COSHH Regulations 2002: Control of Substances Hazardous to Health

Read the full text: Control of Substances Hazardous to Health Regulations 2002 on legislation.gov.uk.

The Control of Substances Hazardous to Health Regulations 2002 (COSHH 2002) require every employer and self-employed person in Great Britain to prevent or adequately control exposure to substances that can damage health. These regulations apply to virtually every workplace — from offices and schools to factories, construction sites, salons, workshops and farms. If your work involves chemicals, cleaning products, dusts, fumes, vapours, mists, gases or biological agents, COSHH applies to you.

COSHH came into force on 21 November 2002 under statutory instrument 2002/2677, replacing the previous 1999 regulations. The regulations have been amended several times since, most recently in 2013. COSHH implements several EU directives into UK law and remains in force post-Brexit. This guide explains what COSHH 2002 requires, who it applies to, and what a compliant COSHH assessment must contain.

What COSHH 2002 Requires

The core duty is set out in Regulation 7: employers must ensure that exposure of employees to substances hazardous to health is either prevented or, where prevention is not reasonably practicable, adequately controlled. The regulations establish an eight-step process:

Under Regulation 6, employers must carry out a suitable and sufficient assessment of the health risks created by work involving hazardous substances. The assessment must identify what hazardous substances are present or created, who might be exposed and how, what precautions are already in place, and what further action is necessary. The assessment must be reviewed regularly — at least every five years, or sooner if circumstances change.

Regulation 7 requires control measures to follow a hierarchy: eliminate the substance or substitute with something less hazardous; if not possible, control exposure using engineering controls and safe systems of work (enclosure, ventilation, reduced exposure time); and only where these measures do not adequately control exposure, provide suitable personal protective equipment (PPE) as a last resort. Simply issuing gloves and masks without first considering elimination or substitution breaches the hierarchy.

Regulation 9 requires employers to ensure control measures are used correctly. This means training employees how to use the measures, checking they are used properly, and ensuring the measures are maintained in working order. Regulation 10 requires monitoring of exposure in certain circumstances — for example when working with carcinogens, asthmagens or substances assigned a workplace exposure limit. Regulation 11 requires health surveillance where employees are exposed to substances linked to identifiable diseases or health effects and there is a reasonable likelihood of the disease occurring under the working conditions.

Regulation 12 requires specific additional measures for work with carcinogens and mutagens, including total enclosure where reasonably practicable, prohibition of eating and drinking in contaminated areas, and provision of adequate washing facilities. Information, instruction and training must be provided under Regulation 12, covering the health risks, the precautions to be taken, the results of monitoring, and collective findings of health surveillance. Records of COSHH assessments, monitoring and health surveillance must be kept for specified periods — typically 5 years for monitoring records, 40 years for health surveillance records involving carcinogens or respiratory sensitisers.

Who COSHH 2002 Applies To

COSHH applies to every employer in Great Britain. This includes:

• Limited companies and partnerships employing one or more persons
• Sole traders and self-employed individuals (Regulation 3(2) applies equivalent duties where the work may affect their own health or the health of others)
• Charities, schools, colleges, hospitals and public sector organisations
• Temporary employers and recruitment agencies (where they control the work being done)
• Landlords employing contractors or staff to carry out maintenance involving hazardous substances

Employees also have duties under Regulation 8: they must make full and proper use of control measures and PPE provided, report defects immediately, and not misuse anything provided for health and safety purposes. An employee who removes or bypasses ventilation or uses a hazardous substance without following the safe system of work can be prosecuted personally.

COSHH does not apply to asbestos (covered by the Control of Asbestos Regulations 2012), lead (covered by the Control of Lead at Work Regulations 2002), or substances hazardous only because they are radioactive, at high pressure, at extreme temperature, or have explosive or flammable properties unrelated to health. Those hazards are controlled by other regulations. However, if a substance is both flammable and a respiratory irritant, COSHH applies to the health hazard even though separate fire regulations apply to the flammability.

