COSHH assessment is a legal requirement under Regulation 6 of the Control of Substances Hazardous to Health Regulations 2002. If your work involves hazardous substances—chemicals, dusts, fumes, vapors, mists, or biological agents—you must assess the health risks before work begins and implement appropriate controls. This article explains exactly what the law requires.
Do you meet COSHH assessment legal requirements?
Check your compliance status.
Legal basis for COSHH assessments
COSHH assessments are required by:
Regulation 6: Assessment of risk to health
The COSHH Regulations 2002 state:
"An employer shall not carry on any work which is liable to expose any employees to any substance hazardous to health unless he has made a suitable and sufficient assessment of the risk created by that work to the health of those employees..."
This creates an absolute legal duty. There are no exceptions based on business size, number of employees, or type of substance. If the work involves hazardous substances, assessment is required.
Supporting legislation:
Health and Safety at Work etc. Act 1974:
- Section 2: General duties of employers to employees
- Section 3: Duties to non-employees affected by work activities
Management of Health and Safety at Work Regulations 1999:
- Regulation 3: General requirement for risk assessment
- Regulation 5: Health and safety arrangements (competent persons)
COSHH assessment is not optional. It's a legal requirement with criminal penalties for non-compliance. "We didn't know" or "we're too small" are not defenses. Ignorance of the law doesn't protect you from prosecution.
Who must complete COSHH assessments?
Employers
All employers must assess risks from hazardous substances to which their employees might be exposed, including:
- Permanent employees
- Temporary workers and agency staff
- Part-time employees
- Apprentices and trainees
- Workers on zero-hours contracts
You remain responsible even if workers are agency staff or contractors—you must ensure their safety if they work under your direction or in your workplace.
Self-employed persons
Self-employed people must assess risks to themselves and others affected by their work. If you work alone but use hazardous substances, you still need COSHH assessments.
Duties to non-employees
Employers must also consider risks to:
- Contractors and visitors on their premises
- Members of the public who might be affected
- Employees of other companies sharing the workplace
- Customers or service users (e.g., care home residents, students)
If multiple employers share a workplace, they must cooperate and coordinate their COSHH assessments and controls. One employer's use of hazardous substances might affect another's employees.
When must COSHH assessments be completed?
Before work begins
Regulation 6(1) is clear: assessment must be done before employees are exposed. You cannot start work and "do the assessment later." The sequence must be:
- Identify hazardous substances you intend to use
- Complete COSHH assessment
- Implement control measures identified in the assessment
- Train employees
- Begin work
For existing work
If you're already using hazardous substances without assessments, you must:
- Stop work immediately if there's serious risk to health
- Complete assessments as a priority for high-risk substances
- Implement interim controls while conducting assessments
- Complete all assessments within a reasonable timeframe (weeks, not months)
The HSE can issue a prohibition notice requiring you to stop work immediately until adequate assessments and controls are in place. This can shut down your business overnight. Don't wait for enforcement action—assess proactively.
When introducing new substances
Every time you introduce a new hazardous substance or change how you use an existing one, you must:
- Complete a COSHH assessment before first use
- Not wait for the next scheduled review
- Consider whether existing controls are adequate or need modification
- Provide training on the new substance and any new controls
What must be included in an assessment?
A suitable and sufficient COSHH assessment must identify and evaluate:
1. The hazardous substances present
Identify all substances:
- Chemicals, products, and materials purchased
- Substances created by work processes (dusts, fumes, vapors, biological agents)
- Intermediate products and by-products
- Waste materials
Gather information:
- Safety Data Sheets (SDS) for all purchased chemicals
- Product labels and hazard information
- Workplace Exposure Limits (from HSE's EH40)
- Scientific literature or guidance for process-generated substances
2. The health risks they present
Immediate (acute) effects:
- Burns, irritation, poisoning
- Asphyxiation, drowning, unconsciousness
- Allergic reactions
Long-term (chronic) effects:
- Cancer, genetic damage, reproductive harm
- Occupational asthma, dermatitis, chronic obstructive pulmonary disease
- Organ damage (liver, kidney, nervous system)
- Sensitization (allergic reactions after repeated exposure)
Route of exposure:
- Inhalation (breathing in vapors, dusts, fumes, gases)
- Skin or eye contact (splashes, direct handling)
- Ingestion (swallowing—usually accidental contamination)
3. Who is at risk and how
Identify affected persons:
- Employees who use the substance directly
- Employees working nearby or in the same area
- Maintenance staff who service equipment
- Cleaning staff
- Contractors
- Visitors and members of the public
- Vulnerable groups (young workers, pregnant workers, those with pre-existing conditions)
Assess exposure:
- How much substance is used and how often?
