The COSHH Regulations 2002 explained
What the Control of Substances Hazardous to Health Regulations 2002 require of an employer, one regulation at a time. Checked against the current revised text on legislation.gov.uk.
What are the COSHH Regulations?
The COSHH Regulations are the Control of Substances Hazardous to Health Regulations 2002, the law in Great Britain on hazardous substances at work. They require employers to prevent exposure or, where that is not reasonably practicable, to control it adequately.
They cover far more than labelled products. A substance hazardous to health includes anything meeting a CLP health hazard class or carrying a workplace exposure limit. Biological agents and dust at or above set concentrations count too. Cement, solvents, isocyanate paints, biocides, silica dust and welding fume are typical examples.
The working core is regulations 6 to 13. Assess, prevent or control, and make sure controls are used and tested. Monitor, provide health surveillance, train people and plan for emergencies. HSE explains how to comply in its Approved Code of Practice, L5. If you need the form itself, start with the free COSHH assessment template.
What each COSHH regulation requires
Current revised textThe regulations that matter to an employer, in plain words. Where the law sets a number, it is given exactly. Each citation links to the regulation itself on legislation.gov.uk.
What counts as a substance hazardous to health
A substance or mixture is in scope if it meets the criteria for any CLP health hazard class or has an HSE workplace exposure limit. Biological agents are in scope too. Dust of any kind counts at or above 10 mg/m³ inhalable or 4 mg/m³ respirable, as an 8-hour time-weighted average. Anything else that creates a risk to health through its chemical or toxicological properties and the way it is used is also caught. Fume and dust made by the work can count, with or without a data sheet.
Regulation 2, interpretationYour duties reach beyond your own employees
Duties to your employees are also owed, so far as is reasonably practicable, to others your work may affect. That means other trades, the client’s staff, occupants and the public. Health surveillance is owed only to your own employees. Monitoring, training and emergency duties extend to others only while they are on the premises where the work is done.
Regulation 3, dutiesWhere COSHH does not apply
Regulations 6 to 13 do not apply where, and to the extent that, the Control of Lead at Work Regulations 2002 or the Control of Asbestos Regulations 2012 apply. Nor do they apply where a substance is hazardous only because it is radioactive, explosive or flammable. The same goes for hazards only from high or low temperature or high pressure.
Regulation 5, applicationAssess the risk before the work starts
Work liable to expose employees must not start until the employer has made a “suitable and sufficient” assessment of the risk. The steps it identifies must be in place. It considers the hazards, the supplier’s safety data sheet, the level and duration of exposure, maintenance work, exposure limits and combined exposures. It is reviewed regularly, and at once if it may no longer be valid, the work changes significantly or monitoring results call for it. With five or more employees, the significant findings and the control steps must be recorded.
Regulation 6, assessmentPrevent exposure, or control it adequately
Prevention comes first, and substitution is preferred: a safer product or process, such as a water-based paint in place of a solvent one. Where prevention is not reasonably practicable, control follows an order of priority. Process design, engineering controls and suitable equipment come first, then control at source, including adequate ventilation systems such as extraction, and organisational measures. Personal protective equipment comes last, in addition to the others, where they cannot achieve adequate control alone.
Regulation 7(1) to (3), prevention or controlWhat adequate control means in law
Control only counts as adequate if the principles of good practice in Schedule 2A are applied and no workplace exposure limit is exceeded. Exposure to carcinogens and mutagens must also be as low as is reasonably practicable. That means hazard statements H340, H350 and H350i, and Schedule 1 substances and processes. The same applies to asthmagens: H334, anything in section C of HSE’s Asthmagen? review, or anything the assessment shows may cause occupational asthma. Schedule 1 includes hardwood dusts and used engine oils. Check the hazard statements on the label and safety data sheet.
Regulation 7(7) and Schedule 1The principles of good practice
Schedule 2A sets eight principles. Design processes to minimise emission and spread. Consider inhalation, skin absorption and ingestion. Make controls proportionate to the risk, and choose the most effective and reliable options. Use PPE, with other measures, only where other means cannot achieve adequate control. Check and review controls regularly. Inform and train employees. Make sure new controls do not raise the overall risk.
Schedule 2A, principles of good practiceMake sure the controls are used
The employer must take all reasonable steps to see that every control measure provided is properly used. Employees must make full and proper use of it and return it to its storage after use. They must report any defect to the employer straight away.
Regulation 8, use of control measuresMaintain, examine and test the controls
Plant, engineering controls and PPE must be kept in efficient working order, in good repair and clean. Systems of work and supervision are reviewed at suitable intervals. Local exhaust ventilation (LEV) needs a thorough examination and test at least once every 14 months. Schedule 4 sets shorter maximum intervals of 1 or 6 months for four processes. One is grinding, abrading or polishing metal with powered tools, other than wet processes, in any room for more than 12 hours in any week: at least every 6 months. Reusable RPE is thoroughly examined and, where appropriate, tested at suitable intervals. Records of examinations, tests and resulting repairs, or a suitable summary, are kept for at least 5 years.
