%201.svg)
A walkthrough of the Control of Substances Hazardous to Health Regulations 2002, Regulation by Regulation, with the amendments, the Approved Code of Practice, and the practical duties they place on UK employers.
The COSHH Regulations 2002 are the UK law on hazardous substances at work. They set out what employers must do to assess, prevent and control the health risks from chemicals, dust, fumes, biological agents and other hazardous materials. Almost every UK workplace uses substances in scope, which is why these regulations are among the most widely-applied pieces of health and safety law.
This page walks through the regulations themselves — what each one requires, where they came from, how they've been amended, and how the Approved Code of Practice fits in. If you need the broader context first, see what COSHH is and what it covers.
What the regulations are
The Control of Substances Hazardous to Health Regulations 2002 are a statutory instrument made under the Health and Safety at Work etc. Act 1974. Their reference is SI 2002/2677 and they came into force on 21 November 2002. Like all statutory instruments, they have the force of primary legislation — breach is a criminal offence and can be prosecuted in the magistrates' or Crown Court.
The 2002 regulations replaced an earlier 1999 set, which itself replaced the original 1988 regulations and a 1994 revision. The basic framework has been stable since 1988: an employer-led duty to assess and control risk, with specific duties around monitoring, health surveillance, training and emergency planning. Each revision has tightened the requirements, brought in new substance categories, and aligned with successive EU directives on chemical safety.
The regulations are enforced by the Health and Safety Executive for most workplaces, and by local authority environmental health officers for retail, office, leisure and similar premises.
Brief history: 1988 to today
A short timeline helps make sense of the amendments:
- 1988: First COSHH Regulations introduced, consolidating a previous patchwork of substance-specific legislation
- 1994: First major revision
- 1999: Second revision, incorporating biological agents more explicitly
- 2002: Current regulations made and came into force on 21 November
- 2003: First amendment (SI 2003/978) tightening provisions on carcinogens and biological agents
- 2004: Second amendment (SI 2004/3386) further changes to control measure provisions
- 2015: Amendments through the Classification, Labelling and Packaging of Chemicals (Amendments to Secondary Legislation) Regulations 2015, aligning COSHH with the CLP Regulation
- 2018: Two sets of changes — the Personal Protective Equipment (Enforcement) Regulations 2018 (SI 2018/390) tightened the PPE provisions, and the Health and Safety (Amendment) (EU Exit) Regulations 2018 (SI 2018/1370) retained COSHH in domestic law after Brexit
- 2020: EH40 updated to reflect the EU Carcinogens and Mutagens Directive (2017/2398), introducing new workplace exposure limits for thirteen substances
The L5 Approved Code of Practice — the main practical guidance document — is currently in its sixth edition, having been updated to reflect REACH and CLP. The 2002 regulations themselves remain the operative law and have not been replaced.
The Approved Code of Practice and what it adds
Section 16 of the Health and Safety at Work Act allows HSE to issue Approved Codes of Practice (ACOPs). An ACOP is more than guidance and less than law. It explains how to comply with the regulations in practice, and it has a special legal status: in a prosecution for breach of the regulations, the ACOP can be cited as evidence. If an employer hasn't followed the ACOP, they have to show they've achieved compliance some other way. Following the ACOP is the simplest route to demonstrating compliance.
The COSHH ACOP is published by HSE as L5, currently in its sixth edition. It runs to several hundred pages and works through the regulations one by one, with detailed guidance, worked examples and references to other publications. For complex compliance questions — particularly around regulation 7 (control), 10 (monitoring) and 11 (health surveillance) — L5 is the authoritative source. HSE also publishes more accessible practical guidance separately, including HSG97 on risk assessment and HSG258 on local exhaust ventilation.
Walking through the regulations
The active duties on employers are in Regulations 6 to 13. Regulations 1 to 5 cover citation, interpretation, application and exemptions; Regulations 14 to 22 cover specific provisions on fumigation, exemptions, defence and similar matters.
Regulation 6 — Risk assessment
Regulation 6 prohibits work liable to expose any employee to a substance hazardous to health unless a "suitable and sufficient" assessment has been made and the necessary steps to comply with the regulations have been taken. The assessment must consider the hazardous properties of the substance, information from the supplier (including the safety data sheet), the level and nature of exposure, any workplace exposure limits, the effects of preventive and control measures, and the results of any monitoring or health surveillance.
The assessment must be in writing where the employer has five or more workers — this is the same threshold that applies to general risk assessments under the Management of Health and Safety at Work Regulations 1999. It must be reviewed regularly, and immediately if there's reason to believe it's no longer valid, if work changes significantly, or if monitoring or health surveillance suggests controls aren't working.
How to carry out a COSHH risk assessment covers the practical method, and the COSHH risk assessment template is the document you record findings on.
Regulation 7 — Prevention or control of exposure
Regulation 7 is the operational heart of the regulations. It requires employers to either prevent exposure to hazardous substances entirely or, where prevention isn't reasonably practicable, control exposure adequately. The choice between prevention and control is not a free one — Regulation 7(2) makes substitution by a safer alternative the explicit preference. Where substitution isn't reasonably practicable, Regulation 7(3) sets a hierarchy of control: engineering controls and appropriate work systems first; control of exposure at source through ventilation and organisational measures next; PPE only as a last resort, in addition to other controls.
For carcinogens, mutagens and substances that cause occupational asthma, the standard goes higher: exposure must be reduced as low as reasonably practicable (ALARP), not merely controlled below the workplace exposure limit. This is the most-cited part of COSHH in practice. The COSHH hierarchy of control walks through each level with examples.
