A CE or UKCA mark shows a product was assessed against design rules before it was sold. It does not tell you it is the right kit for the job in front of you, or that anyone has to wear it. Workplace law starts with the hazard, not the label.
This is practical guidance for people specifying and using PPE, not legal advice.
The duty sits with the employer (and, in some cases, the self-employed person). If a risk remains after better controls, suitable PPE has to be provided, free, and actually used. The mark on the box is a separate question: whether that product was allowed onto the market.
Read this first
This article summarises the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999, the Personal Protective Equipment at Work Regulations 1992 as amended by the Personal Protective Equipment at Work (Amendment) Regulations 2022, and product rules under Regulation (EU) 2016/425 as it applies in Great Britain, enforced by the Personal Protective Equipment (Enforcement) Regulations 2018. Northern Ireland has its own workplace PPE regulations and follows EU product rules under the Windsor Framework. HSE’s Approved Code of Practice and guidance is L25 (fourth edition, 2022). It is not a substitute for the assessment of your work or workplace, or for advice on a particular contract or prosecution.
PPE is the last control, not the first conversation
Section 2 of the Health and Safety at Work etc. Act 1974 requires an employer to ensure, so far as is reasonably practicable, the health, safety and welfare of employees. Section 3 extends protection to people who are not employees but may be affected by the work.
The Management Regulations 1999 require a suitable and sufficient risk assessment and apply the principles of prevention. Avoid the risk where you can, combat what remains at source, and give collective protection priority over individual protection. PPE sits at that individual end: it only protects the wearer, fails if it does not fit, and fails if it is left in the van.
Regulation 4 of the Personal Protective Equipment at Work Regulations 1992 says the same thing in PPE terms: suitable PPE must be provided to workers who may be exposed to a health or safety risk, except where and to the extent that the risk has already been adequately controlled by other means which are equally or more effective. Issuing gloves because they are cheap, while the blade guard is missing, does not meet that test.
Other regulations still bite when the hazard is specific. COSHH covers substances, including dust and biological agents. The Control of Noise at Work Regulations 2005 and the Control of Vibration at Work Regulations 2005 have their own hierarchies; hearing protection and anti-vibration gloves are not a substitute for quieter tools or lower exposure. The Work at Height Regulations 2005 treat a harness as part of a fall-protection system, not as a free-standing control. CDM 2015 does not create a second PPE code, but the principal contractor and contractors still have to plan and manage the work so that PPE is not being used to paper over a bad sequence.
Who must be issued PPE, and who pays
Until 6 April 2022 the 1992 Regulations applied to employees. The 2022 amendment extended the same duties to limb (b) workers: people who personally do the work under a contract, but who are not employees and are not running their own business for a client. Agency staff, casuals and some zero-hours workers fall into that group if the legal test is met. A job title does not decide it.
In Northern Ireland the equivalent extension took effect on 21 October 2024 under the Personal Protective Equipment at Work (Amendment) Regulations (Northern Ireland) 2024. Someone genuinely self-employed, working for their own clients, is outside the employer’s duty to provide. A relevant self-employed person who conducts an undertaking of a prescribed description — including construction, agriculture and asbestos work — must provide their own suitable PPE.
If the assessment says PPE is required, the employer provides it. Section 9 of the 1974 Act stops an employer charging an employee for anything done or provided to meet a specific statutory requirement. The 2022 amendment extended that protection to limb (b) workers. In Northern Ireland the no-charge rule is Article 10 of the Health and Safety at Work (Northern Ireland) Order 1978. A “deposit”, a payroll deduction, or a requirement to buy the kit and claim it back later is still a charge. Ordinary work clothes and uniforms that are not controlling a risk are outside this rule. A high-visibility vest issued because the risk assessment requires it is not.
The employer also has to maintain it, replace it when it no longer does the job, and provide storage. The worker has to use it as trained, and return it to that storage. Lost or defective kit should be reported. “We gave them a pair in January” is not compliance if the pair is now torn, contaminated, or the wrong size.
