper included working-time guidance. The hours people were actually working didn’t match it. They included regular one-to-ones with managers, with no system saying how often or what should be covered. They included stress training for line managers, with nobody tracking who had been on it. There was no route for a manager to report a stressed colleague centrally, so the organisation had no picture of where its risks were. Staff and unions had not been involved in any of it.

It took the union raising workload with management from July 2022, a formal complaint to HSE in April 2024, an inspection across four days in 2025, and 24 focus groups, to get to a letter that says: you have a policy, and you are not doing what it says.

Knowledge was never the gap

Here’s the uncomfortable part. Birmingham had wellbeing support in place. It had an EAP, surveys, a policy, training listed as a control. That list is the problem. Having a policy is not managing a risk. Running a survey is not a risk assessment. Offering counselling after the harm is not prevention.

The frameworks say all of this. HSE’s own standards say it. ISO 45003 says it. The hierarchy of controls has said it since before most of us were working. What Birmingham lacked was not information. It was anyone making them act on it, until a union complaint brought the regulator in.

Compare physical first aid. HSE publishes an eight-page guide on choosing a first aid training provider. It sets minimum contact hours, 18 over three days for the full qualification. It requires trainers to hold a current certificate and an assessing qualification. It gives employers a checklist and expects them to keep a record of it. All this for a broken arm.

For the single biggest cause of lost working days, there is no equivalent. Work-related stress, depression and anxiety accounted for 964,000 workers and 22.1 million lost working days last year. Half of all work-related ill health. And the enforcement record on it, until Birmingham, was close to empty. The law firms writing up the case call it one of the first high-profile enforcement actions on workplace stress in the UK. Twenty-six years after the duty was written down.

I’ve written before about how we count work-related stress and stopped asking why. This is the other half of that. We know the causes. We have known the fixes for decades. What we don’t have is a system that makes anyone apply them.

What I’d want employers to take from it

I train mental health first aiders. I’m not a health and safety lawyer, and I don’t pretend to be one. But I read the Birmingham letter as someone who spends her working life in rooms with people who have been trained to notice distress. Three things for the organisations that send them.

Your first aiders are the last line, not the first. The hierarchy puts them at the bottom for a reason. If your only control for work-related stress is that someone will notice when a colleague breaks, you have the same problem Birmingham had, and you have it whether or not an inspector ever calls.

The question the inspector asked is the one to ask yourself. Not “do we have a policy?” but “is anyone doing what it says, and how would we know?” If workload is the risk, what have you done about the workload? Not the coping, the workload. Resilience training asks the wrong person to adapt, and the hierarchy of controls has said so for decades.

And involve the people who carry the risk. HSE’s list of actions for Birmingham closes with one line that covers all of them: involve and consult your employees, and show how. The people closest to the pressure are the ones who can tell you where it is.

Birmingham’s deadline to complete its plan is 30 September 2026. Whether it does or not, the letter has already done something useful. It has shown that the duty was never advisory. It was law, waiting for someone to enforce it.

The knowledge has been sitting there for more than twenty years. The question was always whether anyone would be made to use it.

Get new posts by email

New posts most weeks. No spam, unsubscribe any time.

Subscribe