What is COSHH? Everything you need to know

A plain-English guide to the Control of Substances Hazardous to Health Regulations 2002 — what they cover, who they apply to, and what compliance looks like.

COSHH stands for the Control of Substances Hazardous to Health. It's the UK law that sets out how employers must protect workers from substances that can harm their health at work — chemicals, dust, fumes, vapours, gases, biological agents and more. The full title is the Control of Substances Hazardous to Health Regulations 2002, usually shortened to "the COSHH Regulations" or just "COSHH".

If your business uses, produces or stores anything that could harm health, COSHH applies to you. That covers a vast range of workplaces. A joinery shop creating wood dust falls under it. So does a hair salon using bleach and colourants, a hospital ward handling cytotoxic drugs, a cleaning team working with surface disinfectants, a garage using brake cleaner aerosols, and a brewery with CO₂ asphyxiation risks. Almost no UK workplace is fully outside its scope.

When the regulations came in

The first set of COSHH regulations was made in 1988. The current version is the 2002 regulations, which came into force on 21 November 2002 as Statutory Instrument 2002/2677. They've been amended several times since — in 2003, 2004, 2015, 2018 (twice, including the EU Exit amendments that retained the regulations in domestic law after Brexit) and 2020.

The regulations sit underneath the Health and Safety at Work etc. Act 1974, the umbrella for almost all UK workplace health and safety law. They're enforced by the Health and Safety Executive or by local authority environmental health officers, depending on the type of premises. The detailed practical guidance for compliance is the Approved Code of Practice L5, now in its sixth edition.

What COSHH covers

The regulations apply to "substances hazardous to health". In practice that means:

• Chemicals and products containing chemicals — cleaning agents, paints, adhesives, solvents, agricultural chemicals, fuel
• Fumes, including welding fume, soldering fume and exhaust emissions
• Dusts — wood dust, silica dust from cutting or grinding stone and concrete, flour, grain, cement
• Vapours and mists from sprays, metalworking fluids and similar processes
• Gases, including asphyxiating gases like CO₂ and nitrogen
• Biological agents — bacteria, viruses, fungi and other microorganisms that cause disease

The test isn't whether the label has a warning symbol. It's whether the substance can harm health under the conditions in which it's used. Plain water counts as hazardous in some contexts, because prolonged wet work causes occupational dermatitis. HSE's rule of thumb is that washing your hands more than around twenty times a day puts a worker at risk of contact dermatitis even without contact with anything formally classified as hazardous.

For the detailed scope, including the edge cases — nanomaterials, asphyxiating gases, and the awkward definition of "substance hazardous to health" in law — see our guide to what substances are covered by COSHH.

What COSHH does not cover

Three substance groups sit outside COSHH because they have their own specific regulations:

• Asbestos is regulated by the Control of Asbestos Regulations 2012. Note the date — these are 2012 regulations, not 2002. A surprising number of guides get this wrong.
• Lead is regulated by the Control of Lead at Work Regulations 2002, which require biological monitoring (blood lead testing) that goes beyond standard COSHH controls.
• Radioactive substances are regulated by the Ionising Radiations Regulations 2017.

There's also overlap with the Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR). DSEAR covers fire and explosion risks; COSHH covers health risks. Many flammable solvents trigger both, with the two regulations addressing different aspects of the same substance.

Who has duties under COSHH

The primary duty sits with the employer. Under the regulations, employers must assess the risks from hazardous substances, prevent exposure where reasonably practicable, control it where not, monitor exposure where required, carry out health surveillance for specified processes, and inform, instruct and train their workforce. Self-employed people have the same duties as employers in most respects, except that for health surveillance purposes they're treated as their own employees.

Employees also have specific duties. They must cooperate with their employer, use control measures and PPE as instructed, report defects in equipment or controls, and attend health surveillance appointments where required. These duties come both from COSHH itself and from Section 7 of the Health and Safety at Work Act.

For the full split between employer and employee duties — including what training must cover under Regulation 12 — see COSHH responsibilities for employers and employees.

What a COSHH risk assessment looks like

The risk assessment is the keystone of COSHH compliance. Regulation 6 requires every employer to make a "suitable and sufficient" assessment of the risks from hazardous substances before any work that exposes employees can begin. Where the employer has five or more workers, that assessment must be in writing.

The assessment identifies which substances are present, who could be harmed and how, evaluates the level of risk, sets out the controls, and is reviewed when circumstances change. Most assessments are built from the safety data sheets (SDS) supplied with each substance — these contain the hazard information the assessment draws on, particularly Section 2 (hazards), Section 8 (exposure controls and PPE) and Section 11 (toxicological information).

Two pages on the site go deeper into this. How to carry out a COSHH risk assessment walks through the process step by step with worked examples. The COSHH risk assessment template is the document you fill in afterwards, with each field explained.

The eight steps of COSHH compliance

HSE breaks COSHH compliance into eight discrete duties, each tied to a regulation:

1. Assess the risks (Reg 6)
2. Decide what precautions are needed (Reg 7)
3. Prevent or adequately control exposure (Reg 7)
4. Ensure controls are used and maintained (Regs 8 and 9)
5. Monitor exposure where required (Reg 10)
6. Carry out health surveillance where required (Reg 11)
7. Plan for accidents, incidents and emergencies (Reg 13)
8. Inform, instruct and train employees (Reg 12)

Each step has its own operational requirements and its own evidence trail. Some pages frame this as five steps (using the generic HSE risk assessment template) or seven (omitting one of the duties). Eight is the form that maps directly onto Regulations 6 to 13. The eight steps to COSHH compliance explains each step and what good practice looks like.

The hazard symbols you'll see

Hazardous substances carry pictograms on their labels — the familiar red-bordered diamond shapes with black symbols inside. There are nine of these pictograms in total: explosive, flammable, oxidising, gas under pressure, corrosive, acute toxicity, health hazard, serious health hazard, and environmental hazard. They're defined under the GB CLP Regulation, which is the retained version of the EU CLP Regulation that the UK adopted after Brexit, and they're based on the United Nations' Globally Harmonised System of Classification and Labelling of Chemicals (GHS).

Strictly speaking these are "CLP hazard pictograms", not "COSHH symbols" — but the colloquial term has stuck and you'll see them referred to as COSHH symbols everywhere. They replaced the older orange-square CHIP symbols in two stages, with substances changing over from 1 December 2010 and mixtures from 1 June 2015. Existing stock could legally be sold through to 1 June 2017. You'll still occasionally find older containers carrying the orange symbols in workplaces that haven't refreshed their inventory.

For each pictogram in detail — what it means, example substances, and how to use them in your assessment — see COSHH symbols and their meanings.

The hierarchy of control

When the COSHH risk assessment identifies an exposure risk, the regulations set out the order in which controls must be considered. Substitution comes first under Regulation 7(2): wherever reasonably practicable, the hazardous substance must be replaced with something less hazardous, or the process changed to remove the need for it. Where substitution isn't possible, Regulation 7(3) sets out a hierarchy of further controls: engineering controls first, then organisational controls and control at source, then PPE only as a last resort.

This is the COSHH-specific version of the general hierarchy of control. It differs in some details from the generic "elimination, substitution, engineering, administrative, PPE" hierarchy that most general health and safety training uses, although the underlying logic is the same. The COSHH hierarchy of control explains each level with examples.

Why COSHH matters

The human cost is the reason the regulations exist. HSE's annual statistics for 2024/25, published in November 2025, estimate that 1.9 million workers in Great Britain suffered from work-related ill health. Around 11,000 deaths a year are linked to past occupational lung exposures — long-latency conditions like chronic obstructive pulmonary disease, asbestos-related cancers and mesothelioma. A further 22,000 workers each year develop new breathing or lung problems caused or made worse by work, and around 84,000 people are estimated to have work-related dermatitis at any time.

The financial picture is similar in scale. Workplace injuries and new cases of work-related ill health cost Great Britain an estimated £22.9 billion in 2023/24, with ill health accounting for roughly 72% of the total.

Most of these conditions are preventable. The substances that cause them have been on the market for decades, the controls are well understood, and the regulations have been in place since 1988. What makes COSHH compliance difficult isn't the science. It's the operational discipline to keep doing it across every shift, every substance and every worker.

Penalties

Breaching the COSHH regulations is a criminal offence. On summary conviction in a magistrates' court, the penalty is an unlimited fine. On indictment in the Crown Court, the penalty is also an unlimited fine, and individual directors or managers can be prosecuted personally where their consent, connivance or neglect contributed to the breach. Sentencing follows the Sentencing Council's guideline for health and safety offences, which scales fines by the seriousness of the harm and the size of the organisation. Six- and seven-figure fines are routine in serious cases.

HSE can also issue improvement notices requiring corrective action within a stated period, prohibition notices that immediately halt an unsafe activity, or charge Fees for Intervention where they spend time investigating a material breach.

Training and what to do next

Regulation 12 requires employers to provide their workforce with information, instruction and training. The training must cover the nature of the substances involved, the significant findings of the COSHH assessment, the precautions in place, and the results of any monitoring or health surveillance. Refresher training is expected where circumstances change or where the original training is no longer effective.

Getting people genuinely competent — not just compliant on paper — is the most reliable way to keep COSHH workable in practice. That's where structured COSHH Training earns its place.

Frequently asked questions

What does COSHH stand for?

COSHH stands for Control of Substances Hazardous to Health. It refers to the Control of Substances Hazardous to Health Regulations 2002 and their amendments — the UK law that requires employers to control hazardous substances at work.

When did COSHH come into force?

The current regulations came into force on 21 November 2002. The original COSHH regulations were made in 1988 and revised in 1994 and 1999 before the 2002 version replaced them. Several amendments have followed, most recently in 2020.

What does COSHH cover?

COSHH covers chemicals, products containing chemicals, fumes, dusts, vapours, mists, gases, biological agents and asphyxiating gases — any substance that could harm health under the conditions in which it's used. It applies whether the substance is brought into the workplace or created by a process (such as welding fume or sanding dust).

What doesn't COSHH cover?

Asbestos (Control of Asbestos Regulations 2012), lead (Control of Lead at Work Regulations 2002) and radioactive substances (Ionising Radiations Regulations 2017) are regulated separately. Substances hazardous solely because they're flammable or explosive fall under DSEAR rather than COSHH, although many substances trigger both regimes.

Who is responsible for COSHH?

The employer holds the primary legal duty. Employees have specific duties to cooperate, use controls properly, report defects and attend health surveillance. The self-employed are treated as employers for most of the regulations. Directors and senior managers can also be personally liable where their conduct contributed to a breach.

Do I need COSHH training?

Regulation 12 requires employers to provide training to anyone whose work brings them into contact with hazardous substances. The training must cover the substances themselves, the assessment findings, the controls in place, and what to do in an emergency. Refresher training is needed when circumstances change.

What's the penalty for breaching COSHH?

Breach of COSHH is a criminal offence punishable by an unlimited fine in either the magistrates' or Crown Court. Directors and managers can be prosecuted personally where their conduct contributed. HSE can also issue improvement notices, prohibition notices, or charge Fees for Intervention.