What “suitable” means on the job
L25 treats suitability as more than a British Standard number. The PPE has to control the residual risk, fit the wearer, be compatible with other kit worn at the same time, and match the length and conditions of the work. A glove that is cut-resistant but too thick to hold a fixing is not suitable for that task. Ear defenders worn over the arms of safety spectacles often lose the seal. A full-face visor and a tight-fitting mask can fight each other.
For tight-fitting respiratory protective equipment, fit is not optional. Where tight-fitting RPE is used to control exposure, the Approved Codes of Practice under COSHH, the Control of Lead at Work Regulations, the Control of Asbestos Regulations, the Confined Spaces Regulations and the Ionising Radiations Regulations call for a face-fit test on the model and size the person will wear. HSG53 and INDG479 (revised 2025) set out how to do that. A pass on a different brand, or on a sample mask in the store, does not carry over. Repeat the test if the model, size or material changes, or if the wearer’s face changes (weight, dental work, scarring). Facial hair at the seal breaks a tight-fitting facepiece; the answer is a different type of RPE, not a tighter strap. A fluid-resistant surgical mask is not an FFP3 and does not become one because someone has written “PPE” on the box.
Training has to cover why the item is worn, how to put it on and take it off, how to check it, what it will not do, and where it is stored. A signature on an induction sheet is a weak record if the person cannot don the RPE they were issued.
The mark is product law, not a method statement
Workplace-use law and product law answer different questions. Regulation (EU) 2016/425, as it applies in Great Britain, and the Personal Protective Equipment (Enforcement) Regulations 2018, govern design, manufacture and placing on the market. Annex I splits PPE into three categories by the risk it is meant to protect against.
Category I is minimal risk only: superficial mechanical injury, weak cleaning materials or prolonged water contact, hot surfaces not above 50°C, sunlight (not looking at the sun), and ordinary weather. Category II is everything that is neither Category I nor Category III. Category III is the serious list: hazardous substances, oxygen deficiency, harmful biological agents, ionising radiation, high heat (effects comparable to at least 100°C air), extreme cold (comparable to −50°C or below), falls from height, electric shock, drowning, chainsaw cuts, high-pressure jets, bullets and knives, and harmful noise. Category III needs ongoing third-party assessment. Hearing protection sits in Category III under this Regulation.
From 1 October 2024 the Product Safety and Metrology etc. (Amendment) Regulations 2024 recognise valid CE marking indefinitely for PPE placed on the Great Britain market, alongside UKCA. Either mark is acceptable in England, Scotland and Wales if the underlying conformity assessment is valid. “Indefinite” means no end date has been set; it is not a promise that the rule can never change. A UKCA mark based on a UK Approved Body, and a CE mark based on an EU notified body, are not interchangeable stamps you can add yourself.
Northern Ireland is different. Under the Windsor Framework, PPE placed on the NI market must meet EU product rules and carry CE marking. UKCA alone is not enough for NI. Where a UK approved body has done the assessment for the NI market, the CE mark is accompanied by the UKNI indication, and that combination cannot be placed on the EU market.
A mark means the product was assessed for the essential health and safety requirements of the PPE Regulation. It does not select the assigned protection factor, the glove cut level, the helmet’s chinstrap requirement, or the need for a compatibility check with the harness. Buying the cheapest marked item that looks right is a purchasing decision, not an assessment.
What to keep straight on site
Assess the work first and record why PPE is still needed. Name the standard the item must meet only after that, and only the standard that matches the residual risk. Issue it free to employees and limb (b) workers, in a size that fits, with storage and a way to get a replacement before they carry on with the task if it fails. Face-fit tight-fitting RPE to the model worn. Do not treat a surgical mask, a dust mask with no class marking, or a “CE” sticker from an online marketplace as evidence of either product compliance or workplace suitability. Check whether the job is in Great Britain or Northern Ireland before you accept UKCA-only stock.
Guidance only, based on the law and HSE publications current at October 2026. It is not a legal opinion on your work or workplace.