Universities, Safeguarding and Duty of Care: Preparing for 2026-27

Moving into 2026-27, the central question of what universities legally owe their students remains unresolved — but the landscape around it has changed. A run of new legislation, regulation and case law has materially hardened the expectations placed on institutions, even as the duty of care itself stays undefined. For the professionals holding the risk day to day, 2026 is the year the scaffolding got heavier while the foundations stayed uncertain.

The duty of care question

The legal position has not fundamentally shifted. Campaigners continue to pursue a statutory duty requiring universities to take reasonable care against foreseeable harm, while institutions press for clearer regulatory expectations. The debate returned to Parliament in January 2026, but the Government has so far preferred a non-legislative route. Meanwhile institutional responsibilities continue to arise in a fragmented way through health and safety law, the Equality Act, contract law, human rights law and a patchwork of sector guidance.

The anchoring case remains Abrahart v University of Bristol. Its lasting significance is the anticipatory nature of the reasonable-adjustments duty: it arises once a student's disability is evident to even one member of staff, including through what a student says or does. That places real weight on the judgement of tutors, lecturers and front-line staff, not just specialist services.

In place of legislation or improved regulatory clarity, the Government's centrepiece has been the National Review of Higher Education Student Suicide Deaths, published in May 2025 by the National Confidential Inquiry into Suicide and Safety in Mental Health. It found a familiar catalogue of issues: poor monitoring of disengagement, silos between academic and support functions, and inconsistent practice on restricting access to means. Three-quarters of the deaths examined were undergraduates, nearly a quarter of them in their first year. Its recommendations included mandatory mental health and suicide-prevention training for all staff, greater involvement of families, and a duty of candour requiring institutions to be open with families after a suspected suicide.

That duty of candour is now its own live issue. The broader statutory duty — the "Hillsborough Law", carried by the Public Office (Accountability) Bill and intended to apply to public authorities including universities — stalled over how it would apply to the intelligence services but did not fall; it now sits at report stage and is widely expected to become law later in 2026. For universities the direction of travel is clear: a duty to engage openly with inquiries and inquests, such as after a student death, ultimately backed by criminal sanction for those who obstruct or mislead.

The Crime and Policing Act 2026

The most significant legislative development is the Crime and Policing Act 2026, which received Royal Assent on 29 April 2026. It is extensive with fifteen parts spanning antisocial behaviour to terrorism but with several provisions land squarely on the desks of university safeguarding leads.

Mandatory reporting of child sexual abuse

Implementing an Independent Inquiry into Child Sexual Abuse recommendation, the Act establishes England's first statutory duty to report child sexual abuse. It applies to anyone undertaking regulated activity with children, triggered where a person is told about abuse by the child or perpetrator, or witnesses it. This matters more for higher education than it might appear: universities routinely engage with under-18s through outreach and widening participation, summer schools, foundation years, sports provision and 17-year-old first-year entrants. The scope is specific — not a general duty to report all abuse, or to report on indicators alone — so institutions should train precisely rather than over-correct. The duty is not yet live, awaiting a commencement date and statutory guidance; that lead-in is the window to map which roles are caught and brief designated leads, not a reason to wait.

Spiking

A stand-alone offence of administering a harmful substance explicitly captures spiking — a clearer legal anchor for prevention, response and signposting in a sector whose night-time economy and students' union venues sit at the heart of campus life.

Intimate image abuse

New offences cover the taking, recording or copying of intimate images without consent, alongside the creation and supply of "nudification" tools — directly relevant to student-on-student harm and image-based abuse institutions increasingly find themselves managing.

Cuckooing

New offences targeting the takeover of a vulnerable person's home are relevant wherever students are at risk of exploitation, including in student housing — incidents typically linked to county lines activity have risen, though statutory guidance for police is still awaited.

Corporate liability

The Act also extends a reformed "identification doctrine" to all criminal offences, broadening the basis on which an organisation can be held criminally liable for the acts of its senior managers. For governing bodies, it is a reason to look again at how decision-making authority maps onto regulatory and safety risk.

DBS: the supervision exemption goes

Flowing from the same Act is a change every institution that works with under-18s must diarise: from 1 September 2026, the supervision exemption is removed from the definition of regulated activity.

Until now, certain roles — teaching, training, instructing, caring for or supervising children — fell outside regulated activity if carried out under the day-to-day supervision of someone already in regulated activity. That exemption disappears. From September, those roles count as regulated activity in their own right where carried out frequently or meeting the period condition, making post-holders eligible for an enhanced DBS check with children's barred list information.

The group most affected is volunteers — with obvious resonance for higher education's reliance on student ambassadors, peer mentors, outreach helpers, coaches and open-day volunteers. Two further points carry weight. It becomes an offence for a barred person to work in one of these roles, and for an employer to knowingly place them there; and where someone in a previously-supervised role is removed for risking harm to a child, the employer is now under a legal duty to refer them to the DBS. Eligibility is for the highest level of check rather than a blanket requirement, but institutions should be reviewing now which roles and volunteer arrangements are caught.

