Skip to main content

Context and overview

This guidance applies to Wales. For the rules or guidance in the other parts of the UK, please visit the sites for England, Scotland and Northern Ireland.

Although serious illness and deaths have greatly reduced as a result of the success of the vaccination programme and the rules introduced to slow the spread of coronavirus, coronavirus is still with us and still poses a significant risk to public health. We all have a responsibility to help minimise this risk to protect ourselves, our employees and customers.

The response to the pandemic in Wales to date has been a collective effort – the public, the government, employers, businesses, trade unions, health and social care providers, and the third sector have all worked together. We all have a duty to continue to do so to help keep the virus under control as we enter this new phase of the pandemic

What legal requirements remain in place?

At Alert Level Zero, from August 7 2021, there are no legal limits on the number of people who can meet, including in private homes, public places or at events. In addition all businesses and premises may be open.

However, the Welsh Government has kept a small but significant number of legal requirements to help reduce the spread of the virus and help protect the most vulnerable. Businesses, employers and other organisations have a duty to protect their employees and customers while on their premises. While there are some important steps we must all continue to take to help ourselves and others, 5 legal requirements remain at Alert Level Zero:

  1. Businesses, employers and other organisations, including activity and event organisers, must undertake a bespoke coronavirus risk assessment of their premises and activities and take reasonable measures to minimise exposure to, and the spread of, coronavirus based on that bespoke risk assessment.
  2. Everyone must still self-isolate for 10 days if they test positive for COVID-19
  3. Every adult (18 or over) who is notified by a contact tracer that they have had close contact with someone who has tested positive for COVID-19 must self-isolate for 10 days, unless they have been fully vaccinated in the UK (you are considered to be fully vaccinated, if it has been at least two weeks (14 days) since you completed a full course of an approved vaccine against coronavirus more than 14 days before they had the close contact.
  4. From the 29 October, the Welsh Government is also strongly advising if someone in your household has symptoms or has tested positive and you are fully vaccinated or aged 5 to 17 you should self-isolate and take a PCR test. If your test is negative you can stop isolating. Children under 5 are no longer advised to take a test unless recommended by a doctor or if parents believe a test is absolutely necessary and in the best interest of the child.
  5. Adults and children over 12 must wear face-coverings in indoor public places, with the exception of hospitality settings such as restaurants, pubs, cafes or nightclubs, or for solemnisation of a marriage, formation of a civil partnership or an alternative wedding ceremonies.

Purpose of this guidance

This guidance is intended to provide the essential information needed to help businesses, employers and other organisations or institutions meet the legal obligations they are under to minimise the risk of people being exposed to, or spreading, coronavirus on their premises.

The guidance sets out what we know about how coronavirus is transmitted and the most effective ways of reducing the spread of the disease. This helps explain why a range of different precautions are necessary to lower risks.

The foundation of the specific legal requirement that applies in Wales is that the risk of exposure to coronavirus on all premises open to the public and workplaces must be assessed and “reasonable measures” taken to minimise that risk. The guidance explains what “reasonable measures” mean and provides illustrations of the measures that can be taken.

There are separate sector-specific action cards which provide more guidance on industry-specific issues and mitigations (please note these are guidance and not legally-binding unless specified).

How does coronavirus spread?

The most common ways coronavirus is spread are:

  • through the air as an aerosol
  • through the air by droplets
  • by direct contact with an infected person
  • by direct contact with a contaminated surface

This helps us understand what kind of places are most risky. These are places where people come into close contact with others, and places where ventilation is poor meaning that stale air is not removed and fresh air is not introduced, giving coronavirus the opportunity to build up. So the following places are particularly risky:

  • indoor places where ventilation is poor
  • indoor places where people are together for a long time
  • any place, particularly indoors, where people have close contact with others
  • any place, particularly indoors, where people are breathing heavily close to others or over extended periods, such as through strenuous exercise, loud singing, chanting, or shouting, coughing or sneezing (this is because an infected person can spread droplets over a larger area)

The different ways coronavirus spreads are illustrated in the diagram below.

Where a premises or activity has any of the above characteristics, particular attention should be paid to these risks when considering the reasonable measures that should be taken. For example, having greater physical distancing when strenuous exercise or singing is involved, or improving ventilation in busier indoor areas.

Smaller infected droplets travel further and remain airborne longer, improve ventilation to reduce risk.

What can I do to minimise the risk of coronavirus spreading as a person responsible for a premises, employees, event or activity?

Existing legal duty to minimise risks to health and safety

Employers or persons responsible for premises, events or activities, are subject to a long standing legal responsibility to maintain the health and safety workers, and others attending their premises (on

There is a further requirement that applies in Wales to carry out a specific bespoke coronavirus risk assessment to identify risks and to do everything reasonably practicable to minimise those risks – to take “reasonable measures”.  The Welsh Government has for some time imposed a particular legal requirement on people responsible for workplaces and for premises open to the public (called “regulated premises” in the Regulations) to ensure that reasonable measures are taken to minimise the risk of exposure to, or the spread of, coronavirus by those who have been at those premises. This legal requirement forms part of the public health response to the coronavirus pandemic and applies in addition to existing occupational health requirements under health and safety law.

In general terms there are five main ways to minimise risk. These are often described as the “hierarchy of controls”. This provides a framework against which to assess risks and consider reasonable measures to take to minimise those risks. This is a widely accepted system promoted by numerous safety organisations as a way of determining how to implement feasible and effective solutions to reduce the risk of illness or injury.

hierarchy of controls diagram


The controls are summarised below, with some specific examples of reasonable measures under each heading. What may be reasonable is explained later in this guidance.