- What is the duration of exposure?
- What tasks involve the substance?
- What is the concentration or intensity of exposure?
- Is exposure continuous, intermittent, or occasional?
4. What controls are needed
Following the hierarchy of control:
- Elimination — Can you stop using the substance?
- Substitution — Can you use something less hazardous?
- Engineering controls — Enclosure, ventilation, automation
- Administrative controls — Reduced exposure time, training, procedures
- PPE — Gloves, respirators, goggles (last resort)
The assessment must:
- Evaluate whether existing controls are adequate
- Identify additional controls needed
- Specify what control measures will be implemented
- Assign responsibility for implementing controls
- Set target dates for completion
5. Monitoring and health surveillance
Consider whether you need:
- Air monitoring — If Workplace Exposure Limits apply or exposure is uncertain
- Health surveillance — If exposure could cause identifiable disease (skin checks, lung function tests, biological monitoring)
- Equipment examination — LEV thorough examination every 14 months, RPE checks
6. Emergency arrangements
Plan for:
- Spills, leaks, or accidental releases
- Fire involving hazardous substances
- Equipment failure or loss of control
- Accidental exposure (skin contact, inhalation, ingestion, eye contact)
Ensure:
- Emergency equipment available (spill kits, eyewash, fire extinguishers)
- Employees trained in emergency procedures
- First aid arrangements adequate for the substances used
7. Information, instruction, and training
Document what employees need:
- Information about hazardous substances they work with
- Training in safe use, control measures, and emergency procedures
- Instructions in safe systems of work
- Access to Safety Data Sheets
What a Complete COSHH Assessment Includes
Name, supplier, location, quantity, frequency of use, SDS reference
Acute and chronic effects, route of exposure, WELs, classification
Job roles exposed, tasks involved, duration, intensity, vulnerable groups
Existing controls, adequacy, additional controls needed, hierarchy applied
Air monitoring requirements, health surveillance, equipment checks
Spill response, first aid, fire fighting, emergency equipment
Review date, trigger conditions, person responsible, approval
Who can carry out COSHH assessments?
Regulation 6 requires assessments to be made by a competent person. The COSHH Approved Code of Practice defines competence as:
"A person is competent where they have sufficient training, experience, knowledge, and other qualities to enable them to properly assist in undertaking the measures needed to comply with the law."
Competence requirements:
A competent person must understand:
- COSHH Regulations and requirements
- Hazard classification and labeling (CLP Regulation)
- How to read and interpret Safety Data Sheets
- Routes of exposure and health effects
- Hierarchy of control measures
- Workplace Exposure Limits and their application
- When air monitoring or health surveillance is needed
- The work processes and substances used in your workplace
Who is typically competent?
For simple, low-risk assessments:
- Trained managers or supervisors
- Employees who have completed COSHH awareness training
- Health and safety officers or coordinators
Suitable for:
- Common cleaning chemicals used as directed
- Small quantities of low-hazard substances
- Simple processes with well-established controls
- Substances with good industry guidance (e.g., COSHH Essentials)
For complex or high-risk assessments:
- Occupational hygienists (BOHS-qualified)
- Health and safety consultants with COSHH expertise
- Occupational health professionals
Required for:
- Carcinogens, mutagens, or respiratory sensitisers
- Substances with Workplace Exposure Limits requiring air monitoring
- Large quantities or high exposure levels
- Complex chemical processes or reactions
- Biological agents (healthcare, laboratories, waste management)
- Novel or unusual substances
- Processes generating hazardous fumes, dusts, or vapors
Don't overestimate your competence. If you're unsure whether controls are adequate, whether monitoring is needed, or how to interpret exposure data, seek specialist advice. The cost of getting it wrong—employee ill health, prosecution, civil claims—vastly exceeds the cost of expert help.
