COSHH Regulations 2002: The Duties Explained

What Are the COSHH Regulations 2002? (Short Answer)

The Control of Substances Hazardous to Health Regulations 2002 (SI 2002/2677) are the UK statutory instrument that requires employers to assess and control workplace exposure to substances that can damage health. They contain 21 numbered regulations (plus regulation 16A, inserted later) and ten schedules (1, 2, 2A, and 3 to 9), and they apply to employers of any size — there is no small-business exemption.

The working core is regulations 6 to 13. Those eight regulations carry the duties you will actually be judged on: assess, control, maintain the controls, monitor, run health surveillance, train, and plan for emergencies. Everything else in the instrument is scope, interpretation, exemptions and machinery.

How the Regulations Are Structured

Knowing the shape of the instrument makes it much faster to find what you need.

Regulations 1-5 — citation, interpretation, who the duties fall on, prohibited substances, and which regulations apply to what.
Regulations 6-13 — the substantive duties. Regulation 5 is headed "Application of regulations 6 to 13", which is the instrument's own signal that this block is the operational heart.
Regulations 14-21 (plus 16A, inserted later for the Office of Rail and Road) — fumigations, exemption certificates, MoD provisions, extension outside Great Britain, revocations, and the defence provision.
Schedules 1-9 (plus 2A, inserted later by SI 2004/3386) — the detail that the regulations point to: the carcinogen definition, prohibited substances, the principles of good practice (Schedule 2A), biological agents (Schedule 3), LEV test frequencies (Schedule 4), substances requiring monitoring (Schedule 5), medical surveillance (Schedule 6), labelling legislation, and fumigation provisions.

A note on how the duties are worded, because it governs how much room you have. Some are absolute ("shall ensure"), some are qualified by "so far as is reasonably practicable", and some are conditional on appropriateness. Those differences are deliberate and they matter — an absolute duty leaves no cost-benefit argument available.

The Eight Duties in Regulations 6-13

Regulation 6 — Assess the risk

The gateway duty. You cannot lawfully start the work first and assess later — and the gate is higher than most summaries suggest, because it covers implementation as well as assessment:

"An employer shall not carry out work which is liable to expose any employees to any substance hazardous to health unless he has—(a) made a suitable and sufficient assessment of the risk created by that work to the health of those employees and of the steps that need to be taken to meet the requirements of these Regulations; and (b) implemented the steps referred to in sub-paragraph (a)."

Read limb (b) carefully. It is not enough to have written the assessment before work starts; the steps it identifies — controls, PPE, training, monitoring — must actually be in place. Regulation 6(1) is where most of the "before the work begins" timing in COSHH actually lives.

Assessments must be kept current. Regulation 6(3) requires review "regularly and forthwith if— (a) there is reason to suspect that the risk assessment is no longer valid; (b) there has been a significant change in the work to which the risk assessment relates; or (c) the results of any monitoring carried out in accordance with regulation 10 show it to be necessary". The third limb is the one people miss — see when to review a COSHH assessment.

Recording is where the size threshold appears — the only one in the duty block. Regulation 6(4): "Where the employer employs 5 or more employees, he shall record— (a) the significant findings of the risk assessment as soon as is practicable after the risk assessment is made; and (b) the steps which he has taken to meet the requirements of regulation 7."

Under five employees, the assessment duty is identical; only the recording duty is relaxed. In practice, an unrecorded assessment is very hard to evidence, so most small employers write it down anyway. Our step-by-step assessment guide walks through the process.

Regulation 7 — Prevent or control exposure

The central obligation:

"Every employer shall ensure that the exposure of his employees to substances hazardous to health is either prevented or, where this is not reasonably practicable, adequately controlled."

Prevention comes first, control second, and only where prevention is not reasonably practicable. Regulation 7(3) then ranks the control measures "in order of priority", putting process design and engineering controls above personal protective equipment, which is permitted only "where adequate control of exposure cannot be achieved by other means". See COSHH control measures, the Regulation 7 adequate control duty, and RPE and fit testing.

Regulation 8 — Make sure controls are used

Providing a control is not the same as it being used:

"Every employer who provides any control measure, other thing or facility in accordance with these Regulations shall take all reasonable steps to ensure that it is properly used or applied as the case may be."

Employees carry a reciprocal duty under 8(2) to "make full and proper use" of what is provided and, "if he discovers a defect therein, report it forthwith to his employer."

Regulation 9 — Maintain, examine and test the controls

Controls have to keep working. Regulation 9 sets the maintenance duty and two different examination regimes. For local exhaust ventilation, 9(2)(a) requires thorough examination and test "at least once every 14 months", or more often for the processes listed in Schedule 4. For respiratory protective equipment, 9(3) is looser: examination and testing "at suitable intervals".

Records under 9(4) must be "kept available for at least 5 years from the date on which it was made." More detail in our guide to LEV testing.

Regulation 10 — Monitor exposure

Where the assessment calls for it, "the employer shall ensure that the exposure of employees to substances hazardous to health is monitored in accordance with a suitable procedure", at regular intervals and "when any change occurs which may affect that exposure". Schedule 5 sets minimum frequencies for specified substances and processes.

Monitoring records run for "at least 40 years" where the record represents the personal exposures of identifiable employees, and "at least 5 years" otherwise. Both run from the date of the last entry. Workplace exposure limits explains what you are measuring against.

Regulation 11 — Health surveillance

"Where it is appropriate for the protection of the health of his employees who are, or are liable to be, exposed to a substance hazardous to health, the employer shall ensure that such employees are under suitable health surveillance."

