A COSHH risk assessment is a legal requirement under the Control of Substances Hazardous to Health Regulations 2002 (as amended) for any UK employer or self-employed person who uses, produces, or stores hazardous substances. COSHH assessments must be carried out before work involving hazardous substances begins, and must identify how people could be harmed, what controls are needed to prevent that harm, and how those controls will be maintained and monitored.
What is COSHH?
COSHH stands for the Control of Substances Hazardous to Health. The Control of Substances Hazardous to Health Regulations 2002 (COSHH) impose specific duties on employers and the self-employed to protect workers and others from the health risks posed by hazardous substances used or created in the workplace.
Hazardous substances covered by COSHH include chemicals (cleaning products, paints, adhesives, solvents, pesticides), fumes (welding fumes, vehicle exhaust emissions), dusts (wood dust, silica dust, flour dust, cement dust), biological agents (bacteria, viruses, moulds), and any substance with a warning label indicating it is harmful, toxic, corrosive, irritant, or sensitising.
COSHH does not cover asbestos (covered by the Control of Asbestos Regulations 2012), lead (covered by the Control of Lead at Work Regulations 2002), or radioactive substances (covered by separate ionising radiation regulations). For these, separate risk assessments are required.
Who Needs a COSHH Risk Assessment?
Under Regulation 6(1) of COSHH, an employer must not carry out work which exposes employees to hazardous substances without first making a suitable and sufficient assessment of the risks created by that work and the steps needed to meet the requirements of the Regulations. This duty applies to all UK businesses, regardless of size or sector, that use or create hazardous substances as part of their work activities.
Common sectors requiring COSHH assessments include cleaning companies (bleach, multi-surface cleaners, descalers, disinfectants), construction and groundworks (cement, silica dust, paints, adhesives, bitumen), motor vehicle repair (brake cleaner, spray paints, solvents, welding fumes), hairdressing and beauty (hydrogen peroxide, hair dyes, acrylic nail products, aerosols), catering and hospitality (oven cleaner, dishwasher detergent, chlorine-based sanitisers), agriculture (pesticides, herbicides, animal medicines, diesel fumes), printing and manufacturing (inks, resins, solvents, metal-working fluids), and healthcare (disinfectants, cytotoxic drugs, glutaraldehyde, formaldehyde).
If your business uses any product with a hazard pictogram on the label (the orange or red diamond symbol indicating flammable, corrosive, toxic, harmful, irritant, or dangerous to the environment), a COSHH assessment is legally required.
What Must a COSHH Assessment Cover?
A suitable and sufficient COSHH assessment must identify the hazardous substances to be used, assess the risks to health from exposure, and determine what precautions are needed. Under Regulation 6(2) of COSHH, the assessment must include consideration of the hazardous properties of the substance, information from the supplier (the safety data sheet), the circumstances of the work (how much is used, how often, by whom, in what conditions), the likely routes of exposure (inhalation, skin contact, ingestion, injection), and the groups of workers who may be exposed, including vulnerable groups such as pregnant workers, young workers, or those with pre-existing health conditions.
The assessment must then set out the control measures required to prevent or adequately control exposure, applying the hierarchy of control set out in Regulation 7 of COSHH: elimination or substitution of the substance wherever reasonably practicable, enclosure or isolation of the process, local exhaust ventilation or other engineering controls, administrative controls (safe systems of work, training, supervision, exposure monitoring), and personal protective equipment as a last resort where exposure cannot be adequately controlled by other means.
The assessment must also specify the arrangements for health surveillance (where required under Regulation 11), the emergency procedures in case of spillage or accidental exposure, the arrangements for maintaining and testing control equipment (such as LEV under Regulation 9), and the information, instruction and training to be provided to workers under Regulation 12.
How to Carry Out a COSHH Risk Assessment
Step 1: List all hazardous substances
Identify every substance used or created in your workplace that is hazardous to health. Check product labels for hazard pictograms and read the safety data sheet (SDS) for each substance — suppliers are legally required to provide an SDS for any substance classified as hazardous under the Classification, Labelling and Packaging Regulation (CLP).
Step 2: Identify who is at risk and how
Consider every person who may be exposed: employees carrying out the task, employees working nearby, contractors, cleaners, maintenance workers, and visitors. Think about the route of exposure — is the substance inhaled (fumes, dust, vapour), absorbed through the skin, splashed into the eyes, or accidentally ingested?
