Child Safeguarding Is a Business Responsibility

Why every business should think beyond the safeguarding policy

Every day, in every country, children are abused, beaten, raped and exploited. Too often, the person responsible is someone the child knows and trusts. They may even work for an organisation that is meant to help or support children, but instead they abuse their position, their power and the child's trust. Tragically, it is often children who are already in difficult or vulnerable situations who face the greatest risks.

As reports have shown for many years, no sector is immune. Children have been abused by NGO workers, peacekeeping personnel, teachers, sports coaches, religious leaders and people working in the corporate sector.

We have learned, sometimes through terrible failures, that good intentions do not protect children. Systems do. Culture does. Accountability does. And all organisations have a responsibility to protect children from harm. That includes businesses.

I first wrote about this in 2018, after eight years at Keeping Children Safe, whose International Child Safeguarding Standards were written for organisations in every sector, companies included. Much has changed since then. Companies now build the apps, games, platforms and AI tools children use every day. Businesses operate global supply chains involving communities and families. Employees volunteer in schools and mentor young people. Companies offer work experience and internships to under-18s. Children enter corporate premises, use corporate products and interact with corporate staff. Regulators also expect more.

But the basic argument has not changed. So I want to make it again, particularly for the people sitting around the boardroom table.

Why should businesses have a child safeguarding policy?

Because any business whose staff, products, partners, programmes or premises come into contact with children can harm them, or fail to act when harm happens. Sometimes that contact is obvious. A company may provide educational services, children's products or activities involving young people.

Sometimes it is much less obvious. A child may use an app that was never specifically designed for them. A teenager may take part in a work experience placement. Employees may volunteer in schools. A contractor may work in an environment where children are present. Children may be affected by a company's supply chain even though they never interact directly with the company itself.

The first safeguarding question for a business therefore should not simply be: Do we work with children? It should be: Where and how does our business touch children's lives?

A safeguarding policy can help a company answer that question and set out how it prevents abuse, responds to concerns and holds itself accountable. But the policy is only the beginning.

That responsibility is not only ethical. The UN Committee on the Rights of the Child, in General Comment No. 16 (2013), states that "all businesses must meet their responsibilities regarding children's rights and States must ensure they do so". The UN Guiding Principles on Business and Human Rights (2011) expect every business to have a policy commitment approved at the most senior level, human rights due diligence and processes that enable remedy when harm occurs.

Child safeguarding may form part of a company's corporate responsibility or sustainability strategy, but it cannot sit there alone. Safeguarding belongs in governance, risk management, operations, recruitment, procurement, product design and organisational culture.

Five reasons businesses should consider child safeguarding

1. It demonstrates a commitment to the rights and protection of children

Many companies say they support children's rights. The real question is what that commitment looks like in practice. A commitment matters only if it is specific enough to influence decisions and behaviour.

The Children's Rights and Business Principles, published in 2012 by UNICEF, the UN Global Compact and Save the Children, ask every business to "ensure the protection and safety of children in all business activities and facilities" under Principle 4, including through a child protection code of conduct and appropriate training.

A safeguarding policy turns a general commitment into something employees, contractors, partners and leaders can understand and use. It says what behaviour is expected. It explains what is unacceptable. It tells people what to do when they are concerned about a child. And it makes clear who is responsible for acting. Without those systems, a commitment to children's rights can remain little more than a statement on a website.

2. It helps ensure staff, operations and partners do no harm to children

Much of a company's safeguarding risk may sit outside the head office. General Comment No. 16 recognises that a business's impact on children often runs through "complex networks of subsidiaries, contractors, suppliers and joint ventures", and calls for child-rights due diligence across business relationships and global operations.

That matters because safeguarding failures do not necessarily happen through permanent employees. They can happen through contractors, suppliers, agencies, consultants, volunteers, delivery partners and other organisations acting in a company's name. A company therefore needs to understand not only what happens inside its own offices but what happens across the relationships through which it operates.

Safeguarding expectations should be reflected in contracts where appropriate. Partners should understand the standards expected of them. They should know how to report a concern. And the company should know what it will do if a partner fails to meet those standards. Due diligence should not end once a contract is signed.

In the EU, the amended Corporate Sustainability Due Diligence Directive, Directive (EU) 2026/470, published 26 February 2026, makes human rights due diligence a legal duty for companies with at least 5,000 employees and €1.5 billion in turnover, from 26 July 2029. Most businesses fall outside that scope. But the direction is clear. Companies are increasingly expected to understand and address human rights risks connected to their operations and business relationships. For children, that means asking where harm could occur before it does.

3. If abuse does occur, reporting and response must be of the highest quality

No safeguarding policy can guarantee that harm will never happen. That is an uncomfortable but important point. The existence of a policy does not remove risk. What matters is whether the organisation has reduced foreseeable risks and whether people know what to do when a concern arises.