Key Duties at a Glance

• Regulation 6 — Assessment: Carry out a suitable and sufficient assessment of the health risks before work starts. Identify substances, assess exposure, determine if controls are adequate. Review when circumstances change or at least every 5 years.
• Regulation 7 — Prevention or control of exposure: Prevent exposure where reasonably practicable. Where not, control exposure using engineering controls (ventilation, enclosure) before relying on PPE. Ensure controls adequately control exposure.
• Regulation 8 — Use of control measures: Employees must use control measures and PPE correctly and report defects. Employers must ensure measures are used and employees are trained.
• Regulation 9 — Maintenance of control measures: Keep equipment and controls in efficient working order and good repair. Test ventilation systems at least every 14 months and keep records for 5 years.
• Regulation 10 — Monitoring exposure: Monitor exposure where necessary to ensure controls remain adequate or to protect health. Keep records for at least 5 years (40 years for specified substances including carcinogens).
• Regulation 11 — Health surveillance: Provide health surveillance where exposure may cause identifiable disease and surveillance is valid. Keep individual health records for at least 40 years from last entry.
• Regulation 12 — Information, instruction and training: Provide employees with comprehensible information about the hazards, the COSHH assessment, control measures, emergency procedures, and monitoring results.
• Regulation 13 — Arrangements to deal with accidents and emergencies: Prepare procedures to deal with spills, leaks, uncontrolled releases or reasonably foreseeable accidents. Ensure suitable warning and communication systems, escape routes, rescue equipment and PPE are available.

Penalties for Non-Compliance

Breaches of COSHH 2002 are criminal offences prosecuted by the Health and Safety Executive (HSE) or local authorities. In the magistrates' court the maximum fine is £20,000 per offence. In the Crown Court fines are unlimited and custodial sentences of up to two years can be imposed for serious breaches under Section 33 of the Health and Safety at Work etc. Act 1974.

The HSE can also issue improvement notices (requiring specified action within a set period) and prohibition notices (stopping work immediately until the risk is controlled). The HSE's Fee for Intervention (FFI) scheme means businesses are charged £163 per hour (2024 rate) for inspector time spent investigating material breaches. A half-day site visit investigating missing COSHH assessments or inadequate ventilation can easily cost over £1,000 in FFI charges alone, even if no prosecution follows.

According to HSE statistics, exposure to hazardous substances causes thousands of occupational illnesses each year. In 2022, there were an estimated 12,000 new cases of breathing or lung problems caused or made worse by work, and around 13,000 deaths each year from past exposures — primarily to asbestos, silica and other dusts. COSHH compliance is not bureaucracy; the regulations exist because workplace exposure to hazardous substances kills and disables workers.

How COSHH 2002 Relates to Risk Assessments

A COSHH assessment is a specific type of risk assessment required under Regulation 6. It sits alongside — not instead of — the general workplace risk assessment required under Regulation 3 of the Management of Health and Safety at Work Regulations 1999. Many businesses integrate the two: the general risk assessment identifies hazardous substances as a hazard, and the COSHH assessment then provides the detailed evaluation of how exposure is controlled.

The COSHH assessment must be in writing unless you employ fewer than five people. Even where the law does not require it in writing, the HSE strongly recommends recording it — and during an inspection, inspectors will expect to see evidence that an assessment has been carried out. A verbal assessment that exists only in someone's head is not suitable and sufficient.

A compliant COSHH assessment must identify: the hazardous substances used or created; the health hazards (irritation, sensitisation, poisoning, cancer); who is at risk (employees, contractors, visitors, members of the public); what exposure currently occurs; what control measures are in place; whether those controls are adequate; what further action is needed; and when the assessment will be reviewed. The assessment must reference safety data sheets, workplace exposure limits, and any relevant HSE guidance.

Need a COSHH assessment? Anyrisks generates workplace-specific COSHH assessments in under 2 minutes, covering the substances you use, the control measures required, PPE, monitoring, training and emergency procedures. The assessment is delivered as a PDF and editable Word document, compliant with Regulation 6 of COSHH 2002.

COSHH 2002 and the Cleaning Industry

Commercial cleaning businesses face substantial COSHH duties. Cleaning operatives use multiple hazardous substances daily — bleach, caustic drain cleaners, acidic descalers, disinfectants, solvent-based degreasers, aerosol polishes and air fresheners. Many of these products are corrosive, irritant or harmful if inhaled. Some contain respiratory sensitisers that can cause occupational asthma.

A compliant COSHH assessment for a cleaning company must cover each substance in use. This means obtaining and reviewing the safety data sheet for every product, identifying the hazard classifications (corrosive, harmful, irritant, sensitiser), assessing the exposure (concentration, duration, frequency), and confirming that control measures are adequate. Control measures typically include: diluting concentrates correctly (over-concentrated products increase exposure); providing adequate ventilation; training operatives not to mix chemicals (e.g. bleach and acidic cleaners produce chlorine gas); issuing suitable gloves, aprons and eye protection where required; and providing washing facilities.

