What is COSHH? The regulations, duties and UK penalties explained

COSHH is the Control of Substances Hazardous to Health Regulations 2002, the law that makes employers in Great Britain find the substances at work that can harm people's health and then prevent or control exposure to them. In practice that means assessing each harmful substance and process, putting controls in place, keeping them working, training staff, and planning for spills and accidents, with Northern Ireland following its own 2003 version.

COSHH at a glance

• COSHH covers chemicals, fumes, dusts, gases and germs, from oven cleaner to flour.
• The duties are in regulations 6 to 13: assess, prevent or control, check controls are used, maintain them, monitor, health surveillance, training and emergencies.
• If you employ 5 or more people, you must write down the significant findings of your assessment.
• Breaking COSHH is a criminal offence. A director can be prosecuted personally, and fines for organisations follow a sentencing guideline that runs from £50 to £10 million.

What does COSHH stand for, and what counts as a "substance hazardous to health"?

COSHH stands for Control of Substances Hazardous to Health. The legal definition is in regulation 2 of the COSHH Regulations 2002, and it's wider than most people expect. A substance or mixture is hazardous to health if it:

1. meets the criteria for any health hazard class under the CLP Regulation, "whether or not the substance is classified";
2. has a workplace exposure limit (WEL) approved by HSE;
3. is a biological agent, meaning a micro-organism, cell culture or human endoparasite that "may cause infection, allergy, toxicity or otherwise create a hazard to human health";
4. is dust of any kind in air at 10 mg/m³ or more of inhalable dust, or 4 mg/m³ or more of respirable dust, averaged over 8 hours;
5. or, failing all of those, creates a risk to health "because of its chemical or toxicological properties and the way it is used or is present at the workplace".

The last limb catches things with no label at all. HSE's guide to carrying out a COSHH risk assessment says "health hazards are not limited to substances labelled as 'hazardous'", and gives wood dust from sanding and fumes from welding as examples of substances your own process creates. In a food business the main ones are flour dust, charcoal-grill carbon monoxide and wet work, covered in "hazards that aren't in a bottle" below.

What COSHH doesn't cover

Regulation 5 takes three groups out of regulations 6 to 13:

• substances covered by the Control of Lead at Work Regulations 2002 or the Control of Asbestos Regulations 2012;
• substances hazardous "solely by virtue of" being radioactive, explosive or flammable, or "solely because it is at a high or low temperature or a high pressure";
• medicines given to a patient as part of their medical treatment.

Note the word "solely". Fire and explosion go to the Dangerous Substances and Explosive Atmospheres Regulations (DSEAR), but if a flammable solvent also irritates skin, COSHH covers that.

COSHH isn't the same as a safety data sheet

The Health and Safety Executive for Northern Ireland puts it plainly on its COSHH topic page: "The SDS itself is not an assessment of the risk." A safety data sheet (SDS) tells you what a product can do. Your assessment says how your staff use it, how often, and what you've done about the risk. A shelf of SDS printouts won't satisfy an inspector.

Where did COSHH come from?

The first COSHH Regulations (SI 1988/1657) came into force on 1 October 1989. The current 2002 Regulations replaced the 1999 version on 21 November 2002, and a 2004 amendment brought in today's single "workplace exposure limit" from 6 April 2005. HSE's brief guide, INDG136, gives the reason for all of it: "Every year, thousands of workers are made ill by hazardous substances", and HSE's COSHH overview adds that "Many of the long-term or chronic effects cannot be cured once they develop."

Which COSHH law applies in each UK nation?

Regulation 6(4) of the 2003 Northern Ireland Regulations has the same "five or more employees" threshold for a written record.

Who is responsible for COSHH?

• The employer. Every main duty sits with the employer. Under regulation 3 the employer also owes it, "so far as is reasonably practicable", to anyone else affected by the work, such as customers, contractors and agency staff. Health surveillance is for employees only.
• The self-employed. With employees, all of COSHH applies. With none, HSE says it still applies when you take hazardous substances to other people's premises, minus monitoring and health surveillance.
• Employees. Regulation 8(2) says every employee "shall make full and proper use of any control measure" and report any defect "forthwith".
• Directors and managers personally. Under section 37 of the 1974 Act, a director or manager whose "consent or connivance" or "neglect" led to the company's offence is guilty too.
• Contractors on your site. HSE's training guidance says "you need to know if they are bringing hazardous substances onto your premises". Think of the deep-clean firm.

The eight COSHH duties, step by step

1. Assess the risk (regulation 6)

You can't carry out work that could expose employees to a hazardous substance until you've made "a suitable and sufficient assessment" and put its steps in place, says regulation 6. It has to cover, among other things, the substance's hazards, the supplier's safety data sheet, the level and duration of exposure, high-exposure jobs such as maintenance, and products used in combination.