A reporting and response procedure should tell anyone, including a child, parent, employee, volunteer or contractor, how to raise a concern and what happens next.

• Who receives the report?
• Who decides what action is needed?
• When should external authorities be contacted?
• How is the person affected supported?
• How is confidentiality managed?
• How are people who raise genuine concerns protected from retaliation?

And, critically, does the child understand how to speak up? A reporting mechanism that only adults can understand or access is not enough when children themselves may need to use it.

There is another point businesses should think carefully about. A company that has never used its safeguarding procedure is not necessarily a company where no concerns exist. It may be a company where no one has felt safe enough to raise one.

Boards should therefore be cautious about treating an absence of reports as evidence that safeguarding systems are working. Sometimes silence is not reassurance. It is a warning.

4. It makes volunteering, placements and other contact with children safer

Employee volunteering can create enormous value. Companies support schools, mentoring programmes, community projects, work experience, internships and other opportunities for young people. But these activities also bring adults and children into direct contact, often outside the company's normal working environment and normal controls. That creates safeguarding responsibilities.

Before staff take part, businesses should consider safer recruitment where appropriate, clear codes of conduct, appropriate supervision, safeguarding briefings and straightforward procedures for reporting concerns. Employees should understand boundaries. Children and the organisations hosting the programme should know what behaviour they can expect. And everyone involved should know what to do if something does not feel right.

Of course, a safeguarding failure can also cause enormous damage to an organisation's reputation and public trust. But reputation should never be the primary reason for acting. A child harmed through a company's programme has been let down by that company, whatever the headlines say. The first question should always be what happened to the child and how it could have been prevented.

5. It puts the protection and safety of children at the heart of business activities

When I first wrote about this in 2018, I was thinking mainly about programmes, people and premises. Today, for many companies, the biggest point of contact with children is the product itself.

Principle 5 of the Children's Rights and Business Principles asks businesses to ensure that products and services "for children or to which children may be exposed are safe and do not cause mental, moral or physical harm". That principle has become even more important.

A child's interaction with a company may now happen entirely through a screen. It may be through a game, a social platform, a learning app, a smart toy, a recommender system or an AI chatbot. The child may never meet a company employee. That does not make the safeguarding responsibility disappear. It changes where we need to look for the risk.

Safeguarding therefore has to become part of product development and design, not something considered only by HR, CSR or a safeguarding focal point. If children can use a product, the company should be asking before launch:

• What could go wrong?
• Which children might be particularly affected?
• What happens if a child discloses abuse or distress?
• Could the product expose children to harmful content or contact?
• What information are we collecting about children?
• Can a child understand what the product is doing?
• And who has the authority to act if we identify a serious risk?

The technology may be new. The safeguarding principle is not.

A safeguarding policy is not the same as a safeguarding culture

I recently spent eight days in Australia with the ISPCAN Child Safeguarding Working Group, now in its second year. One reflection from those discussions applies to companies just as much as it does to charities, schools, sports organisations or any other institution working with children.

Policies and procedures are essential. But culture is revealed in what happens when someone actually raises a concern. Are they heard? Are they supported? Do leaders act? Is there accountability? And does the organisation learn and change?

A company can have an excellent safeguarding policy sitting on its intranet and still be a place where a junior employee would not dare to report a senior colleague. It can have mandatory annual training while employees remain unclear about what to do when they see something concerning. It can have a reporting mechanism that technically exists but is so complicated, inaccessible or intimidating that no one uses it. That gap between policy and practice is where children can get hurt.

A safeguarding culture means people know that raising concerns is part of their responsibility, not a threat to the organisation. It means leaders would rather hear about a concern early than protect themselves from uncomfortable information. It means safeguarding is discussed when things are going well, not only after something has gone wrong. And it means organisations are willing to ask whether their own systems, behaviours or decisions contributed to the risk. That is much harder than writing a policy. But it is what makes the policy meaningful.

Safeguarding belongs in the boardroom

Safeguarding cannot sit with one designated person or department. A safeguarding focal point may coordinate the work, provide expertise and support colleagues. But they cannot carry the responsibility for the entire organisation.

There is another important reason for this. Sometimes the person causing harm, or failing to act when harm occurs, may themselves be in a position of leadership. They may be a senior manager, executive or even a board member. If safeguarding responsibility and authority sit entirely with one person, what happens when that person is the subject of the concern? Who feels able to challenge them? Who listens when a concern is raised? And who has the authority to act?

This is why a strong safeguarding culture needs both clear accountability and shared responsibility. Different people need to be involved in safeguarding implementation, reporting, oversight and accountability. There need to be different routes for raising concerns, including routes that do not depend on the person being reported or their immediate line of authority.

