What is COSHH? The Control of Substances Hazardous to Health Explained

Ask most people what COSHH is and they will tell you it is “the sheets in the folder”. The safety data sheets, filed, ticked, forgotten. That is the single biggest misunderstanding in the whole subject, and it is worth clearing up before anything else.

COSHH stands for the Control of Substances Hazardous to Health Regulations 2002. It is the law that requires employers to prevent, or where that is not reasonably practicable adequately control, exposure to substances that can harm people at work. The safety data sheet is an input to that job. It is not the job. The job is knowing what your people are actually exposed to, deciding what to do about it, and making sure what you decided actually happens.

That distinction runs through everything below.

What COSHH actually covers

COSHH is deliberately broad. It is not just about the obvious drums of chemicals in a store. It covers substances hazardous to health in whatever form they turn up at the point of use.

That includes chemicals and products containing chemicals, but it also includes fumes, dusts, vapours, mists and gases, which is where a lot of real exposure hides. Wood dust, flour dust, welding fume, silica from cutting stone or concrete, none of those arrive with a label on a drum, but every one of them is a COSHH matter and several of them cause serious, well documented occupational disease.

It also covers biological agents. Bacteria and other micro-organisms that arise from or are used in a work process fall under COSHH. Legionella is the obvious example, which is why legionella control shares the same underlying logic even though it is managed through its own dedicated guidance. If your water hygiene work is where you meet hazardous substances most often, our guide to ACOP L8 and HSG274 covers that specialist end in detail.

What COSHH does not cover

This is where people get caught out, because some of the most dangerous substances on a site sit outside COSHH and under their own regulations entirely.

Asbestos is not a COSHH substance. It has its own regime under the Control of Asbestos Regulations. Lead has its own regulations too. So do radioactive substances. And, importantly, substances that are hazardous only because they are flammable, explosive or held at extreme temperature or pressure are dealt with under DSEAR, not COSHH. A solvent can sit under both, COSHH for the harm its vapour does to your lungs, and DSEAR for the fact it can ignite. Knowing which regime a substance falls under is not pedantry. It decides which assessment you are legally required to do.

If you would rather hand this to someone who does it every day, you can compare health and safety consultants on our featured list.

The safety data sheet is not the assessment

This is the single most common failure in the whole subject, so it is worth its own section. People get into the habit of taking the supplier’s safety data sheet, copying the hazard information straight across into a COSHH assessment, and considering the job done. It is not done. It has barely started.

A safety data sheet describes one substance in isolation. That is its entire limitation. It has no idea what else is sitting in your store, and it cannot tell you what happens when two of your products meet. You can have two chemicals that are each, on their own, fairly benign, that react badly together, and neither sheet will warn you, because neither sheet knows the other one exists. Working out what can be stored next to what, and what must be kept apart, is the assessor’s job. The sheets will never do it for you.

The other giveaway is the PPE line. A safety data sheet will almost always tell you to wear gloves and avoid skin contact, and it will say that even for products whose entire purpose is to touch skin. Pull the data sheet for a shampoo or a hand soap and it will still tell you to keep it off your skin and wear protection. That is not a mistake. The sheet is written around bulk handling and storage, so in its mind you are standing next to an IBC or a drum of the concentrated stuff, not squirting a dose onto someone’s hands. Copy that line straight into your assessment and you end up mandating gloves for a task where the product is designed to be rubbed into skin, which tells anyone reading it that you transferred the words without thinking about the task.

That is the whole lesson of COSHH in miniature. The data sheet is an input. The assessment is about this task, this quantity, this room, this person, and what else is nearby. Once you see the sheet that way, most COSHH assessments improve on their own.

The core duties, in plain terms

The regulations set out a sequence of duties. Stripped of the legal language, they run like this.

Assess the risk. Work out which hazardous substances are present, how people could be exposed, and how much harm that could do. This is the COSHH assessment, and it is about the task and the person, not the product. The same chemical is a very different risk poured carefully into a bucket than it is sprayed as a fine mist in an unventilated room.

Decide on the precautions. Once you understand the exposure, decide what will control it.

Prevent or control exposure. The law wants you to prevent exposure first, by not using the substance at all, by substituting something safer, or by changing the process. Only when prevention is not reasonably practicable do you move to controlling it, and even then there is an order. Engineering controls such as local exhaust ventilation come before personal protective equipment. PPE is the last line, not the first, and a COSHH assessment that jumps straight to “wear gloves and a mask” has usually skipped the part that mattered.

Keep the controls working. A control that is fitted and then never checked is not a control. Local exhaust ventilation needs testing. RPE needs face fit testing and maintenance. This is the duty most often failed in practice, because it is the one that costs money every year rather than once.

Monitor exposure, and carry out health surveillance where it is needed. For some substances the law expects you to measure exposure, and to keep an eye on the health of the people exposed, so that early signs of harm are caught before they become permanent.

Plan for emergencies, and inform, instruct and train. People need to know what they are working with, what it can do to them, and what to do when something goes wrong.

Workplace Exposure Limits

For a large number of substances there is a Workplace Exposure Limit, a WEL, which is the concentration in the air that must not be exceeded, averaged over a defined period. These are published by the HSE in the document EH40. A WEL is a legal ceiling, not a target to sit just underneath. The duty is still to reduce exposure so far as is reasonably practicable, so being “under the WEL” is not the same as being compliant if you could reasonably get exposure lower.

Where COSHH assessments go wrong

Having read a lot of them, the failures cluster.

The commonest is the assessment that describes the product instead of the task. It copies the hazard statements off the safety data sheet and stops there, so it tells you the substance is harmful but nothing about whether your particular use of it actually exposes anyone. Two businesses using the identical product can have completely different risks, and only the task tells you which.

The second is the missing generated substance. The chemicals in drums get assessed because they have labels. The silica dust from cutting, the fume from welding, the dust from sanding, those get missed, because nobody bought them, so nobody thinks of them as substances. They are frequently the most harmful things on the site.

The third is the control that exists on paper. The extraction unit that has not been tested in years. The masks kept in a drawer but never fit tested. The assessment says the risk is controlled. The control is not working. That gap is exactly what an inspector looks for, and exactly what causes the disease the regulations exist to prevent.

How COSHH fits with the rest

COSHH does not sit on its own. It is one of the specific sets of regulations that hang beneath the Health and Safety at Work Act, alongside things like CDM in construction and RIDDOR for reporting when things go wrong. A COSHH assessment is a particular kind of risk assessment, focused on substances, and it feeds the same overall picture of how a business manages its risks.

Related reading

For the specialist biological end of COSHH, see our guide to ACOP L8 and HSG274 and the legionella risk assessment cost guide. For the wider legal framework, start with the Health and Safety at Work Act and what a risk assessment actually is. If you also manage work equipment, our guide to PUWER covers the parallel duties there.

Getting the right help

A good COSHH assessment is not a filing exercise, and the people who do it well tend to spend more time watching the task than reading the label. If your processes generate dust or fume, or you use substances where the control measures need testing and maintaining, it is worth getting someone competent to look at what you actually do rather than what the drum says.

You can find health and safety consultants on My Safety Consultant, including our featured consultants, where their qualifications, professional memberships and company accreditations are set out on the profile. Contact them directly. We take no commission and we never sell your enquiry on.

This guide is a plain English summary and is not a substitute for the current version of the COSHH Regulations or for competent advice on your specific premises and processes.

Frequently Asked Questions