A walkthrough of the Control of Substances Hazardous to Health Regulations 2002, the Approved Code of Practice and the practical duties they place on employers in Great Britain.

The COSHH Regulations 2002 are the main hazardous-substances-at-work regulations in Great Britain. Northern Ireland has its own COSHH Regulations 2003. The Great Britain regulations set duties to assess, prevent and control health risks from chemicals, dust, fumes, biological agents and other hazardous substances.

This page walks through the regulations themselves — what each one requires, where they came from, how they’ve been amended, and how the Approved Code of Practice fits in. If you need the broader context first, see what COSHH is and what it covers.

What the regulations are

The Control of Substances Hazardous to Health Regulations 2002 are secondary legislation made under the Health and Safety at Work etc. Act 1974. Their reference is SI 2002/2677 and they came into force on 21 November 2002. They have legal force, and breaches of their duties can be prosecuted.

The 2002 regulations replaced the 1999 regulations, following earlier versions in 1988 and 1994. The central approach remains assessment, prevention or adequate control of exposure, and supporting duties on maintenance, monitoring, health surveillance, training and emergency arrangements.

The regulations are enforced by the Health and Safety Executive for most workplaces, and by local authority environmental health officers for retail, office, leisure and similar premises.

Brief history: 1988 to today

Timeline of the COSHH Regulations from 1988 to today

A short timeline helps make sense of the amendments:

  • 1988: First COSHH Regulations introduced, consolidating a previous patchwork of substance-specific legislation
  • 1994: First major revision
  • 1999: COSHH Regulations 1999 replaced the 1994 rules
  • 2002: COSHH 2002 was made on 24 October and came into force on 21 November
  • 2003: COSHH Amendment Regulations (SI 2003/978)
  • 2004: COSHH Amendment Regulations (SI 2004/3386)
  • 2015: Amendments through the Classification, Labelling and Packaging of Chemicals (Amendments to Secondary Legislation) Regulations 2015, aligning COSHH with the CLP Regulation
  • 2018: Amendments included changes connected with PPE legislation and EU exit. These amended an existing domestic regulatory framework; they did not create COSHH for the first time.
  • 2020: HSE published the fourth edition of EH40, including new or revised workplace exposure limits for 13 substances. EH40 is a separate exposure-limit publication, not a replacement set of COSHH regulations.

The L5 Approved Code of Practice — the main practical guidance document — is currently in its sixth edition, having been updated to reflect REACH and CLP. The 2002 regulations themselves remain the operative law and have not been replaced.

The Approved Code of Practice and what it adds

An Approved Code of Practice has a special legal status. Following its relevant provisions is a recognised way to meet the duties it addresses. If a prosecution establishes that a relevant provision was not followed, the dutyholder must show compliance by another method. An ACOP is not itself an Act or regulation.

HSE publishes the COSHH ACOP as L5, sixth edition (2013). The 100-page publication works through the regulations and includes guidance on control, monitoring and health surveillance. Use it alongside the current amended legislation and HSE topic guidance, including HSG97 on assessment and HSG258 on local exhaust ventilation.

Walking through the regulations

Regulations 6 to 13 contain the principal operational duties covered here. Earlier regulations address interpretation, application and prohibitions; later provisions address matters such as fumigation and exemptions. The schedules add requirements for particular substances and processes.

Regulation 6 — Risk assessment

Regulation 6 prohibits work liable to expose any employee to a substance hazardous to health unless a “suitable and sufficient” assessment has been made and the necessary steps to comply with the regulations have been taken. The assessment must consider the hazardous properties of the substance, information from the supplier (including the safety data sheet), the level and nature of exposure, any workplace exposure limits, the effects of preventive and control measures, and the results of any monitoring or health surveillance.

An employer with five or more employees must record the significant findings and the steps taken to comply. Every employer must assess the risk. Review the assessment regularly and immediately where it may no longer be valid, work changes significantly, or monitoring or health surveillance shows that review is necessary.

How to carry out a COSHH risk assessment covers the practical method, and the COSHH risk assessment template is the document you record findings on.

Regulation 7 — Prevention or control of exposure

Regulation 7 is the operational heart of the regulations. It requires employers to either prevent exposure to hazardous substances entirely or, where prevention isn’t reasonably practicable, control exposure adequately. The choice between prevention and control is not a free one — Regulation 7(2) makes substitution by a safer alternative the explicit preference. Where substitution isn’t reasonably practicable, Regulation 7(3) sets a hierarchy of control: engineering controls and appropriate work systems first; control of exposure at source through ventilation and organisational measures next; PPE only as a last resort, in addition to other controls.

For carcinogens, mutagens and substances that cause occupational asthma, adequate control also requires exposure to be reduced as low as reasonably practicable, alongside the other applicable control requirements. Meeting a workplace exposure limit alone is insufficient.

Regulation 8 — Use of control measures

Regulation 8 deals with what happens after controls are put in place. Employers must take all reasonable steps to ensure that the control measures are properly used and applied. Workers, in turn, must use the control measures properly, follow procedures, report defects, and use PPE as required. The dual duty is important — an employer who provides perfect engineering controls can still be in breach if those controls aren’t actually used, and a worker who ignores the controls can be personally liable.