Review it "regularly", and straight away if it may no longer be valid or the work has changed significantly. With 5 or more employees, record the significant findings and the steps you've taken. If you have four staff, the written record becomes compulsory once you take on a fifth. Our COSHH risk assessment templates show what that looks like.

2. Prevent exposure, or control it (regulation 7)

Regulation 7 is the main COSHH duty. First, prevent exposure, and substitution "shall by preference be undertaken": swap the substance or process for a safer one if that's reasonably practicable. Only where you can't prevent it do you control it, in this order of priority:

1. work processes, systems and engineering controls, and suitable equipment and materials;
2. control at source, "including adequate ventilation systems and appropriate organisational measures";
3. personal protective equipment, and only "where adequate control of exposure cannot be achieved by other means", on top of the first two.

Control only counts as adequate if the principles of good practice in Schedule 2A are applied and no WEL is exceeded. For carcinogens, mutagens and substances that can cause asthma (hazard statement H334, for example), exposure must also be reduced "to as low a level as is reasonably practicable".

3. Make sure controls are used (regulation 8)

Under regulation 8(1) the employer must "take all reasonable steps" to make sure control measures are "properly used or applied". So you have to check that staff wear the gloves you bought.

4. Maintain, examine and test controls (regulation 9)

Regulation 9(1) requires plant and equipment, including PPE, to be kept "in an efficient state, in efficient working order, in good repair and in a clean condition". Local exhaust ventilation (LEV) must be thoroughly examined and tested "at least once every 14 months" (more often for the processes listed in Schedule 4). Under regulation 9(3), reusable respiratory protective equipment (RPE) provided as a control needs "thorough examination and, where appropriate, testing" at suitable intervals; disposable masks are excluded. Regulation 9(4) says the LEV and RPE results and repairs must be recorded, for the period in the records table below.

PPE must be stored in "a well-defined place", checked, and repaired or replaced before further use if it's defective.

5. Monitor exposure where needed (regulation 10)

Regulation 10 requires monitoring, usually air sampling, where the risk assessment shows it's needed to keep control adequate or otherwise to protect health. You don't have to monitor if you can show by another method that you're complying. Monitoring has to be recorded, and the records table below gives how long to keep it.

6. Health surveillance where it's appropriate (regulation 11)

Regulation 11 requires health surveillance where an identifiable disease or adverse health effect "may be related to the exposure", it's reasonably likely in your conditions of work, and there are valid techniques to detect it. Typical examples are skin checks for dermatitis and lung function tests for asthma. Each employee under surveillance needs an individual health record (retention is in the records table below).

HSE's health surveillance page says testing alone isn't enough: "Employers must then have the results interpreted and take action".

7. Information, instruction and training (regulation 12)

Regulation 12 requires "suitable and sufficient information, instruction and training" for anyone liable to be exposed. It must cover the substances and their risks, the assessment's findings, the precautions, and monitoring and anonymised surveillance results.

HSE's catering sheet says "It will not be enough just to issue safety data sheets", and asks employers to take account of "staff who do not have English as a first language". For a short session plan, see our in-house COSHH training guide.

8. Plan for accidents, incidents and emergencies (regulation 13)

Regulation 13 requires procedures, "including the provision of appropriate first-aid facilities and relevant safety drills (which shall be tested at regular intervals)", for an accident or emergency involving a hazardous substance. They're not needed where there's "only a slight risk" and your controls cover it, unless the substance is a carcinogen, mutagen or biological agent.

Which COSHH duties apply to your business? A decision table

Answer each question for your site. A yes sends you to the duty that applies; the detail is in that section.

Reading labels and safety data sheets

INDG136 says that "Since 2009, new international symbols have been gradually replacing the European symbols". GB CLP uses nine, each a black symbol in a red-bordered diamond. The hazard classes in the middle column come from Annex V of the GB CLP Regulation. The kitchen examples are the kind of product where you may meet each one; your own label and SDS decide.

Four of the nine (corrosion, skull and crossbones, exclamation mark and health hazard) are health hazards and bring COSHH in. The flame, exploding bomb, flame over circle and gas cylinder mark physical hazards, which regulation 5 leaves to other law when that's the only hazard ("solely", above). HSE's page on cleaning products and the corrosive pictogram explains why the oven cleaner you've bought for years may suddenly carry the corrosion symbol. CLP's classification tests are "more stringent", but that "does not mean that the chemical product is any more or less hazardous than it was". Corrosion with H318 means serious eye damage; the exclamation mark with H319 means eye irritation.