Step 3: Assess the level of risk
The risk depends on the intrinsic hazard of the substance (how harmful it is) and the extent of exposure (how much, how often, for how long). A highly toxic substance used once a year in a well-ventilated outdoor environment presents a lower risk than a moderately harmful substance used daily in a confined space with no ventilation.
Step 4: Determine the control measures
Apply the hierarchy of control under Regulation 7. Can you eliminate the substance entirely (stop using it)? Can you substitute it with a less hazardous alternative (water-based instead of solvent-based, low-dust instead of standard)? If not, what engineering controls are needed (local exhaust ventilation, fume cupboards, enclosed systems)? What administrative controls (limiting exposure time, permit-to-work systems, training)? What PPE is required as a final layer of protection (gloves, respirators, eye protection)?
Step 5: Record the assessment
Under Regulation 6(3), if you employ five or more people, you must record the significant findings of the assessment. Best practice is to record all COSHH assessments regardless of headcount. The record must include the substance name and CAS number (if applicable), the hazards (reference the SDS Section 2), who is at risk, the risk rating, the control measures in place and planned, the person responsible, and the review date.
Step 6: Review and update
Under Regulation 6(4), you must review the assessment if you suspect it is no longer valid or there has been a significant change in the work. Specific triggers for review include a change in the substance or its supplier (new SDS), a change in the process (different quantities, frequencies, or methods), an incident involving the substance (spillage, exposure, ill health), new information about the health effects, or the introduction of new control equipment.
The Hierarchy of Control for COSHH
Under Regulation 7(1) of COSHH, every employer must ensure that exposure to substances hazardous to health is either prevented or, where prevention is not reasonably practicable, adequately controlled. Regulation 7(2) sets out the hierarchy of measures that must be applied, in order of preference:
- Elimination — stop using the substance altogether. Example: use mechanical cleaning methods instead of chemical degreasers. This is the only control that removes the hazard entirely.
- Substitution — replace the hazardous substance with a safer alternative. Example: replace solvent-based paint with water-based paint; replace high-dust materials with low-dust or paste formulations; replace chlorinated cleaning products with non-chlorinated alternatives. Under Regulation 7(3), substitution must be considered before relying on control measures.
- Enclosure or isolation — enclose the process so that exposure is prevented, or isolate it so that fewer people are exposed. Example: fully enclosed mixing systems for chemicals; automated dispensing systems that eliminate manual handling.
- Local exhaust ventilation (LEV) — extract fumes, dust or vapour at source before it can be inhaled. Example: extraction hoods over welding benches, dust extraction on woodworking machinery, fume cupboards in laboratories. Under Regulation 9, LEV must be thoroughly examined and tested at least every 14 months, and records kept for 5 years.
- Administrative controls — reduce exposure by limiting the time spent working with the substance, reducing the quantity used, providing training, implementing permit-to-work systems, and ensuring good housekeeping. Example: job rotation to limit individual exposure duration; storing only the minimum necessary quantity on site; clear labelling and segregation of substances.
- Personal protective equipment (PPE) — the final control when exposure cannot be adequately controlled by other means. Example: chemical-resistant gloves, respirators, face shields, chemical-resistant suits. Under Regulation 7(5) and the Personal Protective Equipment at Work Regulations 1992, PPE must be suitable for the hazard, properly maintained, and provided free of charge. It must never be relied upon as the sole control unless all higher measures have been demonstrated to be not reasonably practicable.
A COSHH assessment that lists "wear gloves" as the only control measure, without first considering elimination, substitution, or engineering controls, is unlikely to meet the legal standard of adequate control.
Common Hazardous Substances by Sector
Cleaning and Facilities Management
Bleach (sodium hypochlorite, corrosive and irritant to skin and eyes), multi-surface cleaners (may contain alcohols, surfactants, fragrances that cause skin sensitisation), oven cleaners (sodium hydroxide, highly corrosive), toilet cleaners (hydrochloric acid or phosphoric acid, corrosive), disinfectants (quaternary ammonium compounds, respiratory and skin sensitisers). Control measures: substitute with less hazardous products where possible, provide adequate ventilation, use trigger sprays to reduce aerosol generation, provide nitrile gloves and eye protection, train staff to never mix cleaning chemicals (especially bleach and acidic products, which produce toxic chlorine gas).