Regulation 8 — Use of control measures
Regulation 8 deals with what happens after controls are put in place. Employers must take all reasonable steps to ensure that the control measures are properly used and applied. Workers, in turn, must use the control measures properly, follow procedures, report defects, and use PPE as required. The dual duty is important — an employer who provides perfect engineering controls can still be in breach if those controls aren't actually used, and a worker who ignores the controls can be personally liable.
Regulation 9 — Maintenance, examination and testing
Controls have to be maintained in efficient working order, in good repair and in clean condition. For local exhaust ventilation (LEV) plant — the engineering control most often used to reduce airborne exposure — regulation 9 sets a specific maximum interval for thorough examination and testing: 14 months. Records of testing must be kept and made available for inspection. Other categories of equipment have suitable intervals defined in the ACOP or by manufacturer specification.
This 14-month figure is the operational detail competitor guides most often miss. It comes from Regulation 9(2)(a) and is a hard maximum, not an aspiration. LEV systems that haven't been examined within 14 months are technically non-compliant regardless of how well they appear to be working.
Regulation 10 — Monitoring exposure
Where the risk assessment indicates that the exposure of employees needs to be monitored, the employer must arrange the monitoring. This means measuring the substance in the air a worker breathes — usually through personal sampling pumps and analytical laboratory work. Records must be kept for at least five years, or forty years where the record relates to the personal exposure of an identifiable employee subject to health surveillance.
Monitoring isn't required in every case. The ACOP gives criteria for when it's needed, particularly where exposure is close to a workplace exposure limit, where controls are critical to safety, or where the substances involved have particularly serious health effects.
Regulation 11 — Health surveillance
Some COSHH-relevant work requires health surveillance — periodic medical or workplace checks to identify occupational disease early. Regulation 11 and Schedule 6 of the regulations list the processes where health surveillance is required: work with vinyl chloride monomer, certain processes involving silica or asbestos (though asbestos has its own regime), work with chrome plating baths, and others. Health surveillance is also required where workers are exposed to substances on a defined list (Schedule 6 again) at a level that could cause identifiable disease.
Health records must be kept for at least 40 years from the date of last entry — a much longer retention period than ordinary employment records, reflecting the long latency periods of many occupational diseases. The records belong to the employer but must be made available to HSE on request.
Regulation 12 — Information, instruction and training
Employers must provide their workforce with information, instruction and training that's "suitable and sufficient" so they know the risks they face and the precautions in place. The training must cover the names of the substances they're exposed to, the significant findings of the assessment, the precautions in place, the results of any monitoring, and what to do in an emergency.
This regulation is the legal basis for COSHH training programmes in UK workplaces. Refresher training is expected where circumstances change, where workers move into new roles, or where the original training has lapsed in effectiveness. Practical training — including how to put on respiratory PPE correctly, how to read a safety data sheet, and how to respond to a spill — is hard to achieve through a wall poster alone, which is why structured COSHH Training is the usual route for compliance.
Regulation 13 — Emergency arrangements
Regulation 13 requires employers to plan for accidents, incidents and emergencies involving hazardous substances. The arrangements must include emergency procedures (drills, evacuation plans, decontamination), provision of first aid, and information for the emergency services. Alarms, warning signs and communication systems must be in place where the risk warrants them. Where a substance is listed in Schedule 2 (the prohibited or restricted substances list), additional notifications may be required.
Penalties and enforcement
Breach of any of the COSHH regulations is a criminal offence under Section 33 of the Health and Safety at Work Act. On summary conviction in a magistrates' court, the penalty is an unlimited fine. On indictment in the Crown Court, the penalty is also an unlimited fine, with no statutory cap. Individuals — including directors, managers and other officers — can be prosecuted personally under Section 37 of the Act where the breach occurred with their consent or connivance, or was attributable to their neglect.
Sentencing follows the Sentencing Council's guideline for health and safety offences, which sets penalty ranges by combining the seriousness of the harm risked with the culpability of the offender and the size of the organisation. For organisations in the highest culpability and harm categories, the starting points run into the millions of pounds for large companies.
HSE has three enforcement tools short of prosecution. An improvement notice requires the employer to put a specific defect right within a stated period. A prohibition notice immediately stops an unsafe activity. Fees for Intervention (FFI) allow HSE to charge for the time spent investigating a material breach — currently at an hourly rate published by HSE — including the time spent writing letters, taking statements and producing reports.
Frequently asked questions
When did COSHH 2002 come into force?
The Control of Substances Hazardous to Health Regulations 2002 came into force on 21 November 2002. They replaced the previous 1999 regulations, which were themselves a revision of the original 1988 COSHH framework.
How often have the regulations been amended?
The regulations have been amended several times — most significantly in 2003, 2004, 2015 (alongside CLP implementation), 2018 (PPE provisions and post-Brexit retention), and 2020 (EH40 workplace exposure limit updates).
What is the L5 ACOP?
L5 is the Approved Code of Practice issued by HSE alongside the regulations. It runs through each regulation with practical guidance and worked examples. The current edition is the sixth. It has a special legal status — if you've followed the ACOP, you're presumed to have complied with the regulations.
What are the penalties for breaching COSHH?
Breach is a criminal offence punishable by an unlimited fine in either court. Directors and managers can be personally prosecuted. HSE can also issue improvement notices, prohibition notices, or charge Fees for Intervention.
What is a statutory instrument?
A statutory instrument is a piece of secondary legislation made by a minister under powers given by an Act of Parliament — in this case, the Health and Safety at Work Act. SIs have the force of law and breach can be prosecuted as a criminal offence.
Is COSHH still in force after Brexit?
Yes. The Health and Safety (Amendment) (EU Exit) Regulations 2018 retained the COSHH regulations in domestic UK law as part of the broader retained EU law framework. Some specific references to EU bodies and procedures were updated, but the substantive duties on employers are unchanged.