Regulation 9 and Schedule 4Keep PPE clean, stored and checked
PPE, including protective clothing, must be stored in a well-defined place, checked at suitable intervals, and repaired or replaced before further use if defective. Kit that may be contaminated comes off on leaving the work area and is kept apart from clean clothing. It is then decontaminated or, if necessary, destroyed.
Regulation 9(5) to (7)Monitor exposure where the assessment calls for it
Where the assessment shows monitoring is needed to keep control adequate or to protect health, exposure is measured. It follows a suitable procedure, at regular intervals and after any change. It is not required if the employer can show adequate control by another method of evaluation. Records representing the personal exposure of identifiable employees are kept for at least 40 years, and other monitoring records for at least 5 years, both from the last entry.
Regulation 10, monitoringHealth surveillance where harm can be detected
Surveillance is required where an identifiable disease or adverse effect may be linked to the exposure and is reasonably likely in the conditions of the work. There must also be a valid, low-risk technique to detect it. Schedule 6 adds a short list of substances and processes, mostly in manufacturing, that need medical surveillance at least every 12 months. Health records are kept for at least 40 years from the last entry. Employees attend when required, in working hours and at the employer’s cost. If harm is found, the employer tells the employee, reviews the assessment and controls, and considers moving the employee to other work.
Regulation 11, health surveillanceInformation, instruction and training
Employees liable to be exposed must get “suitable and sufficient” information, instruction and training. It covers the substances and their risks, any exposure limit, access to the safety data sheet, the significant findings of the assessment and the precautions to take. Anyone doing COSHH work for you, such as an LEV tester, needs it too. A container not labelled under other law, such as cleaning chemical decanted into a spray bottle, must show its contents and hazards.
Regulation 12, information and trainingPlan for accidents, incidents and emergencies
Procedures must be ready before an incident: first aid, safety drills tested at regular intervals, information on the hazards, and warning and communication systems. In an incident, only people essential to the repair enter the affected area, with suitable PPE. The planning duties do not apply where the assessment shows only a slight risk because of the quantity of each substance present. The regulation 7 controls must also be sufficient to control it. The same applies to the incident response, except for carcinogens, mutagens and biological agents.
Regulation 13, emergenciesRegulations 4 and 14 to 21 cover prohibited substances, fumigation, exemptions, extent and the due diligence defence. Regulation 14 matters to pest control firms that fumigate with hydrogen cyanide, phosphine or methyl bromide.
COSHH regulations quick reference
Where the regulation itself requires a record, the evidence column says so. Other entries are sensible evidence, not a legal requirement.
| Regulation | What it requires | Evidence to keep |
|---|---|---|
| Regulation 6 | A suitable and sufficient assessment before the work, reviewed regularly and when things change. | Required with five or more employees: the significant findings and the steps taken to control exposure. |
| Regulation 7 | Prevent exposure, by substitution where possible, or control it adequately in order of priority. | Good practice: the substitution considered, the controls chosen, and RPE selection and face fit test records. |
| Regulation 8 | Controls properly used; employees use them and report defects. | Good practice: supervision checks and defect reports. |
| Regulation 9 | Controls maintained; LEV examined and tested at least every 14 months, or more often for Schedule 4 processes; reusable RPE examined. | Required: examination, test and repair records, kept for at least 5 years. |
| Regulation 10 | Exposure monitoring where the assessment shows it is needed. | Required: monitoring records, 40 years where they represent identifiable employees, otherwise 5 years. |
| Regulation 11 | Health surveillance where a linked disease can be detected. | Required: a health record for each employee under surveillance, kept for at least 40 years. |
| Regulation 12 | Suitable and sufficient information, instruction and training. | Good practice: training and briefing records, signed by each operative. |
| Regulation 13 | Emergency procedures, drills, information and warning systems. | Good practice: the written procedure, spill kit checks and drill records. |
Who the COSHH duties fall on
Employers carry the main duties, for their own employees and, so far as is reasonably practicable, for anyone else their work affects. A subcontractor spraying a two-pack coating in an occupied building owes duties to the occupants as well as to its own team.
The self-employed are covered, since 1 October 2015, only if their work is of a prescribed description. That includes any work on a construction site, work with asbestos and gas work under the Gas Safety (Installation and Use) Regulations 1998. It also includes any activity that may put other people at risk. A self-employed person in scope is treated as both employer and employee, except that monitoring and health surveillance do not apply. A self-employed person who employs others has the full employer duties towards them, monitoring and health surveillance included.
Employees have duties too. They must use the controls provided, return them after use and report defects. Where health surveillance applies, they must attend when required, in working hours and at the employer’s cost.
