Calls for a new statutory duty of care for universities are politically understandable.
But they misdiagnose the problem. Higher education institutions already operate within a dense framework of duties. The real challenge is inconsistent interpretation, messy system boundaries, and a lack of confidence that existing obligations are being applied well.
The idea has a certain inevitability to it. Something goes wrong, a student is harmed, and the instinct is to reach for a simple mechanism to prevent recurrence – make universities legally responsible, in black and white, and they will do better.
It’s an emotionally compelling proposition. It’s also operationally misdirected.
Providers in England already sit within a complex set of responsibilities – common law duties, duties under the Equality Act, safeguarding responsibilities, health and safety requirements, and regulatory obligations under various regulators.
The question is not whether universities have responsibilities. They do. The critical question is why, despite this, we still see uneven practice, disputes about accountability, and low confidence in how student risk is identified and managed.
The answer is not “no duty”. The answer is that existing duties are applied inconsistently, in a system where the boundaries between universities and statutory services are blurred, and where misunderstandings – particularly around information sharing and existing statutory responsibilities – lead to poor outcomes.
Understandably, any sort of reliance upon the common law duty of care is subject to significant criticism from those advocating for the establishment of a statutory duty. The common law duty describes an obligation to take reasonable steps to prevent foreseeable harm. Determining whether such a duty exists only takes place after harm has taken place – by a court.
Whether such a duty exists in a given case is legally complex and typically assessed using tests such as the Caparo test, which considers foreseeability, proximity, and whether it is fair, just, and reasonable to impose a duty. Applying these principles to universities is not straightforward. Universities are therefore expected to support students through reasonable and proportionate measures without assuming responsibilities that would sit with parents, guardians, or statutory agencies.
When taking into account the complexity and lack of utility of the common law duty, alongside the extensive statutory framework which also applies to universities, the result is a distinctive legal environment. Universities serve diverse adult populations, alongside under-18s, but unlike schools they operate without a single, clearly codified safeguarding framework. Instead, they must interpret duties drawn from multiple statutes not designed with higher education in mind, creating ongoing uncertainty about the scope of responsibility and appropriate institutional action.
When people argue for a statutory duty of care, they are often trying to solve a real problem – inconsistency, variability, and the fear that lessons are not being learned. But adding a new duty on top of existing duties doesn’t automatically solve any of that. It may simply create a new label for old failures.
Consistency, not law
Across the sector, there are examples of excellent safeguarding and student support practice. There are also approaches that are fragmented, under-developed, or overly dependent on individual staff confidence and local culture.
That variation isn’t surprising. Universities vary in size, mission, student demographics, commuter and residential patterns, and how student support is organised. Yet student risk doesn’t respect those organisational differences. Similar situations recur across institutions, whether that’s a student disclosing self-harm, serious mental ill health emerging during study, domestic abuse, harassment, estrangement, homelessness, substance misuse, or an acute crisis requiring rapid multi-agency response.
In practice, universities interpret what counts as “reasonable steps” in these contexts in very different ways. The result is a postcode lottery of threshold decisions, escalation routes, information-sharing practices, and approaches to family engagement.
If we want fewer tragedies and better safeguarding, that inconsistency is where attention should go.
The key test is whether a statutory duty would change behaviour in the real world, not whether it’s morally satisfying or politically saleable.
A simple logic model helps. If the input is a new statutory duty, what activities does that reliably trigger across a diverse sector, and what outputs follow?
In reality, many institutions would respond first by doing what organisations do under legal uncertainty – protect themselves. That typically means commissioning legal advice, rewriting policies, expanding documentation, formalising risk panels and escalation structures, increasing training, and narrowing discretion for staff. Those steps may look like progress, but they don’t guarantee the outputs that matter – earlier identification of risk, faster access to appropriate support, clearer multi-agency roles, and consistent, competent decision-making.
Adult autonomy
There’s a further complication – universities educate adults, in the main. Safeguarding in higher education sits in a different ethical and legal terrain from schools. Students have autonomy, privacy rights, and legal capacity. Any duty that implicitly encourages intrusive interventions risks undermining those principles.
It’s not hard to imagine how this plays out. If staff feel they are being held liable for “clinical risk” they aren’t trained or resourced to manage, universities may respond by tightening “fitness to study” pathways, increasing coercive expectations of engagement, or relying more heavily on exclusionary decisions. A system can become safer on paper while becoming less humane in practice.
Such challenges cannot be overcome should a duty be established similar to that which exists between employers and employees within the UK. The duty of care owed by employers to employees is historically and doctrinally grounded in control, dependency, and risk creation. Employers organise work, design systems, set hours, provide equipment, and direct conduct within environments that employees cannot realistically redesign or avoid.
The risks in question within such a relationship are by nature of the employment relationship itself and arise from how labour is structured and managed. The employer therefore exercises operational control over both the hazard and the conditions of exposure, and the employee’s autonomy is correspondingly constrained by the terms of such a contract. It is this combination that makes a statutory duty of care coherent – responsibility follows control, and compliance can be expressed through preventable standards that can be enforced.
Such logic doesn’t translate well to the relationship between universities and students. Universities don’t organise students’ lives in the way employers organise work. They don’t create most of the risks associated with student mental distress – with such distress pre-existing for many – and they don’t exercise continuous control over students’ conduct, environment, or health.
Students are, mostly, autonomous adults, free to enter and leave, to refuse support, and to make decisions that fall outside institutional direction. Mental health crises and suicide are not products of an institutional process to the same degree as unsafe systems of work, but outcomes of complex, largely external causal factors.
To impose an employer-style duty of care on universities would therefore sever the historical link between control and responsibility, transforming a limited educational relationship into a quasi-guardianship role that neither reflects the reality of university authority nor provides a mechanism capable of preventing the harms in question.