The HSE has prosecuted several cleaning companies for COSHH failures. Common breaches include: no COSHH assessment; use of products without safety data sheets; inadequate training; failure to provide or enforce use of PPE; and operatives developing dermatitis or respiratory problems due to uncontrolled chemical exposure. A written, product-specific COSHH assessment is not optional for cleaning businesses — it is a legal requirement under Regulation 6.

COSHH and Construction Work

Construction sites involve multiple COSHH hazards: silica dust from cutting brick, block or concrete; wood dust from sawing timber; solvent vapours from paints, adhesives and sealants; diesel exhaust from plant and vehicles; welding fume; cement (causes dermatitis and chemical burns); bitumen fume; and lead paint on refurbishment projects. The Construction (Design and Management) Regulations 2015 require construction phase plans to address COSHH where relevant, but COSHH 2002 itself applies in full.

Silica dust is a particular concern. Cutting, grinding or drilling materials containing silica (brick, concrete, stone, mortar) generates respirable crystalline silica (RCS), classified as a carcinogen. Long-term exposure causes silicosis (irreversible lung scarring) and lung cancer. Regulation 7 requires exposure to be controlled — typically using on-tool extraction (vacuum dust suppression on power tools), water suppression, or in extreme cases respiratory protective equipment (RPE). The workplace exposure limit for RCS is 0.1 mg/m³ (8-hour TWA). Exposure monitoring under Regulation 10 is required where there is significant dust generation.

Many small contractors assume COSHH applies only to factories and laboratories. That assumption is wrong. A self-employed bricklayer cutting bricks dry with an angle grinder is exposed to RCS and must carry out a COSHH assessment under Regulation 3(2) and implement adequate controls under Regulation 7. Failure to do so is a criminal offence and, over time, will cause irreversible lung disease.

COSHH and the Hairdressing and Beauty Industry

Hairdressers face COSHH risks from hydrogen peroxide, persulphate-based bleaching agents, permanent colourants, and formaldehyde-releasing preservatives in some products. Occupational asthma caused by persulphate exposure is a recognised industrial disease. Control measures include adequate salon ventilation, latex-free gloves, and substitution of high-risk products where possible.

COSHH and Catering and Food Production

Catering businesses use cleaning chemicals that require COSHH assessment. Food production environments may generate flour dust (a known respiratory sensitiser with a WEL of 1 mg/m³ over 8 hours under EH40) and spice dusts. Cleaning in place (CIP) chemicals used in food manufacturing include strong acids and caustic soda requiring full COSHH assessment and LEV.

COSHH and Small Businesses

Many small businesses assume COSHH does not apply to them because they only use common cleaning products or small quantities of chemicals. That assumption is wrong. COSHH applies to all employers regardless of size. Even a small office using multipurpose cleaner, glass cleaner and hand sanitiser is using hazardous substances and must assess the risks.

For low-risk, straightforward activities, the assessment does not need to be complex. The HSE provides a simple risk assessment template (COSHH essentials) that small employers can use. The key steps are: list the hazardous substances you use; check the safety data sheet (SDS) for each substance; identify who might be exposed and how; confirm that the control measures already in place (such as using products as directed, storing them securely, and providing PPE where needed) are adequate; and record your findings.

Common mistakes made by small businesses include: failing to obtain safety data sheets from suppliers; not reading or understanding the hazard information; using products incorrectly (for example, mixing bleach with acidic cleaners, which creates toxic chlorine gas); not providing adequate ventilation; and failing to train staff on safe use. These errors can result in chemical burns, respiratory harm, and poisoning — all preventable with a basic COSHH assessment.

Safety Data Sheets and COSHH Assessments

A safety data sheet (SDS) — previously called a material safety data sheet (MSDS) — is a document provided by the chemical supplier under the UK REACH regulation. It contains information about the substance's properties, hazards, safe handling, emergency measures, disposal and transport. Every hazardous substance supplied for use at work must have an SDS.

The SDS is the starting point for your COSHH assessment, but it is not itself a COSHH assessment. The SDS describes the substance in general; your COSHH assessment must evaluate the specific risk in your workplace, taking into account how much is used, how often, in what conditions, and what controls you have in place. An SDS filed in a drawer does not satisfy Regulation 6. You must read it, understand it, and use it to assess whether your controls are adequate.

