What is COSHH?

What COSHH stands for, and what it is

COSHH is the Control of Substances Hazardous to Health Regulations 2002 — a statutory instrument, SI 2002/2677, made under the Health and Safety at Work etc. Act 1974. People say "a COSHH" meaning the paperwork, but the regulations are the law; the paperwork is how you show you followed it.

The idea underneath them is narrower than people expect. COSHH is not about every chemical on site. It is about exposure — how much of a substance gets into somebody, by breathing it, swallowing it, or through their skin and eyes — and about doing something proportionate before it does.

That is why the regulations bite on dust from cutting a paving slab as firmly as on the tin of solvent beside it. The slab has no label and no safety data sheet, and it is still one of the worst exposures on a construction site.

What counts as a substance hazardous to health

Regulation 2 defines it, and it is wider than a shelf of labelled products. In practice, on a site, it means any of these:

Anything with a health hazard classification

The label tells you: a health warning symbol and an H3-something statement — irritant, corrosive, carcinogen, sensitiser. You can look a substance up to see what the published lists give it.

Anything with a workplace exposure limit

If HSE has approved a limit for it in EH40, the regulations cover it. Portland cement, wood dust and respirable crystalline silica all have one.

Dust of any kind, in quantity

Cutting, grinding, chasing, sweeping. There is no tin and no supplier — the work makes it, and the control is the method rather than the label.

Fumes, mists and vapours the work generates

Welding fume, exhaust in an enclosed space, torched bitumen, spray.

Biological agents

Legionella in a stagnant system, leptospirosis in groundworks, bird fouling in a roof void.

What the regulations actually ask of an employer

Eight duties carry most of the weight. They read as a sequence because they are one: find out, decide, control, keep controlling, check, and tell people.

1. Assess before the work starts

   Regulation 6. An employer must not carry out work liable to expose employees to a substance hazardous to health without first assessing the risk and what needs doing about it. Before, not afterwards — this is the duty most often discovered in hindsight. See how a COSHH assessment works.

2. Prevent exposure, or control it

   Regulation 7, and the order matters: prevent first — do not use the substance, or use a safer one, or change the method so the exposure never happens. Only when prevention is not reasonably practicable do you move to controlling it, and personal protective equipment is the last resort rather than the first purchase.

3. Use the controls you decided on

   Regulation 8. The employer makes sure they are used; the employee uses them properly and reports faults. An extraction unit switched off because it is loud is the classic failure here.

4. Maintain, examine and test them

   Regulation 9. Controls are kept in working order, and local exhaust ventilation gets a thorough examination and test at least every fourteen months, with the record kept.

5. Monitor exposure where it is needed

   Regulation 10 — where the assessment says it is needed to tell whether control is adequate, or where a specified substance and process demands it.

6. Health surveillance where the risk calls for it

   Regulation 11. For sensitisers, some solvents and dusts, there is a recognisable disease or effect and a valid way of detecting it early.

7. Tell, instruct and train the people exposed

   Regulation 12 — what the risks are, what the controls are and how to use them, what the exposure monitoring and surveillance say. See what COSHH training has to cover.

8. Plan for what happens when it goes wrong

   Regulation 13 — spills, leaks and emergencies, with procedures and information available before they are needed.

Who it applies to, and how small is too small

It applies to every employer whose work is liable to expose someone — employees or otherwise — to a substance hazardous to health, and to the self-employed in respect of their own work. There is no headcount below which it stops applying.

There is one headcount that matters, and it is about the writing rather than the doing. Under the Management of Health and Safety at Work Regulations 1999, an employer with five or more employees must record the significant findings of their risk assessments. Below five, the assessment is still required; recording it is not. Most firms record it anyway, because a prequalification form asks for it and nobody can remember a verbal assessment two years later.

What COSHH does not cover

Three exclusions catch people out, and all three matter more than the things COSHH does cover, because getting them wrong sends you to the wrong regulations entirely.

Asbestos is excluded — the Control of Asbestos Regulations 2012 apply instead, most work with it is licensed, and suspected material means stop and survey rather than assess and carry on. Lead is excluded too, under the Control of Lead at Work Regulations 2002 — sanding or burning old paintwork and hot lead work are the exposures they exist for.

And a substance that is hazardous only because it catches fire or explodes is DSEAR's business, not COSHH's. Petrol is the everyday example: its fire risk is DSEAR, its health effects are COSHH. The same tin, two sets of regulations, for two different reasons.

Why it is worth doing properly

The enforcement argument is the weakest one, so take it first and get it out of the way: COSHH breaches are enforceable, and improvement and prohibition notices stop work. Fine. That is not why anyone who has watched it happen does the paperwork.

The real argument is that the harm is slow and it is permanent. Occupational lung disease does not announce itself on the day — a joiner sensitised to hardwood dust reacts to it for the rest of their working life, and silicosis takes years to arrive and does not go away when the job finishes. The trades that suffer worst are the ones where the exposure looked like nothing much at the time.

The third reason is commercial and it is the one that gets firms started. Prequalification asks. A main contractor's onboarding asks. An assessment you can produce in an afternoon is the difference between being on the approved list and not — which is the same reason firms build a COSHH register rather than writing each assessment from scratch.

Questions people ask

What does COSHH stand for?

The Control of Substances Hazardous to Health Regulations 2002. People often use it as shorthand for the assessment paperwork, but COSHH is the regulations themselves.

What year did COSHH come in?

The current regulations are from 2002 and have been amended since. Earlier versions go back to 1988, which is why some older documentation refers to COSHH 1994 or COSHH 1999.

Is COSHH a legal requirement?

Yes. The regulations are made under the Health and Safety at Work etc. Act 1974 and are enforceable. An employer must not carry out work liable to expose employees to a substance hazardous to health without first assessing the risk.

Does COSHH apply to a one-person firm?

The regulations apply to the self-employed in respect of their own work. What changes with size is the recording duty: an employer with five or more employees must write down the significant findings of the assessment.

Is asbestos covered by COSHH?

No. Asbestos has its own regulations — the Control of Asbestos Regulations 2012 — and most work with it is licensed. Lead is also excluded, under the Control of Lead at Work Regulations 2002.