The legal duties under COSHH split between employers, employees and the self-employed, with the specific regulations and operational details that matter in practice.

COSHH places duties on employers and employees, and also applies to self-employed people subject to specific exceptions. This guide concerns the Great Britain COSHH Regulations 2002; Northern Ireland has separate regulations. Employers’ duties are more extensive, but employees also have enforceable responsibilities.

This page sets out who has to do what, where each duty comes from, and what the practical implementation looks like. For the broader context, see what COSHH is and the underlying COSHH Regulations 2002.

Where the duties come from

COSHH duties don’t sit in isolation. They’re built on top of two broader frameworks.

The first is the Health and Safety at Work etc. Act 1974. Section 2 of the Act sets the general employer duty to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees. Section 7 sets the equivalent general duty on employees — to take reasonable care for their own health and safety and that of others who may be affected by their acts or omissions at work, and to cooperate with their employer to enable the employer to comply with statutory duties.

The second is the Management of Health and Safety at Work Regulations 1999. These require employers to make a general workplace risk assessment, appoint competent persons to help with health and safety, provide health surveillance where appropriate, and provide information and training. COSHH builds on this framework with substance-specific duties.

The duties in COSHH itself — covered in detail in the COSHH Regulations 2002 walkthrough — are spread across Regulations 6 to 13. Most fall on the employer; Regulation 8(2) is the main employee-facing duty.

Employer duties under COSHH

The employer has seven major operational duties under the regulations.

Assess the risks

Under Regulation 6, the employer must make a “suitable and sufficient” assessment of the risk to health from each hazardous substance used or produced in the workplace, before any work that exposes employees can begin. The assessment must consider the substance’s hazardous properties, the level and nature of exposure, the effect of any preventive or control measures, and the results of any monitoring or health surveillance.

With five or more employees, the employer must record significant findings and the steps taken to comply. Review the assessment regularly and immediately where it may no longer be valid, work changes significantly or monitoring or surveillance indicates a need.

For the practical method, see how to carry out a COSHH risk assessment.

Prevent or adequately control exposure

Regulation 7 requires the employer to either prevent exposure to hazardous substances entirely or, where prevention isn’t reasonably practicable, control exposure adequately. The preferred approach is substitution — replacing the hazardous substance with something less hazardous, or changing the process so the substance isn’t needed. Where substitution isn’t possible, the hierarchy of control sets the order: engineering controls first, then control of exposure at source, then PPE only as a last resort.

For carcinogens, mutagens and substances that cause occupational asthma, the standard is higher. Exposure must be reduced as low as is reasonably practicable, not merely controlled below the workplace exposure limit.

The COSHH hierarchy of control walks through each level with examples.

Ensure controls are used and maintained

Regulations 8 and 9 cover what happens after controls are put in place. Regulation 8 requires the employer to take all reasonable steps to ensure that controls are properly used. Regulation 9 requires the employer to maintain controls in efficient working order, in good repair, and in clean condition.

LEV generally needs thorough examination and testing at intervals no longer than 14 months, with shorter intervals for the processes in Schedule 4. Keep test records for at least five years. Use suitable maintenance and inspection intervals for other controls and continue routine checks between formal tests.

Storage of substances is a control measure too. For the practical detail on cabinets, segregation and signage, see COSHH storage requirements.

Monitor exposure where required

Arrange exposure monitoring where Regulation 10 requires it. Personal air sampling is one method; the choice depends on the substance and exposure route. Retain records representative of identifiable employees’ personal exposure for at least 40 years after the last entry, and other monitoring records for at least five years.

Monitoring is not required in every workplace. It is needed where necessary to maintain adequate control or protect health, unless adequate control can be demonstrated by another method, and in the specific circumstances listed in Schedule 5.

Carry out health surveillance where required

Health surveillance is appropriate where the Regulation 11 criteria are met, including a reasonably likely identifiable health effect and a valid, low-risk detection technique. Schedule 6 specifies additional medical surveillance for certain substance-and-process combinations; it is not a list of all work requiring surveillance.

In practice this means routine medical or workplace checks — skin inspections for workers exposed to substances that cause dermatitis, lung function tests for workers exposed to asthmagens, and so on. Health records must be kept for 40 years from the date of the last entry, reflecting the long latency periods of many occupational diseases.

Inform, instruct and train

Workers need suitable and sufficient information, instruction and training on the substances, assessment findings, controls and emergency action. Explain monitoring results and collective health-surveillance findings while protecting confidential individual medical information.

The legal threshold is “suitable and sufficient”, which means the training has to fit the substances and the work. A wall poster doesn’t satisfy the duty for workers handling carcinogens; an annual refresher e-learning module may not satisfy it for workers using a new substance brought in last week. Structured COSHH Training is the way most UK employers meet this duty for the standard substances workers encounter.

Plan for accidents, incidents and emergencies

Regulation 13 requires the employer to prepare for foreseeable emergencies involving hazardous substances. The arrangements must include emergency procedures (including evacuation and decontamination), provision of first aid suitable to the substances involved, and information for the emergency services about what they may encounter.

Provide alarms, warnings and communications appropriate to the risk. Regulation 13 contains a slight-risk exception where existing precautions are sufficient, and biological-agent arrangements are addressed separately in Schedule 3. Schedule 2 does not create a general emergency-notification duty.

Employee duties under COSHH

The main employee duty under COSHH is in Regulation 8(2): every employee must make full and proper use of any control measure, other thing or facility provided in compliance with the regulations, and must take all reasonable steps to ensure it is returned after use to any accommodation provided for it.

