Nursery risk assessment

The rule: EYFS paragraphs 3.93 and 3.91

Paragraph 3.93 of the EYFS statutory framework for group and school-based providers is the risk assessment duty for nurseries, pre-schools and school-based early years settings in England. The EYFS statutory framework for group and school-based providers, in force from 1 September 2026, reads: “Providers must ensure that they take all reasonable steps to ensure staff and children in their care are not exposed to risks and must be able to demonstrate how they are managing risks. Providers must determine where it is helpful to make some written risk assessments in relation to specific issues, to inform staff practice, and to demonstrate how they are managing risks if asked by parents and/or carers or inspectors. Risk assessments should identify aspects of the environment that need to be checked on a regular basis, when and by whom those aspects will be checked, and how the risk will be removed or minimised.”

Its footnote points to the Health and Safety Executive for “Guidance on risk assessments, including where written ones may be required where five or more staff are employed”. The outings paragraph, 3.91, is the only other place the framework uses the words risk assessment: “Children must be kept safe while on outings. Providers must assess potential risks or hazards for the children and must identify the steps to be taken to remove, minimise and manage those risks and hazards. The assessment must include consideration of staff to child ratios. The risk assessment does not necessarily need to be in writing; this is up to providers.”

Two other paragraphs bring the general law in. Paragraph 3.80 says “Providers must comply with requirements of health and safety legislation, including fire safety and hygiene requirements”, and 3.81 requires reasonable steps to keep children, staff and others safe “in the case of fire or any other emergency”, including an emergency evacuation procedure. The legislation that matters most is regulation 3(1) of the Management of Health and Safety at Work Regulations 1999: “Every employer shall make a suitable and sufficient assessment of– (a) the risks to the health and safety of his employees to which they are exposed whilst they are at work; and (b) the risks to the health and safety of persons not in his employment arising out of or in connection with the conduct by him of his undertaking”. The children in a nursery, and visiting parents, are persons not in the employer's employment.

The two sets of rules have different enforcers:

• Ofsted inspects and enforces the EYFS, including 3.91 and 3.93. It does not enforce health and safety law in a nursery.
• The local authority, usually its environmental health team, enforces health and safety law where the main activity in non-domestic premises is, in the words of Schedule 1 to the Health and Safety (Enforcing Authority) Regulations 1998, “The provision of child care, or playgroup or nursery facilities” (regulation 3(1)).
• The Health and Safety Executive enforces instead on a school campus – any school-based setting, including a nursery run by another provider on the school site (regulation 3(5) of the 1998 Regulations: the HSE “shall be the enforcing authority for the whole of any such premises”) – and in premises occupied by a local authority, such as a council-run nursery (regulation 4 of the 1998 Regulations).

Older editions of the EYFS numbered these paragraphs differently, so a risk assessment policy that cites other paragraph numbers was written against an earlier framework and is worth checking against the current text. Childminders have the same two duties in the EYFS statutory framework for childminders: outings at 3.90 and the general duty at 3.92, which covers “children in their care, and any assistants”; the childminder policies guide covers what a childminder must write down.

Which risk assessments a nursery needs

A nursery in England needs an outings risk assessment (EYFS 3.91), a general assessment showing how it manages risks to children and staff (EYFS 3.93), the employer's risk assessment (Management of Health and Safety at Work Regulations 1999, regulation 3) and a fire risk assessment (Regulatory Reform (Fire Safety) Order 2005, article 9), plus specific assessments where the work involves hazardous substances, manual handling or a new or expectant mother. In practice one well-organised set of assessments can serve several of these duties at once.