Must assessments be in writing?
Legal requirement:
Regulation 6(3) states:
"Where it is appropriate for the purposes of compliance with his duties under these Regulations, the employer shall keep a suitable record of the assessment..."
This is interpreted as:
- 5 or more employees: You must record assessments in writing
- Fewer than 5 employees: Recording is not legally required, but strongly recommended
Why you should always write it down:
Even if you employ fewer than 5 people:
- Demonstrates compliance to the HSE during inspections
- Provides evidence in case of enforcement action or prosecution
- Ensures consistency across your workforce and over time
- Helps communication with employees, contractors, and emergency services
- Supports training by documenting procedures
- Enables review by competent persons or specialists
- Protects against claims by showing you took reasonable precautions
The HSE strongly advises all employers to record assessments in writing, regardless of size. A verbal assessment is easily forgotten, inconsistently applied, and impossible to demonstrate. Always write it down.
How long must records be kept?
COSHH Regulations specify retention periods for different types of records:
COSHH assessments:
- No specific period stated in the regulations, but must be kept "as long as they are current"
- Good practice: Keep for at least 5 years after the substance is no longer used
- Rationale: Evidence of your risk management in case of future claims or investigations
Exposure monitoring records:
- Minimum 5 years for most substances (Regulation 10(4))
- Minimum 40 years for:
- Substances that cause cancer (carcinogens)
- Substances that cause genetic damage (mutagens)
- Respiratory sensitisers that cause occupational asthma
- Biological agents
Health surveillance records:
- Minimum 40 years from last entry (Regulation 11(4))
- Even if the employee leaves or the business closes, records must be preserved
- If business ceases, notify the HSE—they will arrange secure storage
Training records:
- Good practice: At least 5 years (not specified in COSHH but useful evidence)
Long retention periods recognize that occupational diseases (especially cancers) can take decades to develop. Records must be available if former employees develop disease many years after exposure. The HSE can prosecute long after the exposure occurred if they can demonstrate you failed to control risks.
Review and revision requirements
COSHH assessments are not "set and forget" documents. Regulation 6(3) requires:
"Where there is reason to suspect that a risk assessment is no longer valid, or there has been a significant change in the work to which the assessment relates, the employer shall review that assessment..."
When must assessments be reviewed?
Mandatory review triggers:
-
When you suspect the assessment is no longer valid
- Exposure levels higher than expected
- Controls not working as intended
- Employee reports symptoms
- Monitoring or health surveillance indicates problems
-
After a significant change:
- New substances introduced or existing ones changed
- Work methods or processes changed
- Quantities of substance increased
- Frequency or duration of use changed
- Equipment or controls modified or replaced
- Workforce changes (new vulnerable workers, different roles)
- Incidents, accidents, or near misses involving the substance
- New information about substance hazards (updated SDS, new research)
Good practice reviews:
- Annually for high-risk substances (carcinogens, respiratory sensitisers, substances with WELs)
- Every 2-3 years for moderate-risk substances
- When reviewing your general health and safety management system
- Before HSE inspections to ensure assessments are current
Review Schedule by Risk Level
Review as soon as incident occurs or change is made—don't wait for next scheduled review
Carcinogens, mutagens, asthmagens, substances with WELs, large quantities
Corrosives, irritants, sensitisers, flammables—where exposure is well controlled
Small quantities, infrequent use, simple controls, well-established processes
Continuously watch for changes that trigger review—don't wait for scheduled date
Penalties for non-compliance
Failure to complete adequate COSHH assessments is a criminal offense under the HSWA 1974 and COSHH Regulations 2002.
