The COSHH Regulations 2002 Explained

The Cornerstone of UK Hazardous Substance Law

If you work with chemicals, dust, fumes, or biological agents anywhere in Great Britain, one piece of legislation governs almost every protective measure around you: the Control of Substances Hazardous to Health Regulations 2002, universally known as COSHH. These regulations are not a gentle suggestion or a corporate aspiration. They are statutory law, made under the Health and Safety at Work etc. Act 1974, and they carry the full weight of criminal enforcement.

COSHH did not appear out of nowhere. The first version came into force in 1988, replacing a patchwork of older laws — some dating back to the nineteenth century — that had been written for specific substances or specific industries. By the late twentieth century, British workplaces had changed beyond recognition: new chemicals, new processes, new biological risks, and a growing understanding that occupational disease was killing far more workers than accidents ever did. A unified, risk-based framework was needed. COSHH was that framework, and the 2002 version (with later amendments) is the one in force today.

What Makes COSHH Different

Older safety laws tended to be prescriptive — they told employers exactly what to do, substance by substance. COSHH is fundamentally different: it is goal-setting and risk-based. Rather than listing every chemical and its prescribed control, COSHH requires employers to identify the hazards present in their own workplace, assess the risks those hazards pose to their own workers, and then put in place controls that are adequate for the situation. The law sets the destination — preventing or adequately controlling exposure — and leaves the route to the employer, provided the route is rational, documented, and effective.

This flexibility is also COSHH's most demanding feature. It means there is no checklist you can simply tick off. Every workplace must think for itself, and every worker must understand the controls that apply to them.

The Substances COSHH Governs

COSHH covers an extraordinarily broad sweep of materials:

• Chemicals and products containing chemicals — from industrial solvents to everyday cleaning sprays.
• Fumes, dusts, vapours, mists and gases — including substances generated by a process, such as welding fume or wood dust, even if they were never deliberately introduced.
• Biological agents — bacteria, viruses, fungi and other micro-organisms encountered in healthcare, laboratories, waste handling and agriculture.
• Germs that cause leptospirosis or legionellosis, and any other substance that creates a comparable health risk.
• Nanotechnology materials — engineered particles whose tiny scale presents novel exposure risks.

Three notable substances sit outside COSHH because they have their own dedicated regulations: asbestos, lead, and radioactive materials. We will return to these exclusions in the next lesson.

The Eight Core Duties of the Employer

COSHH places the primary legal burden squarely on the employer. The regulations are organised around a set of interlocking duties — each one a regulation in its own right. Together they form a cycle of continuous control that should never end while hazardous substances remain in the workplace.

1. Assess the Risk (Regulation 6)

Before any work involving a hazardous substance is carried out, the employer must complete a suitable and sufficient COSHH assessment. This means identifying what the substances are, who could be exposed, how exposure could occur, what harm it could cause, and what controls are needed. The assessment must be written down where five or more people are employed, reviewed regularly, and updated whenever the work changes.

2. Prevent or Adequately Control Exposure (Regulation 7)

This is the heart of COSHH. The employer must prevent exposure where reasonably practicable — by eliminating the substance or substituting something safer. Only if prevention is genuinely impossible may they fall back on control, and that control must follow the hierarchy of control: engineering controls (such as local exhaust ventilation) and safe systems of work first; personal protective equipment (PPE) only as a last line of defence.

3. Ensure Controls Are Properly Used (Regulation 8)

Buying a fume cabinet is not enough. The employer must take all reasonable steps to make sure that controls are actually used — that the cabinet is switched on, the respirator is worn correctly, the lid stays closed on the solvent tank. This duty also explicitly applies to employees, who must use the controls provided.

4. Maintain, Examine and Test Controls (Regulation 9)

Controls degrade. Filters clog, ducts leak, seals perish. COSHH requires employers to keep all control measures in efficient working order and good repair. Local exhaust ventilation systems must be thoroughly examined and tested by a competent person at least every fourteen months, and records kept for at least five years. Respiratory protective equipment subject to maintenance must be inspected at suitable intervals.

5. Monitor Exposure (Regulation 10)

Where the COSHH assessment shows it is necessary to ensure adequate control — or where a Workplace Exposure Limit (WEL) applies and there is doubt about whether it is being met — the employer must measure airborne concentrations or other exposure indicators. Monitoring records must be kept for at least five years, or forty years where they relate to identifiable individuals exposed to substances that cause long-term harm.

