EYFS safeguarding and welfare requirements

The rule: section 3 and the regulations behind it

Section 3 of the EYFS statutory framework sets out the safeguarding and welfare requirements providers must meet, and starts from the premise that “children learn best when they are healthy, safe, secure, when their individual needs are met, and when they have positive relationships with the people caring for them” (3.1). Paragraph 3.3 of the framework for group and school-based providers says: “Providers must take all necessary steps to keep children safe and well. The requirements in this section explain what early years providers must do to: Safeguard children. Ensure the people who have contact with children are suitable. Promote good health. Support and understand behaviour. Maintain records, policies, and procedures.” Both frameworks are published by the Department for Education; the childminder framework has its own section 3 with the same structure and some different paragraph numbers.

The legal force comes from the Childcare Act 2006: section 39(1)(b) lets the Secretary of State make “welfare requirements” by regulations, and section 40 of the Childcare Act 2006 says a provider “must comply with the welfare requirements”. Under regulation 3(2A) of the Early Years Foundation Stage (Welfare Requirements) Regulations 2012, the “obligatory provisions” are the section 3 sentences that use the word “must”, except a listed set – in the group framework 3.10, 3.23, 3.25, 3.26, 3.75, 3.79 and 3.105 to 3.107, the notification, disqualification-information and corporal punishment paragraphs, which the Regulations deal with separately. Regulation 3(3) requires providers to “have regard to” the sentences that say “should”. Regulation 2, as amended by SI 2026/796 from 1 September 2026, names both frameworks dated 13 July 2026.

The framework is mandatory for everyone on the early years register with Ofsted or a childminder agency (CMA), on domestic or non-domestic premises, and for schools whose early years provision is exempt from registration. It “uses the word ‘must’ where the requirement is mandatory”; a “should” means providers “must take the guidance into account … and should follow it, unless there is a good reason not to.” Settings that only offer before- and after-school or holiday care for children in reception or older need not meet sections 1 and 2, but “all settings that provide care for children aged 0-5 must meet safeguarding and welfare requirements as set out in Section 3.” The EYFS applies in England only.

What section 3 covers, paragraph by paragraph

Section 3 of the group and school-based framework runs from 3.1 to 3.108. Use the headings as a checklist against your own policies and practice:

• Safeguarding policies and the DSL (3.4 to 3.6): a designated safeguarding lead with “lead responsibility for safeguarding children”, and a safeguarding policy in line with the local safeguarding partners' procedures. These are the core safeguarding requirements.
• Whistleblowing (3.7 and 3.8): procedures for all staff, students and volunteers, including “when and how to report concerns”.
• Concerns and allegations (3.9 and 3.10): concerns about a child go “immediately” to children's social care, with regard to Working together to safeguard children and the Prevent duty; allegations of harm or abuse go to Ofsted or the CMA within 14 days.
• Absences (3.11 and 3.12): timely follow-up, and an attendance policy shared with parents.
• Suitable people (3.13 to 3.29): DBS and barred list checks, references, disqualification, staff medication, alcohol and smoking.
• Training, supervision and skills (3.30 to 3.42): safeguarding training to Annex C, induction, supervision, paediatric first aid, English, and a key person for every child who builds “a relationship with their parents and/or carers” and helps families reach specialist support.
• Ratios and qualifications (3.43 to 3.58), with children “adequately supervised, especially whilst eating”.
• Health (3.59 to 3.73): illness and infection, medicines, food, allergies, weaning, safer eating and food poisoning.
• Behaviour (3.74 to 3.76): no corporal punishment, and a record of any physical intervention.
• Special educational needs (3.77).
• Premises and equipment (3.78 to 3.94): accidents and first aid, fire, banned dogs, space, outdoor access, safer sleep, the baby room, toilets, visitors and collection, insurance, outings, risk assessment and screen use.
• Information and records (3.95 to 3.104): confidentiality and protecting children's privacy, information about each child and for parents, complaints, inspections and the daily register.
• Changes to notify to Ofsted (3.105 to 3.107), and other legal duties (3.108): the EYFS does “not supersede or replace any other legislation”.