HSE enforcement powers:
Improvement Notice:
- Specifies what you must do to comply
- Sets a deadline (typically 21 days or more)
- Failure to comply leads to prosecution
Prohibition Notice:
- Immediately stops work involving hazardous substances
- Remains in force until you demonstrate compliance
- Can shut down your business overnight
- Significant financial impact from lost production
Criminal prosecution:
Magistrates' Court (summary conviction):
- Maximum fine: £20,000 per offense
- Multiple offenses can result in multiple fines
Crown Court (conviction on indictment):
- Unlimited fines
- Imprisonment up to 2 years (or both)
- Reserved for serious breaches or where employee ill health results
Typical fines for COSHH failures:
Recent prosecutions show:
- Small businesses: £10,000 - £50,000 plus costs
- Medium businesses: £50,000 - £200,000 plus costs
- Large businesses: £200,000 - £1,000,000+ plus costs
The Sentencing Council guidelines base fines on:
- Culpability (how far below acceptable standards you fell)
- Harm (actual harm caused or potential for harm)
- Company size (turnover)
Additional consequences:
- Civil claims from employees who suffer ill health (can run into hundreds of thousands of pounds)
- Increased insurance premiums or policy voidance
- Reputational damage (convictions are public record and reported in media)
- Loss of contracts (many clients require evidence of health and safety compliance)
- Director disqualification (possible if gross negligence or repeated breaches)
Manufacturing company fined £300,000 for inadequate COSHH assessments
A metal finishing company used multiple hazardous chemicals including acids, alkalis, and solvents. COSHH assessments were generic, outdated, and didn't reflect actual exposure levels. No air monitoring had been conducted despite several substances having Workplace Exposure Limits. Three employees developed chronic respiratory conditions.
- ✗COSHH assessments were generic templates, not substance-specific
- ✗Assessments hadn't been reviewed in over 5 years despite changes
- ✗No air monitoring despite substances having WELs
- ✗No health surveillance for respiratory sensitisers
- ✗Local exhaust ventilation inadequately maintained
- ✗Assessments not conducted by competent person
- ✗Employees not provided with adequate information or training
HSE prosecution resulted in £300,000 fine plus £45,000 costs. Company required to engage occupational hygienist for full exposure assessment. Three affected employees brought successful civil claims totaling over £500,000. Company's reputation damaged, resulting in loss of major contracts.
COSHH assessments must be specific, current, and conducted by competent persons. Generic templates provide no real protection. Air monitoring and health surveillance are essential where WELs apply or exposure could cause identifiable disease. The cost of proper assessment and control is minimal compared to the cost of failure.
Common deficiencies found by HSE inspectors
The HSE frequently finds these problems during inspections:
1. No assessments completed
Simply not done, or employer unaware of the requirement. This is the most serious breach and often results in prohibition notices.
2. Generic assessments
Copied from templates or other companies without adapting to actual workplace conditions. Generic assessments don't fulfill the legal requirement for "suitable and sufficient" assessment.
3. Assessments not substance-specific
One assessment covering "all cleaning chemicals" without evaluating each substance's specific hazards and exposure levels.
4. Missing information
Assessments that don't identify who is at risk, what harm could occur, or what specific control measures are needed.
5. No consideration of vulnerable workers
Failing to consider young workers, pregnant workers, or those with pre-existing conditions (asthma, dermatitis) who may be more susceptible.
6. Inadequate control measures
Relying solely on PPE without considering elimination, substitution, or engineering controls first.
7. No review mechanism
Assessments completed years ago and never updated despite changes in substances, processes, or workforce.
8. Not conducted by competent person
Assessments completed by someone without adequate training or knowledge to evaluate risks and specify controls.
9. Assessments not accessible
Filed away in an office where supervisors and employees can't refer to them when needed.
10. No link between assessment and actual practice
Assessment says one thing, but observation of work shows something completely different. Controls specified in the assessment aren't actually implemented.
Inadequate vs. Adequate COSHH Assessment
Inadequate (Non-Compliant)
- •Generic template, not specific to workplace
- •No detail on who is exposed or how
- •States 'use appropriate PPE' without specifying what
- •No reference to Safety Data Sheets
- •No review date or review history
- •Signed by someone with no COSHH training
- •Locked in filing cabinet, inaccessible
Adequate (Compliant)
Recommended- •Specific to each substance and how it's used
- •Identifies all persons at risk by role
- •Specifies exact control measures required
- •References SDS and WELs where applicable
- •Clear review date and review history documented
- •Completed by competent person with evidence of competence
- •Accessible to supervisors and employees who need it
- •Demonstrates hierarchy of controls applied
- •Links to training records and maintenance schedules
Bottom line: An adequate assessment is a working document that guides actual practice, not just a paper exercise to satisfy inspectors.