Free speech and the Sussex judgment

If one event reshaped the regulatory mood this year, it was the High Court's decision in R (University of Sussex) v Office for Students [2026] EWHC 984 (Admin) on 29 April 2026.

The OfS had fined Sussex £585,000 over breaches of free speech registration conditions it found, following a long investigation rooted in the controversy surrounding Professor Kathleen Stock. Mrs Justice Lieven quashed the decision in full on five grounds. Most damagingly, she found strong evidence of predetermination: that a fair-minded observer would see a real possibility the regulator had approached the matter with a "closed mind". She also held that the OfS had misdirected itself on the meaning of freedom of speech, exceeded its jurisdiction, and adopted an unworkably broad reading of what counts as a "governing document" under the Higher Education and Research Act 2017.

There is an important practical footnote. The OfS's free speech guidance, Regulatory Advice 24 (RA24), sets out a three-step compliance process. The court did not reject that framework, but rejected the "absolutist" way the regulator applied it — moving from "this policy could restrict lawful speech" to "this is therefore a breach" without genuine proportionality analysis. Because several of RA24's worked examples model that reasoning, parts of the guidance have effectively been overtaken. The OfS declined to appeal on 19 May 2026 and said it would learn lessons — so providers should expect RA24 to be revised, and treat the existing examples with caution meanwhile.

For safeguarding, the case crystallises a tension: the duty to protect students from harm now sits alongside a hardening duty to secure freedom of speech, and policies drafted to protect one value need to be tested against the other.

Harassment and sexual misconduct: condition E6 beds in

That balance is written directly into the regulatory framework through condition E6, the OfS's harassment and sexual misconduct condition, which came into force on 1 August 2025 and is now a settled compliance reality for 2026-27.

E6 requires every provider to maintain a single, accessible source of information on its policies and procedures for harassment and sexual misconduct, covering both staff-to-student and student-to-student conduct. It mandates accessible reporting routes, including anonymous and online options; requires meaningful, evidence-based training for students and investigators; and prohibits non-disclosure agreements used to silence students. On staff-student relationships, the OfS stopped short of an outright ban, but made clear a ban could make a "significant and credible difference" and that mere disapproval will not suffice.

Crucially, condition E6.8 requires providers to comply consistently with freedom of speech — the Sussex tension in miniature, in a live registration condition. It is why so many institutions have routed E6 work through the same governance channels as their Prevent and safeguarding arrangements.

On the horizon: Martyn's Law and dates for the calendar

Not every change for 2026-27 has landed. The largest still to come is Martyn's Law, the Terrorism (Protection of Premises) Act 2025, brought in over a deliberately long lead time. The Home Office published statutory guidance in 2026, but the duties are not expected to be enforced until around April 2027, with the Security Industry Authority as regulator. For 2026-27, the task is preparation rather than compliance — but preparation that must start now, since the work is estate-wide and cannot be done in a single term.

Higher education sits squarely in scope, and unlike schools it gets no special treatment. Universities follow the general model: standard tier where 200 to 799 people may reasonably be present, enhanced tier at 800 or more, and most institutions will hold premises in both. Standard duty is about preparedness — documented evacuation, invacuation, lockdown and communication procedures, and staff who know how to use them. Enhanced duty adds a requirement to assess and reduce vulnerability, keep a security document, and name a senior individual accountable. The enforcement teeth are real: penalties run to £10,000 in the standard tier and up to £18 million, or five per cent of worldwide revenue, in the enhanced tier. For a sector built around lecture theatres, graduation ceremonies, open days and students' union venues, this is a safeguarding-adjacent duty that needs a named owner and a plan, not an item left to estates alone.

Taken with the dates already noted — the supervision exemption on 1 September 2026, mandatory reporting awaiting commencement, the removal of the three-year limitation period for child sexual abuse claims from mid-2026, and the expected passage of the Public Office (Accountability) Bill — 2026-27 is a year for a live compliance calendar, not a static policy shelf.

Where does this leave us?

The defining feature of recent years — universities "holding the risk" in the most complex cases without a clear statutory framework — persists. What has changed is that the space around that gap has filled in. Mandatory reporting, DBS reform, Martyn's Law, condition E6 and the free speech regime each impose concrete, enforceable expectations that together describe what "keeping students safe" now requires — even as the duty of care debate rumbles on unresolved.

For staff on the ground, the underlying discipline is unchanged. When a concern arises about an adult student, the questions remain whether they are over 18, whether they have care and support needs, and whether they are at risk of or experiencing significant harm. Where those apply, an adult-at-risk framing under the Care Act 2014 supports proportionate information-sharing and justifies contacting next of kin unless doing so would create a safety risk. Data protection should never be a barrier: where someone's vital interests are engaged, sharing a concern is not breaching confidentiality, it is extending it. If in doubt, share.

The wider truth also holds: universities cannot keep students safe alone, depending on NHS, mental health, social work and policing partners who remain overstretched. Whatever the outcome of the duty of care debate, the immediate task is the same — to meet each new obligation well, keep the balance with free speech in view, and ensure that those making judgement calls at the front line are trained, supported and never left holding the risk by themselves.