Regulation 9 — Maintenance, examination and testing

Control measures must be kept effective, in good repair and clean. LEV normally requires thorough examination and testing at least every 14 months, but Schedule 4 specifies shorter intervals for certain processes. Retain examination and test records for at least five years. Other controls also need suitable maintenance and checks.

The 14-month interval in Regulation 9(2)(a) is a maximum for the general LEV requirement. A shorter interval may apply because of the process, risk assessment or condition of the equipment. Routine checks between thorough tests remain necessary.

Regulation 10 — Monitoring exposure

Where Regulation 10 requires exposure monitoring, use suitable methods to establish employees’ exposure. This can include personal air sampling. Records representative of identifiable employees’ personal exposure must be retained for at least 40 years from the last entry; other monitoring records must be retained for at least five years. The 40-year rule is not limited to employees under health surveillance.

Monitoring isn’t required in every case. The ACOP gives criteria for when it’s needed, particularly where exposure is close to a workplace exposure limit, where controls are critical to safety, or where the substances involved have particularly serious health effects.

Regulation 11 — Health surveillance

Health surveillance is required where the Regulation 11 criteria are met: an identifiable disease or effect may be related to exposure, it is reasonably likely in the work concerned, and a valid, low-risk detection technique exists. Schedule 6 also specifies particular substance-and-process combinations requiring medical surveillance where its conditions apply. Check the specific substances, processes and conditions in Schedule 6 rather than assuming all hazardous work requires the same type of surveillance.

Employers must retain the required health record for at least 40 years after its last entry and provide access as required by Regulation 11. The employer’s health record is distinct from confidential clinical records held by an occupational health professional.

Regulation 12 — Information, instruction and training

Provide suitable and sufficient information, instruction and training on hazardous substances, assessment findings, precautions and emergency action. Explain monitoring results and collective health-surveillance findings without disclosing individuals’ confidential medical information.

This regulation is the legal basis for COSHH training programmes in UK workplaces. Refresher training is expected where circumstances change, where workers move into new roles, or where the original training has lapsed in effectiveness. Practical training — including how to put on respiratory PPE correctly, how to read a safety data sheet, and how to respond to a spill — is hard to achieve through a wall poster alone, which is why structured COSHH Training is the usual route for compliance.

Regulation 13 — Emergency arrangements

Regulation 13 requires arrangements appropriate to the risk, including emergency procedures, suitable first aid, relevant safety drills and information for emergency services. Warning and communication arrangements must suit the hazards. Its detailed requirements have a slight-risk exception where other controls are sufficient; biological agents in Schedule 3 have separate arrangements. Schedule 2 is not a general emergency-notification list.

Penalties and enforcement

Breaches of COSHH duties can be criminal offences under the Health and Safety at Work etc. Act 1974. Unlimited fines are available on summary conviction in England and Wales and on indictment; Scottish summary sentencing rules differ. Section 37 can apply to company officers where an offence occurred with their consent or connivance, or was attributable to their neglect.

In England and Wales, the Sentencing Council’s health and safety guideline considers culpability, harm and the organisation’s size. The outcome depends on the offence and facts; there is no fixed COSHH fine.

An improvement notice requires a breach to be remedied within a specified period. A prohibition notice stops an activity involving a risk of serious personal injury and may take effect immediately or after a stated period. HSE’s Fee for Intervention scheme recovers relevant costs for material breaches within its scope.

Frequently asked questions

When did COSHH 2002 come into force?

The Control of Substances Hazardous to Health Regulations 2002 came into force on 21 November 2002. They replaced the previous 1999 regulations, which were themselves a revision of the original 1988 COSHH framework.

How often have the regulations been amended?

COSHH has been amended several times, including changes in 2003, 2004, 2015 and 2018. Use the current legislation and its amendment information. The 2020 EH40 publication updated exposure limits; it was not a replacement COSHH regulation.

What is the L5 ACOP?

L5 is HSE’s COSHH Approved Code of Practice and guidance, currently sixth edition (2013). Following the relevant ACOP provisions is a recognised route to compliance for the matters they cover. Alternative methods are possible if they meet the law.

What are the penalties for breaching COSHH?

Breaches can lead to prosecution, notices and relevant HSE cost recovery. Unlimited fines are available in England and Wales; Scottish summary sentencing rules differ. Company officers may be prosecuted where the Section 37 conditions are met.

What is a statutory instrument?

A statutory instrument is a piece of secondary legislation made by a minister under powers given by an Act of Parliament — in this case, the Health and Safety at Work Act. SIs have the force of law and breach can be prosecuted as a criminal offence.

Is COSHH still in force after Brexit?

Yes. COSHH remains domestic law in Great Britain after EU exit. Amendments updated aspects of the framework; employers still have duties to assess and control hazardous-substance risks. Northern Ireland has its own COSHH regulations.

Make sure your team is trained to recognise and control hazardous substances under COSHH.

Explore the COSHH Training course →

Sources & references

Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about workplace health & safety, COSHH and accredited online training for COSHH Training, part of Online CPD Academy.