Aim to avoid or remove the risk of coronavirus being present at the premises. This is the most effective type of intervention as it aims to stop people becoming exposed and infected. This could include:

  • Prohibiting people from attending if they feel unwell and advising that they should get a PCR test. 
  • Ensuring that employees do not attend the premises if they are required to self-isolate, either because they have tested positive or because they are over 18, have not been fully vaccinated, and have had close contact with someone who has tested positive for COVID-19.
  • Encouraging or requiring employees to undertake routine testing using lateral flow tests to identify any individuals who may be asymptomatic (support for regular testing of staff may be available under the workplace testing programme).
  • Encouraging and facilitating vaccination of staff or requiring those coming on to the premises to be fully vaccinated.
  • Ensuring that accurate records are kept of which employees (and, where appropriate customers, visitors or clients) have been present so that they can be contact traced if necessary.
  • Enabling and facilitating staff to work from home.


Aim to swap a risky activity for a less risky one. This could include:

  • Reducing the time that people come into face-to-face contact.
  • Changing work patterns so that people work in a fixed group or cohort or arrive at and leave work at staggered times (this limits the number of people that the virus can potentially spread to).
  • Moving to working outdoors to reduce potential spread of the virus surface contamination and aerosol transmission.
  • Using technology to replace face-to-face interactions, for example using ‘click and collect’ technologies, remote working, phone/video consultations.

Engineering controls

Aim to try to lower the risk by changing the way an activity takes place. This could include:

  • Improving ventilation:
    • Increasing fresh-air ventilation in poorly ventilated spaces
    • Where fresh air is not possible, ensuring mechanical ventilation meets appropriate standards and is serviced and adjusted accordingly
  • Limiting use of shared surfaces:
    • Using no-touch (contactless) technologies
    • Using anti-microbial surfaces
    • Reducing the use of shared surfaces, where this cannot be avoided
  • Improving hygiene:
    • Providing additional hand wash stations
    • Regular handwashing and sanitising, including providing facilities and signage to encourage good behaviours
  • Introducing and maintaining physical distancing:
    • Limiting or controlling movement of people, for example one way systems, or limiting number of people accessing confined areas such as lifts, toilet facilities, kitchens or meeting rooms at the same time
    • Providing clear signage (for example signs, floor tape or paint) for physical distancing, queuing systems, one way systems etc.
    • Maintaining a distance between people on the premises
    • Limiting face to face interaction
    • Installation of partitions at appropriate places (for example reception desks or between work stations) to separate staff etc. (where used they should cleaned and disinfected in line with appropriate good hygiene arrangements)
  • Managing numbers and duration:
    • Limiting time spent in rooms with little or poor ventilation
    • Limiting the number of people present in rooms with little or poor ventilation
  • Supporting good behaviour:
    • Communicating effectively with those on the premises and acting on feedback on measures taken to minimise risk
    • Removing some restrictions when it is safe to do so, in order to promote adherence to the most effective and necessary restrictions

Administrative controls

Aim to lower any remaining risks of exposure. This could include:

  • providing training on the measures taken explaining why they have been taken (for example the effectiveness of maintaining physical distancing, cleaning etc.)
  • avoiding sharing equipment, such as ‘hot-desking’
  • reducing how many people are working in a particular location by, for example, encouraging home working or partial home working
  • staggering shifts
  • maintaining regular communication with staff (in all relevant languages) and ensuring they understand the advice given

Personal protective equipment (PPE)

Aim to protect those present on the premises from residual exposure through use of PPE. These are the least effective interventions, so should be used in conjunction with other measures set out above. Attention must be paid to infection control during wear, removal, storage and disposal. This includes use of:

  • fluid resistant surgical face masks or other proper respiratory protection (such as FFP2 and FFP3 grade masks or PAPR helmets) as may be advised in certain circumstances, for example in health or social care settings or other close contact services (where indicated by guidance)
  • lower grade face coverings (see guidance on wearing face coverings in indoor public places)
  • gloves and aprons
  • eye protection

What is the legal requirement on businesses, workplaces, public places and event organisers?

What is the legal basis for requirements?

Regulation 16 of the Health Protection (Coronavirus Restrictions) (No. 5) (Wales) Regulations 2020 imposes obligations on people responsible for premises that are open to the public or where work takes place:

  • to minimise the risk of exposure to coronavirus on the premises, and
  • to minimise the risk of spread of coronavirus by those who have been on the premises.

This is to be achieved by taking the following steps, which are based on the “hierarchy of controls” principles (referred to above):

  • step 1: undertake a bespoke assessment of the risk of exposure to coronavirus at their premises (and to consult persons working on the premises or representatives of those persons in doing so)
  • step 2: provide information to those entering or working at the premises about how to minimise the risk of exposure to coronavirus. This includes, in particular, information to all those working on the premises about their risk of exposure to coronavirus identified in the bespoke coronavirus risk assessment and the measures to be taken to minimise this risk
  • step 3: ensure that reasonable measures are taken to minimise risk of exposure to the virus on the premises

Each of the 3 steps is required to be taken. Further detail on each step is set out below.

What has changed?

The requirement to carry out a bespoke coronavirus risk assessment and to take reasonable measures has not changed. These requirements remain in place at Alert Level Zero.

