Early years safeguarding policy

The rule: EYFS paragraphs 3.5 and 3.6

The duty to have an early years safeguarding policy is in paragraph 3.5 of the EYFS statutory framework for group and school-based providers, dated 13 July 2026 and in force from 1 September 2026: “Providers must have and implement policies and procedures to keep children safe and meet EYFS requirements. Schools are not required to have separate policies to cover EYFS requirements provided the requirements are already met through an existing policy. Where providers are required to have policies and procedures as specified below, these policies and procedures should be recorded in writing. Policies and procedures should be in line with the guidance and procedures of the relevant Local Safeguarding Partners.”

Paragraph 3.6 then says what the safeguarding policy must contain: “Safeguarding policies must include: The action to be taken when there are safeguarding concerns about a child. The action to be taken in the event of an allegation being made against a member of staff. How mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting. Procedures to follow to check the suitability of new recruits. Detail of how safeguarding training is delivered and how practitioners are supported to put this into practice.”

Three things about the strength of those words matter when you write or review the policy:

• “Must” is law. Section 40 of the Childcare Act 2006 requires early years providers to comply with the welfare requirements, and regulation 3(2) and (2A) of the Early Years Foundation Stage (Welfare Requirements) Regulations 2012 make the section 3 sentences that say “must” welfare requirements. A few are excluded from that because the regulations set them directly: the duties to notify Ofsted of allegations, significant events and changes (3.10, 3.23 and 3.105) are imposed by regulation 8 and its Schedule. Working together to safeguard children 2026 restates the point at paragraph 271: early years providers “must ensure that … they implement policies and procedures to safeguard children.”
• “Should” is not optional either. Regulation 3(3) requires providers to “have regard to” the rest, and the framework says a “should” means providers “must take the guidance into account when delivering the requirements and should follow it, unless there is a good reason not to.” Writing the policy down is a “should”; in a group setting there is rarely a good reason not to, because 3.100 requires copies for parents on request and Ofsted may ask to see it.
• Your local procedures come first in practice. 3.5 ties the policy to the Local Safeguarding Partners – the local authority, the integrated care board and the police for your area – so the referral routes, contact numbers and thresholds in your policy should be theirs, not a template's from another county.

The framework applies in England only. Schools with nursery or reception classes can meet it through their existing child protection policy, provided that policy already covers the EYFS requirements (3.5), and 3.9 says all schools must have regard to Keeping children safe in education (the 2026 edition applies from 1 September 2026). Childminders follow their own framework, under which some need not write their policies down; see childminder policies rather than adapting a nursery policy.

What an early years safeguarding policy must include

Take the five items in 3.6 as the spine of the policy, and for each one write what a member of staff actually does, in the order they will need it:

