Every statutory duty on a group setting: the clause, how often it comes round, what we track, and what we don’t.
Every duty and clause below traces to the EYFS statutory framework for group and school-based providers (Department for Education, dated 14 July 2025, in force 1 September 2025), plus the cross-cutting employer laws that apply to any workplace. Clause numbers are the EYFS's own. Where we say “in build” we mean it is not live yet and we will not claim it until it is.
| The duty | Cadence | What NurseryGuard does today | What it doesn’t do |
|---|---|---|---|
| Group A: the sector-specific EYFS duties (Ofsted-inspected) | |||
| Safeguarding policy setEYFS 3.5–3.12 | One-off + continuous review | Prepares your source-grounded draft policy set, covering safeguarding & child protection, whistleblowing, attendance and mobile-phone/camera, for your DSL to review, adopt and e-sign; readiness self-check flags gaps. | Doesn’t adopt or implement the policies for you (the provider’s legal duty), and isn’t legal advice. Policy pack is drafted and awaiting your ratification before live use. |
| DSL designated + DSL trainingEYFS 3.4, 3.31 | Designation continuous; training every 2 years | Records who your DSL (and deputy) is and tracks the DSL training date with a two-yearly renewal prompt in the staff record. | Doesn’t act as your DSL, take safeguarding decisions, or deliver the DSL’s Annex C training course. |
| All-staff safeguarding training + inductionEYFS 3.30, 3.32–3.33 | Per-hire induction + every 2 years | Tracks each staff member’s safeguarding-training and induction dates and auto-schedules the two-yearly refresh the day a course completes. | The built-in training modules are in build with founding settings: today we track completion, we don’t yet deliver the course. Never a substitute for hands-on competence. |
| Safer recruitment & referencesEYFS 3.20–3.21 | Per-hire | A guided per-hire record that sequences references-before-recruitment, identity, qualifications and induction in the right order, and composes the EYFS 3.18 vetting record. | Doesn’t obtain references or make the hiring decision for you, and doesn’t judge whether a reference is satisfactory, that’s the setting’s call. |
| Enhanced DBS + vetting checksEYFS 3.15–3.17 | Per-hire + continuous | Records each person’s enhanced-DBS certificate number, the date obtained and who obtained it; tracks your own re-check policy and DBS Update Service status. | Doesn’t carry out the DBS check, and never tells you a DBS has “expired”: a DBS has no statutory expiry. Re-check prompts follow the policy you set, not an invented deadline. |
| Staff vetting record (like a single central record)EYFS 3.18 | Per-hire, held continuously | Maintains the per-staff vetting record the EYFS requires, covering qualifications, identity checks, references, DBS reference number, date and who obtained it, ready to produce on inspection. | This is the EYFS 3.18 vetting record, similar to a single central record but not a statutory one (that’s a schools/KCSIE duty, which does not bind PVI settings). We never call it a required “SCR”. |
| Disqualification + 14-day notifyEYFS 3.22–3.26 | Per-event, 14-day clock | Logs disqualification self-declarations and runs the 14-day Ofsted-notification clock as a tracked statutory deadline. | Doesn’t make the notification to Ofsted for you or decide whether someone is disqualified, it prompts and evidences; the provider acts. |
| Paediatric first aid (PFA)EYFS 3.37–3.39, 3.56, 3.64 | Cert every 3 years + daily cover | Tracks each PFA certificate’s three-yearly renewal and computes daily cover: at least one current holder on premises and on outings, present while children eat. | Doesn’t deliver first-aid training. PFA is face-to-face with your chosen provider; we signpost and track the certificate. We never sell or accept online PFA as compliant. |
| Staffing ratios + qualified leadEYFS 3.44–3.56 | Continuous (daily) | Room Check: a manual ratio check you run against your register by age band (1:3 / 1:5 / 1:8), with the manager-Level-3 and named-deputy conditions surfaced. | Live, integration-fed ratio sampling (from Famly check-ins) is in build; today Room Check is manual. It informs; it doesn’t deploy staff or replace the manager’s on-the-floor judgement. |
| The required-records spineEYFS 3.60–3.101 | Daily + per-event | A compliance diary for the staff-side statutory records: accident/injury, medication, complaints (28-day clock), risk assessment, evacuation, each logged with its countdown running, exportable as an inspection pack. | Doesn’t replace your management app’s child-side daily records (attendance register, key-person notes); keep Famly/Blossom/Tapestry for those; we hold the evidence they don’t. |
| Ofsted notificationsEYFS 3.10, 3.72, 3.78, 3.102–3.103 | Per-event, statutory clocks | A notification log with the 14-day clocks (serious harm, serious accident/illness/death, food poisoning affecting two or more children) tracked to the day; missing one is a criminal offence. | Doesn’t submit the notification to Ofsted for you or judge whether an event is notifiable, it prompts and evidences; the provider decides and reports. |