There has however been a change to how those required to take reasonable measures determine what reasonable measures they should take, as well as a change in emphasis in what reasonable measures are necessary. The Regulations are now less prescriptive about exactly what measures must be put in place, enabling there to be more flexibility in what is done based on the levels of risk identified.

The specific requirements on licensed and retail premises are no longer set out separately in the Regulations. However, this does not mean those things are no longer considered ‘reasonable measures’ that may be required, rather that they are not legally required in all circumstances.

For example, table service in a pub has been required at all times. As a result of the change in the law, however, whether a table service should be put in place will depend on the circumstances. In a pub that is very rarely busy or during the day where there are few customers present, table service is unlikely to be required as the risk is lower. But table service may well be a reasonable measure that should be taken on a busy evening, or if a pub was holding an event, as the bar area could become crowded.

In so far as the reasonable measures themselves are concerned, there has been a particular emphasis throughout on physical distancing, in particular measures to keep people 2 metres apart. Following the change in the law, physical distancing is still a reasonable measure that may be taken, and in many circumstances is likely to be required to be taken, however it is no longer given particular prominence. This means that where other measures can be taken to minimise risk, such as moving outdoors, requiring people to be tested or vaccinated, using screens etc., physical distancing may not be required or could be required to a lesser extent.

From 11 October 2021, certain venues have been required to put in place measures connected with checking evidence of vaccine or testing status (this will be done by means of the NHSCovid pass) as a mandatory reasonable measure. This guidance has been updated to provide further information to enforcement officers relating to this new requirement of a Covid-pass.

This requirement will be further expanded on 15 November 2021 to include indoor theatres, cinema’s and concert halls.

To whom does the legal requirement apply?

The requirement to take reasonable measures applies in a very broad range of circumstances, including every kind of workplace which is open. This includes for example; public services, health and social care premises, schools and childcare settings, higher education, further education settings (including training centres and adult learning), call centres, hospitality businesses, travel and holiday accommodation, voluntary services, commercial and industrial premises, construction sites and other open sites such as roadworks and outdoor places including livestock markets.

The duty in law to take reasonable measures applies to the person or persons responsible for premises open to the public and on the person responsible for the work being undertaken in any workplace; that is the person responsible for management control of the premises (not necessarily, for example, the owner of a leased factory space or office).

In the case of particular activities that may take place on regulated premises, the duty applies to both the person responsible for the premises where the activity is taking place and the person responsible for the activity.

Similarly in the case of regulated premises that also host other businesses on site, for example hospitality settings that host live music, the duty applies concurrently to both the person responsible for the premises where the activity is taking place and the person responsible for the individual business performing (the band in this example).

And again, in the case of weddings and other celebrations that are organised by an individual but held on regulated premises that involve outside businesses being present during the event, for example, outside caterers, live music, or other such performers, the duty applies to both the person responsible for the premises where the activity is taking place and the person responsible for the individual business present during the event.

The duty to take reasonable measures also applies to taxis and to public transport provision (including indoor areas of transport hubs such as bus stations, railway stations, airports and ferry ports) Additional supplementary detailed transport guidance is also available in relation to public transport.

Although the legal obligations fall on specific persons, everybody in a workplace or on premises open to the public has a personal responsibility both for their own behaviour and also not to frustrate steps taken to ensure that the risk of transmission of coronavirus across Wales is reduced.

Please note that this guidance is not aimed at NHS settings or care homes, which will have separate guidance due to the nature of the services they provide. While the general requirement applies to health and social care settings, these settings may also need to be compliant with other sector specific guidance, such as that for infection prevention and control. That guidance would set out what is considered reasonable in those settings to manage risks.

What is the status of this guidance?

This guidance is made under regulation 18 of the Health Protection (Coronavirus Restrictions) (No. 5) (Wales) Regulations 2020 and sets out further information on the practical application of the legal requirement under regulation 16. This guidance replaces the previous separate statutory guidance on “Reasonable Measures”.

What must be done to minimise the risk of exposure to coronavirus?

Regulation 16 requires 3 steps to be taken:

Step 1: Carry out a bespoke coronavirus risk assessment

The Regulations require persons responsible for premises open to the public or for work premises to carry out a specific assessment of the risk of exposure to coronavirus in relation to the premises. So businesses, organisations, employers, and activity and event organisers must carry out a bespoke coronavirus risk assessment, and act upon it.  As part of that process, they are required to consult with those who work on the premises or their representatives (such as a trade union). This should be done “in good time” giving those being consulted a meaningful opportunity to contribute to the process.

The obligation to assess the risk that arises specifically from coronavirus applies in addition to the more general requirement to undertake a risk assessment found in regulation 3 of the Management of Health and Safety at Work Regulations 1999 (S.I. 1999 No. 3242). Where a risk assessment completed under those Regulations already assesses the risk of exposure to coronavirus, this is sufficient to meet the requirement (subject to the need to consult and inform those working on the premises and to keep the position under review). The obligation to provide information to staff already exists under regulation 10 of the 1999 Regulations.

Crucially, outcomes of risk assessments specific for your premises, and all identified risks, should form the basis for determining what reasonable measures should be taken to mitigate risk of exposure to coronavirus. It is not enough to simply conduct a risk assessment – as this is merely a tool to help inform what must be done to minimise risk.