For the records – what goes in a record of concern, the medicines and accident records, how long to keep them – see the nursery record-keeping guide and early years safeguarding records. For each notification and its clock, see notifying Ofsted of changes.

Four kinds of duty, and the evidence each produces

Section 3's duties fall into four kinds, and each leaves a different trace.

Written policies and procedures. Paragraph 3.5 says providers “must have and implement policies and procedures to keep children safe and meet EYFS requirements”, and that where the framework asks for them they “should be recorded in writing”; schools need not duplicate an existing policy. Section 3 names the safeguarding policy (3.6), whistleblowing procedures (3.7), the attendance policy (3.12), the illness and infection procedure (3.60), the medicines policy (3.61), the emergency evacuation procedure (3.81), the procedure for checking visitors' identity (3.89), the procedures for an uncollected or missing child (3.100) and the complaints procedure, which 3.101 requires in writing with a “must”. The safeguarding policy must cover concerns about a child, allegations against staff, how “mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used”, checks on new recruits, and how training is delivered. Childminders registered only on the early years register or with an early years CMA “are not required to have written policies and procedures”, but “must be able to explain” them (paragraph 3.6 of their framework).

Records. Staff qualifications and checks, including the DBS reference number, the date and who obtained it (3.18); each dose of medicine (3.62); physical intervention (3.76); accidents, injuries and first aid (3.78); each child's details (3.99); complaints and outcomes (3.101); and a daily register of children, hours and key persons (3.104). Risk assessments are the exception people get wrong: 3.93 leaves it to the provider to decide “where it is helpful to make some written risk assessments”, and an outings assessment “does not necessarily need to be in writing” (3.91), though the framework's footnote to 3.93 points to Health and Safety Executive guidance, “including where written ones may be required where five or more staff are employed”.

Notifications. Allegations (3.10), significant events and disqualification (3.23 to 3.26), food poisoning affecting two or more children (3.73), serious accidents, illness, injury or death (3.79) and changes to premises and people (3.105 to 3.107) go to Ofsted or the CMA as soon as reasonably practicable and within 14 days at the latest – a change of person in advance where that is reasonably practical (3.106) – and for several the framework says a provider who fails without reasonable excuse “commits an offence”.

Practice. Much of section 3 is only visible in the room: ratios, children “within sight and hearing of a member of staff whilst eating” (3.70), an adult in the same room for every sleep of a baby under six months (3.86), and “every person looking after children must be alert to any issues of concern” (3.4). Ofsted's early years inspection information for use from September 2026 says “we do not expect leaders to produce written evidence to support each standard in each evaluation area.”

Three clocks recur: concerns go to children's social care “immediately” (3.9); parents are told about medicine, physical intervention, accidents and first aid on the same day or as soon as reasonably practicable (3.62, 3.76, 3.78); and notifiable events reach Ofsted within 14 days. Safeguarding training “must be renewed every two years” (3.33), and paediatric first aid training every three years and “relevant for people caring for young children and babies” (3.37).

What changed in September 2025 and September 2026

From 1 September 2025 the government implemented the safeguarding reforms it consulted on in 2024: its consultation outcome on EYFS safeguarding confirmed “all of the safeguarding changes that were consulted on” and “2 new changes on whistleblowing and providing employment references”, now at 3.7 to 3.8 and 3.20 to 3.21.

The frameworks dated 13 July 2026 came into force on 1 September 2026, and the Department for Education's summary of changes to the EYFS framework lists what is new. The 2026 frameworks:

• bring the safer sleep rules into the framework (3.86): children under two on their back in their own sleep space, babies aged 12 months and under “must only be placed to sleep in a cot” (including carrycots, Moses baskets and travel cots), and an adult in the room for every sleep of a baby under six months;
• prohibit childcare where a banned dog breed under section 1 of the Dangerous Dogs Act 1991, including the XL Bully type, is “kept or present”, even with an exemption certificate (3.82);
• require providers to “have regard to” the screen use guidance (3.94);
• require notification of allegations of “harm” rather than “serious harm” (3.10);
• add a barred list check to the enhanced criminal records check for every person aged 16 and over who works directly with children or lives or works on the premises, and extend both to all volunteers, including supervised ones (3.15), and bar anyone from starting until the check is received (3.17) – except supervised volunteers who only help out occasionally, such as a parent on a trip, but not overnight or giving personal care;
• widen what staff must be told to disclose to “arrests, charges, convictions, cautions, court orders, reprimands and warnings” (3.17); and
• require group providers on domestic premises to notify Ofsted, or their CMA, of changes to people aged 16 or over living or working there (3.105, 3.107).