The statutory services fault line
One of the most persistent issues in university safeguarding is the interface with the NHS, police, and local authorities.
Universities are not clinical or social care providers. They don’t diagnose, treat, or detain. Further, they aren’t responsible to assess whether an individual requires interventions under the Children Act 1989 or the Care Act 2014. Yet universities increasingly find themselves holding such risks because statutory services are inaccessible, thresholds are high, or pathways are unclear.
In that environment, calls for a statutory duty can operate as a kind of displacement activity. We focus on the institution that is visible and convenient – the university – rather than confronting the structural reality that serious mental ill health and immediate risk should be met by a functioning health and care system.
If the policy debate drifts into implying that universities should compensate for failures elsewhere, we create a perverse dynamic. Universities are pressured to hold risk without the tools, expertise, or remit to treat it. A statutory duty wouldn’t repair that boundary problem. It could entrench it, by reinforcing the assumption that universities are the default responsible actor when the problem is, at least in part, capacity and accountability in statutory services.
Information-sharing myths
Another recurring operational barrier is misunderstanding about information sharing. It’s common to see both universities and statutory agencies citing “GDPR” as a reason not to share information, sometimes correctly, often not.
The outcome is predictable. Statutory agencies lack visibility of risk that would help them intervene. Universities delay escalation for fear of breaching privacy. Families are excluded by default even where engagement could be lawful and helpful. Decisions become inconsistent and dependent on individual staff confidence.
A statutory duty of care doesn’t automatically clarify any of this. What would help is clear, scenario-based guidance that gives staff confidence about what they can share, when, and why – paired with shared protocols between universities and statutory partners.
If not a new duty, what then?
If we accept that the problem is implementation rather than legal absence, the agenda becomes more practical and more likely to improve outcomes. The Office for Students (OfS), as the regulator for higher education in England, is best-placed – and empowered by s.5 of the Higher Education and Research Act 2017 – to move the sector forward.
First, we need clearer guidance on applying existing duties. That means sector-wide clarity on what “reasonable steps” look like in common scenarios – escalation of risk, reasonable adjustments, safeguarding triage, placement risk, serious incident response, and family engagement. Not vague principles, but operational guidance that supports consistent practice.
Second, we need stronger regulatory assurance and minimum expectations. If students and families have low confidence, it isn’t enough to say duties exist. There must be visible assurance that compliance is tested and that poor practice has consequences. That requires auditable expectations around competence, escalation models, governance, and learning after serious incidents.
Finally, we need to repair relationships with the NHS, police, and local authorities. Universities need reliable multi-agency pathways with shared thresholds, named points of contact, agreed protocols, and clarity on who does what when risk escalates. This is the work that prevents universities being left holding clinical risk in isolation. However, it isn’t enough to direct providers to “form partnerships with NHS partners” in their area. Barriers to working alongside statutory agencies exist at all sides of the conversation, with students sometimes being treated as second-class citizens where agencies identify them as attending university.
A logic model asks the question – do the above proposals plausibly connect the problem being experienced to the outcomes being sought? When applied to concerns about student mental wellbeing and safeguarding, the core problems consistently identified are inconsistent practice, uncertainty among staff, fragmented institutional responses, and low confidence in accountability. These are problems of interpretation, application, and system coordination, rather than problems of legal absence.
Regulatory guidance grounded in existing legal and regulatory frameworks passes this test because it intervenes directly at the point where failure most often occurs – how duties are understood and enacted in practice. Unlike new legislation, guidance doesn’t merely restate responsibility. It articulates expectations, clarifies thresholds, and translates legal principles into operational decision-making frameworks that institutions can actually use.
From a logic-model perspective, the pathway is clear. Guidance changes the inputs available to institutions – shared definitions, common standards, and authoritative interpretation – which enables different activities, including consistent training, aligned policies, clearer escalation routes, and more confident engagement with external services. These activities generate tangible outputs – improved decision-making consistency, better documentation of safeguarding judgements, and more coherent institutional responses. Crucially, these outputs are logically and directly linked to the intended outcomes – safer practice, improved student experience, greater confidence for families, and stronger regulatory assurance.
Regulatory guidance also strengthens the wider system. By setting explicit expectations, it supports regulators to assess performance, challenge poor practice, and intervene. It enables universities to design support structures that align with both legal duties and statutory services. It creates a shared language across higher education, health, and social care, which is essential for early intervention and partnership working. Guidance aligns institutional behaviour, regulatory oversight, and cross-sector coordination around the same operational understanding.
Regulatory enforcement of such guidance would be essential to overcome the “voluntary” nature of a majority of existing good practice. OfS has recently exercised its authority to require providers in England to comply with their set standards under the E6 Condition of Registration. It’s still too early to determine the effectiveness of this measure but, if universities become fundamentally safer as a result, have we effectively seen a pilot of actually improving understanding of duty of care within higher education?
We’ll be here again
As the debate of 13 January 2026 was framed as “should we legislate or not”, we got predictable positions and limited progress. The government’s response relying upon the work of the Higher Education Mental Health Implementation Taskforce (HEMHIT) and Student Minds’ University Mental Health Charter has already been proven to not fully reassure advocates for a statutory duty.
Therefore, I fully anticipate government to find itself responding to the issue again. A more useful question would have been what would make safeguarding practice more consistent across the sector, and what would make statutory partners more reliable when risk escalates.
The uncomfortable point is that the most effective reforms aren’t headline-grabbing. They’re about guidance, assurance, governance, competence, and multi-agency capacity.
If the goal is fewer harms and better safeguarding, the most meaningful response is not a new duty. It’s requiring that the duties universities already have are applied consistently, and that they aren’t left substituting for statutory services that are meant to lead.