Biological Agents and COSHH: What UK Employers Need to Know

Do Biological Agents Fall Under COSHH?

Yes. The Control of Substances Hazardous to Health Regulations 2002 (COSHH) apply to biological agents as well as chemical substances. Many employers — particularly those in healthcare, waste management, veterinary work, agriculture, and food production — handle biological hazards routinely, yet may not have treated them with the same COSHH rigour applied to bottled chemicals.

Under COSHH, a biological agent is defined in Regulation 2(1) as:

"a micro-organism, cell culture, or human endoparasite, whether or not genetically modified, which may cause infection, allergy, toxicity or otherwise create a hazard to human health"

This covers bacteria, viruses, fungi, parasites, and prions — anything biological that can cause harm. It also covers exposure that is incidental to work, such as healthcare workers potentially encountering bloodborne viruses, or construction workers disturbing legionella in water systems.

The Four Hazard Groups

COSHH Schedule 3 classifies biological agents into four groups based on how dangerous they are to human health:

Group	Definition
Group 1	Unlikely to cause human disease
Group 2	Can cause human disease; unlikely to spread to the community; effective prophylaxis or treatment usually available
Group 3	Can cause severe human disease; may spread to community; effective prophylaxis or treatment usually available
Group 4	Causes severe human disease; likely to spread to community; no effective prophylaxis or treatment usually available

The regulations require employers to assign any biological agent they work with to the appropriate hazard group. Where there is uncertainty between two groups, the higher group must be selected.

Most UK workplaces encounter Group 1 or Group 2 agents at most — for example, common bacteria like E. coli (Group 2) or influenza virus (Group 2). Group 3 agents include Mycobacterium tuberculosis and hepatitis C virus. Group 4 agents (Ebola, Marburg virus) are almost exclusively encountered in specialist research laboratories with stringent containment requirements.

Which Workplaces Are Affected?

Any workplace where employees may encounter biological agents — through deliberate use or incidental exposure — must consider COSHH compliance. Common examples:

Healthcare and social care: Risk of exposure to bloodborne viruses (hepatitis B, hepatitis C, HIV — Group 3 agents), tuberculosis, Clostridium difficile, and MRSA. This includes GPs, care homes, ambulance services, and community nurses — not just hospitals.

Waste management and sewage treatment: Workers handling household and commercial waste or sewage can be exposed to a wide range of bacteria and viruses. Legionella (Group 2) is a particular risk in cooling towers and water systems.

Agriculture, horticulture, and veterinary work: Zoonotic diseases — those transmissible from animals to humans — include Leptospira (Group 2, from contaminated water or soil), Salmonella (Group 2), Campylobacter (Group 2), and Q fever (Coxiella burnetii, Group 3) in livestock workers.

Food production: Flour dust (COSHH chemical hazard) sits alongside biological risks from moulds and the contamination that can occur in high-care environments.

Construction: Legionella in water systems, Leptospira in soil and flood water, and tetanus risk from contaminated soil all require COSHH consideration.

Laboratories: Deliberate work with biological agents — research, diagnostic, or production — is governed by the most detailed requirements in COSHH, including Schedule 3 containment levels.

COSHH Schedule 3: Biological Agent-Specific Requirements

The biological-agent-specific provisions in COSHH sit primarily in Schedule 3 ("Additional Provisions Relating to Work with Biological Agents"), which applies by virtue of Regulation 7(10): "Without prejudice to the provisions of this regulation, Schedule 3 shall have effect in relation to work with biological agents."

Schedule 3 is divided into five Parts:

Part I — General provisions (classification, notification, employee records):

Classification — where an agent has not been formally classified, the employer must assign it to one of the four hazard groups based on its infection risk, with any uncertainty resolved by selecting the higher group.
Notification (Schedule 3, paragraph 5) — before using Group 2, 3, or 4 biological agents for the first time at particular premises, the employer must notify the HSE in writing at least 20 working days in advance. Pure diagnostic work not involving propagation or concentration is exempt.
Employee records (Schedule 3, paragraph 4) — employers must keep a list of employees exposed to Group 3 or Group 4 biological agents, including the type of work and, where known, the agent involved. Records must be retained for at least 40 years.

Part II — Containment requirements for laboratory and animal room work:

Specifies 14 containment measures (physical containment, air filtration, access control, disinfection, microbiological safety cabinet requirements, etc.) that apply at containment levels 2, 3, and 4 depending on the hazard group of the agent.

Part III — Containment requirements for industrial process work:

For closed-system industrial processes using biological agents, Part III specifies seven containment measures covering exhaust treatment, sample handling, and controlled area specifications at containment levels 2, 3, and 4.

