In brief
Ask a South African employer how many people its safety system covers and it will give you a headcount. Ask how many people are on its premises on a normal Tuesday and the number is usually far larger, sometimes by a factor of ten. A school has staff and it has learners. A hospital has staff and it has patients and visitors. A hotel has staff and it has guests. An office block has staff and it has clients in reception, couriers at the loading bay and a contractor's team on the roof. Section 9 of the Occupational Health and Safety Act 85 of 1993 imposes a duty owed to all of them, in terms that do not mention employment at all. [1] The reporting duty in section 24 is written the same way, around "any person" rather than any employee. [1] And the safety net that caps an employer's exposure when an employee is hurt, section 35 of the Compensation for Occupational Injuries and Diseases Act, does not extend to a person who is not an employee. [2] So the population the file does not count is the population against which the employer's exposure is uncapped. This article sets out what section 9 actually says, what evidence of compliance with it looks like, and why Britain publishes a number for it that South Africa does not.
What section 9 actually says
The Act deals with employees in section 8 and with everybody else in section 9. Section 9 is headed "General duties of employers and self-employed persons to persons other than their employees", and section 9(1) reads:
"Every employer shall conduct his undertaking in such a manner as to ensure, as far as is reasonably practicable, that persons other than those in his employment who may be directly affected by his activities are not thereby exposed to hazards to their health or safety." [1]
Section 9(2) places the same duty on a self-employed person, in respect of both that person and others directly affected by the undertaking. [1] The wording of the Act is reproduced as published, which is why the pronouns are as they are.
Four features of that sentence matter, and three of them are usually missed.
It is a duty about the undertaking, not about the workplace. Section 8 asks an employer to provide and maintain a safe working environment. Section 9 asks something different: that the undertaking be conducted so that other people are not exposed to hazards by it. The obligation attaches to what the business does, wherever its activities reach, rather than only to the premises where its own staff work. [1]
It does not depend on the person being anywhere in particular. There is no requirement that the affected person be on site, be a visitor, have been invited, or have signed anything at reception. The test is whether the person may be directly affected by the employer's activities. [1]
It is narrower than the British equivalent, by one word. Section 3(1) of the Health and Safety at Work etc. Act 1974 uses the phrase "persons not in his employment who may be affected thereby". [3] Section 9(1) of the South African Act says "directly affected". [1] That word does real work: a chain of consequence that a British tribunal might accept may fall outside the South African duty. Employers should not assume that British case law on section 3 maps across without qualification, and we do not present it as though it does.
It is backed by the same criminal penalty as the rest of the Act. A contravention is an offence under section 38, carrying a fine not exceeding R50 000 or imprisonment for a period not exceeding one year, or both. [1]
The reporting duty is written around "any person"
The provision that catches employers out in practice is not section 9 but section 24, because section 24 is the one with a deadline attached.
Section 24(1) requires the reporting to an inspector of each incident occurring at work, or arising out of or in connection with the activities of persons at work, or in connection with the use of plant or machinery, in which or in consequence of which "any person dies, becomes unconscious, suffers the loss of a limb or part of a limb or is otherwise injured or becomes ill" to a degree serious enough to threaten death, a permanent physical defect, or at least 14 days away from work or the usual activity. It applies equally where a major incident occurred, or where "the health or safety of any person was endangered" in the specified circumstances. [1]
Any person. Not any employee. A learner who loses a finger in a school workshop, a patient injured by a contractor's equipment in a hospital corridor, a guest hurt when a hotel lift fails, a courier struck by a forklift on a loading bay: on the face of the section these are reportable incidents, reportable by the employer or the user of the plant or machinery concerned. Most incident registers we would expect to find in a South African business are built from the payroll, so an event involving a person who is not on it does not reach the register at all, and therefore does not reach the inspector.
The asymmetry nobody prices
There is a further consequence, and it runs the opposite way to intuition.
When an employee is injured at work, section 35(1) of the Compensation for Occupational Injuries and Diseases Act 130 of 1993 provides that no action lies by that employee, or a dependant, for the recovery of damages against the employer in respect of the occupational injury or disease, and that no liability for compensation arises on the employer's part save under that Act. [2] The employer's exposure for its own staff is channelled into the Compensation Fund and, in that sense, capped.