When considering what reasonable measures should be taken at any premises, those responsible should make an assessment of risk which is specific to all of the activities undertaken at the workplace and should be updated if new activities are added. This includes taking into account all individuals who use or visit that setting including permanent and temporary staff, contractors, visitors and members of the public.  It also involves taking into account that the level of risk may vary depending on how many people are present on the premises or depending on what is being done at a particular time. Risk assessments are an established part of managing health and safety at work and specific coronavirus risk assessments for your premises should be completed as part of a wider safety management system. Comprehensive guidance is available from the Health and Safety Executive.

This guidance does not cover risk assessments in detail, however the assessments should be undertaken in accordance with the procedural requirements set out in regulation 3 of the Management of Health and Safety at Work Regulations 1999 (as it has been modified by the Coronavirus Regulations). The risk assessment should be reviewed regularly as changes in the wider threat from the pandemic should be taken into account when considering how the obligation to take reasonable measures to minimise the risk should be met.  Risk assessment is a dynamic process which should always involve those working on the premises.

A template has been provided to assist. However, risk assessments must be specific to the workplace, situation or specific activity in question. Measures to mitigate risk referred to on the template are not intended to be seen as an exhaustive list. It is for the responsible person to identify all hazards for their staff, customers and visitors, applicable to indoor and outdoor work, situations and activities.

Employers will need to take full account of the requirement to keep staff safe at work and should offer individual risk assessments for their members of staff, dependent on the roles they play and whether they are at increased risk or clinically extremely vulnerable. This also includes having regard to the physical and mental health of your workforce, particularly as they may be anxious about returning to the workplace environment if they have been working at home. They should also engage with staff representatives, and trade union representatives, in a timely fashion.

While risk assessments do not have to be published, there is a requirement that all those working on the site are informed of their content, and the mitigation measures they set out. Where the responsible person is an employer who employs 5 or more employees the employer must record the significant findings of the risk assessment and any group of employees identified as being especially at risk. 

Step 2: Providing information

Providing information to workers and others on premises or in a workplace is key to successful control of virus spread. Information may be given orally or in writing (most obviously in signage), and in line with the Equality Act in terms of formats available.

Generally the information provided will need to:

  • explain what measures have been taken to maintain physical distancing indoors or reduce close face to face interaction;
  • assist people to follow what is required, for example by giving directions about how to enter and walk around premises if a one-way system has been put in place or by reminding people when they need to wear face coverings and how to use them effectively and responsibly (see separate guidance on face coverings);
  • provide users of premises with information on the safe limit of people who can be on the premises.

Some basic signage is available here - safety and physical distancing signs for employers and on the Business Wales website.

Step 3: taking reasonable measures

What is a reasonable measure?

Regulation 16 sets out an obligation to:

“Take reasonable measures to mitigate the risk of exposure to coronavirus that arises where persons gather on the premises, such as:

(a)       seeking to prevent the following persons from being present at the premises:

(i)         any person who has tested positive for coronavirus in the previous 10 days,

(ii)        any person who has had close contact in the previous 10 days with a person who has tested positive for coronavirus,

(iii)       any person experiencing symptoms associated with COVID-19;

(b)       ensuring that persons gathering at the premises gather outdoors where this is practicable;

(c)        limiting close physical interaction between persons on the premises, in particular face-to-face interaction, for example by:

(i)         changing the layout of premises including the location of furniture and workstations;

(ii)        controlling the use of entrances, passageways, stairs and lifts;

(iii)       controlling the use of shared facilities such as toilets and kitchens;

(iv)       otherwise controlling the use of, or access to, any other part of the premises;

(v)        installing barriers or screens;

(d)       limiting the duration of time for which persons may be present on the premises;

(e)       seeking to ensure that the premises are well ventilated;

(f)        maintaining good hygiene on the premises;

(g)       providing or requiring use of personal protective equipment.”

However, the measures listed are examples and what constitutes a “reasonable measure” will vary depending on the nature of the premises, and the activity that is carried out. For example those providing close personal services will not be able to maintain physical distancing while providing the service, but they should be able to use PPE and ensure there is good airflow on the premises. 

Similar examples can also be found above in the “Hierarchy of Controls” section. The coronavirus bespoke risk assessment undertaken and the “Hierarchy of Controls” system should form the basis for what reasonable measures should be taken.

When thinking about reasonable measures to take, it is important to consider the Alert Level in force and general advice from Welsh Government and public health authorities about the level of risk.

Regulation 16 applies in all circumstances while the Regulations remain in force, it applies at all of the different Alert Levels, including where no Alert Level applies under the Regulations (“Alert Level 0”). The measures that are reasonable to take at a low Alert Level may differ from those which are reasonable when the Alert Level is high, in other words more is likely to be required to be done at the higher Alert Levels as the risk of exposure to coronavirus is higher.

Relevant considerations to deciding whether measures are reasonable

Those subject to the legal obligation to take reasonable measures have discretion in deciding what measures to take. However, those measures must “mitigate the risk of exposure to coronavirus that arises where persons gather” on their premises, and determining what measures are “reasonable” to take is an objective test. This means that what is reasonable depends on what a reasonable person faced with a similar situation would do.  

Subject to that, when considering what measures are reasonable consideration may be given, among other things, to the following factors:

  • Cost – is the cost of the measure proportionate to the extent to which risk is reduced by the measure? 
  • The nature of the work – are the measures practical, or would they undermine the delivery of the service or undertaking of the business so much that they would be unsustainable?
  • Can measures be put in place without compromising health and safety in other respects not related to the spread of coronavirus? If measures would increase the health and safety risk, for example in the case of operating machinery, these would most likely not be reasonable measures.
  • The nature and capacity of those in a workplace – where a service or business is responsible for looking after or working with vulnerable people, it may not be reasonable to institute rigid physical distancing. 
  • Measures should command staff and workforce confidence that proper consideration has been given to the level of risk that they face.
Types of reasonable measure that can be taken

In all circumstances, but especially where physical distancing will not be possible or enforceable, a range of measures are likely to be needed to minimise risk.