The volunteer change follows the law: footnote 20 says “The Crime and Policing Act 2026 amended the Safeguarding Vulnerable Groups Act 2006 to remove the previous exemption for supervised unpaid activity”, so caring for or supervising children frequently, on more than three days in 30, or overnight is regulated activity, paid or not. The screen use change is a duty to have regard to guidance, not a cap: the screen use guidance says screen use “should be avoided for under 2s and limited to up to an hour a day for children aged 2 to 5.” The Early years qualification requirements and standards, which regulation 3(2) of the Welfare Requirements Regulations also gives legal effect for providers other than childminders, were reissued with the same date, and the banned dog rule reaches beyond the EYFS to nannies and Childcare Register providers through the same amending regulations, SI 2026/796. A policy that still says “serious harm”, a rota with unchecked regular volunteers, or a sleep procedure that only refers out to NHS advice is now out of step.

How Ofsted checks section 3, and what happens when it is not met

The EYFS framework says Ofsted inspects all providers except providers of childcare on domestic premises registered with a CMA, which get the agency's quality assurance visits instead. Under the education inspection framework for use from November 2025, Ofsted no longer gives an overall effectiveness grade; it grades early years providers on evaluation areas including safeguarding, which is “met” or “not met”, and children's welfare and wellbeing. Ofsted's early years inspection toolkit (version 2.0, June 2026) splits section 3 between them: for safeguarding, inspectors “consider only the early years foundation stage (EYFS) safeguarding and welfare requirements that do not sit within the children's welfare and wellbeing evaluation area.” Safeguarding is “met” when “relevant EYFS requirements are met” and the toolkit's other conditions apply; among the signs of “not met” it lists leaders who “do not follow the requirements for safer recruitment, reporting, referrals and the ‘Prevent’ duty” and adds: “Poor record-keeping has a significant impact on children's safety.” Ofsted's inspection information adds that inspectors check “that statutory guidance for babies’ sleeping, weaning and feeding is well understood and implemented effectively”, and in the toolkit's welfare and wellbeing area inspectors consider the extent to which practitioners “consistently put into practice safe sleeping arrangements”.

Inspectors must be able to see the paediatric first aid arrangements and the “Disclosure and Barring Service (DBS) records and any other documents summarising the checks on, and the vetting and employment arrangements of, all staff”, and may ask for the EYFS policies, referrals to the local authority designated officer, accident records and complaints.

Where a provider fails a requirement, the framework says Ofsted “may issue actions”, or serve a welfare requirements notice if the failure is in section 3, and Ofsted's inspection information adds: “When there is a significant failure to meet the safeguarding and welfare requirements, inspectors will normally serve a welfare requirements notice.” Failing to comply with a notice without reasonable excuse is an offence under regulation 12. Funding follows: the Department for Education's statutory guidance on early education and childcare, valid from 1 April 2026, makes safeguarding “not met” a “specified grade” for all the funded entitlements, and tells local authorities to “withdraw funding from a provider (other than a local authority maintained school) as soon as is practicable” once a provider receives one.

The requirements that run on messages

Read section 3 for its verbs and a pattern appears. A concern goes to children's social care “immediately”. Parents hear about an accident, a dose of medicine or a physical intervention on the same day. Providers must “enable a regular two-way flow of information with parents and/or carers” (3.95). Staff must know “when and how to report concerns” about poor practice (3.7). The DSL gives “support, advice and guidance to all practitioners on an ongoing basis” (3.32). Every one of those is a conversation, and in most settings much of it now happens by message.