Construction and Groundworks
Cement and mortar (alkaline, causes severe skin burns and eye damage on contact with wet cement), silica dust from cutting concrete, brick or stone (causes silicosis and lung cancer after long-term exposure), paints and coatings (may contain isocyanates, solvents, or other respiratory sensitisers), bitumen fumes (irritant to respiratory tract, possible carcinogen). Control measures: use pre-mixed cement to reduce dust exposure, wet-cutting or on-tool dust extraction for silica, water-based paints instead of solvent-based where practicable, RPE (P3 or FFP3 respirators) where dust cannot be controlled below the workplace exposure limit.
Hairdressing and Beauty
Hair dyes and bleaches (contain hydrogen peroxide, ammonia, para-phenylenediamine — all skin and respiratory sensitisers), acrylic nail products (contain methacrylates, which cause occupational asthma and skin sensitisation), aerosol hairsprays (propellants and solvents, respiratory irritant in poorly ventilated spaces). Control measures: local exhaust ventilation in nail treatment areas, non-latex gloves (nitrile) to prevent skin contact, training on minimising skin contact and spillage, health surveillance for respiratory symptoms under Regulation 11.
Motor Vehicle Repair
Brake cleaner (contains solvents such as tetrachloroethylene, which is toxic and carcinogenic), spray paints (contain isocyanates, which cause occupational asthma), welding fumes (contain metal oxides that can cause metal fume fever and long-term lung disease), used engine oil (contains polycyclic aromatic hydrocarbons, carcinogenic with long-term skin contact). Control measures: water-based brake cleaning where practicable, spray booths with adequate extraction for painting, LEV or respiratory protection for welding, barrier creams and frequent handwashing for oil contact, prohibition on wiping oily hands on overalls.
Legal Penalties for Failing to Comply with COSHH
Failure to carry out a suitable and sufficient COSHH assessment, or failure to implement the control measures identified, is a criminal offence under Section 33 of the Health and Safety at Work Act 1974. Breaches of COSHH can be prosecuted in either the Magistrates' Court (maximum fine £20,000 per offence) or the Crown Court (unlimited fine and up to two years' imprisonment for individuals).
Under the Sentencing Council guidelines for health and safety offences, organisational fines are calculated by reference to turnover and culpability. A large organisation (turnover over £50 million) found guilty of a serious COSHH breach with high culpability can be fined several million pounds. In 2023, the HSE secured 628 convictions for health and safety offences, with an average fine of £148,000 per conviction.
Beyond criminal penalties, an employer who fails to assess or control exposure to hazardous substances faces civil claims from employees who suffer ill health as a result (occupational asthma, dermatitis, poisoning, occupational cancer), HSE enforcement notices requiring immediate improvements or prohibition of the work, reputational damage and loss of client contracts (particularly in sectors where COSHH compliance is audited, such as facilities management or construction), and exclusion from tender processes for public sector contracts.
When is Health Surveillance Required?
Under Regulation 11 of COSHH, health surveillance is required where the COSHH assessment identifies that exposure to a substance may result in an identifiable disease or adverse health effect, and there is a reasonable likelihood that the disease or effect may occur under the conditions of work, and there are valid techniques for detecting early signs of the disease or effect. Health surveillance is mandatory for work involving substances that cause occupational asthma (isocyanates, flour dust, wood dust, animal proteins), skin sensitisation (epoxy resins, chromates, certain biocides), or bladder cancer (certain aromatic amines used in dye manufacturing).
Health surveillance typically involves periodic questionnaires about symptoms (cough, wheeze, breathlessness, skin rashes), skin inspections by a responsible person, and referral to an occupational health professional if symptoms or exposure levels warrant it. Records of health surveillance must be kept for at least 40 years under Regulation 11(5).
Workplace Exposure Limits
Many hazardous substances have a Workplace Exposure Limit (WEL) — the maximum concentration of the substance in air that workers may be exposed to, averaged over a reference period (usually 8 hours for long-term exposure limits, 15 minutes for short-term exposure limits). WELs are published by the HSE in EH40/2005 Workplace Exposure Limits, updated annually.
Under Regulation 7(7) of COSHH, exposure to substances with a WEL must be controlled so that the WEL is not exceeded. Where a substance has a WEL and the assessment shows that the WEL may be exceeded, air monitoring is required to confirm that exposure is below the limit. If monitoring shows the WEL is exceeded, immediate action must be taken to reduce exposure below the limit, and affected workers must be informed.
Some substances have a lower limit still — a Biological Monitoring Guidance Value (BMGV) — which indicates the concentration of the substance or its metabolite in blood or urine that corresponds to the WEL. Biological monitoring may be required as part of health surveillance under Regulation 11.