Ultimately, if the measures that can reasonably be taken are insufficient to mitigate the risks involved, regulation 16 makes clear that reasonable measures may include ceasing to carry out certain activities and closing part of premises. Although regulation 16 is primarily concerned with how things are done, not whether they are done, there may be some activities where the risk of exposure to coronavirus is such that the only means of minimising the risk is not to do it. This option will be particularly relevant at higher Alert Levels.

Set out below are some of the most effective reasonable measures that should be considered and put in place where possible. A fuller set of examples is provided in the section on the “hierarchy of controls”.

Seeking to prevent people from being on the premises and supporting people identified as close contacts of a positive case

The most effective way of preventing the spread of coronavirus in any premises is to prevent the virus being present in the first place. This is why vaccination, testing and self-isolation are so important. It is also why the Regulations provide that the reasonable measures to be taken may include seeking to prevent people from attending premises if they:

  1. have tested positive for coronavirus,
  2. have had close contact with anyone who has tested positive, or
  3. are experiencing symptoms associated with COVID-19.   

It is a legal requirement for a person over 18 who has not been fully vaccinated in the UK to self-isolate if they are notified by a contact tracer that they have had close contact with someone who has tested positive for coronavirus. The reasonable measure to be taken would include seeking to prevent people who are legally required to self-isolate from being present at the premises.

Individuals who are exempt from self-isolation are advised, but not required, to limit contact with the clinically extremely vulnerable, take part in regular asymptomatic testing, wear a face covering in enclosed spaces and practice social distancing for the period of time they would have been required to self-isolate.

Depending on the nature of the business or organisation being carried out from the premises and the activities involved, it may also be reasonable for an employer to take measures in relation to any person who is not legally required to self-isolate  following close contact with somebody who has tested positive for coronavirus.

In some circumstances, it may be reasonable to take measures to require or enable such a person to not be present at premises. Whether or not this is reasonable in will depend on a number of factors, including, in relation to a worker: whether it is feasible for the work to be carried out from elsewhere (and see the guidance below on working from home); the impact the worker being away from the premises would have on the service provided; and the risk the worker could pose to particular vulnerable persons should they continue to work at the premises.

Other measures that may be reasonable to take could include:

  • encouraging employees to notify their employer if they are identified as a close contact of a positive case of COVID-19, to enable consideration of appropriate reasonable adjustments  and mitigation measures such as physical distancing and wearing of PPE or face coverings;
  • considering the nature of the employee’s interaction with the public and whether alternative duties may be appropriate to reduce potential transmission risk;
  • reinforcing the importance of the person taking Day 2 and Day 8 PCR tests as well as other regular asymptomatic testing for example using rapid lateral flow tests.
  • identifying employees considered clinically extremely vulnerable (who are at higher risk of severe COVID-19 infection) and seeking to avoid the person who has had close contact with a positive case of COVID-19 working in close proximity to them;
  • considering whether others should be informed if a person has had close contact to a positive case of COVID-19.

Specific guidance has been published for health and social care employees who are notified as close contacts of a positive case of COVID-19. This guidance outlines a process of risk assessment and mitigation for patient/service user facing employees to provide additional safeguards and protections for people who may be more vulnerable to COVID-19. Employers from other sectors may wish to consider the principles in this guidance, namely to redeploy staff to alternative duties, if their business includes contact with those who are immunosuppressed or clinically extremely vulnerable.

Improving ventilation

Improving ventilation is a particularly important measure. Carrying out activities outdoors will provide natural ventilation. Natural ventilation indoors might be provided by opening doors and windows where this does not contravene fire safety requirements. Improvements in mechanical ventilation will also help minimise risks if done effectively.

It is also a legal requirement under regulation 6 of the Workplace (Health, Safety and Welfare) Regulations that “Effective and suitable provision shall be made to ensure that every enclosed workplace is ventilated by a sufficient quantity of fresh or purified air.” The Chartered Institute of Building Services Engineers has guidance available on what is “sufficient”, which is referenced in the HSE’s COVID-19 guidance.

Ventilation can work in combination with other measures such as restricting or reducing duration of activities and enhanced use of face coverings in settings with higher risk of aerosol transmission.

It is important to identify and deal with areas that are not well ventilated. The more people occupying an area that is poorly ventilated, and the longer they remain in it, the greater the risk of spread of coronavirus.

So maximising the fresh air in a space can be done by:

  • natural ventilation
  • mechanical ventilation
  • a combination of natural and mechanical ventilation, for example where mechanical ventilation relies on natural ventilation to maximise fresh air

And risk assessments should consider the following:

  • effective fresh air ventilation, working alongside face coverings, distancing and enhanced hygiene regimes
  • restricting or reducing duration of activities indoors
  • room layout
  • using rooms with good ventilation and avoiding the use of those without;
  • the use of suitable air quality monitoring systems and air cleaning devices to enhance indoor air quality
  • making sure mechanical ventilation systems are maintained in line with manufacturers’ instructions
  • avoiding ventilation which only recycles air
  • if table or pedestal fans are unavoidable, ensuring that air is not blown from one person (or groups of people) to another person (or group of people) by regularly bringing in air from outside by opening windows or doors
  • using ceiling fans and fresh air to improve the circulation of air from outside and avoid pockets of stagnant air forming indoors

Employers should provide employees with clear guidance on ventilation, why it is important, and instruction on how to achieve and maintain good natural ventilation or to operate systems if there are user controls which employees can access.