Part IV — Biohazard sign:

Sets out the mandatory biohazard symbol that must be posted where containment level 2, 3, or 4 agents are in use. Regulation 7(6)(a) requires employers to display suitable and sufficient warning signs, including this biohazard sign, where exposure to biological agents cannot reasonably be prevented.

Part V — Agents requiring specific notification:

Lists specific Group 2-4 agents (including Bordetella pertussis, Neisseria meningitidis, and others) for which the advance notification requirement under paragraph 5 applies specifically.

For most SME employers encountering biological risks incidentally — legionella in water systems, zoonoses in agricultural or veterinary work — the notification and containment levels in Schedule 3 Parts II and III will not apply directly: those provisions are triggered by deliberate use or active propagation of classified agents. The risk assessment under Regulation 6 and the control hierarchy under Regulation 7 remain the primary compliance duties for incidental exposure.

How COSHH Regulation 7 Applies to Biological Agents

The hierarchy of control under Regulation 7 applies to biological agents, with adaptations for the biological nature of the hazard:

Prevention — can exposure be avoided entirely? For incidental biological risks (e.g. legionella in water systems), effective water system design and management can eliminate the hazard.

Engineering controls — microbiological safety cabinets, autoclaves, enclosed processes, negative pressure rooms in healthcare.

Organisational controls — safe systems of work, vaccination programmes (where effective vaccines exist), restricting access to contaminated areas.

PPE — appropriate gloves, respirators, and gowns as a supplement to, not replacement for, engineering controls.

For Group 3 and Group 4 biological agents, Schedule 3 requires the highest applicable containment measures (containment levels 3 and 4 respectively). Good practice — and the Schedule 3 containment requirements themselves — means that reducing exposure as far as reasonably achievable is the expected standard, not merely staying within a theoretical limit. The specific ALARP ("as low as reasonably practicable") wording in Regulation 7(7) applies directly to carcinogens and asthmagens; for biological agents, the equivalent discipline derives from Schedule 3 containment requirements and the Regulation 7 control hierarchy read together.

The Risk Assessment Obligation

Before working with any biological agent that is not Group 1, employers must complete a COSHH risk assessment under Regulation 6. The assessment must consider:

The nature of the biological agent and its hazard group
The route of exposure (inhalation, ingestion, skin or mucous membrane contact, injection)
Who is at risk (including vulnerable groups — pregnant workers, immunocompromised workers)
Existing controls and their adequacy
The containment level required if deliberate work is involved

For incidental exposure (where the agent is not deliberately used but may be encountered), the assessment should cover the likelihood of exposure, the pathogens potentially present, and the controls proportionate to that risk.

The risk assessment for biological agents is often more complex than for chemicals because the hazard profile of a pathogen can change (mutations, resistance), exposure levels are harder to measure, and the route of transmission varies between organisms.

Health Surveillance for Biological Agent Exposure

Regulation 11 of COSHH (health surveillance) applies to biological agent exposure. For Group 2 or higher agents, employers should consider whether health surveillance is appropriate — particularly where:

Employees are in regular contact with known pathogens
There is a risk of occupational infection that benefits from early detection (e.g. tuberculin testing for TB-exposed healthcare workers)
An effective vaccine exists and should be offered to exposed workers

Vaccination is specifically mentioned as a control measure in Regulation 7(6) for biological agents. Where an effective vaccine exists against a Group 3 or 4 agent, employers should make it available to at-risk employees. The decision to vaccinate remains with the employee, but the offer must be made.

Practical Steps for Employers

For most SMEs encountering biological risks incidentally (as opposed to laboratory or specialist healthcare settings), the practical steps are:

Identify where biological agents could be encountered — water systems, waste handling, animal contact, patient contact.
Classify the relevant agents — consult the HSE's Advisory Committee on Dangerous Pathogens (ACDP) Approved List of Biological Agents for Group assignments.
Complete a COSHH biological agent risk assessment — covering routes of exposure, likelihood, controls, and who is at risk.
Implement the control hierarchy — engineering controls first, then organisational controls, then PPE.
Offer vaccination where appropriate vaccines exist and exposure risk justifies it.
Notify the HSE if you first begin work involving Group 2-4 agents.
Record and review — biological agent risks can change as pathogens evolve; assessments need periodic review.

For guidance on how COSHH biological agent requirements interact with chemical COSHH — particularly in workplaces that have both — see our what is COSHH guide for a broad scope overview, or how to do a COSHH assessment for the step-by-step assessment process.

This guide is for information only and does not constitute legal advice. The definitive sources are the Control of Substances Hazardous to Health Regulations 2002, COSHH Schedule 3, and the HSE's Approved Code of Practice L5. The ACDP Approved List of Biological Agents is the definitive source for hazard group classifications.