COSHH Assessment Worked Example: Using Bleach in a Care Home
Substance: Sodium hypochlorite solution 5% (household bleach), used for disinfecting hard surfaces in bathrooms and kitchens.
Hazards (from SDS): Corrosive to skin and eyes (causes severe burns), harmful if swallowed, releases toxic chlorine gas if mixed with acids or ammonia, irritant to respiratory tract if used in poorly ventilated areas.
Who is at risk: Domestic staff carrying out cleaning, residents (if not removed from the area during cleaning), other staff passing through the area.
Routes of exposure: Skin and eye contact (splashes during pouring or wiping), inhalation of vapour (especially in small bathrooms with doors closed), ingestion (if cleaning chemicals stored in unmarked containers near food).
Control measures (hierarchy applied):
- Substitution: Consider using a quaternary ammonium disinfectant instead of bleach for routine cleaning (less corrosive, lower vapour pressure). Bleach retained for terminal cleaning after infection outbreaks as per infection control policy.
- Engineering controls: Ensure bathrooms have adequate ventilation (open windows during and after cleaning, mechanical extract fan operating). Use trigger spray bottles to apply diluted bleach rather than pouring from bulk containers (reduces splash risk and vapour generation).
- Administrative controls: Dilute bleach correctly as per manufacturer's instructions (typically 1:10 for disinfection). Never mix bleach with other cleaning products. Store bleach in original labelled containers in locked cleaning cupboard away from food storage. Clean during periods when residents are not in the immediate area. Train all cleaning staff in safe handling, emergency procedures (eye wash, first aid for skin contact), and symptoms of over-exposure (coughing, throat irritation, watering eyes). Provide written cleaning schedules and instructions.
- PPE: Provide and ensure use of nitrile gloves (not latex, which bleach degrades), aprons, and eye protection (safety glasses or face shield) when handling concentrated bleach or large quantities of diluted solution.
Emergency procedures: In case of skin contact, rinse immediately with plenty of water for at least 15 minutes and remove contaminated clothing. In case of eye contact, rinse with water for at least 15 minutes and seek medical attention immediately. In case of spillage, ventilate area, wear PPE, absorb with paper towels, and dispose of as chemical waste. Do not use acidic cleaning products in the same area without thorough rinsing.
Health surveillance: Not required for bleach at typical use concentrations, but staff should be instructed to report persistent respiratory symptoms or skin reactions.
Review date: 12 months, or sooner if there is a change in product, cleaning methods, or an incident occurs.
How Anyrisks Helps with COSHH Assessments
Producing a compliant COSHH assessment from scratch is time-consuming — you must interpret safety data sheets (often dense technical documents), identify all relevant exposure routes, apply the hierarchy of control correctly, and write everything in clear language that staff can understand. Many businesses resort to generic COSHH templates that fail to reflect the actual substances used or the specific conditions in the workplace.
Anyrisks generates COSHH risk assessments in under 2 minutes by asking you to describe the substance, the task, the workplace conditions, and who is at risk. The system then produces a fully written assessment that names the specific hazards from the substance, applies the COSHH hierarchy of control, references the relevant regulations (COSHH Regulations 2002, EH40/2005 where applicable), and includes the emergency procedures and PPE requirements specific to the substance you are using.
The assessment is delivered as a PDF and an editable Word document for £29. You remain legally responsible for reviewing the assessment to ensure it accurately reflects your workplace, and for implementing the control measures it identifies. But the time required to produce a compliant, well-written COSHH assessment document is reduced from hours to minutes.
For broader health and safety guidance, see our ultimate guide to risk assessment. For related regulatory content, see risk assessment legal requirements and our sector-specific guides including construction risk assessments, cleaning risk assessments, and care home risk assessments.
Further COSHH Resources
The HSE publishes extensive guidance on COSHH compliance. The HSE COSHH essentials series provides practical control guidance for common tasks involving hazardous substances, organised by task (cleaning, painting, welding, etc.) rather than by substance. EH40/2005 Workplace Exposure Limits is updated annually and lists all current WELs. For specific substances, the HSE provides substance-specific guidance on high-risk materials such as silica, wood dust, and isocyanates. The COSHH Approved Code of Practice (L5), now withdrawn but still cited in enforcement, provides detailed interpretation of the COSHH Regulations and remains a useful reference for what constitutes adequate control.