COSHH and Workplace Exposure Limits

A workplace exposure limit (WEL) is the maximum concentration of a substance in the air, averaged over a reference period (usually 8 hours — the long-term limit, or 15 minutes — the short-term limit). WELs are listed in EH40, published by the HSE. If a substance has a WEL, exposure must not exceed that limit.

Regulation 7(7) states that where a substance has a WEL, control of exposure is only adequate if the level of exposure is reduced so far as is reasonably practicable and in any case below the WEL. This means compliance with the WEL is the legal minimum — you must still reduce exposure further if reasonably practicable. For substances without a WEL, exposure must be controlled to a level to which nearly all the working population could be exposed day after day without adverse effects — this is assessed using the COSHH assessment and, where necessary, occupational hygiene monitoring.

Health Surveillance Under COSHH

Regulation 11 of COSHH 2002 requires health surveillance where: the employee is exposed to a substance listed in Schedule 6 (such as vinyl chloride monomer or work in compressed air); or the COSHH assessment identifies a risk to health and there are valid techniques available to detect early signs of disease. Health surveillance aims to detect adverse health effects at an early stage so that action can be taken to prevent further harm.

Common examples of health surveillance in practice include: respiratory questionnaires and spirometry (lung function tests) for workers exposed to respiratory sensitisers such as isocyanates or flour dust; skin checks for workers handling chromates, epoxy resins or cutting oils; and biological monitoring for workers exposed to lead or solvents. The type and frequency of surveillance must be appropriate to the level and nature of exposure.

Health surveillance must be carried out by a qualified person — typically an occupational health nurse or doctor. Records must be kept for at least 40 years and must include: the employee's name; details of the health surveillance carried out; the date; and the conclusions. Employees must be informed of the results and any action needed. If health surveillance shows that control measures are inadequate, the employer must review the COSHH assessment immediately and implement additional controls.

Amendments to COSHH 2002

COSHH 2002 has been amended several times. Key amendments include: the Control of Substances Hazardous to Health (Amendment) Regulations 2004 (SI 2004/3386), which revised the provisions on biological agents; and the Control of Substances Hazardous to Health (Amendment) Regulations 2013 (SI 2013/1471), which revised Schedule 1 (list of substances assigned workplace exposure limits) to align with changes in EH40.

The current consolidated version is referred to as COSHH 2002 (as amended). References in HSE guidance and Approved Codes of Practice (ACOPs) to COSHH 1999 or COSHH 1988 are now historical — the applicable law is COSHH 2002 as amended. Always check legislation.gov.uk for the current in-force version if in doubt.

COSHH Compliance Checklist

To comply with COSHH 2002, employers must:

• Identify all hazardous substances used, stored or created by the work
• Obtain and review safety data sheets for every hazardous substance
• Carry out a COSHH assessment for each substance or process, assessing the risks and determining adequate control measures
• Record the assessment in writing and make it accessible to employees
• Implement the hierarchy of control: eliminate or substitute first, then use engineering controls, safe systems and PPE only as a last resort
• Ensure control measures are used correctly — provide instruction, training and supervision
• Maintain, examine and test control measures regularly (LEV systems every 14 months, RPE fit testing, PPE inspection)
• Monitor exposure where necessary to protect health
• Provide health surveillance where required
• Provide information, instruction and training to all employees on the hazards, risks, controls and emergency procedures
• Make arrangements for accidents, incidents and emergencies
• Review COSHH assessments regularly (at least annually) and whenever there is significant change

For businesses needing a compliant written assessment, Anyrisks generates COSHH risk assessments covering the substances you use, the exposure routes, the control measures required, and the PPE needed — in under 2 minutes, delivered as PDF and editable Word doc.

Related Regulations

COSHH works alongside several other key health and safety regulations. The Management of Health and Safety at Work Regulations 1999 require a general workplace risk assessment covering all hazards, of which hazardous substances are one category. The Personal Protective Equipment at Work Regulations 1992 set out additional duties when PPE is required as a COSHH control measure. The Health and Safety (Safety Signs and Signals) Regulations 1996 require warning signs where hazardous substances are stored or used. The Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR) cover the fire and explosion risks from flammable or explosive substances — often the same substances covered by COSHH for health risks. A compliant assessment will address both sets of regulations where relevant.