When a workplace accident happens, there is a natural instinct to deal with it, learn the immediate lesson and move on. But the legal consequences of a safety failure don’t always move at the same speed. They can arrive years later, sometimes decades later and they land on the organisation as it is then, judged on decisions made long before.

Two cases this year make that point powerfully. The first is the conviction of Air France and Airbus for corporate manslaughter, 17 years after the loss of flight AF447 and 228 lives, and after an earlier acquittal was overturned. Safety obligations do not fade, and neither does legal responsibility.

The second is closer to home. On 21 April 2026, at Southwark Crown Court, Industrial Chemicals Ltd was fined £3.8 million after two separate employees suffered serious chemical burns from caustic soda, at two different sites, three years apart. Same company, same category of failure breached twice: inadequate control of a known hazardous substance.

Why this matters

After the first incident, an investigation took place however cases like these often reveal the presence of systemic gaps and a failure to consider the broader question: Does this risk exist anywhere else in our organisation? Whatever learning followed the first incident didn’t reach far enough to prevent the second. Three years later, a second employee was injured and the company was ultimately convicted.

Often overlooked during the timeline from accident to conviction is not the potential fine, the legal costs or the years of management time consumed by an investigation and prosecution. It is the fact that every incident you encounter today could become evidence in a case in the future and how you respond to it may be examined in forensic detail. An investigation that fails to identify a recurring failure does more than leave a risk unaddressed; it creates a latent vulnerability that can resurface years later with far greater consequences.

Getting this right

The organisations that manage this well do three things differently.

First, they investigate systemically, not locally. When something goes wrong at one site, with one process or one team, they ask whether the same conditions exist elsewhere and they record this process.

Second, they close the loop visibly. Findings become actions, actions have owners and deadlines and completion is verified. Years down the line, that record is the difference between showing a learning organisation and a failure to heed warnings.

Third, they treat every incident as if it will one day be evidence in a courtroom because it might be. That mindset changes the quality of investigations, the transparency of reports and the speed of follow through.

What to do now: If your organisation has had a workplace incident, near miss or enforcement action in the past few years, ask yourself: did the investigation look past the immediate site or team? Were the lessons applied everywhere they were relevant? Could you evidence that today? If you’re not confident of the answers, get in touch so we can review the gap before the regulator asks the same questions.

Shared for general information purposes only and does not constitute legal advice. It is recommended that specific professional advice is sought before acting on any of the information given. Please contact us for specific advice on your circumstances.

Cyber Essentials certification is a UK government backed security standard that demonstrates an organisation has implemented the key technical controls needed to protect against the most common cyber threats.

Get the Regulatory Brief

This field is for validation purposes and should be left unchanged.
Name(Required)
A PRACTICAL GUIDE FOR BUSINESSES AND INDIVIDUALS WHEN THE REGULATOR CALLS

This field is for validation purposes and should be left unchanged.
Name(Required)
A PRACTICAL GUIDE FOR BUSINESSES AND INDIVIDUALS WHEN THE REGULATOR CALLS

This field is for validation purposes and should be left unchanged.
Name(Required)

This field is for validation purposes and should be left unchanged.
Name(Required)