A person who is not an employee is not in that system. Section 35 does not bar their claim, because it is written about employees. Their route is an ordinary civil claim for damages, decided on ordinary principles, with no statutory ceiling.
So the arithmetic of an employer's real exposure is the reverse of the arithmetic of its safety file. The file is thickest where the exposure is capped, and thinnest or absent where it is not.
Britain counts them. We could not find a South African equivalent.
This is where the numbers become instructive, and where we have to correct our own earlier work.
The Health and Safety Executive published its provisional annual fatal injury figures for Great Britain on 01 July 2026. They recorded 126 workers killed in work-related accidents in 2025/26, the lowest number ever recorded in a single year. [4][5] Published article 12 on this site was written from that release and reported that figure.
The same release recorded 104 members of the public killed in work-related accidents in 2025/26, up from 96 the previous year. Of those 104, 32 died on railways and 59 in service sector industries, including 23 in health and social work. [4][5] Article 12 did not mention it, and that omission is the reason this article exists.
Read together the two figures say something a single figure cannot. Non-employee deaths are close in number to worker deaths, and they are rising while worker deaths fall. Britain reports them as a separate series because its Act imposes them as a separate duty, in section 3. [3] South Africa has the equivalent duty in section 9 but, as far as we could establish from the Department of Employment and Labour's published statements and inspection reports, publishes no comparable series separating harm to non-employees from harm to workers. We record that as a search that came up empty rather than as a finding that no such data exists, because the absence of a published series is not proof that the figure is not held.
What follows for a South African employer does not depend on the local number. The duty is in force, the reporting provision is written around any person, and the civil exposure is uncapped. An employer reading the British split is reading the shape of a risk it already carries and does not measure.
Who is actually on your premises
The practical question is not legal, it is clerical: who are these people, and does anything in the file name them?
An independent school on one campus has educators and support staff on the payroll, and it has learners in classrooms, science laboratories and workshops, boarders in a hostel overnight, parents at a sports fixture, an appointed transport operator, caterers, groundskeepers and a building contractor in the holidays. On a match day the population on site can exceed the payroll several times over, and the hazards that reach it are the school's own activities.
A private hospital or clinic has clinical and administrative staff, and it has patients who are by definition more vulnerable than a healthy adult, visitors, independent practitioners who are not its employees, medical gas and waste contractors, and equipment technicians. It is worth noting that health and social work accounted for 23 of Britain's 104 public deaths. [4]
A hotel or guesthouse has staff, and it has guests asleep on the premises overnight, which changes every assumption about evacuation, and function guests, and a kitchen and plant room that guests never see but are affected by.
A multi-tenant office building has each employer's own staff, and it has every other tenant's staff, clients waiting in reception, couriers, and the cleaning, security and lift contractors whose activities affect all of them.
In each case two further provisions bear on the same population. Section 37 deals with the acts of mandataries, that is contractors, and provides that a written agreement recording the arrangements between the parties can affect liability, which is why a contractor on your premises is a section 9 question as well as a section 37 one. [1] Section 10(1) places a duty on any person who designs, manufactures, imports, sells or supplies an article for use at work to ensure, as far as is reasonably practicable, that it is safe and without risks to health when properly used. [1] Between them, sections 9, 10 and 37 describe an Act that was never written to stop at the payroll.
What evidence of section 9 compliance looks like
Section 9 does not ask for a document. It asks that the undertaking be conducted in a particular way, so far as is reasonably practicable. But "reasonably practicable" is decided after something has happened, on the record that existed before it happened, which means in evidential terms section 9 asks for exactly four things, none of which is exotic.
A risk assessment whose scope includes people the business does not employ, naming them as populations rather than as an afterthought: learners, boarders, patients, visitors, guests, tenants, contractors' staff, the public passing the hoarding.
Controls recorded against those populations, and dated. An evacuation plan that accounts for sleeping guests or for learners in a laboratory is a different document from one that accounts for staff at desks.