Organisations should also be clear about how conflicts of interest are identified and managed when someone involved in receiving, investigating or making decisions about a concern has a personal or professional relationship with the person being reported. No individual, however senior, should be beyond challenge.

This does not mean that accountability becomes unclear or that safeguarding becomes everybody's responsibility and therefore nobody's responsibility. There should still be clear roles, clear decision making and clear lines of accountability. But safeguarding should never depend entirely on one individual.

A strong system creates checks and balances. It ensures that more than one person understands the risks, more than one person knows how concerns should be handled and there are ways to act when the concern involves someone at the top. Safeguarding is therefore a leadership, governance and organisational responsibility.

Boards and senior leaders need to understand where the business touches children's lives, what risks arise from those interactions and whether the organisation has the systems and culture to manage them. Most importantly, they need to ask questions. These are the questions I would want every board to be able to answer:

• Where do we touch children's lives? Through products, premises, programmes, supply chains, volunteering, placements, internships or business partners?
• Who is accountable? Which board member or senior leader owns safeguarding, and when did the board last discuss it?
• What happens if the concern involves that person? Is there an alternative and independent route for reporting, escalation and decision making when a safeguarding concern involves a senior leader or board member?
• Is our policy actually used? Is it part of a wider safeguarding framework that staff understand, or simply a document on the intranet?
• What happens when someone raises a concern? Is our reporting and response procedure clear? Who investigates? Who supports the person affected? What did we learn from the last concern?
• Is our safeguarding focal point equipped to do the job? Do they have the training, resources, time, access to leadership and authority to act?
• Do we recruit safely? Does safer recruitment apply to every relevant role with access to children, including volunteers, interns and contractors?
• Do our partners meet the same expectations? Are safeguarding responsibilities reflected in procurement, contracting and due diligence where appropriate?
• Are children able to speak up? Can a child understand how to raise a concern, and will they be listened to when they do?
• Have we listened to children? Where our products, programmes or services affect children, have we involved them appropriately in understanding the risks and designing the safeguards? Children should not only be treated as people who need protection. They are rights-holders, and where decisions affect them, their experiences and views should help shape those decisions.
• When were we last independently checked? A safeguarding audit tests whether what the policy says is what actually happens.

And I would add one more: What information reaches the board? Boards cannot exercise meaningful oversight if they only hear about safeguarding when a serious incident becomes public. They need enough information to understand trends, recurring risks, concerns raised, training gaps and whether previous recommendations have actually been implemented.

If a board cannot answer all of these questions today, that should not be a reason to hide from them. It is a starting point. What matters is whether leadership is prepared to ask the questions, listen carefully to the answers and act on what it finds.

Prevention must become as important as response

We have become better at asking what should happen when harm is identified. But we must continue asking the harder question: What are we doing today to prevent that harm from happening in the first place? That means looking at culture, leadership, recruitment, reporting, education, risk, accountability and the environments we create around children.

For businesses, prevention does not always require complicated systems. It might mean:

• completing a safeguarding risk assessment before a volunteering programme launches;
• adding a safeguarding clause to a supplier contract;
• briefing employees before they enter a school;
• changing a reporting mechanism so a child can actually understand it;
• reviewing who has access to children's data;
• or carrying out a safety and safeguarding review before a new digital feature reaches young users.

These actions may appear small. But prevention is often built through decisions made long before anyone reports a concern.

Start here

For a business that has not considered child safeguarding before, the first step does not need to be complicated. Start by mapping every point where your business touches children's lives. Look at your people, products, premises, programmes, partners and supply chains. Then ask three questions:

• What could go wrong?
• What safeguards do we already have?
• Who is accountable for addressing the gaps?

That simple exercise can reveal risks that may otherwise remain invisible because the business does not think of itself as an organisation that "works with children". From there, the company can decide what policies, procedures, training, governance and other safeguards are proportionate to the risks it has identified.

Digital products and AI have changed the safeguarding landscape

For companies building digital products, the traditional idea of safeguarding needs to expand. A company does not need to physically meet a child in order to affect their safety. If your business builds digital products that children use, some of these responsibilities are now reflected directly in law.

In the UK, the Online Safety Act 2023 requires user-to-user services likely to be accessed by children to carry out a children's risk assessment. In the EU, Article 28 of the Digital Services Act requires online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for minors, with the European Commission publishing guidelines on the protection of minors on 14 July 2025. But legislation should be the baseline, not the end of the conversation.

General Comment No. 16 already recognised in 2013 that companies can contribute to harm to children online without being directly involved in the abusive act itself. That point matters even more today. A chatbot, game, platform or recommender system that children can reach needs safeguarding thinking just as a youth programme does.

The questions may look different, but the principle is the same. What could go wrong? For which children? What design choices could increase or reduce that risk? Who is accountable? And what will the company do about it?

