So who or what do you think is actually to blame here?

1. The EU directive itself.

2. Some British HSE bureaucrat adding his own interpretation to that directive and ordering companies to comply.

3. Somebody in the company over-reacting to the "risk assessment" directive and making things needlessly complex.

My instinct on this is to go with #2, simply because that seems to be happening all too frequently these days.