The Health and Safety Executive (HSE) has updated and expanded its advice to help employers provide adequate ventilation in their workplaces and premises during the pandemic. It also provides guidance on other factors to consider when assessing the risk from aerosol transmission, and determining whether adequate ventilation is being provided to reduce this risk.

Further advice and guidance for employers, building managers and those who are responsible for workplaces, non-domestic public buildings can be found below:

Working from home    

The most effective way of minimising the risk of exposure to coronavirus in workplaces is to enable some or all staff to work from home, as often as possible. As “reasonable measures” there is an expectation that employers should be flexible and make adjustments wherever that is possible. For example issuing staff with IT equipment (laptops, monitors, keyboards), office furniture, mobile phones and facilitating communication across locations.

Employees should not be required or placed under pressure to return to a workplace setting if there is not a clearly demonstrated business need for them to do so. Employers who are considering requiring their staff to return to workplace settings should first assess whether alternative arrangements could meet the majority of business needs in order to minimise the risk of exposure to or spread of coronavirus. This should be discussed with staff or representatives of staff.

In determining whether to ask staff to return to workplace settings, employers should consider whether any individual’s wellbeing would be particularly adversely affected by this. This includes people who are at increased risk or are clinically extremely vulnerable (who were previously advised to shield and who still need to take high levels of precaution), or because returning to the workplace would cause them severe anxiety. This is particularly the case where work would require them to be in regular or sustained contact with other people or to be share a poorly ventilated space for long periods.

Equally, there may be staff who wish to return to workplace settings. In these circumstances, the wellbeing of staff is a relevant consideration when deciding what measures to prevent the spread of coronavirus are reasonable. Although employers’ first priority should be minimising the risk of exposure to coronavirus, this should be balanced against the detrimental effect working from home may be having on an employee’s wellbeing. In these circumstances if employees in this position can return to the workplace setting without a significant increase in the risk of exposure to coronavirus, this should be allowed. In considering this, employers should consider the extent to which the employee returning to the workplace would come into close contact with others both within the workplace but also in travelling to and from work. 

Physical distancing

Scope for physical distancing on premises is to an extent constrained by the size of premises; however, regardless of the size of the premises, the starting point is that consideration should be given to how people could be kept physically apart and how close face to face interaction could be prevented or minimised.

The risk assessment required by the Coronavirus Regulations should establish the appropriate number of people who can be present and that information should be made available publicly, such as through signage. There should also be specific controls at the entry and exit to premises to ensure that the numbers on the premises do not exceed this number. That means limiting access, organising the flow of people through the premises, design and planning of work and will likely require measures to be put in place to help people stay apart.

The nature of measures that are reasonable will be specific to the individual workplace or premises, and will reflect the physical environment and the nature of the business or activity being conducted. Examples of ways to support physical distancing include:

  • controlling entry to the premises to limit the number of people on the premises at any one time
  • increasing the space between people by reducing the total number of people in attendance,
  • changing the layout of premises and removing furniture to support physical distancing
  • controlling use of entrances, passageways, stairs and lifts
  • controlling use of shared facilities such as toilets and kitchens
  • increasing space between staff – for example on a production line leaving 2 metre gaps between people and indicating spacing with markings
  • considering appropriate provision of rest space, such as providing additional space or staggering breaks
  • altering tasks undertaken – making adjustments to the way that work is done, to reduce contact
  • staggering shifts to minimise people on site and to reduce congestion at the point of shift changes

In considering whether it is reasonable to maintain physical distancing there are a range of situations in which this is not practicable. Examples include where the location is too small to accommodate distancing (e.g. public transport), where contact is essential (e.g. personal services), where it is essential for safety, or where proximity is for short periods of time (e.g. sports).

Where premises are open to young children, it may not be practicable to attempt to maintain continual physical distancing between those children (or even between those children and any adults on the premises). This is in part because it is harder for younger children to understand the concept of physical distancing, and in part because appropriate support from carers will often require closer contact. It is also of note that evidence suggests that younger children are less likely to transmit the virus (whether to other children or to adults), and that the virus appears in general to have a milder effect on younger children than on adults.

Maintaining high levels of physical distancing could place some businesses under significant commercial strain. Although protecting public health and maintaining public confidence should be the priority, businesses opt for alternatives to physical distancing or maintain less physical distancing if the cost implications are such that they would make the business unviable.

The risk assessment should include consideration for what mitigating actions can be taken if physical distancing is more limited or not maintained. If taking other reasonable measures will not sufficiently mitigate the risk of exposure to the virus, this suggests that physical distancing is still required.

Other reasonable measures that can be taken

In all circumstances, but especially where physical distancing will not be possible or enforceable, it is important that other measures are taken. The most obvious measures to take are anything which reduce close face to face interaction and to improve hand washing, avoidance of touching the face with unwashed hands, respiratory hygiene and surface cleaning.