INDG136 says "Safety data sheets can be hard to understand", and tells you where to look first:

• Sections 2 and 16 tell you what the dangers are.
• Sections 4 to 8 tell you about emergencies, storage and handling.

HSE says "only about 500 substances have WELs", listed in EH40/2005 Workplace exposure limits. The limits are "legally binding under COSHH", and a product with no WEL is still covered if it meets a CLP health hazard class.

COSHH for cleaning chemicals in kitchens, bars and front of house

HSE's Catering Information Sheet No 22 on cleaning substances in hospitality (CAIS22 rev2, July 2017) is the official guidance written for food businesses. It lists the products it means: "washing-up liquids, dishwasher detergents and rinse-aids, drain-cleaning products, oven cleaners, disinfectants, toilet cleaners, bleach, sanitisers and descalers."

Its main points for employers and staff:

• Never mix products. "Cleaning products containing bleach mixed with acidic toilet cleaners or ammonia will give off harmful gases." CAIS22 also asks you to "Consider safe storage arrangements", so keep incompatible products apart.
• Dilute the right way round: "Always add the concentrated liquid to water, not the water to the concentrate."
• Never decant into food or drink containers. CAIS22 says the habit is "still common". Label any spray bottle you fill.
• "Avoid latex gloves as they are known to cause reactions", and check rubber gloves for holes.
• With aerosols, "never spray them onto hot surfaces as this can produce harmful vapours". That's the oven-cleaner mistake.

Locking chemicals away at the end of a shift is a COSHH storage control in its own right. See our chemical store lock-up checks. Chemicals also run through your food safety system: sanitisers and their contact times sit in two-stage cleaning.

COSHH hazards in food businesses that aren't in a bottle

Three come up again and again in official sources.

Flour dust. HSE began a programme of inspections at large bakeries across Great Britain in January 2026. Its press release on flour dust inspections calls flour dust "one of the most common causes of occupational asthma in Great Britain" and names the high-risk tasks: "dusting flour during dough handling, tipping and dispensing dry ingredients, and cleaning up flour spills". Inspectors check the hierarchy runs in order, down to "Respiratory protective equipment as a last resort".

Carbon monoxide from solid-fuel cooking. Cornwall Council's guidance on solid fuels in commercial kitchens puts carbon monoxide under COSHH and says to check your extraction suits a charcoal grill and to "Get your system checked every 14 months".

Wet work and skin. HSE's brief guide to COSHH, INDG136(rev5) says "Wet working, eg catering and cleaning, can cause dermatitis": if your kitchen porter has their hands in hot soapy water all shift, that's a COSHH issue. Gloves, hand care and regular skin checks are the controls HSE's overview describes, and they apply to pot wash. Our dermatitis risk assessment covers this in detail.

What records does an inspector expect?

Under 5 employees, CAIS22 says "you don't have to write anything down, but it is good practice to keep a record". An inspector will still expect you to explain how you control the risks.

Enforcement, penalties and real cases

Who enforces and what powers they have

For most restaurants, cafés, pubs, hotels and shops in Great Britain, COSHH is enforced by the council's environmental health team (see our guide to what an environmental health officer does); elsewhere it's HSE. In Northern Ireland, catering premises fall to the district council.

An inspector who thinks you're breaking the law can serve an improvement notice under section 21, which gives you a deadline to put it right, or a prohibition notice under section 22 to stop an activity that involves "a risk of serious personal injury". Ignoring either one is a separate offence.

Penalties in each nation

Breaking COSHH is an offence under section 33(1)(c) of the Health and Safety at Work etc. Act 1974. It's triable either way, and the maximum penalty is set by Schedule 3A to the Act:

Prison applies to individuals, such as a director convicted under section 37. A company pays a fine.

The Sentencing Council's guideline applies in England and Wales only. There, courts use its guideline for organisations breaching health and safety regulations. The court sets culpability and harm, then reads across a table for the organisation's turnover. The offence range is "£50 fine – £10 million fine".

In Scotland, we found no sentencing guideline for health and safety offences; the Scottish Sentencing Council's approved guidelines list none and none is in development. In Northern Ireland, we found no guideline for health and safety breaches. The nearest is a 2012 Crown Court guidance judgment on corporate manslaughter, R v J M W Farm Ltd [2012] NICC 17.

Time limits for prosecution

Because a COSHH breach can be tried either way, there's no six-month time limit in England and Wales: section 127(2) of the Magistrates' Courts Act 1980 disapplies it for "any indictable offence". In Northern Ireland, article 19(2) of the Magistrates' Courts (Northern Ireland) Order 1981 says such an offence "may be made and dealt with at any time". In Scotland, the six-month limit in section 136 of the Criminal Procedure (Scotland) Act 1995 applies only to offences "triable only summarily", so it doesn't apply either.