• Outings (3.91). Every outing, from a walk to the post box to a coach trip, must be assessed, and the assessment must consider staff to child ratios. The paragraph adds that providers “should also have regard for the paediatric first aid requirements set out in sections 3.37 - 3.39 while on outings”; 3.37 says at least one person with a current paediatric first aid certificate “must accompany children on outings”. Vehicles transporting children, and their drivers, “must be adequately insured” (3.92).
• The setting's general assessment (3.93). The premises, indoors and outdoors, must be “fit for purpose and suitable for the age of children cared for and the activities provided” (3.80). The framework names several risks that a general assessment should reach: safe sleep (3.86), food prepared “in a way to prevent choking” and children “within sight and hearing of a member of staff whilst eating” (3.68 and 3.70), visitors, collection and children leaving the premises (3.89), banned dog breeds (3.82), and smoking and vaping (3.29).
• The employer's assessment for staff (regulation 3). Risks to employees at work, from lifting and low furniture to childhood infections, and risks to others from the way the nursery runs.
• New and expectant mothers (regulation 16). Where staff include women of child-bearing age and the work “could involve risk, by reason of her condition, to the health and safety of a new or expectant mother, or to that of her baby”, regulation 16 of the 1999 Regulations requires the regulation 3 assessment to include that risk. The duty turns on who works for you, not on whether anyone is pregnant: the HSE's risk assessment guidance for new and expectant mothers says “You must, by law, assess the risks to women of childbearing age as part of your general workplace risk assessment”, and an individual assessment is also required once a worker tells you in writing that she is pregnant, has given birth in the last six months or is breastfeeding.
• Fire (article 9). Under article 9 of the Regulatory Reform (Fire Safety) Order 2005, the responsible person “must make a suitable and sufficient assessment of the risks to which relevant persons are exposed for the purpose of identifying the general fire precautions he needs to take”. EYFS 3.81 adds the evacuation procedure, fire detection and control equipment in working order, and clear fire exits.
• Hazardous substances (COSHH). Regulation 6 of the Control of Substances Hazardous to Health Regulations 2002 bars work “which is liable to expose any employees to any substance hazardous to health” until the employer has assessed the risk and put in place the steps the assessment identifies – in a nursery, typically some of the cleaning and sterilising products.
• Manual handling. Where it is not reasonably practicable to avoid lifting that involves a risk of injury, regulation 4 of the Manual Handling Operations Regulations 1992 requires “a suitable and sufficient assessment of all such manual handling operations” – lifting children onto a changing table, into a cot or a high chair.

The 2026 framework changed two things older risk assessment templates will not reflect: it updated the safer sleep requirements in 3.86, under which children under two are placed down on their back in their own separate sleep space and babies aged 12 months and under only in a cot, and it added the 3.82 rule that banned dog breeds, including the XL Bully type, “must not be kept or present on the premises at any time”. A setting planning a visit from a pet, or with a dog that lives on site, needs the second.

What has to be written down, and what does not

Not every nursery risk assessment has to be written. The EYFS leaves most of the decision to the provider; health and safety law fixes three written records. The difference matters because the most common summary online – that written risk assessments are required for specific or high-risk issues, or with five or more staff – gets both sources slightly wrong: the EYFS leaves the choice of what to write to the provider, and the five-employee rule requires the significant findings of the employer's assessment to be recorded, not every assessment.

• The EYFS general assessment (3.93): written where the provider decides it is “helpful … to inform staff practice, and to demonstrate how they are managing risks if asked by parents and/or carers or inspectors”. Managing risks and being able to demonstrate how is a “must”; whether to write it down is a judgement.
• Outings (3.91): “The risk assessment does not necessarily need to be in writing; this is up to providers.” A setting that does not write down a routine walk still has to have assessed it and be able to explain how.
• The employer's assessment (regulation 3(6)): “Where the employer employs five or more employees, he shall record– (a) the significant findings of the assessment; and (b) any group of his employees identified by it as being especially at risk.” It is the significant findings that must be recorded, not every assessment in full. The HSE's steps needed to manage risk page lists them as the hazards, who might be harmed and how, and what you are doing to control the risks.
• COSHH (regulation 6(4)): “Where the employer employs 5 or more employees, he shall record” the significant findings of the substances assessment, as soon as practicable, and the steps taken to prevent or control exposure.
• Fire (article 9(6)): since 1 October 2023 the responsible person in England and Wales must record every fire risk assessment and every review “as soon as practicable”, whatever the number of employees. The five-employee threshold that used to apply to fire was removed by section 156 of the Building Safety Act 2022 (commenced for England by S.I. 2023/362 and for Wales by W.S.I. 2023/914). Scotland has its own regime under the Fire (Scotland) Act 2005.

A setting with five or more employees will therefore hold a written employer's assessment, a written fire risk assessment and written assessments for the specific issues it has decided warrant one: sleep, food and allergies, the garden, regular outings and visitors are the usual candidates. A small pre-school with four staff still has to record its fire risk assessment.

Ofsted does not issue a risk assessment form, and its Early years inspection information for use from September 2026 says “Settings do not need to provide evidence for the inspection beyond what we ask for or that is required by the EYFS” and “We do not expect providers to prepare a presentation or any additional documentation about their setting or context for inspection.” What an inspector will look for is that risks are being managed in practice, and that the setting can show how.

What a written risk assessment contains, with examples

A written EYFS risk assessment should identify the aspects of the environment that need to be checked regularly, when and by whom they will be checked, and how each risk will be removed or minimised (3.93). That is a “should”, not a “must”, but it is the closest thing the framework has to a template, and it lines up with the HSE's five steps: identify hazards, assess the risks, control the risks, record your findings and review the controls. The HSE steps are guidance on how to meet the 1999 Regulations, not an EYFS requirement.