| Staff supervisionEYFS 3.34–3.35 | Continuous (no fixed frequency) | Records dated supervision arrangements per staff member so the trail exists on inspection. | Doesn’t conduct supervisions or set a frequency the framework doesn’t specify. We don’t invent a cadence. |
| Group B: the cross-cutting employer duties (every workplace) | |||
| Fire safety & risk assessmentFire Safety Order 2005 (+ EYFS 3.79–3.80) | Assessment reviewed regularly | The EYFS evacuation-procedure requirement (EYFS 3.80) sits in the records spine. The underlying fire risk assessment is available across the EveryGuard family’s Fire topic as a cross-sell. | Doesn’t carry out your fire risk assessment: that is a competent-person duty under the Fire Safety Order. Not part of the NurseryGuard core. |
| Health & safetyHealth and Safety at Work etc. Act 1974 (+ EYFS 3.79) | Continuous | EYFS premises and risk-assessment records are held in the diary. Broader H&S management is a cross-cutting employer duty served across the EveryGuard family. | Doesn’t manage your general health-and-safety regime or write your risk assessments for you. Not part of the NurseryGuard core today. |
| Food hygiene & allergensFood Safety Act 1990; allergen info law; FHRS | Continuous + per-child | The EYFS allergy & dietary duty (EYFS 3.64–3.65), covering information before admission, allergy action plans and anaphylaxis awareness, is grounded and in scope for the records spine. Upload your menu and AI drafts the 14-allergen matrix dish by dish, for your cook to confirm. | Doesn’t run your kitchen’s food-safety management, produce an FHRS rating, or give clinical/dietetic advice. The allergen matrix is a draft you confirm: never an auto-certificate. |
| Employment & working timeEmployment Rights Act; Working Time Regs; right-to-work law | Continuous + per-hire | Right-to-work and contract evidence can sit alongside the per-staff record. Recruitment, hours and guaranteed-hours tooling are served across the EveryGuard family (HireGuard). | Doesn’t run payroll, contracts, hours/rota, or right-to-work checks as a NurseryGuard core feature, and isn’t employment-law advice. |
| Data protection & ICO feeUK GDPR; Data Protection Act 2018; ICO fee | Annual ICO fee + continuous | Handles the setting’s data securely and can track your annual ICO data-protection fee renewal as a dated item. | Doesn’t register you with the ICO, write your privacy notices, or act as your data-protection officer. Not legal advice. |
Enforcement note: under the EYFS, non-compliance with a welfare requirements notice is a criminal offence, and employing a disqualified person can carry imprisonment. Cancellation of registration applies to every setting a provider runs, not just the one inspected. This page maps the duties; it does not assess whether any individual setting meets them, that is the provider’s responsibility, and where in doubt, take professional advice.
The clause numbers below are the EYFS statutory framework’s own. NurseryGuard prepares and chases the written evidence these duties require; holding a record never replaces carrying out the duty.
A group setting must have and implement written safeguarding policies and procedures, in line with its Local Safeguarding Partners. The set includes a safeguarding & child-protection policy (with the five things EYFS 3.6 requires it to cover), a mobile-phone/camera position, and (new since September 2025) a whistleblowing procedure and an attendance policy. Non-compliance with a welfare requirements notice is a criminal offence.
Prepares each of these as a deterministic, source-grounded draft from the EYFS clauses, filled with your own arrangements (your DSL, your LSP, your imaging-device rule), for your DSL to adopt and e-sign; the readiness self-check flags what’s missing.
Adopt or operate the policies for you, assume which LSP covers you, or give legal advice. The pack is currently drafted and awaits your ratification before live adoption.
Every setting must designate a practitioner to take lead responsibility for safeguarding, who liaises with children’s social care and the LSPs. The DSL must attend training consistent with the EYFS Annex C criteria, renewed every two years.
Records your DSL and deputy and tracks the DSL training date, prompting the two-yearly renewal before it lapses.
Act as your DSL, make safeguarding judgements, or deliver the Annex C training course itself.
All practitioners must be trained in line with Annex C and supported to implement the setting’s safeguarding policy; safeguarding training must be renewed every two years, and induction must cover safeguarding, evacuation and health & safety. Ofsted has raised inspection actions on safeguarding training.
Tracks each staff member’s training and induction dates and schedules the two-yearly refresh automatically the day a course completes.