Demonstrating compliance during HSE inspections
If the HSE inspects your workplace, they will want to see:
Documentation to provide:
- Written COSHH assessments for all hazardous substances
- Safety Data Sheets for all chemical products
- Inventory of hazardous substances used
- Exposure monitoring reports (if conducted)
- Health surveillance records (anonymized summaries)
- LEV examination certificates (thorough examination every 14 months)
- Training records (who, when, what topics covered)
- Review history (evidence that assessments have been reviewed)
- Incident records involving hazardous substances
- Maintenance records for control equipment
What inspectors will look for:
- Competence: Who conducted the assessments? What training or qualifications do they have?
- Specificity: Are assessments tailored to your workplace or generic?
- Currency: Are assessments up to date? When were they last reviewed?
- Implementation: Are the control measures specified in assessments actually in place and being used?
- Adequacy: Do the assessments properly identify risks and specify adequate controls?
- Communication: Have employees been trained? Do they know about the risks and controls?
On-site observations:
Inspectors will walk the workplace to observe:
- Whether specified control measures are in place and functioning
- Whether employees are using PPE and equipment correctly
- Storage arrangements for hazardous substances
- Condition of ventilation systems and other control equipment
- Housekeeping (evidence of spills, leaks, poor practices)
- Labeling and warning signs
Conduct your own internal audits regularly. Check that what's written in assessments matches what actually happens on the floor. If there are gaps, either improve practices or update the assessment to reflect reality—then improve practices to match best practice.
Frequently asked questions
You can group similar substances used in the same way, but they must have similar hazards and require similar controls. For example, several brands of general-purpose cleaner might be grouped. However, substances with different hazard classifications (e.g., corrosive vs. irritant) or used differently need separate assessments. When in doubt, assess separately.
Written assessments aren't legally required if you employ fewer than 5 people, but the HSE strongly recommends them. Without a written record, you cannot demonstrate compliance during an inspection. If an employee becomes ill or there's an incident, you'll need evidence that you assessed risks and implemented controls. Always write it down.
Templates are a useful starting point, but you must customize them to your specific workplace. A template downloaded and used without adaptation is not a 'suitable and sufficient' assessment. You must evaluate your actual exposure, work methods, and employees at risk. Use templates as a structure, but fill them with workplace-specific detail.
There's no specific required qualification, but you must be competent. For low-risk assessments, NEBOSH General Certificate, IOSH Managing Safely, or specific COSHH training may be sufficient. For high-risk substances, consider engaging a BOHS-qualified occupational hygienist. The key is having sufficient knowledge, training, and experience for the substances and risks involved.
The law requires review when there's reason to suspect the assessment is invalid or after significant changes. There's no fixed interval. However, good practice is annual review for high-risk substances and every 2-3 years for lower-risk substances. More importantly, review immediately when anything changes.
Employees have a legal duty to use control measures and PPE provided (Regulation 8). If they refuse, investigate why—PPE may be uncomfortable, ill-fitting, or impractical. Address genuine concerns (provide alternatives, improve fit) but make clear that refusal is a disciplinary matter. Document training and refusals. If employees won't use PPE, you haven't adequately controlled exposure.
Yes. There's no time limit for HSE prosecution under the HSWA 1974. If a worker develops occupational disease years after exposure, the HSE can investigate historical practices and prosecute if you failed to assess and control risks at the time. This is why 40-year record retention is required for some substances.
Act immediately. Prioritize high-risk substances—assess them first and implement controls urgently. For other substances, create a plan to complete or revise assessments within a reasonable timeframe (weeks, not months). Consider engaging a consultant if you lack competence. Document your actions. If you're proactive, the HSE is more likely to work with you than take enforcement action.
Next steps
Learn how to conduct a COSHH assessment step-by-step:
Understand what COSHH covers and why it matters:
Check whether your substances have exposure limits:
Workplace Exposure Limits (WELs) Explained →
Ensure safe storage of your hazardous substances:
Safe Storage of Hazardous Substances →
Use our COSHH checker to identify your obligations:
Uncertain whether your COSHH assessments meet legal requirements? A qualified health and safety consultant can review your existing assessments, identify deficiencies, and ensure you achieve full compliance before an HSE inspection.
Related articles:
Useful tools: