%201.svg)
The legal duties under COSHH split between employers, employees and the self-employed, with the specific regulations and operational details that matter in practice.
Two parties have legal duties under COSHH: the employer who controls the workplace and the substances, and the employee who works with them. The duties are different — the employer's are far more extensive — but both are enforceable and both can be prosecuted in their own right.
This page sets out who has to do what, where each duty comes from, and what the practical implementation looks like. For the broader context, see what COSHH is and the underlying COSHH Regulations 2002.
Where the duties come from
COSHH duties don't sit in isolation. They're built on top of two broader frameworks.
The first is the Health and Safety at Work etc. Act 1974. Section 2 of the Act sets the general employer duty to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees. Section 7 sets the equivalent general duty on employees — to take reasonable care for their own health and safety and that of others who may be affected by their acts or omissions at work, and to cooperate with their employer to enable the employer to comply with statutory duties.
The second is the Management of Health and Safety at Work Regulations 1999. These require employers to make a general workplace risk assessment, appoint competent persons to help with health and safety, provide health surveillance where appropriate, and provide information and training. COSHH builds on this framework with substance-specific duties.
The duties in COSHH itself — covered in detail in the COSHH Regulations 2002 walkthrough — are spread across Regulations 6 to 13. Most fall on the employer; Regulation 8(2) is the main employee-facing duty.
Employer duties under COSHH
The employer has seven major operational duties under the regulations.
Assess the risks
Under Regulation 6, the employer must make a "suitable and sufficient" assessment of the risk to health from each hazardous substance used or produced in the workplace, before any work that exposes employees can begin. The assessment must consider the substance's hazardous properties, the level and nature of exposure, the effect of any preventive or control measures, and the results of any monitoring or health surveillance.
Where the employer has five or more workers, the significant findings must be recorded in writing. The assessment must be reviewed regularly and when circumstances change.
For the practical method, see how to carry out a COSHH risk assessment.
Prevent or adequately control exposure
Regulation 7 requires the employer to either prevent exposure to hazardous substances entirely or, where prevention isn't reasonably practicable, control exposure adequately. The preferred approach is substitution — replacing the hazardous substance with something less hazardous, or changing the process so the substance isn't needed. Where substitution isn't possible, the hierarchy of control sets the order: engineering controls first, then control of exposure at source, then PPE only as a last resort.
For carcinogens, mutagens and substances that cause occupational asthma, the standard is higher. Exposure must be reduced as low as is reasonably practicable, not merely controlled below the workplace exposure limit.
The COSHH hierarchy of control walks through each level with examples.
Ensure controls are used and maintained
Regulations 8 and 9 cover what happens after controls are put in place. Regulation 8 requires the employer to take all reasonable steps to ensure that controls are properly used. Regulation 9 requires the employer to maintain controls in efficient working order, in good repair, and in clean condition.
For local exhaust ventilation — the engineering control most commonly used to reduce airborne exposure — Regulation 9 sets a specific maximum interval for thorough examination and testing: 14 months. Records of testing must be kept for at least five years. Other categories of equipment have suitable intervals defined in the Approved Code of Practice or by manufacturer specification.
Storage of substances is a control measure too. For the practical detail on cabinets, segregation and signage, see COSHH storage requirements.
Monitor exposure where required
Where the risk assessment indicates that exposure needs to be monitored, Regulation 10 requires the employer to arrange the monitoring. In practice this usually means personal sampling — air sampling pumps worn by workers during representative periods of work, with subsequent laboratory analysis. Records must be kept for at least five years, or 40 years where the record relates to the personal exposure of an identifiable employee subject to health surveillance.
Not every COSHH-covered workplace needs monitoring. The Approved Code of Practice gives criteria: monitoring is required where exposure is close to a workplace exposure limit, where the controls are critical to safety, or where the substances have particularly serious health effects.
Carry out health surveillance where required
Regulation 11 requires health surveillance for employees exposed to substances on a defined list in Schedule 6 of the regulations, or where the risk assessment indicates that an identifiable disease may result from exposure and surveillance can detect it early.
In practice this means routine medical or workplace checks — skin inspections for workers exposed to substances that cause dermatitis, lung function tests for workers exposed to asthmagens, and so on. Health records must be kept for 40 years from the date of the last entry, reflecting the long latency periods of many occupational diseases.
Inform, instruct and train
Regulation 12 requires the employer to provide workers exposed to hazardous substances with information, instruction and training. The training must cover the names of the substances they're exposed to, the significant findings of the assessment, the precautions in place, the results of any monitoring or health surveillance, and what to do in an emergency.
The legal threshold is "suitable and sufficient", which means the training has to fit the substances and the work. A wall poster doesn't satisfy the duty for workers handling carcinogens; an annual refresher e-learning module may not satisfy it for workers using a new substance brought in last week. Structured COSHH Training is the way most UK employers meet this duty for the standard substances workers encounter.
Plan for accidents, incidents and emergencies
Regulation 13 requires the employer to prepare for foreseeable emergencies involving hazardous substances. The arrangements must include emergency procedures (including evacuation and decontamination), provision of first aid suitable to the substances involved, and information for the emergency services about what they may encounter.
Alarms, warning signs and communication systems must be in place where the risk warrants them. Where a substance is listed in Schedule 2 of the regulations (prohibited or restricted substances), additional notifications may be required.
Employee duties under COSHH
The main employee duty under COSHH is in Regulation 8(2): every employee must make full and proper use of any control measure, other thing or facility provided in compliance with the regulations, and must take all reasonable steps to ensure it is returned after use to any accommodation provided for it.
In practice this breaks down into six things workers must do.