1. A concern about a child. Who staff tell (the designated safeguarding lead, and who deputises when the DSL is absent), how they record what they saw or heard, and who refers. Paragraph 3.9 sets the clock: providers “must immediately notify their local authority children's social care team, in line with local reporting procedures, and, in emergencies, the police”, and must take into account the government's statutory guidance Working together to safeguard children and the Prevent duty guidance – the Counter-Terrorism and Security Act 2015 duty “to have due regard to the need to prevent people from being drawn into terrorism”. Name the local children's social care referral line and its out-of-hours number. What a record of concern contains is covered in early years safeguarding records.
2. An allegation against a member of staff. Working together to safeguard children 2026 says at paragraph 264 that any allegation “should be reported immediately to a senior manager within the organisation or agency” and that the local authority designated officer (LADO) “should also be informed within one working day”. Paragraph 3.10 of the EYFS adds a legal duty: registered providers must tell Ofsted (or, for childcare on domestic premises registered with a childminder agency, that agency) of “any allegations of harm or abuse by anyone living, working, or looking after children at the premises”, whether on the premises or elsewhere, and of the action taken, “as soon as is reasonably practicable, but in any event within 14 days of the allegations being made”. Failing to do so without reasonable excuse is an offence. “Harm” takes its meaning from section 31(9) of the Children Act 1989. The policy should also say who refers to the Disclosure and Barring Service when someone is dismissed, or would have been, because they harmed a child or put a child at risk of harm (3.19). Name who handles an allegation against the manager or the owner.
3. Mobile phones, cameras and other devices. 3.6 asks how “mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting”, and adds that providers “may find it helpful to read” the UK Council for Internet Safety's online safety considerations for early years managers, which lists “Safe and appropriate use of personal devices, wearable technology, mobile phones and cameras”. Say where personal phones and smartwatches are kept, which devices may take photographs, where images are stored and who may share them. Photo consent and social media are in social media policy for a nursery.
4. Checking the suitability of new recruits. Group and school-based providers must obtain an enhanced criminal records check and barred list check for every person aged 16 and over, including volunteers, who works directly with children or lives or works on the premises (unless they have no access to, or do not work in, the childcare area when children are there) (3.15), and must not let anyone begin working or volunteering until that check has been received (3.17). There are two carve-outs: supervised volunteers who only help out occasionally (footnotes 20 and 23), and childcare on domestic premises, where Ofsted or the childminder agency does the checks (3.14). At least one written reference is a must for every member of staff, including students and volunteers (3.20); the ten checks on references that follow are “should”. The provider must record the checks, including the criminal records check reference number, the date and who obtained it (3.18), and an additional check “should” be made for anyone who has lived or worked abroad (3.16). See Ofsted DBS checks.
5. Training, and support to use it. All practitioners must be trained to the criteria in Annex C (3.31), and Annex C paragraph 2 sets what that training must cover, from “The main categories of abuse, harm and neglect” and “How to identify signs of possible abuse, harm and neglect at the earliest opportunity” to “The setting's safeguarding policy and procedures” – so the policy is itself training content. Training must be renewed every two years (3.33); an annual refresher is something providers “may consider”, not a requirement. Say how new starters are inducted on the policy, how the DSL supports staff, and when training is renewed.

What else belongs in a nursery safeguarding policy

Other paragraphs of section 3 do not say “safeguarding policy”, but staff look for them in the same place, and most local templates include them:

• The designated safeguarding lead. 3.4 requires a practitioner in every setting to be designated “to take lead responsibility for safeguarding children”, responsible for liaison with local children's services and the Local Safeguarding Partners, and 3.32 requires the DSL to “provide support, advice and guidance to all practitioners on an ongoing basis”. Name the DSL and the deputy. Annex C paragraph 3 says the DSL's training must cover “How to develop and implement safeguarding policies and procedures” and “How to manage and monitor allegations of abuse against other staff”. More in designated safeguarding lead.
• Whistleblowing. 3.7 requires procedures for all staff, including students and volunteers, to raise concerns about poor or unsafe practice, including “when and how to report concerns and the process that will be followed after staff report concerns”. 3.8 points to the NSPCC whistleblowing advice line (0800 0280285) and Ofsted's complaints procedure for staff who feel unable to raise an issue with their employer. See whistleblowing policy.
• Child absence. 3.11 requires follow-up of absences “in a timely manner” and contact with parents and emergency contacts when a child is absent without notice or for a prolonged period, and 3.12 requires an attendance policy shared with parents. Many settings cross-refer the two policies so the safeguarding route is clear when a child does not arrive.
• Disqualification and significant events. 3.22 says a disqualified person must not be employed in connection with early years provision, and 3.23 requires providers to notify Ofsted of “any significant event which is likely to affect the suitability of any person who is in regular contact with children”. See childcare disqualification and notifying Ofsted.

A policy that tries to hold every procedure becomes too long to use. A common shape is a short policy that names the people, the routes and the timescales, with the recording forms, the allegations procedure and the phones procedure as appendices that cite the paragraph they meet.

Making the policy work: staff, parents and Ofsted

Paragraph 3.31 is the test a policy is judged by: providers “must ensure that practitioners are supported and confident to implement the setting's safeguarding policy and procedures on an ongoing basis”. A policy that only the manager has read does not meet it. Walk new starters, students and regular volunteers through the concern and allegation routes on their first day, keep the local contact numbers where staff can see them, and check understanding at supervision and staff meetings.