Deliver the training course yet: the built-in modules are in build with founding settings; today we track completion. Recording a certificate is never the same as competent practice.
Since September 2025, a reference must be obtained for every member of staff, including students and volunteers, before they are recruited, with the framework’s handling rules (no open references, from a senior authority, discrepancies resolved before appointment).
Provides a guided per-hire record that walks references-before-recruitment, identity, qualifications and induction in the correct sequence and composes the EYFS 3.18 vetting record from it.
Obtain the references, make the appointment, or judge whether a reference is satisfactory: those are the setting’s decisions.
Registered group providers must obtain an enhanced criminal-records (DBS) check for every person aged 16+ who works directly with children, with an additional check for anyone who has lived or worked abroad, and no unsupervised contact until suitability is checked. Where a person is on the DBS Update Service, the status is checked with consent, and a new disclosure is applied for only where the details have changed.
Records the DBS certificate number, date obtained and who obtained it, and tracks your own re-check policy and the annual Update Service status check.
Carry out the DBS check, or ever tell you a DBS has “expired”: a DBS has no statutory expiry. Any re-check prompt follows the policy you set, not an invented legal deadline.
Providers must record staff qualifications and the identity checks, vetting processes and references completed, including the criminal-records check reference number, the date obtained and who obtained it. Inspectors review these staff records early in a visit.
Maintains this per-staff record in one place, composed from the safer-recruitment steps, ready to produce on inspection.
Call it a statutory “single central record”. The formal SCR is a schools duty under KCSIE, which is not statutory for PVI settings: this is the EYFS 3.18 vetting record, similar to one but not the same thing.
A disqualified person must not be employed in connection with early-years provision, and the provider must notify Ofsted of a significant event likely to affect suitability, within 14 days of becoming aware, and act to keep children safe. Failure is an offence.
Logs disqualification self-declarations and runs the 14-day clock as a tracked statutory deadline with a prompt.
Make the notification to Ofsted or decide whether someone is disqualified, the provider takes the action; we prompt and evidence it.
At least one person with a current full PFA certificate must be on the premises and available at all times children are present, and on outings; certificates renew every three years; a PFA-holder must be present while children eat; and since September 2025 students/volunteers/apprentices count in ratios only if they are PFA-qualified.
Tracks each PFA certificate’s three-yearly renewal and computes daily cover against your rota, so a gap is visible before it happens.
Deliver first-aid training. Full PFA is face-to-face by the EYFS’s own criteria: we signpost a provider and track the certificate; we never present online PFA as compliant.
Minimum staff-to-child ratios apply by age band (broadly 1:3 under twos, 1:5 for two-year-olds, 1:8 or 1:13 for three-and-overs depending on qualifications), with a Level-3 manager and a named deputy. Ratios are the single most common EYFS inspection-action topic.
Room Check, a manual ratio check you run against your register by age band, surfacing the qualification conditions, works today with no integration.
Yet sample live check-ins automatically (Famly-fed ratio monitoring is in build), and never deploys staff or replaces the manager’s on-the-floor decision.
See the full ratio table, the clauses and how a mixed-age room is calculated →
Read the EYFS framework on gov.uk →The EYFS names a spine of records: daily attendance register, accident/injury with same-day parent notice, medication per administration with same-day notice, a complaints log with a 28-day outcome clock, child information and emergency contacts, allergy/dietary action plans, physical-intervention and choking records, risk assessment, evacuation procedure and insurance. Inspectors can inspect and copy any of them.
Provides a compliance diary for the staff-side records: accident, medication, complaints (28-day clock), risk assessment, evacuation, each with its countdown, exportable in one click as an inspection pack.
Replace your management app’s child-side daily records: the attendance register and key-person notes stay in Famly/Blossom/Tapestry; we hold the compliance evidence they don’t.
Several events must be notified to Ofsted, each within 14 days and each an offence if missed: allegations of serious harm or abuse, a serious accident/illness/injury or death, food poisoning affecting two or more children, and significant changes or events at the setting.
Keeps a notification log with each 14-day clock tracked to the day and a prompt as the deadline approaches.
Submit the notification to Ofsted or judge whether an event is notifiable, the provider decides and reports; we prompt and evidence.
Providers must put appropriate supervision arrangements in place for staff who have contact with children, providing support, coaching and training. Supervision is a frequent EYFS inspection-action topic.
Records dated supervision arrangements per staff member so the trail exists for inspection.
Conduct supervisions, or set a frequency: the framework specifies none, and we don’t invent one.
