Writing a health and safety policy when nobody works on a factory floor

A health and safety policy for a company with no factory floor

A health and safety policy is the document a company writes down to show how it keeps the people working for it safe, physically and mentally, at whatever kind of work they actually do. Most templates online assume a warehouse, a workshop or a shop floor. A small company that works from laptops, with no office, no vehicle and no production line, needs a policy that says so plainly, not a rewritten factory checklist.

Two readers use this page. A procurement or compliance contact evaluating Ripe Leads wants to know whether a real health and safety policy exists and what it actually commits to. An owner of a small, mostly remote business has been asked for a health and safety policy statement by a client, an insurer or a tender, and needs to know what belongs in one before writing it.

Ripe Leads, the trading name of UAB "Kofi Tech", publishes its own version as DSS-1, the Occupational Safety and Health Policy, one of thirteen documents on its sustainability page. It states plainly that "the Company works at a computer and carries out no production or physically hazardous work", which shapes everything else in it.

When the law requires one, and what changes at a small headcount

Health and safety law does not exempt small companies just because there is no factory floor. The EU Framework Directive on occupational safety, 89/391/EEC, applies to every sector, public and private, and binds employers "regardless of size", with only narrow exceptions for certain public or civil-protection activities. Article 6 puts the general duty on the employer directly: take the measures necessary for workers' safety and health, prevention, information, training, adequate organisation and means, applying prevention principles such as avoiding risks and combating them at source, and never at the worker's own expense.

Article 7 requires the employer to designate a competent person for this function, or use an external service where in-house competence is lacking, but it also lets Member States define, by activity and size of undertaking, categories where the employer may perform the function personally. Lithuania uses that room: under its Law on Safety and Health at Work, an employer must appoint an OSH specialist or service, or contract one externally, sized to the company's activity, headcount and risk. Lithuania's labour inspectorate publishes guidance stating that a company with no more than nine employees may have its head, or someone the head authorises, perform that function personally, though that specific number sits in guidance restating the underlying model regulations rather than in the statute's own text. A separate duty in the same law sets a training obligation that does bind every employer regardless of size: no worker may start work without instruction on how to do it safely, repeated whenever the risk changes.

For a company that works entirely at a screen, the more directly relevant EU rule is the Display Screen Equipment Directive, 90/270/EEC. Article 3 requires the employer to analyse workstations for risks to eyesight, physical strain and mental stress; Article 7 requires the working day to be organised so screen work is periodically interrupted; Article 9 entitles a worker to an eye test before starting display-screen work and at regular intervals after, with special appliances provided at no cost if normal correction will not do. That directive covers office and home-based screen work on exactly the same footing, because its parent directive, 89/391/EEC, is size-independent by design.

What a health and safety policy for a small business should cover

A health and safety policy for a small, screen-based business should state, in concrete terms rather than general language, what a compliant workstation looks like: a proper desk and chair, screen height and distance, and a rule for extended laptop use, since laptop screens and keyboards are not built for four or eight hours a day without a stand or a separate keyboard.

It should set a break rule, an eye-test entitlement and who pays for it, and a plain statement of who is responsible for organising it, since the Display Screen Equipment Directive puts that duty on the employer directly rather than leaving it to the worker to ask.

It should also cover what happens after something goes wrong: a reporting deadline, who investigates, and whether or when the State Labour Inspectorate gets told, plus an annual workstation risk assessment that gets logged rather than done once and forgotten.

A policy that goes beyond the legal minimum might also address working hours and a right to disconnect outside them. Neither the EU framework directive nor the display screen directive sets out such a commitment, so where one appears in a company policy, treat it as that company's own undertaking and check whether it names the hours it covers.

Judging someone else's health and safety policy statement

The fastest way to tell a copy-pasted health and safety policy from a real one is whether it names the actual work being done. A policy that talks about machinery guarding or personal protective equipment for a company that only works at a laptop was written for a different business and never adapted.

Check for numbers rather than intentions: a stated break interval, a stated eye-test frequency, a stated incident-reporting deadline. A policy that only says the company "takes health and safety seriously" without a single number attached is a statement of intent, not an operating document.

Check who is named as responsible. Lithuanian law lets the head of a company with only a handful of employees perform the OSH function personally rather than hiring a specialist, so a small company naming its director for this role is using the flexibility the law itself provides for that size of employer.

Check whether the policy is reviewed on a stated schedule or was written once and never touched. A policy with no review date attached is a document, not a live system.

Inside DSS-1, our own occupational safety and health policy

DSS-1 applies to "the director and employees", and to partners "to the extent their contract says so" (clause 1.2), and states plainly that the Company "carries out no production or physically hazardous work" (1.3), a scope statement rather than a claim that no risk exists at all.

The workstation standard is concrete: a desk, an adjustable chair with back support, and adequate daylight or artificial light (2.1); screen top edge at eye level, at least 50 centimetres away (2.2); a separate keyboard, mouse or stand once laptop use exceeds four hours a day (2.3); cables and power supplies kept clear of walkways, using only manufacturer or certified equipment (2.4).

A 5 to 10 minute screen break is required every hour (3.1), and the Company pays for a preventive eye test once every two years (3.2). Working time follows the agreed norm, with overtime requiring written agreement (4.1), and DSS-1 sets a right to disconnect between 19:00 and 08:00, on weekends and during leave, stating that "no reply to messages is expected" outside pre-agreed on-call duty (4.2), the Company's own choice, beyond what any statute requires. Harassment, bullying or violence is handled under our separate SKT-1 complaints procedure (4.3).

Every new starter gets a briefing on the policy with a signed acknowledgement before work begins (5.1), and an annual refresher runs alongside module M4 of our EIP-1 training programme (5.2). An accident, health problem or dangerous occurrence has to reach the director "at once and within 24 hours" (6.1); the director logs it, finds the cause and sets a preventive measure (6.2), and reports it to the State Labour Inspectorate where the law requires it (6.3). A workstation risk assessment runs annually and is logged in a register (7.1).

Review, training and reporting: how DSS-1 stays alive

The director reviews DSS-1 annually and approves any change by order (7.2), the same cadence every one of Kofi Tech's thirteen governance documents follows. The annual workstation risk assessment (7.1) and the accident-reporting process (6.1 to 6.3) run on a fixed schedule rather than only when something happens to prompt them, and training on the policy repeats every year through EIP-1 module M4 rather than once at onboarding and never again.

DSS-1 was approved by director's order effective 22 September 2026 and is published in full at its own anchor on the sustainability page, mirrored at kofitech.eu/tvarumas.

What DSS-1 does not prove

DSS-1 is self-authored and approved internally by UAB "Kofi Tech". It has not been inspected, audited, certified or verified by any outside body, and Ripe Leads makes no safety certification, label or score claim about it. From 27 September 2026, the Empowering Consumers Directive, (EU) 2024/825, bans a self-awarded sustainability label outright, one more reason this page carries no badge.

The policy describes a standard and a process, not a record of every incident or risk assessment carried out under it. Those records sit in the internal registers the policy establishes, not in the published text. A reader evaluating this document should treat it the way this page recommends for any health and safety policy: as a statement of commitment, checked against the actual work being described, not as proof that nothing has ever gone wrong.