A child rights impact assessment is one structured way to ask these questions before launch. This is why safeguarding and safety by design increasingly need to sit together. Digital contact is still contact with children. The technology may change. The responsibility to protect children does not.

Safeguarding is demonstrated, not owned

Eight years after I first wrote about this, my conviction is stronger. A child's safety cannot depend on whether the organisation that reaches them calls itself a charity, a school, a technology company or a multinational business.

Children experience the consequences of what organisations do. They do not experience our departmental structures. They do not care whether safeguarding sits with HR, compliance, legal, sustainability, product or a designated safeguarding lead.

What matters to a child is whether someone thought about the risk. Whether adults behaved appropriately. Whether the product was designed safely. Whether someone listened when they spoke. And whether the organisation acted when something went wrong.

A safeguarding policy matters. But safeguarding is not a document. It is what an organisation demonstrates through its decisions, its culture and its actions, every day and at every level.

Frequently asked questions

Does every company need a child safeguarding policy?

Not every business will need the same type of standalone safeguarding policy. The starting point is to identify where and how the business interacts with or affects children. Children may be customers or users, take part in work experience or volunteering programmes, visit company premises, interact with employees or be affected through the company's products, partners or supply chain.

Once those points of contact are understood, the business can determine what safeguarding measures are proportionate to the risks. For some businesses, that will mean a dedicated child safeguarding policy. For others, safeguarding responsibilities may sit within a broader framework of policies and procedures. What matters is not the name of the document. What matters is whether the risks to children have been identified and addressed.

Is child safeguarding just part of corporate social responsibility?

No. It may form part of a company's corporate responsibility or sustainability strategy, but it is broader than that. The UN Guiding Principles and General Comment No. 16 treat respect for children's rights as part of the responsibility of business. In practice, safeguarding can involve governance, HR, procurement, legal and compliance, risk management, product development and senior leadership.

Is child safeguarding a legal requirement for businesses?

It depends on the country, sector and activities of the business. There is no single global safeguarding law applying in exactly the same way to every company. However, specific legal duties increasingly apply in areas such as online safety, children's privacy, employment, human rights due diligence and services used by children. Legal compliance should also be treated as the minimum standard rather than the complete safeguarding framework.

Who should be responsible for safeguarding in a company?

There should be clear operational responsibility, often supported by a trained safeguarding focal point or lead. But safeguarding cannot belong to that person alone. Senior leadership and the board remain responsible for ensuring that appropriate governance, resources, accountability and oversight are in place. Responsibility should also be distributed sufficiently to ensure that concerns can still be raised, investigated and acted upon when the person involved is senior or normally holds safeguarding responsibility.

What happens if a safeguarding concern involves a senior leader or board member?

The organisation should have a reporting and escalation route that does not depend on the person who is the subject of the concern. This is one reason why safeguarding should never sit entirely with one individual. Clear alternative reporting routes, appropriate independent oversight and defined escalation procedures help ensure that seniority does not place someone beyond accountability. Any potential conflicts of interest should also be identified and managed so that the people receiving, investigating or deciding how to respond to a concern are able to act appropriately and independently.

How should a business start?

Start by mapping where the business touches children's lives. Then assess the risks. From there, put in place proportionate safeguarding measures. Depending on the organisation, these may include a safeguarding policy, code of conduct and reporting and response procedure anchored to recognised standards.

• Train people so they understand what those measures mean in practice.
• Include safeguarding in relevant contracts, programmes, recruitment and product decisions.
• Listen to children where your activities affect them.
• Make sure there is more than one appropriate route for raising concerns.

Then test the system. Listen to concerns. Review what happens in practice. And keep improving it.

Sources

1. General comment No. 16 (2013) on State obligations regarding the impact of the business sector on children's rights (CRC/C/GC/16), UN Committee on the Rights of the Child, 17 April 2013, paras 8, 38, 60 and 62.
2. Children's Rights and Business Principles, UNICEF, UN Global Compact and Save the Children, 2012, Principles 4 and 5.
3. Guiding Principles on Business and Human Rights, United Nations, endorsed by the Human Rights Council in resolution 17/4 of 16 June 2011, Principles 11, 15 and 16.
4. International Child Safeguarding Standards, Keeping Children Safe.
5. Online Safety Act 2023, section 11: children's risk assessment duties, legislation.gov.uk.
6. Commission publishes guidelines on the protection of minors, European Commission, 14 July 2025, Article 28 of the Digital Services Act.
7. CSDDD: amending directive published in the Official Journal of the European Union, Noerr, on Directive (EU) 2026/470, published 26 February 2026.

Last reviewed October 1, 2026. Legal provisions and dates checked against the sources listed. They should be checked against the primary sources before being relied on.