Let’s be honest—nobody opens a small business because they can’t wait to read health and safety legislation. But if you’ve got people working with, around, or exposed to any substances that could harm their health, then COSHH is something you need to know about.
So, I’ve done the hard reading for you. This post is your plain-English guide to what the COSHH regulations actually say—and what you need to do about them as an employer.
No legal jargon. No fluff. Just the bits that matter.
What are the COSHH regulations?
COSHH stands for Control of Substances Hazardous to Health Regulations. They’ve been around in one form or another since the late ’80s, and the current version is from 2002.
They’re part of UK law and enforced by the Health and Safety Executive (HSE).
The idea is simple: if you’re an employer, you must prevent or control exposure to substances that could harm health. That’s it in a nutshell.
There are 17 regulations in total, but don’t worry—you don’t need to memorise them. Let’s just go over the bits that apply to you, especially if you’re running a small business.
What does the law actually require?
Here’s a simplified breakdown of your legal duties under COSHH:
1. Assess the risks (Regulation 6)
This is your COSHH assessment. You need to identify hazardous substances in your workplace and figure out how people could be harmed by them.
Then you assess:
- Who might be exposed
- How they could be exposed (inhaled, skin contact, swallowed, etc.)
- What you’re doing to prevent or reduce that exposure
You don’t need a law degree to do this—just a structured, sensible look at what’s going on in your business. And yes, I’ve got templates that make this easier if you want them.
2. Decide on the right controls (Regulation 7)
Once you know what the risks are, the law says you must prevent exposure if you can. If not, you need to control it.
This might include:
- Swapping a substance for a safer one
- Using it in a different form (e.g., pellets instead of powder)
- Improving ventilation
- Using local exhaust extraction (like fume hoods or spray booths)
- Providing PPE like gloves or masks
But here’s the key thing—PPE is a last resort, not your go-to solution.
The law expects you to work through controls in order, starting with removing the hazard altogether if possible.
3. Make sure controls actually work (Regulation 9)
It’s not enough to just have controls. You’ve got to check they’re working.
That means things like:
- Regularly checking fume extraction systems
- Replacing filters
- Inspecting PPE
- Cleaning and maintaining equipment
If something breaks or wears out, you need to fix or replace it.
For certain types of equipment (like LEV systems), the law says they must be thoroughly examined by a competent person at least once every 14 months.
4. Monitor exposure (Regulation 10)
This one’s only relevant if there’s a chance someone could be exposed to a hazardous substance without knowing it, or where health effects might build up over time.
If that’s the case (think fumes, fine dusts, etc.), you may need to do air monitoring or surface testing. In most low-risk small businesses, this isn’t needed—but it’s worth knowing the rule exists.
5. Health surveillance (Regulation 11)
If your workers are exposed to substances that could cause specific health effects—like dermatitis, asthma, or more serious conditions—you might need health surveillance.
That could mean:
- Skin checks for early signs of irritation
- Lung function testing
- Regular health questionnaires
Again, it depends on the risks. If you’re not sure whether health surveillance applies to your business, get in touch—this is something I help businesses work out.
6. Train and inform your team (Regulation 12 & 13)
You need to make sure anyone who could be exposed to hazardous substances:
- Knows what the risks are
- Understands the controls in place
- Knows how to use PPE or other equipment properly
- Knows what to do in an emergency (spills, splashes, exposure)
This doesn’t mean you have to send everyone off for expensive training courses. A proper induction and some clear, regular briefings can often do the trick.
But it does need to be documented. And people need to actually understand it—not just nod along.
7. Plan for accidents and emergencies (Regulation 13 again)
If there’s a risk of a spill, leak, or other exposure incident, you need to have an emergency plan.
That might mean:
- Eye wash stations
- Spill kits
- First aid procedures
- Clear instructions for staff
You don’t need to go full nuclear bunker mode—but you do need to be prepared for things going wrong.
8. Keep records (Regulations 6, 9, 10, 11)
You need to keep a written record of your:
- COSHH assessments
- Control measures and checks
- Health surveillance (if required)
- Exposure monitoring (if required)
- Training and briefings
It doesn’t have to be a leather-bound tome, but it does need to exist. HSE can ask to see this stuff if they visit. And it’s useful for your own peace of mind too.
What happens if I don’t comply?
Not to scare you, but non-compliance with COSHH can get expensive—both financially and legally.
HSE can issue improvement notices, prohibition notices (which stop you working until it’s sorted), or fines. If someone gets ill or injured as a result of your negligence, you could be looking at court time.
More importantly, it puts people at risk. And most small business owners I speak to genuinely don’t want anyone getting hurt on their watch.
Does this apply if I’m self-employed?
Yes—if your work could expose anyone else (including clients, contractors, or the general public) to hazardous substances, you need to follow COSHH.
If you’re just working by yourself with no risk to anyone else, you still need to consider the risks to your own health. The law’s not quite as strict, but it’s still good practice to assess and manage those risks properly.
I’ve only got one or two hazardous substances. Do I still need to do all this?
Yes—but don’t overcomplicate it.
If you’ve got, say, a single cleaning product that’s classed as hazardous, your COSHH assessment for that can be short and simple. Identify the product, assess the risk, document what you’re doing to control it, and make sure anyone using it knows what they’re doing.
Done right, a COSHH file for a small business might only be a few pages long. That’s totally fine—as long as it’s accurate and specific to your business.
Where to start if you’re feeling a bit lost
If this is the first time you’ve thought about COSHH (or if you’ve just discovered your old risk folder is a decade out of date), don’t worry. You’re not alone.
Here’s where I’d start:
- Make a list of all the substances you use that might be hazardous
- Grab the safety data sheets from your suppliers
- Do a COSHH assessment for each one (I can help with templates if you need them)
- Check your controls—are they reasonable and working?
- Let staff know the risks and what they need to do
- Keep your records tidy—ideally all in one place
If you’re still scratching your head, drop me a message. I offer remote help for small businesses who just want to get it sorted without spending all week figuring out what “Regulation 9” means.