Put together, a written assessment for one area or activity usually records:

1. The hazard – what could cause harm, named specifically (“the side gate to the car park”, not “gates”).
2. Who might be harmed and how – children, staff and volunteers, parents, visitors, and any group especially at risk, such as babies, a child with an allergy or a pregnant member of staff.
3. The existing control measures – what already controls the risk: the latch, the ratio, the procedure.
4. The level of risk – how likely harm is and how serious it would be once those controls are in place, so that effort goes where the risk is highest.
5. What else is needed – any further action, and who will take it.
6. The checks – what is checked regularly, how often, and by whom (the 3.93 content).
7. Review – the date of the last review, who did it and what changed.

The daily checklist is not the risk assessment. What many settings call a daily risk assessment is a checklist: the assessment decides what needs checking, when and by whom; the daily checklist is the record that those checks were done – the garden walked before the children go out, the gate latch tested, the sleep room cots clear. A checklist with no assessment behind it does not show why those checks were chosen, and an assessment with no checks behind it is not being applied.

Two short examples of the format, written for illustration rather than to copy:

• Garden gate. Hazard: a child leaving the garden through the side gate to the car park. Who: mobile children, particularly toddlers. Existing controls: a self-closing gate with a latch above child height; children do not leave the premises unsupervised (3.89). Checks: the opening practitioner tests the latch and the closer before children go outside, every day, and records it on the daily checklist. Further action: the room leader reports any fault to the manager the same day, and the garden is used through the main door only until it is fixed.
• Walk to the park. Hazard: road crossings, losing sight of a child, dogs off leads. Who: the children on the walk and the staff with them. Controls: the ratio the manager has set for this route, a paediatric first aider in the group (3.37), a walking rope, a head count at the gate, at the park and on return, a charged phone and the children's emergency contacts. Review: after any incident or near miss, and whenever the route or the group changes.

Ready-made templates are a reasonable starting point. The HSE says of the risk management process: “You can do it yourself or appoint a competent person to help you.” A template is not an assessment of your premises until the hazards, the people, the controls and the checks are your own, and the HSE warns: “Do not rely purely on paperwork as your main priority should be to control the risks in practice.”

Reviewing it, and balancing risk in play

There is no statutory review frequency for a nursery risk assessment. Regulation 3(3) of the 1999 Regulations requires the employer's assessment to be reviewed if “(a) there is reason to suspect that it is no longer valid; or (b) there has been a significant change in the matters to which it relates”, and article 9(3) of the Fire Safety Order requires the fire risk assessment to be “reviewed by the responsible person regularly so as to keep it up to date”. An annual review date is sensible practice, but it is not the legal test, and an assessment reviewed on schedule can still be out of date the week after a change.

The events that usually mean a review is due:

• An accident or a near miss. The HSE says: “Also consider a review if your workers have spotted any problems or there have been any accidents or near misses. Update your risk assessment record with any changes you make.” The nursery accident record is where accidents are written up; reading it for patterns is how they reach the risk assessment.
• A choking incident. EYFS 3.71 asks providers to record where and how a child choked when the incident needed intervention, and says “The records should be reviewed periodically to identify if there are trends or common features of incidents that could be addressed to reduce the risk of choking.”
• A new child or a change in a child's needs – a new allergy, a medical condition, a child who has started climbing or walking.
• A change of room, equipment, route or layout – a new sleep room, a new piece of outdoor equipment, building work, a new route to the park.
• A change in staff – a member of staff who tells you she is pregnant (regulation 16), new or agency staff who do not know the setting, a change in the ratios on a regular outing.
• A staff report of a problem – the gate that did not latch, the fence panel loose after a storm.

Reviewing well is not the same as removing every risk. The HSE's statement Children's play and leisure: promoting a balanced approach says “the goal is not to eliminate risk, but to weigh up the risks and benefits”, that providers should focus on controlling the real risks “while securing or increasing the benefits – not on the paperwork”, and that “Sensible adult judgements are all that is generally required to derive the best benefits to children while ensuring they are not exposed to unnecessary risk.” A risk assessment that removes a sound climbing frame only because a child might fall from it is not, on that view, a good one.

Parents and inspectors may ask how a risk is managed, and 3.93 names both. An inspector may also ask to see the policies the EYFS requires and records such as accident records, according to Ofsted's inspection information, and Ofsted adds that “We risk-assess any information we receive about early years provision”, which can bring an inspection forward. A setting that can show its latest assessment, the date of its last review and what changed is in a strong position for both conversations.