For all-staff safeguarding training, the EYFS sets criteria, not a provider list: practitioners must be “trained in line with the criteria set out in Annex C”, supported to implement your own safeguarding policy, and the training renewed every two years (annual refreshers are discretionary, not statutory). There is no requirement to buy a named external course for this: what an inspector looks for is that the training happened, covered the right ground, and is recorded and in date.
Two places the framework asks for more, and we are plain about both: the designated safeguarding lead must attend a training course consistent with Annex C (taking account of local safeguarding partners’ advice), and paediatric first aid must be a face-to-face course. NurseryGuard tracks and chases both dates; it never claims to deliver either.
What NurseryGuard provides, and what it is: five ratified, adaptive staff courses: safeguarding awareness, a two-year safeguarding refresher, induction, allergy & safer eating, and medication awareness, each built from the statutory text, each ending in a short knowledge check and a dated training record for the staff file. They are training records in the Annex C areas, not external qualifications, and for the all-staff duty above, that is exactly the evidence shape the framework asks you to hold. The renewal chasing is the part no binder does.
Delivers the five ratified awareness courses on your staff’s own phones, issues the dated record for each completion, and chases every renewal, safeguarding two-yearly, PFA three-yearly, DSL two-yearly, before it lapses.
Deliver the DSL’s Annex C course or the face-to-face paediatric first aid course, issue external qualifications, or decide that your training obligations are met: the judgement stays with the provider.
The September 2026 EYFS revision writes safer-sleep practice directly into the statutory framework: babies settled to sleep on their backs, in their own sleep space on a firm, flat surface, with children under twelve months sleeping in a cot or equivalent, and sleeping children checked regularly. Until now this lived in guidance; from 1 September 2026 it is a framework requirement.
Prepares a safer sleep policy drafted from the 2026 clause for you to adopt and e-sign (currently in draft awaiting ratification), and the diary evidences your sleep checks.
Monitor sleeping children or replace your own checking routine: the duty and the judgement stay with your staff.
From 1 September 2026 the supervision exemption in the regulated-activity definition is removed. A volunteer or helper role that previously needed no enhanced DBS because it was supervised may now count as regulated activity, requiring an enhanced DBS with children’s barred-list check. Every setting should re-audit its volunteer, student and parent-helper roles against the new definition.
Provides a volunteer and helper vetting record (in draft awaiting ratification) capturing each role, its pre-change status and the post-change check reference: DBS metadata only, never certificate content.
Decide whether a specific role is regulated activity: that judgement is the provider’s, on the statutory definition.
Single-word judgements are gone. A report card grades your setting on a five-point scale across several categories, with safeguarding judged separately as met or not met. Inspection volume is rising, the routine cycle is moving to four years, and in the first year of the new model, of the inspections that resulted in formal required actions, 540 (71%) related to safeguarding and welfare requirements: record-keeping, not teaching, is where settings are caught out.
Keeps the records those actions cite: the staff file, the checks, the diary, dated, organised and chased before anything lapses.
Predict or influence your grade, or speak for Ofsted: we are an independent tool, not the regulator.
Room Check asks you for the counts by age band and does this maths for you against the EYFS minimum ratios. Here is exactly what it applies, clause by clause, so you can see the “why” behind the answer. Every figure below is the EYFS statutory framework’s own.
| The rule | Requirement | EYFS clause |
|---|---|---|
| Children under 2 | At least one member of staff for every three children (1:3). | EYFS 3.47 |
| Children aged 2 | At least one member of staff for every five children (1:5). | EYFS 3.48 |
| Children aged 3 and over | At least one member of staff for every eight children (1:8). | EYFS 3.50 |
| Aged 3 and over, with a graduate lead | Where a person with Qualified Teacher Status, Early Years Professional Status or Early Years Teacher Status is working directly with the children, at least one member of staff for every 13 children (1:13). This ratio holds only while that person is working directly with the children. | EYFS 3.49 |
| Paediatric first aid, on premises | At least one person with a current paediatric first aid (PFA) certificate must be on the premises and available at all times when children are present. | EYFS 3.37 |
| Paediatric first aid, while eating | A member of staff with a valid PFA certificate should be in the room whilst children are eating. | EYFS 3.64 |
PFA certificates renew every three years (EYFS 3.37). Anyone counted in the ratios must be aged 17 or over (apprentices from 16); students, long-term volunteers and apprentices count only where they are suitable, competent and hold a valid, current paediatric first aid qualification (EYFS 3.56).
The framework sets ratios per age band (EYFS 3.46–3.56) and states no single combined-group formula. Room Check takes the conservative reading: it works out the staff each age band needs on its own, rounding each band up, and adds them together. Staff are not netted across bands.