6. Provide Health Surveillance (Regulation 11)

Where workers are exposed to certain substances and the health effects can be detected, health surveillance is mandatory. This might mean skin checks for those handling sensitisers, lung function tests for those exposed to respiratory hazards, or biological monitoring for substances such as isocyanates. Health records must be kept for forty years.

7. Inform, Instruct and Train (Regulation 12)

Workers cannot protect themselves from what they do not understand. Employers must provide information on the hazards and risks, the precautions to take, the results of any monitoring, and the action to take in an emergency. Training must be sufficient for workers to do their job safely — and refreshed when circumstances change.

8. Arrange for Emergencies (Regulation 13)

For substances where the consequences of an incident would be serious, the employer must have arrangements in place: emergency procedures, first-aid facilities, drills, warnings, and information for the emergency services. A spill of a corrosive cleaning chemical in a school kitchen and a leak of chlorine in a water treatment plant both require thought before they happen — never during.

These eight duties are not independent tasks to be carried out once and filed away. They form a continuous loop: assess, control, use, maintain, monitor, survey, train, prepare — and then back to assess as work, people, and substances change.

The Duties of the Employee

It would be a mistake to read COSHH as a law that only governs employers. Workers carry real legal duties of their own, set out in Regulation 8 and reinforced by the broader duties under sections 7 and 8 of the Health and Safety at Work etc. Act 1974. If you are an employee in a workplace where COSHH applies, the law expects the following of you:

Use the Controls Provided — Correctly

If your employer has installed an extraction hood above your workstation, you must work under it, not beside it. If a glove is provided, it must be worn — not stuffed into a pocket. If a respirator is issued, it must be worn correctly, with the straps adjusted, on a clean-shaven face where face-fit is required. Defeating a control measure — propping open an interlocked door, bypassing a ventilation switch, removing a guard — is both a disciplinary matter and a breach of the law.

Follow the Procedures and Training You Have Been Given

Safe systems of work exist because someone, somewhere, has thought through what could go wrong. Shortcuts may feel efficient, but they are precisely how exposures occur. Workers must follow the procedures laid down — and if a procedure feels wrong or unworkable, the correct response is to raise it, not to silently improvise.

Report Defects, Damage and Near-Misses

A torn glove, a noisy extractor that seems weaker than usual, a label that has worn away, a small spill that nobody saw — these are the early warnings of a system in drift. Employees have a duty to report them promptly so they can be put right. A near-miss reported today prevents an incident tomorrow.

Attend Training and Health Surveillance

If your employer arranges training on the substances you handle, attendance is not optional. If health surveillance is required for your role — a skin inspection, a spirometry test, a urine sample — you are required to take part. These checks protect you, and they also generate evidence that controls are working as intended.

Take Care of Yourself and Others

The general duty under the 1974 Act applies in full: every employee must take reasonable care for the health and safety of themselves and of anyone else who could be affected by their work. In the COSHH context, that means thinking about cleaners, visitors, contractors, and members of the public — not only the colleagues you see every day.

This shared responsibility is what makes COSHH work in practice. The best risk assessment in the world is worthless if the controls it specifies are ignored on the shop floor. Equally, the most diligent worker cannot compensate for an employer who has failed to provide adequate controls in the first place. COSHH is, by design, a partnership — and the law holds both sides to account.

How the Regulations Fit Together

It is worth stepping back to see the architecture of COSHH as a whole. The regulations are arranged in a deliberate sequence that mirrors the natural lifecycle of risk management. You begin by understanding the hazard (assessment), then you design out the risk where you can (prevention or control), then you operate the controls (use, maintenance, monitoring), then you verify that they are working (health surveillance), and finally you prepare for the day they fail (emergencies). Threaded through every step is the duty to inform and train.

This sequence is not academic. It is the structure that HSE inspectors use when they visit a site, and it is the structure that prosecutors use when they bring a case. If you can demonstrate that each link in the chain has been considered and documented, you are well on the way to compliance. If any one link is missing, the whole chain is weakened.

The Approved Code of Practice

The regulations themselves are necessarily concise. They are supported by an Approved Code of Practice (ACOP) L5, published by the HSE, which has a special legal status: an employer who follows the ACOP will normally be deemed to comply with the law, while one who departs from it must be able to show that they have achieved the same standard by other means. Alongside the ACOP sits a library of HSE guidance documents — including the practical COSHH Essentials tools and substance-specific guidance for industries from hairdressing to foundry work.

You do not need to memorise the regulations word for word. You do need to know that they exist, what they require in broad terms, and where to look when a question arises. Throughout the rest of this course, every control measure, every assessment template, every piece of PPE and every emergency procedure we discuss traces back to one of the duties you have just read about.