The report that should change the assessment is usually a message

The risk assessment is a document, but what should change it rarely arrives as one. A practitioner messages the manager at half past seven to say the side gate did not latch again. A parent texts the key person that her son's allergy plan has changed after a hospital appointment. A room leader sends a photograph of a loose fence panel from the garden. On an outing, a member of staff tells the staff group chat that a child slipped away from the rope at the crossing and was back within seconds.

Each of those is the trigger for a review that regulation 3(3) and the HSE describe, and a near miss on an outing is exactly what the outings assessment is for. If the messages sit on personal phones, the setting has no reliable way to show when it knew, and the assessment is only as current as the messages that happened to reach the person who updates it. When an agency practitioner moves on, her report of the near miss moves with her.

ComplyChat is built for the work conversations a setting needs to keep. On paid plans, staff, and parents added by their mobile number, talk in channels the setting controls, everyone added is told the channel is on the record, and once the setting's Microsoft 365 tenant is connected, conversations are kept within its own Microsoft 365 subscription, under the retention schedules it already runs. ComplyChat does not write, store or review risk assessments, and it is not a daily checklist or a health and safety system: the assessment itself belongs wherever your policy keeps it.

A question for the next staff meeting: where was the last thing that should have changed our risk assessment reported, and is that message still anywhere we hold?

Questions people ask

What risk assessments should a nursery have?

A nursery in England needs a risk assessment for outings, which must consider staff to child ratios (EYFS 3.91), and a general assessment showing how it manages risks to children and staff (EYFS 3.93). Health and safety law adds the employer's general risk assessment (Management of Health and Safety at Work Regulations 1999, regulation 3), a fire risk assessment (Fire Safety Order article 9) and, where the work involves them, COSHH, manual handling and new or expectant mother assessments.

What are the 5 things a risk assessment should include?

The HSE's five steps are: identify hazards, assess the risks, control the risks, record your findings and review the controls. For a nursery the EYFS adds that a written assessment should say which aspects of the environment are checked regularly, when and by whom, and how each risk will be removed or minimised (3.93).

How do I write a risk assessment for EYFS?

Paragraph 3.93 of the 2026 EYFS framework says a written risk assessment should identify the aspects of the environment that need checking regularly, when and by whom they are checked, and how the risk will be removed or minimised; the HSE's steps add who might be harmed and how, what you already do, and what further action is needed. The framework leaves it to you which assessments to write down.

Can I write my own risk assessment?

Yes. The HSE says the risk management process is one “You can do it yourself or appoint a competent person to help you”, and a bought template is a starting point, not an assessment of your own premises.

What is an Ofsted risk assessment?

Ofsted does not issue a risk assessment form for providers; inspectors check that the EYFS requirements, including 3.91 and 3.93, are met. Ofsted's own risk assessment is of information it receives: “We risk-assess any information we receive about early years provision”, and it may inspect sooner as a result.

What are 10 common safety hazards found in nurseries?

There is no official list of ten, but the EYFS names the hazards it expects providers to manage: unsafe sleep (3.86), choking on food (3.68 and 3.70), fire and other emergencies (3.81), unauthorised visitors and collection by someone the parent has not named (3.89), banned dog breeds (3.82) and outings and vehicles (3.91 and 3.92). Smoking must not be allowed when children are present or about to be, and practitioners should not vape then either (3.29). The setting's own assessment adds whatever its premises present, from gates and stairs to cleaning products.

Official guidance and your next step

The duties are in section 3 of the EYFS statutory frameworks, in force from 1 September 2026: paragraphs 3.91 and 3.93 for group and school-based providers, 3.90 and 3.92 for childminders. The HSE's Managing risks and risk assessment at work is the guidance the framework's own footnote points to; its steps needed to manage risk page sets out the five steps, and its play statement sets the balance. The legislation is on legislation.gov.uk: the Management of Health and Safety at Work Regulations 1999, the Regulatory Reform (Fire Safety) Order 2005 and the COSHH Regulations 2002. Quotations are from the pages linked in this guide as published on 28 October 2026.

This guide covers early years settings in England and is not legal advice. The EYFS applies in England only; Wales, Scotland and Northern Ireland have their own childcare standards, and Northern Ireland has its own health and safety regulations. For the full map of section 3, see EYFS safeguarding and welfare requirements.

Then do one thing: take your risk assessment policy and check that it cites 3.91 and 3.93 of the current framework, that your fire risk assessment is recorded and dated, and that your last three accidents or near misses each led to a review, or to a note of why none was needed.