This can over-state the staff needed where a mixed group is legitimately supervised at the ratio for its youngest child, but over-stating is the safe direction for a check. Treat a shortfall here as a prompt to look again, not a definitive breach.
The numeric check counts staff against the ratio only. It does not verify the further conditions the EYFS attaches: at least one member of staff holding an approved level 3 qualification in each age band, at least half of the remaining staff at level 2, and (for under-2s) at least half of all staff trained in the care of babies (EYFS 3.47–3.50), nor whether Ofsted has determined a higher ratio (EYFS 3.46). Confirm those separately. School-based and before/after-school variants (EYFS 3.51–3.55, 3.57) are out of scope; the three-and-over path uses the registered early years provision ratios.
Each Room Check writes a timestamped snapshot into your statutory diary: the room, the counts by age band, the staff present, the required-versus-actual figure and the paediatric-first-aid note, kept as append-only, tamper-evidenced evidence you can export for inspection. A passing check closes as evidence; a shortfall (or missing first-aid cover) stays open so you can record the action you took to put it right.
It supports your professional judgement about staffing on the floor; it does not replace it, and it never deploys staff for you.
These aren’t nursery-specific and aren’t the NurseryGuard core: they’re cross-cutting duties every employer carries. We’re honest about where the EveryGuard family can help and where a specialist or a competent person is required.
The EYFS requires an emergency-evacuation procedure and working fire-detection/control equipment (3.80). The underlying fire risk assessment is a duty on the “responsible person” under the Fire Safety Order 2005 and must be carried out by someone competent.
Holds the EYFS evacuation-procedure record in the diary; the fire risk assessment itself is available via the EveryGuard family’s Fire topic as a cross-sell.
Carry out your fire risk assessment, a competent-person duty, or test your alarm system. Not part of the NurseryGuard core.
Premises must be fit for purpose and comply with health-and-safety legislation. General workplace H&S sits under the 1974 Act and applies to every employer.
Holds EYFS premises and risk-assessment records in the diary; broader H&S management is served across the EveryGuard family.
Run your general health-and-safety regime or write your risk assessments. Not part of the NurseryGuard core today, and not H&S advice.
A setting that prepares food is a food business: it must manage food safety, be FHRS-rated, and, under the EYFS (3.64–3.65), obtain dietary and allergy information before admission, keep allergy action plans, and ensure staff know the symptoms and treatment of allergies and anaphylaxis.
Grounds the EYFS allergy & dietary duty for the records spine: information before admission, action plans, anaphylaxis awareness. Upload your menu and AI drafts the full 14-allergen matrix dish by dish from a 750+ dish ratified library; your cook confirms every row against your own recipes.
Run your kitchen’s food-safety management, produce an FHRS rating, or give clinical/dietetic advice or a child’s individual action plan. The drafted matrix is never auto-certified: a human confirms every dish.
As an employer, a setting carries employment-law duties: contracts, working time, guaranteed-hours obligations and right-to-work checks on every hire.
Lets right-to-work and contract evidence sit alongside the per-staff record; recruitment, hours and guaranteed-hours tooling is served across the EveryGuard family (HireGuard).
Run payroll, contracts, rota/hours or right-to-work checks as a NurseryGuard core feature, and isn’t employment-law advice.
A setting handles special-category data about children and families, must comply with UK GDPR and the Data Protection Act 2018, and (as a data controller) must pay the annual ICO data-protection fee.
Handles the setting’s data securely and can track the annual ICO fee renewal as a dated item.
Register you with the ICO, write your privacy notices, or act as your data-protection officer. Not legal advice.
NurseryGuard prepares and chases the written evidence the EYFS asks a setting to hold, and keeps its statutory clocks running. That is real work, and it is the work that trips settings up at inspection: the reference that must exist before day one, the training that lapses in eight months, the notification with fourteen days on the clock. But a document is not the duty. Your DSL’s judgement, the local authority’s response, the fire risk assessment, the first-aid competence in the room: those remain yours, and no software replaces them.
NurseryGuard provides compliance tools and content; it is not Ofsted and does not provide legal advice. Safeguarding is a high-stakes legal duty: records, policies and training here support and evidence your compliance with the EYFS statutory framework, they do not replace the provider’s own legal responsibility for children’s safety. DBS checks have no official expiry date; re-check prompts follow the policy you set. The EYFS 3.18 vetting record is similar to a single central record, not the statutory one required of schools under KCSIE (which does not bind PVI settings). Paediatric first aid courses are delivered face-to-face by your chosen training provider: NurseryGuard tracks the certificates and cover, it does not deliver first-aid training. Where a duty needs a competent person or specialist advice, we say so.