In practice this breaks down into six things workers must do.

Cooperate with the employer’s arrangements

This is the broader duty from Section 7 of the Health and Safety at Work Act, applied to COSHH specifically. Workers must follow the procedures, work within the system, and not undermine the controls the employer has put in place.

Use control measures properly

Employees must make full and proper use of controls provided under COSHH. They should report difficulties with PPE or equipment rather than bypassing it. Select gloves for the substance and task: an unsuitable glove may provide inadequate protection.

Follow established procedures

Where the COSHH assessment has set out a specific procedure (mix the substance in the fume cupboard, use the trolley to move drums, don’t decant into unmarked containers), workers must follow it. Deviating from the procedure undermines the assessment.

Report defects

If PPE is damaged, an LEV system is making unusual noises, a container is leaking, or a procedure isn’t working as intended, the worker must report it. Concealing a defect is itself a breach.

Attend health surveillance appointments

Where the employer has arranged health surveillance under Regulation 11, workers required to attend must do so. Refusal can be a disciplinary matter as well as a breach of statutory duty.

Use PPE as instructed

Use PPE as instructed, inspect it, report defects and store it properly. Tight-fitting RPE requires a suitable fit test and a seal check each time it is worn; these are different checks. Facial hair in the sealing area prevents a reliable seal.

The self-employed

Regulation 3 applies relevant COSHH duties to the self-employed as both employer and employee, except Regulations 10 and 11. They must assess risks and prevent or adequately control their own exposure, as well as meeting applicable duties toward others.

Regulation 3(2) expressly excludes self-employed people from Regulations 10 and 11. They do not have those COSHH monitoring and health-surveillance duties for themselves, although competent advice or appropriate checks may still help them control risk. Duties towards any employees remain.

Tax status does not decide health and safety employment status. A person working under another organisation’s control and direction may count as its employee for health and safety purposes. Clarify responsibilities rather than assuming an invoice removes the organisation’s duties.

The competent person

The Management Regulations 1999 (Regulation 7) require every employer to appoint a competent person to help with health and safety. For workplaces with significant COSHH risk, that appointment typically includes specific responsibility for COSHH compliance — making sure assessments are done, controls are in place, monitoring and surveillance happen on schedule, and training is delivered.

Competence means sufficient training, experience, knowledge and other qualities for the task. A qualification alone does not establish it, and a course is not the only route. An employer may have suitable expertise internally or may need specialist occupational hygiene or occupational health assistance.

RIDDOR reportable occupational diseases

The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 require employers to report certain work-related diseases to HSE. Several of these are directly linked to COSHH-covered substances:

  • Occupational dermatitis where work involves significant or regular exposure to a known skin sensitiser or irritant
  • Occupational asthma associated with significant or regular exposure to a known respiratory sensitiser
  • Occupational cancer attributable to work exposure to a known human carcinogen or mutagen, including ionising radiation
  • Disease attributable to occupational exposure to a biological agent

Report a reportable occupational disease without delay once the responsible person receives a medical diagnosis and the relevant work-related reporting conditions are met. The ten-day deadline used for certain injury reports is not the occupational-disease rule. HSE provides online disease-report forms.

A reportable disease should prompt review of exposure and controls. HSE decides its regulatory response; a report does not mean an investigation or a finding of a COSHH breach is automatic.

Training as the connecting duty

Training supports workers in understanding labels, following controls and responding to emergencies. It needs to be usable in the actual job and supported by suitable equipment, supervision and working arrangements.

Regulation 12 requires the training to be suitable and sufficient. In practice that means it has to be specific to the substances the workers actually handle, the controls actually in place, and the emergency arrangements actually established. Generic awareness training has its place — it’s the foundation — but it doesn’t on its own discharge the Regulation 12 duty for workers in significant exposure roles.

Proper COSHH Training goes beyond awareness. It covers reading safety data sheets and labels, understanding the assessment for the substances at the worker’s site, using the specific controls in place, and practising emergency response procedures. The investment pays back in fewer incidents, fewer cases of occupational ill health, and a clearer audit trail when HSE inspects.

Frequently asked questions

Who is ultimately responsible for COSHH?

The employer retains its legal duties when competent people help with the work. Company officers may be prosecuted under Section 37 where a company offence occurred with their consent or connivance, or was attributable to their neglect.

Can I delegate COSHH duties?

You can delegate the work — getting someone to carry out the assessment, set up the controls, run the training — but you can’t delegate the legal duty. If an assessment is inadequate, the employer is in breach regardless of who actually wrote it.

Which employee actions support COSHH compliance?

Use controls correctly, follow the safe system, keep containers identifiable, avoid incompatible mixing, report defects and attend required health surveillance. Training and supervision should address any difficulties with these arrangements.

What happens if an employee refuses to wear PPE?

Employees must properly use the controls provided. Investigate fit, suitability, comfort, understanding and the task if PPE is not being used. Resolve safety problems and explain the required safe system rather than assuming the cause of the refusal.

Does COSHH apply to volunteers or unpaid workers?

Employers must also protect other people who may be affected by their work, so far as reasonably practicable. Regulation 3 extends COSHH duties with specific exceptions: for example, the employer does not owe the Regulation 11 health-surveillance duty to non-employees. Clarify arrangements for volunteers, contractors and work-experience participants.

Make sure your team is trained to meet its COSHH responsibilities.

Explore the COSHH Training course →

Sources & references

Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about workplace health & safety, COSHH and accredited online training for COSHH Training, part of Online CPD Academy.