The compliance areas businesses should not ignore this year

Regulatory change in 2026 is not arriving as one single reform, but as a series of shifts that together raise the bar on compliance expectations. Health and safety, building safety, mental health, asbestos and fire risk are all moving from guidance-heavy territory into practical, enforceable obligations.

For many organisations, the challenge is not knowing that the law exists, but keeping pace with how it is now being applied.

What’s changing

Several compliance streams are evolving at the same time acknowledging how work and risk have changed in practice. Updated health and safety guidance is being implemented across sectors, while regulators are paying closer attention to how organisations assess and manage mental health risks, particularly in hybrid and remote working environments.

At the same time, long-running reforms in asbestos management, fire safety and building safety are shifting from policy into day-to-day enforcement. The focus is less on written policies and more on whether controls actually work.

Why regulators care

Regulators are responding to patterns they are seeing repeatedly. Serious incidents often arise from well-known risks that were underestimated, poorly monitored or deprioritised over time.

Mental health is acknowledged as a workplace risk rather than a welfare issue. Fire and asbestos failings continue to feature in prosecutions. Building safety duties are now clearly defined and expected to be actively managed.

This combination means regulators are looking at systems, culture and leadership rather than isolated failures.

Why this matters to businesses

Businesses are being assessed on how well they understand their own risk profile. A one-size-fits-all approach to compliance is increasingly risky.

Organisations with dispersed workforces, older buildings, mixed-use premises or complex supply chains are particularly exposed. Directors and senior managers are also under greater pressure to demonstrate oversight, not just delegation.

Common questions we’re hearing

Do we need to update risk assessments every year?
They should be reviewed when risks change, which in many cases is happening more frequently.

Are mental health risks really enforceable?
Yes. Where foreseeable harm exists, regulators expect it to be assessed and managed.

Is asbestos still a priority?
Very much so. Failures around identification, monitoring and contractor control continue to attract enforcement.

A 2026 compliance sense-check

Organisations should use this year to review:

The aim is not perfection, but demonstrable understanding and control.

Useful guidance 
Final thought

2026 is shaping up as a year where compliance expectations and enforcement activity align more closely than they have for some time.

If your systems have not been revisited in light of recent reforms, now is the right moment to do so, before regulators do it for you.

Subscribe to the newsletter for ongoing regulatory updates or share what compliance acknowledges are highest on your agenda this year.

Cyber Essentials certification is a UK government backed security standard that demonstrates an organisation has implemented the key technical controls needed to protect against the most common cyber threats.

This field is for validation purposes and should be left unchanged.
Name(Required)