The key person texts a parent at four o'clock to say their child bumped his head and had a cold compress. A practitioner messages the DSL from the park on an outing because something a child said worried her. The deputy tells the manager in the staff group that a regular volunteer's check has not come back. Those messages are where the same-day duty was met, where a concern was first raised and where someone decided whether a volunteer could start, and when they sit on staff phones in a consumer app, the setting cannot show them to an inspector, a parent or a local authority designated officer. The safeguarding policy already has to say how phones are used; few say where work conversations about children belong.

ComplyChat is built for that conversation. On paid plans, staff, and parents added by their mobile number, talk in channels the setting controls; everyone added is told the channel is on the record; and once the setting's Microsoft 365 tenant is connected, the lasting record files there under its own retention rules. It is not a safeguarding case management system, a policy library, a nursery management system or an inspection pack, and it does not decide what is a concern: the record of concern, the accident record and the notification still have to be made in the right place. The question for the next leadership or committee meeting: for the last accident a parent was told about, could you show when and how they were told?

Questions people ask

What are the safeguarding and welfare requirements?

The safeguarding and welfare requirements are section 3 of the EYFS statutory framework: what every early years provider in England must do to “safeguard children; ensure the people who have contact with children are suitable; promote good health; support and understand behaviour; [and] maintain records, policies, and procedures” (paragraph 3.3). They have legal force through the Early Years Foundation Stage (Welfare Requirements) Regulations 2012, made under section 39(1)(b) of the Childcare Act 2006.

What are the requirements of the EYFS?

The EYFS has three sets of requirements: learning and development in section 1, assessment in section 2, and safeguarding and welfare in section 3. Before- and after-school and holiday settings for reception-age children and older need not meet sections 1 and 2, but every setting caring for children aged 0 to 5 must meet section 3.

What are the key changes to the EYFS in 2026?

The EYFS frameworks in force from 1 September 2026 add safer sleep rules (3.86), a ban on banned dog breeds (3.82), a duty to have regard to screen use guidance (3.94), notification of allegations of “harm” rather than “serious harm” (3.10), DBS and barred list checks for supervised volunteers other than occasional helpers, with no start before the check (3.15, 3.17), a wider disclosure duty (3.17) and notice of changes to people aged 16 or over on domestic premises (3.105).

What are the key changes to safeguarding in 2026?

In early years settings in England, allegations of harm, not only serious harm, must now reach Ofsted or the CMA within 14 days (3.10); checks cover supervised volunteers except occasional helpers, reflecting the Crime and Policing Act 2026, and nobody may start before their check arrives (3.15, 3.17); and staff must be told to disclose arrests and charges as well as convictions (3.17). Keeping children safe in education 2026 applies to schools, including their early years provision (3.9).

What is Annex C in safeguarding?

In the EYFS, Annex C sets the “Criteria for effective safeguarding training”: what every practitioner's training must cover, from “the main categories of abuse, harm and neglect” to “how to respond, record and effectively refer concerns or allegations”, with extra content for the DSL such as safe recruitment and managing allegations against staff. Paragraph 3.31 requires all practitioners to be trained in line with it. Keeping children safe in education is a different document: in its 2026 edition the role of the designated safeguarding lead is Annex B (it was Annex C in the 2025 edition), and Annex C is the summary of changes.

What are the latest updates to the EYFS safeguarding framework?

The latest EYFS frameworks are dated 13 July 2026 and took effect on 1 September 2026; the Department for Education's note of that date says “the requirements for providers have not changed since” they were published for information in July. The previous round, from 1 September 2025, brought in the safeguarding reforms consulted on in 2024, with new requirements on whistleblowing and employment references.

Official guidance and your next step

The primary sources are the two EYFS statutory frameworks, the Welfare Requirements Regulations 2012, Ofsted's early years inspection toolkit and inspection information, and the Department for Education's summary of the 2026 changes. Paragraph 3.9 also points providers to Working together to safeguard children, and schools to Keeping children safe in education. Quotations are from those pages as published on 8 October 2026.

This guide summarises the requirements for England and is not legal advice. Wales, Scotland and Northern Ireland set their own standards, and your local safeguarding partners' procedures sit alongside the framework.

Then do one thing: take the list in the second section of this guide to your next staff meeting and, for each heading, name the policy, record or person that shows you meet it. Any heading with no answer, or an answer that still says “serious harm”, is your first job.