Parents are entitled to see it. 3.100 requires providers to share “Details of the provider's policies and procedures – making copies available on request”, and the UKCIS guidance suggests policies be easily accessible to staff and parents, “for example, published on the setting's website”. The same guidance expects policies to be reviewed and approved by “the management team/committee or equivalent”, which for a committee-run pre-school means the committee.

On inspection, Ofsted's early years inspection information for use from September 2026 says “inspectors may need to see the policies required by the EYFS”, along with other information such as “referrals made to the local authority designated officer for safeguarding, and their resolution”. In our view, the stronger evidence on the day is staff who can explain the concern and allegation routes without looking them up.

The EYFS sets no review cycle for safeguarding policies; the two-year rule in 3.33 is for training. Set your own cycle, check whether your Local Safeguarding Partners expect one, and review the policy whenever the framework changes, after a safeguarding incident or a local partnership update, and when the DSL changes. Date each version, record who approved it, and keep the previous version so you can show what applied at the time of an incident.

The 2026 wording check: what to change in an older policy

The Department for Education's summary of changes to the EYFS framework lists what took effect on 1 September 2026. Compare your policy against each:

• “Harm”, not “serious harm”. In the summary's words, providers must now inform Ofsted or their childminder agency “of allegations of ‘harm’ (instead of ‘serious harm’)”; 3.10 now reads “allegations of harm or abuse”. Search the policy and the allegations procedure for the old phrase.
• Volunteers. The summary says the enhanced criminal records check now covers volunteers “including those who are supervised”; 3.15 requires the enhanced criminal records and barred list check for “every person aged 16 and over including all volunteers” in scope. Footnote 20 keeps one exception: “supervised volunteers who only help out occasionally, such as parents or carers helping out on a trip (but not overnight or if providing personal care)”. Footnote 23 applies the same exception to the rule that nobody begins working or volunteering before their check arrives (3.17).
• What staff must disclose. Providers must tell staff and prospective staff to disclose information that may affect their suitability, “including, but not limited to, arrests, charges, convictions, cautions, court orders, reprimands and warnings (whether received before or during their employment at the setting)” (3.17).
• Childcare on domestic premises. Ofsted or the childminder agency, not the provider, still completes the checks on people looking after children, living or working there (3.14), and group providers on domestic premises must now notify Ofsted or their agency of “Any change to the persons aged 16 years or older living or working on any domestic premises from which childcare is provided” (3.105 and 3.107).

The volunteer change follows the law. Section 139 of the Crime and Policing Act 2026 removed the supervision exemption from regulated activity with children in Schedule 4 to the Safeguarding Vulnerable Groups Act 2006 from 1 September 2026, and section 140 made the same change in Northern Ireland; Scotland is outside both. Teaching, training, instructing, caring for or supervising children frequently, on more than 3 days in any 30, or overnight between 2am and 6am with the chance of face-to-face contact, is now regulated activity even when someone else supervises it. The Disclosure and Barring Service puts it this way: such a person “will be in regulated activity with children even if someone else supervises them.”

Two official statements about checks need reading together. The DBS says: “The legislation does not create a new requirement for organisations to carry out DBS checks, nor does DBS mandate that checks must be obtained.” The Department for Education's guidance on regulated activity, which covers schools and childcare, says: “From 1 September 2026, volunteers engaging in regulated activity will need to have an enhanced DBS check with children's barred list information.” For a nursery or pre-school there is no gap between them: the requirement to check comes from EYFS 3.15 and 3.17, and the policy should say so. For the rest of the 2026 changes – safer sleep, screen use and banned dog breeds – see EYFS safeguarding and welfare requirements.

The phones clause, and where a concern is first mentioned

Read most nursery safeguarding policies at the phones clause and you find cameras: personal phones in lockers, photographs only on setting devices, nothing shared without consent. That answers the imaging half of 3.6. It rarely says how the same devices are used to message about children – although the UKCIS guidance lists among what policies should cover “Expectations regarding professional boundaries/behaviour of staff, including communication via social media”.

