Breach of duty of care: what it means for employers and how to avoid it

Protecting people is the sum of hundreds of decisions organizations make about safety, communication, training, emergency preparedness, and risk management. When those decisions fall below the standard an employer is reasonably expected to meet, and someone is harmed as a result, it can lead to something called a breach of duty of care.

Below, we’ll explain what that means, where organizations are most commonly exposed, and how to reduce risk before an incident occurs.

What is a breach of duty of care? 

A breach of duty of care happens when an employer fails to meet the standard of care they’re reasonably expected to provide, and someone gets hurt as a result. That could be an employee, a contractor, a visitor, or anyone else under their care.

For a breach to be established, four things generally need to be true:

• A duty of care existed between the employer and the person affected
• The employer fell below the expected standard of care
• That failure caused harm
• The harm was a foreseeable result of the failure

So what counts as “reasonable” care? It varies by jurisdiction, industry, and context, which means organizations with operations across multiple regions face more complexity than employers with a single location. What meets the standard in one place may fall short somewhere else.

Breach of duty vs. negligence: what’s the difference?

You’ll often hear these terms used interchangeably, but they have key differences.

• Negligence is the broader legal claim. It’s the full argument that an employer failed in their duty and that failure led to harm
• Breach of duty is one piece of that argument. It’s the specific finding that the employer fell below the expected standard of care.

For employers, the practical question isn’t just whether someone was harmed. It’s whether the organization did what a reasonable employer in the same situation would have done. If it didn’t, that’s where a breach of duty argument starts.

Where breaches most commonly occur

Failure to communicate during an emergency

One of the clearest breach of duty of care examples involves emergency communication, specifically, the failure to notify employees, visitors, or contractors about a known threat in time for them to take protective action.

Here are a few ways this can play out: 

• An employer receives a credible threat advisory affecting a facility but delays communication to affected individuals while waiting for internal confirmation
• A severe weather warning is issued, but the emergency notification system only reaches employees, not the contractors currently working onsite
• An active threat develops near a building, and employees don’t receive instructions because the emergency contact list hasn’t been updated since the last reorg

In each of these breach of duty of care examples, the employer had information relevant to people’s safety and failed to act on it effectively. The gap between knowing and doing is where many breach of duty findings stem.

With today’s availability of threat intelligence tools, weather monitoring systems, and real-time advisory feeds, it’s harder for organizations to take a “we didn’t know in time” stance. 

Inadequate safety protocols

A breach doesn’t always involve a dramatic failure. Sometimes it’s simply the absence of a process that a reasonable employer would have had in place. For example:

• Workplaces where hazards are identified but not addressed
• Environments where PPE is required but not provided or enforced
• Facilities where emergency evacuation plans exist on paper but haven’t been tested or updated to reflect current occupancy
• Organizations where safety training is conducted once at onboarding and never revisited

In general, having a policy isn’t enough if it’s not implemented, maintained, and tested. A fire evacuation plan that names floor wardens who no longer work at the company, for example, is not considered a functioning safety protocol.

Gaps in incident response 

When an incident happens, and the response is slow, disorganized, or incomplete, the harm that follows can be tied to the response failure just as much as the incident itself.

{{protip-1}}

The same pattern shows up across other incident types. Was there a protocol for sheltering employees during severe weather, and was it followed? Were fire evacuation procedures practiced and current? Were access controls appropriate given known security risks? Breach of duty cases frequently come down to whether a response process existed and whether it would have made a difference.

Traveling and remote employees

This area of exposure is growing as workforces become more distributed. The obligation follows employees wherever they’re working:

• A business traveler in a region experiencing civil unrest has a reasonable expectation that their employer is monitoring conditions and will communicate proactively
• A remote employee working from home during a severe weather event has a reasonable expectation that their employer has considered how to reach and support them
• A contractor working at a client site has a reasonable expectation that safety-relevant information will still reach them in a timely manner

Several UK and EU jurisdictions have addressed this directly, extending duty of care obligations explicitly to traveling employees. For example, the UK Health and Safety Executive states that employers must manage health and safety risks for workers traveling as part of their job and that health and safety law applies to work activities on the road in the same way as it does on a fixed site. US law is less uniform, but the direction of travel is the same: employer responsibility for distributed workforces is expanding, not contracting.

Multi-site coordination failures 

For organizations with multiple locations, a breach can occur at the organizational level, not just at the site where something went wrong.

For example, say a severe weather event affects three offices at the same time. The largest location has a current emergency plan, trained floor wardens, and an integrated notification system. The second has an outdated plan and no designated warden. The third, a recently acquired office, has never been brought into the organization’s emergency management infrastructure at all.

Every employee at all three locations is owed the same standard of care. When that standard is applied inconsistently across locations, the ones that fall short create an exposure. The fact that the organization clearly knows how to get it right at some makes that harder to explain.

{{protip-2}}

The reactive posture problem

Most breach of duty cases share a common thread: the employer was responding to harm rather than working to prevent it. Proactive safety is a more defensible posture.

Taking the position that they didn’t know in time gets harder to defend when the tools for proactive risk awareness are widely available and well established. The standard employers are held to is what a reasonable employer with access to the same information and resources would have done.

That standard is rising. As we already mentioned, severe weather monitoring, civil unrest tracking, threat intelligence feeds, and real-time occupancy data are now widely accessible. An employer who isn’t using available tools to stay ahead of foreseeable risks is increasingly in a difficult position when something goes wrong.

{{protip-3}}

How modern safety platforms reduce breach exposure

Technology doesn’t eliminate duty of care obligations, but it does make them significantly easier to meet consistently, at scale, and in a way that’s auditable when something goes wrong.

• Integrated occupancy and visitor data means that during an emergency, the question of who’s in the building has a reliable answer. Visitor logs, contractor check-ins, and employee presence data that live in separate systems create the kind of accountability gaps that surface in breach of duty cases.
• Automated emergency notifications with delivery confirmation reduce the risk of communication failures during an incident. When a notification is sent out and acknowledgment is tracked, there’s a documented record that employees were informed and when they were.
• Proactive threat monitoring across multiple locations means that an employer isn’t waiting for an incident to be reported before taking action. If a severe weather system is developing near a facility, or civil unrest is building near an office, that intelligence should reach the people responsible for employee safety before conditions worsen.
• Consistent procedures across all sites (not just headquarters) close the multi-site exposure gap. Organizations that can prove that their approach is uniform across locations are in a much stronger position than those where practice varies by site.

Used together, they move an organization from reactive to proactive, and from “we think we handled it” to “here’s the record that shows we did.”

—

The organizations with the lowest breach of duty exposure are the ones that have identified their risks, built procedures that reflect operational reality, applied those procedures consistently, and can demonstrate all of that when it’s questioned.

Duty of care obligations don’t pause when an employee is traveling, working from home, or on-site at a location that was acquired two years ago. The standard applies everywhere. Meeting it requires infrastructure that can, too.

Ready to strengthen your organization’s approach to duty of care and emergency response? Learn more about Envoy for emergency management.