In addition to ventilation, working from home and physical distancing a wide range of additional measures are set out in the section on the “Hierarchy of controls”. Additional guidance and specific links are provided below for some of these:

  • Ensuring the role of Test, Trace, Protect is understood, including how it affects your setting. This includes being clear with staff and visitors that anyone with COVID-19 symptoms should not come into work or attend the setting but should start a period of self-isolation and arrange a PCR test.
  • Collecting contact information from people (including staff, customers and visitors) who have been at the premises and to retain this for 21 days. This allows people to be contacted where they may have been exposed to coronavirus at the premises. Separate guidance on the collection of contact details provides further information on collecting contact details.
  • The wearing of face coverings remains mandatory in indoor public places (other than premises where food or drink is sold for consumption on the premises). Separate face coverings guidance has been produced setting out the responsibilities of employers and the managers of premises with regard to face coverings.
  • Use of testing or proof of vaccine certification. Proof of a negative test could be a reasonable measure to reduce the risk of an infectious person being on the premises. Fully vaccinated individuals are also likely to be lower risk of contracting and spreading COVID-19. People in Wales can access a NHS COVID Pass to provide proof of vaccination or negative test.

From Monday 11 October people will be required to show the NHS COVID pass to demonstrate they are either fully vaccinated or have had a recent negative Lateral Flow Test, to enter the following venues and events:

  • nightclubs
  • indoor non-seated events of more than 500 people, where people are mixing closely for prolonged periods
  • outdoor non-seated events of over 4,000, where people will be mixing closely for prolonged periods
  • any event, of any nature, which has more than 10,000 people in attendance
  • the NHS COVID pass allows people to prove they have either been fully vaccinated or to provide evidence of a negative Lateral Flow Test

The system is working and you are already able to access your pass using the NHS digital system which will allow you to produce a COVID pass using a smart phone, a computer or laptop. You can access your COVID pass.

Further information and guidance will be made available by the Welsh Government in the near future. The current guidance on accessing the COVID pass.


From Monday 11 October people attending large events and nightclubs (or similar premises) will have to prove they are either fully vaccinated or have had a negative lateral flow test (LFT) in the last 48 hours or have been tested positive by means of a PCT test no more than 180 days or less than 10 days beforehand.

From Monday 15 November NHS COVID Passes will be needed to access  theatres, cinemas and concert halls.

These requirements which should form part of the bespoke risk assessment and be one of the reasonable measures that is required to be put in place, apply in relation to certain specific premises and settings (see below).  The specific provisions are set out in regulation 16A.

It is important to note that this new evidence checking requirement forms part of a range of reasonable measures which should generally be implemented dependent on the steps identified as part of the bespoke risk assessment.  It does not remove the need to consider and implement other measures.

The bespoke risk assessment should also set out the rationale and justification of how each business and setting has chosen to operate this requirement, which will normally be by means of individuals wishing to attend or enter having to produce a covid-pass. What is considered reasonable in terms of checking will vary at different times and for different venues depending on a range of circumstances, including the capacity and entry procedures.  There may be circumstances where checking everyone entering a particular premises might give rise to particularly large queues and bunching of people, but with other premises, they will already have procedures for checking by means of a queuing system, where it would be reasonable also to check whether each individual has a valid covid pass.  For example, it is normal for night clubs to control numbers by operating a queue outside of the premises, and the expectation is that they would check each person wishing to enter. Likewise, it is normal for theatres, cinema’s and concert halls to check tickets and (for certain performances) proof of age. However, carrying out checks on every person entering at major football or rugby matches could exacerbate safety issues as it could lead to larger than normal queues forming outside.

We would anticipate that a nightclub, theatre, cinema and concert hall, for example, would be able to check the COVID passes of everyone entering the venue.

Each venue will need to undertake a risk assessment to ensure that it can justify what it considers to be a  reasonable measure in the context of checking, taking account  of its other statutory duties for example health and safety of its customers, wider public order issues and potential terrorism risks.


Since 11 October the requirements mean people over the age of 18 in Wales will need to show that they are fully vaccinated or have had a negative lateral flow test 48 hours or have been tested positive by means of a PCT test no more than 180 days or less than 10 days beforehand before they are allowed entry to:

  • nightclubs and similar venues (see below)
  • indoor premises where an event is being held with more than 500 people in attendance where not everyone is normally seated
  • any outdoor premises where an event is being held with over 4,000 people in attendance, where not everyone is normally seated
  • any event, of any nature, which has more than 10,000 people in attendance

From 15 November 2021, the above requirements will also be in place for people over the age of 18 wishing to enter the following settings:

  • theatres
  • cinemas
  • concert halls

For multi-day events, multi venue events or events with separate shows during the day – it is the number of people attending on any day or any show, at any time. It does not include staff, contractors, performers, or volunteers involved in the delivery of the event.

In determining whether or not events are to be treated as outdoors, consideration should be given to any indoor facilities on site which may be occupied by people for most of the day (for example hospitality).  In such circumstances, this may mean that the event should be treated as an indoors one. However, a concourse that is provided solely for the provision of food or drink for take away consumption outdoors at the event and provision of toilets should not be considered to be an indoor event.

Nightclubs and similar venues captured

The requirement to check individuals’ COVID Passes will be required in nightclubs and places where music is provided for dancing - but only if they are authorised to serve or supply alcohol and are open at any time between midnight and 5 am.

The requirement to have a COVID Pass applies to nightclubs and other places where music is provided for dancing if they serve alcohol and are open at any time between midnight and 5 am (and the requirement to have a COVID Pass applies to such premises at any time, including times outside these hours, if they are open and are providing music for people to dance).

This means that a pub, for example, with a dancefloor that starts to play music from 3pm onwards and closes after midnight would be required to implement the COVID Pass for entry from at least 3pm (earlier if those who enter early will still be there when the music starts).