In practice, the first mention of a concern is often a message. A practitioner messages the room leader from the bus home because something a child said during lunch is still bothering her. A parent texts the manager's own number about a member of staff. The deputy and the manager agree by text, late in the evening, whether the morning starts with a call to the LADO. Paragraph 3.10's fourteen days run from “the allegations being made”; when the allegation was made in a message on a personal phone, the setting may not be able to show when its clock started, or what exactly it was told.

ComplyChat is designed to give those conversations a home the setting controls. Staff, and parents added by their mobile number, talk in channels the setting runs; a mobile number verified by SMS is the identity, so a parent or a bank practitioner does not need an account on the setting's systems; and everyone added is told the channel is on the record and can object or leave. On paid plans, once the setting's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription. ComplyChat is not a safeguarding case management system or a nursery management system: it does not hold the record of concern, it does not make the referral, and a message is never a substitute for ringing children's social care or the police when the policy says to. Those stay where your policy puts them.

A question for the next managers' or committee meeting: when an allegation was last made against someone at the setting, how was it first made, and could you show Ofsted the first thing you were told?

Questions people ask

What is a safeguarding policy in the early years?

An early years safeguarding policy is the setting's statement of how it keeps children safe. The EYFS requires every group and school-based provider in England to have and implement one, says it should be recorded in writing and follow the Local Safeguarding Partners' procedures (3.5), and lists five things it must include (3.6).

What does EYFS say about safeguarding?

The EYFS says providers “must take all necessary steps to keep children safe and well” (3.3), must designate a practitioner to lead on safeguarding (3.4), must have safeguarding policies covering five set matters (3.6), and must immediately notify children's social care of concerns about a child (3.9). Section 3 also covers allegations, suitability checks, training, absence and whistleblowing.

What must an early years safeguarding policy include?

Under EYFS paragraph 3.6, it must include the action to take on a safeguarding concern about a child, the action on an allegation against a member of staff, how mobile phones, cameras and other imaging and sharing devices are used, procedures to check the suitability of new recruits, and how safeguarding training is delivered and practitioners supported to put it into practice.

How do I write a safeguarding policy?

Start from your Local Safeguarding Partners' procedures, which the EYFS says policies should follow (3.5), then cover the five 3.6 items and the related duties – the DSL, whistleblowing, notifying Ofsted, absence and recruitment – in the order staff will use them. The DSL's training must cover “How to develop and implement safeguarding policies and procedures” (Annex C), so the DSL is well placed to draft it, with the manager, owner or committee approving it.

Is there an early years safeguarding policy template?

The EYFS framework contains no template. Because 3.5 says policies should be in line with your Local Safeguarding Partners' guidance and procedures, start from your own partnership's model where it publishes one, and check it against 3.6 and the September 2026 changes before adopting it.

What are the key changes in safeguarding policy for 2026?

From 1 September 2026 an early years safeguarding policy should reflect notifying Ofsted of allegations of “harm” rather than “serious harm”, enhanced criminal records and barred list checks for volunteers including supervised ones (except those who only help occasionally) with no start before the check, and a wider list of what staff must disclose. Group settings on domestic premises must also notify Ofsted of changes to people aged 16 or over living or working there. The other 2026 changes are in EYFS safeguarding and welfare requirements.

Official guidance and your next step

The primary sources are the EYFS statutory frameworks (paragraphs 3.3 to 3.33, 3.100, 3.105 and Annex C of the group and school-based framework), the Welfare Requirements Regulations 2012, Working together to safeguard children 2026, the Department for Education's summary of the 2026 changes and guidance on regulated activity, Ofsted's early years inspection information and the UKCIS online safety considerations for early years managers. Schools should also read Keeping children safe in education 2026. Quotations are from those pages as published on 30 October 2026.

This guide covers group and school-based providers in England and is not legal advice. Wales, Scotland and Northern Ireland set their own standards, and your Local Safeguarding Partners' procedures are the ones your policy must follow.

Then do one thing: open your safeguarding policy, search it for “serious harm” and “supervised volunteer”, and check that each of the five items in 3.6 has a named person and a timescale. Anything missing is the next draft.