"Appropriate" is defined by reference to Schedule 6 and to whether "there is a reasonable likelihood that an identifiable disease or adverse health effect will result from that exposure."

Note the retention period, which surprises people: health records must be kept "for at least 40 years from the date of the last entry made in it." That obligation outlives most employment relationships and most businesses. See COSHH health surveillance.

Regulation 12 — Information, instruction and training

"Every employer who undertakes work which is liable to expose an employee to a substance hazardous to health shall provide that employee with suitable and sufficient information, instruction and training."

Regulation 12(3) adds two qualities rather than a schedule: the training must be "adapted to take account of significant changes in the type of work carried out or methods of work used by the employer" and "provided in a manner appropriate to the level, type and duration of exposure identified by the risk assessment".

Note what Regulation 12 does not say. It sets no deadline and no repetition interval — neither "before exposure" nor "at appropriate intervals" appears anywhere in it. The before-exposure timing comes from Regulation 6(1) above: training is one of the steps needed to meet these Regulations, and limb (b) requires those steps to be implemented before the work is carried out. It is also the widely-applied HSE expectation. L5 separately advises, as guidance rather than ACOP text, that "New employees should be provided with proper induction training".

Covered in COSHH training obligations and, for inductions specifically, training for new starters.

Regulation 13 — Plan for accidents and emergencies

Regulation 13(1) requires that "procedures, including the provision of appropriate first-aid facilities and relevant safety drills (which shall be tested at regular intervals), have been prepared which can be put into effect when such an event occurs"; that information on emergency arrangements is available; and that "suitable warning and other communication systems are established to enable an appropriate response, including remedial actions and rescue operations, to be made immediately".

The parenthesis is easy to skip: drills "shall be tested at regular intervals". A written spill procedure nobody has ever rehearsed does not satisfy this.

The Duty Most Employers Miss

Regulation 3 extends the whole framework beyond your own payroll, and it is routinely overlooked:

"Where a duty is placed by these Regulations on an employer in respect of his employees, he shall, so far as is reasonably practicable, be under a like duty in respect of any other person, whether at work or not, who may be affected by the work carried out by the employer except that the duties of the employer—(a) under regulation 11 (health surveillance) shall not extend to persons who are not his employees; and (b) under regulations 10, 12(1) and (2) and 13 (which relate respectively to monitoring, information and training and dealing with accidents) shall not extend to persons who are not his employees, unless those persons are on the premises where the work is being carried out."

Unpacked, that means:

Control duties reach everyone affected by your work, so far as reasonably practicable — contractors, visitors, tenants, members of the public, pupils, care-home residents.
Health surveillance is employees only. No exceptions.
Monitoring, information/training and emergency arrangements extend to non-employees only when they are on your premises.

For anyone running work in an occupied building — cleaning, refurbishment, grounds maintenance, school or care settings — this is the provision that turns "our staff wear masks" into "and what about everyone else in the building?" Our guides to COSHH for construction and COSHH for schools both live in this territory.

What Sits Outside COSHH

COSHH is broad but not universal. Lead, asbestos and radioactive substances each have their own regulations, and some substances are prohibited outright under regulation 4 and Schedule 2 rather than controlled. What is covered by COSHH sets out the boundaries, and what is COSHH is the plain-language starting point.

Regulations, ACOP and Guidance

One last distinction worth holding onto. The regulations above are the law. Sitting alongside them is L5, HSE's Approved Code of Practice, which describes the preferred methods of complying. An ACOP is not law, but departing from it shifts the burden onto you to show you complied another way — so a lot of what feels like a COSHH requirement in practice actually originates there. The COSHH ACOP (L5) explains how that works.

Duty-by-Duty Checklist

Reg 6 — assessment made and its steps implemented before the work starts; reviewed on any of the three 6(3) triggers; recorded if 5+ employees
Reg 7 — prevention considered first; controls ranked in the statutory order; PPE justified as a last resort
Reg 8 — reasonable steps taken to ensure controls are actually used; defect reporting route exists
Reg 9 — LEV examined at least every 14 months; RPE examined at justifiable intervals; records kept 5 years
Reg 10 — monitoring where required; Schedule 5 frequencies met; records kept 5 or 40 years
Reg 11 — health surveillance where appropriate; health records kept 40 years
Reg 12 — information, instruction and training provided, adapted to significant changes in the work, and pitched to the exposure (timing itself sits under Reg 6(1))
Reg 13 — emergency procedures prepared, information available, drills actually tested
Reg 3 — non-employees affected by the work considered

Keeping Nine Duties Straight

The difficulty with COSHH is rarely any single duty. It is that all nine — the eight duties in regulations 6-13, plus the Regulation 3 extension to non-employees — run in parallel, on different clocks — 14-month LEV tests, assessment reviews on change, 5-year and 40-year record retention, training kept current as the work changes, drills at regular intervals — and they are usually tracked in different places by different people.

COSHHmate is being built to hold the assessment, the controls it relies on, and the dates each of those duties turns on, in one place. Pricing will be a flat monthly fee with no per-user charges. To get your COSHH duties tracked properly, join the waitlist.

Sources

This is general guidance based on the operative text of the COSHH Regulations 2002 (as amended) and the published L5 ACOP. The regulations have been amended since 2002 and some duties depend on the substance and process involved — check the current consolidated text on legislation.gov.uk and take advice from a qualified health and safety professional for your specific situation. Not legal advice.