However a pub with a dancefloor which closes before midnight would not have to implement the COVID Pass requirements to enter (unless they are holding any type of unseated event for more than 500 people).

Likewise, a pub that does not have a dancefloor and are not providing music for the purpose of dancing will not be required to implement a COVID Pass requirement to enter (unless they are holding an unseated event for more than 500 people, then they would be captured by that particular provision and would be required to check individuals COVID Passes).

Theatres, cinemas and concert halls

The requirement to check individuals’ covid passes will be required in all indoor theatres, cinemas and concert halls during all operational hours of business.

Exemptions and exceptions

The requirements will only apply to checking the COVID Passes of members of the public attending these venues and event – but not to staff, contractors, performers or volunteers involved in the delivery of the event. However, in order to protect themselves and others and to help us keep the sector open , venue owners and event organisers  should consider encouraging all those on site to take lateral flow tests twice a week as part of their risk assessments.     

The following are examples of the types of premises that are specifically exempted from the requirement.  Premises used for or at which:

  • an outdoor event that does not require an entrance fee or ticket to attend is being held, and where  the event site has multiple points of entry (this would cover, for example, a free fireworks display in a public park, or a farmers market)
  • a protest or picket is being held
  • a mass participation sporting event is being held outdoors (such as a marathon, triathlon or cycle race); or
  • the celebration of a marriage or civil partnership, or the life of a deceased person (but only for such times as they are being used for those purposes)

The following people will not need to provide evidence to enter a venue or event

  • under 18s
  • people working, volunteering or performing in the venues

COVID Pass: guidance for businesses and events.

The current guidance on accessing the COVID Pass.


The Welsh Government expects that businesses and others understand the severity of the situation we are facing as a society and will take the reasonable steps necessary.

By working together, it is hoped that that employers, employees and /or volunteers can come to a reasonable judgment on the best way to minimise the risks of exposure to and spread of coronavirus. It is in all our interests for this to happen so that important work can continue.

However, the Welsh Government has included a duty in law is so that enforcement is possible, where it is necessary.

The police, and local authorities, have powers to enforce the requirements on businesses, services and workplaces imposed by the regulations.

Separate guidance is available on the approach that is expected to be taken to enforcement of the regulations, which is designed to:

  • promote and maintain sustained compliance as a preventative measure to help contain the coronavirus;
  • ensure action is taken immediately to deal with situations in which there is a risk of coronavirus spreading; and
  • ensure that those who fail to comply are held to account.

Local authority Public Protection Enforcement Officers will continue to monitor compliance with the Coronavirus Regulations and those responsible for regulated premises may receive a visit, telephone call and/or an e-mail from their local enforcement officer. This contact is to ensure all have undertaken a risk assessment and that the reasonable measures identified and to be applied are sufficient to minimise the risk of exposure to coronavirus.

If improvements are needed the local enforcement officer will provide information about what is required either informally or, if they have significant concerns, through service of a Premises Improvement Notice. Where the breach is serious or where there has been repeated non-compliance service of a Premises Closure Notice will also be considered.

A proportionate approach will be taken by local enforcement officers who will assess whether the appropriate reasonable measures are being taken. It is not their role to approve risk assessments.

The enforcement system is set out in Schedules 8 and 9 to the Regulations and is based on the issue of a “Premises Improvement Notice” or a “Premises Closure Notice” or both, depending on the circumstances. More detail is available in the separate guidance - reasonable measures to minimise risk of coronavirus in workplaces and open premises: guidance for enforcement officers.

COVID Pass enforcement

The compliance with the new requirements to check evidence of vaccine or testing status in certain venues will be enforced in the same way as compliance with the other requirements under regulation 16 (to undertake risk assessments and put in place reasonable measures) is enforced. This means businesses and events will need to ensure their proposed arrangements and are included in their bespoke risk assessments, including the justification for what it considers to be a reasonable measure.

Examples of considerations could be:

  • have they considered staggered entry times to the nightclub or event in order to be able to check individuals’ vaccine or testing status?
  • is there sufficient space for people to effectively physical distance in any queue to enter?

A wider offence linked to the provision of false or misleading evidence of vaccination or testing status where that evidence is required as part of the requirement for providing evidence for entry has also been introduced.

Where there are reports of individuals providing falsified or misleading information, a police officer or a police community support officer (PCSO) will be able to take action under the Regulations.


In summary, persons responsible for premises, and who are required to take reasonable measures to minimise risk of exposure to coronavirus on the premises, should consider the following:

  1. Do people need to be physically present on the premises, or could alternatives such as home working or remote communications be used?
  2. Where people need to be on the premises, when and where could people be exposed or risk spreading coronavirus?
  3. What can be done to try to prevent people who have tested positive or who are experiencing COVID-19 symptoms from being on the premises?
  4. What can be done to encourage people to be vaccinated?
  5. What can be done to keep people physically distanced on the premises? 
  6. What can be done to use outdoor space instead of indoors on the premises?
  7. What can be done to improve ventilation indoors, either through using windows and natural draft or by use of mechanical ventilation systems?
  8. What can be done to minimise the duration people may be together?
  9. What can be done to minimise close face to face interaction?
  10. What can be done to improve hygiene?
  11. What information is taken to ensure that people can be contacted if they may have been exposed to coronavirus on the premises?
Download this page as a PDF . File size 328 KB.

File size 328 KB. This file may not be fully accessible.