Sources: COSHH regulations 3, 8 and 11(8); the prescribed undertakings regulations 2015; HSE, does COSHH apply to me.
What has changed since 2002
71 recorded changesThe 2002 Regulations replaced the COSHH Regulations 1999 and are still in force. legislation.gov.uk lists 71 changes made to them. All are applied to the revised text, and none was outstanding on 5 October 2026. These are the ones an employer notices.
Mutagens treated like carcinogens
From 29 April 2003, the extra measures for carcinogens in regulation 7(5), and the emergency rules in regulation 13(4), were extended to mutagens. Listed dioxins and furans were added to Schedule 1.
SI 2003/978Workplace exposure limits and the principles of good practice
From 6 April 2005, workplace exposure limits replaced maximum exposure limits and occupational exposure standards. Schedule 2A and the current test of adequate control in regulation 7(7) were added. Regulation 9(1) gained a duty to review systems of work and supervision at suitable intervals.
SI 2004/3386CLP hazard statements replace risk phrases
From 1 June 2015, the definitions moved onto the CLP criteria. Hazard statements H340, H350, H350i and H334 replaced the old risk phrases in regulation 7(7).
SI 2015/21The self-employed narrowed
From 1 October 2015, COSHH applies only to a self-employed person whose work is of a prescribed description, as set out above.
SI 2015/1637After Brexit
From 31 December 2020, references to the EU and its member states were amended. The CLP Regulation behind the definitions is now GB CLP, the version assimilated into the law of Great Britain.
SI 2018/1370 and SI 2019/720How L5, the COSHH ACOP, relates to the law
HSE publishes the Approved Code of Practice and guidance for COSHH as L5, now in its sixth edition (2013). It prints the regulations, the ACOP text and HSE guidance together, and marks which is which.
The ACOP has a special legal status. If you are prosecuted and did not follow the relevant ACOP provisions, you must show that you complied with the law in some other way. Otherwise a court will find you at fault. Following the guidance text is not compulsory, but if you follow it you will normally be doing enough.
HSE’s L5 fills in detail the regulations leave open. It says LEV and work enclosures should be visually checked at least once a week, and lists what an LEV examination record should contain. It also says tight-fitting masks should be face fit tested by a competent person.
L5 predates the 2015 changes and still prints the old risk phrases in regulation 7(7). Read it alongside the current text on legislation.gov.uk. The exposure limits themselves sit in EH40/2005, whose latest edition brought in 13 new or revised limits from 17 January 2020.
COSHH in Northern Ireland
The 2002 Regulations do not extend to Northern Ireland, apart from a narrow import provision. Northern Ireland has its own Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003, SR 2003/34, in operation since 28 February 2003. HSENI publishes the guidance on them.
The duties follow the same pattern. A firm with work on both sides of the Irish Sea should check the Northern Ireland text and HSENI guidance for jobs there, rather than assume every detail matches.
Every data sheet to hand,
tied to the job that uses it.
In Unibuild, each hazardous substance holds its safety data sheet and its supplier, linked to the jobs, materials and purchase orders that use it. Review dates are tracked, every version is kept, and the current one is the one out on site.
When an auditor or a principal contractor asks for the COSHH register, it is a search by name or supplier, not a spreadsheet somebody else kept.
- A data sheet for every substance held with its supplier
- Tied to the job through the materials and purchase orders that use it
- Review dates tracked and every version kept
- Searched by product name or supplier
Free COSHH templates
Free to use and reuse, no sign-upCOSHH Regulations: common questions
What are the key points of the COSHH Regulations 2002?
Is COSHH an Act?
What does COSHH regulation 6 require?
What does COSHH regulation 7 say?
What does COSHH regulation 9 require for LEV?
Do the COSHH Regulations apply to the self-employed?
How long must COSHH records be kept?
Is there a newer version than COSHH 2002?
Does following L5 count as complying with COSHH?
The COSHH guide
Read in any orderSources
Great Britain law and HSE guidance, read on the dates above. Northern Ireland has its own COSHH Regulations.
- The Control of Substances Hazardous to Health Regulations 2002 (SI 2002/2677), revised text, legislation.gov.uk
- Schedule 2A, principles of good practice, legislation.gov.uk
- Changes affecting SI 2002/2677, legislation.gov.uk
- The Health and Safety at Work etc. Act 1974 (General Duties of Self-Employed Persons) (Prescribed Undertakings) Regulations 2015
- The Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003 (SR 2003/34)
- HSE L5, Control of substances hazardous to health, ACOP and guidance, sixth edition 2013
- HSE EH40/2005 Workplace exposure limits
- HSE, I am self-employed. Does COSHH apply to me?
- HSE, The GB CLP Regulation
The COSHH register,
tied to the job.
Unibuild keeps each substance’s data sheet and supplier against the jobs, materials and purchase orders that use it, with review dates tracked and every version kept.