Contractor arrangements in writing, because section 37 makes the written agreement legally material, and because a contractor's activities are the most common route by which an employer's undertaking reaches someone it does not employ. [1]
An incident register that accepts a person who is not on the payroll, so that a section 24 event involving a visitor, a learner or a guest can be recorded and reported at all. [1]
A business can have every one of these and still have no separate section 9 folder, which is the right outcome. The point is not a new file. The point is that the existing files are scoped to the wrong population.
GRC Shop view
Everything above this line is the Act and two published statistical series. What follows is our reading of it.
We think section 9 is the clearest illustration we have yet found of why compliance fails quietly rather than loudly. Nobody decides to exclude learners or guests from a risk assessment. The exclusion happens because the payroll is the only list in the business that is complete, current and machine readable, so every safety process that needs a population quietly borrows it. The register is built from the list that exists, and the duty is measured against a list nobody keeps.
That is also why this one does not embarrass anybody. A safety officer is appointed by the employer, works to the employer's structure and reports on the employer's people. A consultant is engaged to bring a file up to standard, and the standard everyone recognises is built around employees, appointments and registers. An auditor tests the system that is in front of them. None of the three is asked, on the day they do their work, who else was in the building. The answer changes anyway: a school's population changes every term, a hospital's every shift, a hotel's every night, and an office block's every time a tenant signs or a contractor arrives. So a correct section 9 position on the day of the audit is not evidence of a correct one eight months later. It is evidence about that day.
Audits expire. Our system keeps your compliance current. The audit is fine. What fails is afterwards, because closing items out happens in email while the evidence scatters across folders, so a year later the report still reads clean and the file no longer matches it. That is not neglect, it is that nothing holds the pieces together between audits. GRC Shop runs one managed, live compliance record, with the OHS app as the first and currently the only app on the platform, and the reason that matters here is narrow and concrete: a live record can hold a population that changes, date the controls against it, and keep the contractor agreements and the incident register attached to the same file rather than in three places.
Our forecast, and it is a forecast rather than a fact, is that this is where South African enforcement goes next, for the same reason it went there in Britain. A regulator that has driven down the visible injuries to its own workforce starts asking about everybody else, because that is where the remaining number is. The Department is currently scaling its inspectorate and running joint operations that arrive unannounced. An inspector standing in a school hall or a hospital corridor is standing in a room full of people who are not on the payroll, and section 9 is already in the Act they are enforcing.
If you want the population on your premises reflected in your compliance record rather than only your headcount, get a quote at https://www.grcshop.co.za/get-a-quote
Abbreviations
- COIDA: Compensation for Occupational Injuries and Diseases Act 130 of 1993
- HSE: Health and Safety Executive (Great Britain)
- HSWA: Health and Safety at Work etc. Act 1974 (United Kingdom)
- OHS: Occupational Health and Safety
- SME: small and medium enterprise
References
The sources below are external links to third-party websites. We link only to publicly accessible pages and check periodically that the links still work.
[1] Republic of South Africa, "Occupational Health and Safety Act 85 of 1993, sections 1 (definition of workplace), 8, 9, 10, 24, 37 and 38", 1993. https://media.lawlibrary.org.za/media/legislation/369/source_file/d1068c7e542ae5f5/1993-85.pdf
[2] Republic of South Africa, "Compensation for Occupational Injuries and Diseases Act 130 of 1993, section 35 (substitution of compensation for other legal remedies)", 1993. https://www.gov.za/sites/default/files/gcis_document/201409/act130of1993.pdf
[3] United Kingdom, "Health and Safety at Work etc. Act 1974, section 3 (general duties of employers and self-employed to persons other than their employees)", 1974. https://www.legislation.gov.uk/ukpga/1974/37/section/3
[4] Health and Safety Executive, "Latest annual work-related fatalities published", 01 Jul 2026. https://press.hse.gov.uk/2026/07/01/latest-annual-work-related-fatalities-published-2/
[5] British Safety Council, "Britain records lowest-ever annual worker fatalities, HSE statistics show", Jul 2026. https://www.britsafe.org/safety-management/2026/britain-records-lowest-ever-annual-worker-fatalities-hse-statistics-show