Defences

Most COSHH duties are qualified by "reasonably practicable". Under section 40 of the 1974 Act, it's "for the accused to prove" that it wasn't reasonably practicable to do more. So the burden is on you, and your written assessment, maintenance logs and training records are your evidence.

Three cases

• A restaurant, carbon monoxide (2026). The Pickled Plate Ltd used a konro and a drum-style barbecue grill indoors in Padstow without a suitable and sufficient assessment of the carbon monoxide risk. It ignored advice, an improvement notice and then a prohibition notice, and kept using the grill while the prohibition was in force. On 18 June 2026 at Exeter Magistrates' Court it pleaded guilty to five offences under the 1974 Act and COSHH, and Cornwall Council's press release on the Pickled Plate case records a fine of £8,000, a £2,000 victim surcharge and £4,000 costs.
• A golf club, no information on substances (2018). After a worker was burned in an explosion, Kingsgate Golf Club Ltd pleaded guilty at Margate Magistrates' Court on 23 November 2018 to a breach of the 1974 Act and a COSHH charge "for failing to provide details of substances hazardous to health, to which an employee was liable to be exposed". Thanet District Council's press release on the golf club case gives a £3,300 fine, £7,373.21 costs and a £170 victim surcharge.
• A company and its director, welding fume (2023). HSE's conviction record for case 4752713 shows Associated Metal Masters Limited, Dudley, convicted at Dudley Magistrates' Court on 13 September 2023 of two breaches of regulation 7(1) of COSHH, fined £10,000 for each (£20,000 in total), with £3,896.30 costs, for an offence dated 4 October 2021. Kingsley Napley's summary of HSE's announcement fills in the background. HSE had served improvement notices on the welding process in 2016 and 2019. The company "failed to sustain compliance" with them. Managing director Darren James Spittle, who knew of the notices, "pleaded guilty to breaching section 37(1)" of the 1974 Act and was fined £2,000. The director's plea is a separate case and isn't on the company's record.

Myths and facts

The first three myths are printed in INDG136 itself. The next three are things people say online, from our read of X and a Mumsnet thread in October 2026. The last is a misreading of regulation 6(4).

How to check you're doing COSHH properly

When you review your assessment, and after any change of product, supplier, menu or process, check that:

• every product with a hazard pictogram, and every process that makes dust, fume or gas, is on your list with a current SDS or note;
• each one has an assessment, and you've asked suppliers about safer or pre-diluted alternatives;
• chemicals are capped, labelled, away from food, with incompatibles apart;
• gloves and eye protection are the right type, in good condition and worn, and any LEV examination is in date;
• staff can tell you what not to mix, how to dilute and what to do after a splash, and you've practised a spill;
• records are kept for the periods in the table above.

What has changed recently, and what's next?

• Exposure limits. HSE's workplace exposure limits page says new GB limits now go through its own expert committee and public consultation, "a blended approach". Of the outstanding EU limits it "will introduce a revised limit for 3 of them", all for underground mining and tunnelling.
• The Approved Code of Practice. HSE's L5 is in its sixth edition (2013). Under section 17 of the 1974 Act, breaking it isn't an offence in itself, but it "shall be admissible in evidence" in a prosecution.

We found no commenced or announced change to the COSHH Regulations 2002 themselves, or to the Northern Ireland 2003 Regulations, on legislation.gov.uk as of 13 October 2026. COSHH is health and safety law rather than employment law, so the Employment Rights Act 2025 timetable doesn't change any duty on this page.

Related pages

Our PPE training guide covers the last line of the hierarchy, and accident reporting covers what to do when an exposure leads to a reportable injury or disease. Pilla's templates for COSHH checks, lock-ups and training sign-offs are linked above.

Frequently asked questions

Who can carry out a COSHH assessment?

The law doesn't name a qualification. INDG136 says that where the work is "small-scale with obvious control measures, you can do the assessment yourself", and to ask your supplier, trade association or an occupational hygienist when you're not sure. HSENI's guidance says the assessor needs "sufficient skills, knowledge and experience with the chemicals and process".

Is COSHH training a legal requirement?

Yes, in the sense that regulation 12 requires information, instruction and training for anyone liable to be exposed (duty 7 above). COSHH doesn't require a certificate or a named course. HSE lists local colleges, trade associations and suppliers as places to get it.

Does a COSHH cupboard have to be locked?

No regulation uses the word "locked". Regulation 7(4)(a) requires "arrangements for the safe handling, storage and transport of substances hazardous to health", and the assessment decides what safe storage means on your site. Where children, customers or untrained staff could reach the chemicals, a lock is the simple way to meet it.