Cooperate with the employer's arrangements
This is the broader duty from Section 7 of the Health and Safety at Work Act, applied to COSHH specifically. Workers must follow the procedures, work within the system, and not undermine the controls the employer has put in place.
Use control measures properly
A worker handed PPE who refuses to wear it, or a worker who removes the LEV hood from a process because it's in the way, is in breach of Regulation 8(2). The duty extends to using the right control for the right substance — the wrong type of glove provides no protection.
Follow established procedures
Where the COSHH assessment has set out a specific procedure (mix the substance in the fume cupboard, use the trolley to move drums, don't decant into unmarked containers), workers must follow it. Deviating from the procedure undermines the assessment.
Report defects
If PPE is damaged, an LEV system is making unusual noises, a container is leaking, or a procedure isn't working as intended, the worker must report it. Concealing a defect is itself a breach.
Attend health surveillance appointments
Where the employer has arranged health surveillance under Regulation 11, workers required to attend must do so. Refusal can be a disciplinary matter as well as a breach of statutory duty.
Use PPE as instructed
Including putting it on correctly (face-fit for respiratory PPE, full coverage for gloves and aprons), keeping it in good condition, replacing it when defective, and storing it properly between uses.
The self-employed
Regulation 3 of COSHH applies the regulations to the self-employed in the same way as to employers. Self-employed people must assess their own risks, prevent or control their own exposure, and provide themselves with the necessary controls.
There's one technical complication around health surveillance. Self-employed people are treated as their own employees for the purposes of Regulation 11, meaning they may need to arrange health surveillance for themselves — including the 40-year record retention.
Some workers are "self-employed" for tax purposes but employees for health and safety purposes. The test for the health and safety duty is different from the tax test. If you work under someone else's direction, the chances are you're treated as an employee for COSHH purposes even if you submit invoices and file your own self-assessment. The practical effect is that the employer of nominally self-employed workers may have COSHH duties towards them.
The competent person
The Management Regulations 1999 (Regulation 7) require every employer to appoint a competent person to help with health and safety. For workplaces with significant COSHH risk, that appointment typically includes specific responsibility for COSHH compliance — making sure assessments are done, controls are in place, monitoring and surveillance happen on schedule, and training is delivered.
Competence isn't a formal qualification. The Management Regulations define a competent person as someone with sufficient training, experience and knowledge to be able to help the employer comply with the regulations. For most small and medium employers, that's an internal manager who's been through structured COSHH training and is familiar with the substances and work. For larger or higher-risk workplaces, an occupational hygienist or external safety consultant fills the role.
RIDDOR reportable occupational diseases
The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 require employers to report certain work-related diseases to HSE. Several of these are directly linked to COSHH-covered substances:
- Occupational dermatitis caused by exposure at work
- Occupational asthma caused by sensitising agents
- Occupational cancer attributable to specified substances or processes
- Various conditions from work with biological agents
The report must be made within ten days of the employer becoming aware of the diagnosis. Reports are made through the HSE online RIDDOR portal. The duty to report sits with the employer; doctors aren't required to report on their patients' behalf, though some occupational health services do so by arrangement.
RIDDOR reporting is a check on COSHH compliance — a workplace generating multiple cases of occupational asthma will be investigated by HSE, and an absent or inadequate COSHH assessment is one of the things the investigation will find.
Training as the connecting duty
Of all the COSHH duties, training is the one that ties everything else together. Workers who don't know what symbols mean can't make sense of labels; workers who don't understand the assessment won't follow the procedures; workers who haven't been trained on emergency arrangements can't respond effectively to a spill.
Regulation 12 requires the training to be suitable and sufficient. In practice that means it has to be specific to the substances the workers actually handle, the controls actually in place, and the emergency arrangements actually established. Generic awareness training has its place — it's the foundation — but it doesn't on its own discharge the Regulation 12 duty for workers in significant exposure roles.
Proper COSHH Training goes beyond awareness. It covers reading safety data sheets and labels, understanding the assessment for the substances at the worker's site, using the specific controls in place, and practising emergency response procedures. The investment pays back in fewer incidents, fewer cases of occupational ill health, and a clearer audit trail when HSE inspects.
Frequently asked questions
Who is ultimately responsible for COSHH?
The employer holds the primary legal duty. The Management Regulations 1999 require the appointment of a competent person to help, but the duty itself can't be delegated. Directors and senior managers can also be personally prosecuted under Section 37 of the Health and Safety at Work Act where their conduct contributed to a breach.
Can I delegate COSHH duties?
You can delegate the work — getting someone to carry out the assessment, set up the controls, run the training — but you can't delegate the legal duty. If an assessment is inadequate, the employer is in breach regardless of who actually wrote it.
What are the most common employee failures?
Not wearing issued PPE correctly, deviating from established procedures, decanting substances into unmarked containers, mixing incompatible substances, and not attending health surveillance appointments. Most are addressable through training and supervision rather than disciplinary action.
What happens if an employee refuses to wear PPE?
PPE use is part of the Regulation 8(2) duty on employees. Refusal is a breach of statutory duty and can be treated as a disciplinary matter. In practice, refusal usually signals a control problem — uncomfortable PPE that doesn't fit, PPE that's wrong for the substance, or a procedure that makes the work impractical with PPE on. The right response is to investigate the root cause before treating the worker as the problem.
Does COSHH apply to volunteers or unpaid workers?
COSHH applies to "employees" and the broader concept of "any other person on the employer's undertaking". Volunteers working on the employer's premises and contributing to the employer's activity are usually within scope. Unpaid trial workers, work experience placements and contractors are similarly often covered. The Section 3 duty of the Health and Safety at Work Act extends employer responsibilities to people who aren't employees but could be affected by the work.
