COSHH management: chemical safety compliance in hospitality

By Zynthio. Published 3 December 2025, updated 12 September 2026. Editorial policy

General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.

COSHH management means a substance register, controls chosen in the right order, and a review whenever the work or the product changes.

COSHH management is the work of listing every hazardous substance a venue holds, controlling how people are exposed to it, training whoever handles it, and keeping the records that show all three happened. The duty comes from the Control of Substances Hazardous to Health Regulations 2002, which apply in Great Britain; Northern Ireland works to its own equivalent regulations rather than these. For a pub, restaurant, cafe or hotel it covers the bleach behind the bar, the descaler in the coffee machine, the caustic oven cleaner and the sanitiser in the pot wash. Inspectors may ask for the substance register and the assessments behind it during a visit that is nominally about food hygiene, and a folder of half-finished forms is a weak answer.

What counts as a hazardous substance in hospitality

Most hospitality exposure comes from ordinary cleaning and catering products rather than industrial chemicals, which is exactly why it gets underestimated. Concentrated descaler, chlorine-based sanitiser, caustic oven cleaner and drain unblocker can all harm skin, eyes and airways if they are diluted wrongly, stored badly or mixed with something they should never meet. Cellar carbon dioxide and the fumes given off by some polishes and solvents are in scope too, even though staff rarely file them under chemicals. The starting point is knowing what is actually on site. A walk through the kitchen, bar, cellar and store room, writing down what sits on each shelf, usually turns up products that arrived with a routine supplier order and were never assessed, because nobody treated a delivery as a change to the register.

Building a coshh management system that works

A working coshh management system starts with a register of every hazardous substance on site, not only the ones that look dangerous. Each entry needs the supplier's safety data sheet, a note of where the product is stored, who uses it and what protective equipment it calls for. HSE guidance on safety data sheets is worth reading before that register is built: suppliers must provide an up to date data sheet for a substance that is dangerous for supply, the sheet describes the hazards and gives information on handling, storage and emergency measures, and it is not itself a risk assessment. It is the raw material for one. Grouping substances by how much harm they could do then turns a long list into a short list of priorities.

The point of grouping this way is that review time and training time go where the exposure actually is, rather than being spread evenly across everything on the shelf. It also gives a manager somewhere to put a new product when a supplier changes their sanitiser brand, instead of starting from a blank page every time.

Choosing controls in the right order

The objective of COSHH is to prevent exposure, or to control it adequately where prevention is not reasonably practicable, and the order in which controls are chosen is what separates a real assessment from a paper one. HSE guidance on assessing and controlling the risks works down from elimination, through changing the process, containment, safe systems of work and cleaning, to personal protective equipment, and it is blunt about the last of those: do not automatically opt for protective equipment, because it is not as reliable or effective as other measures. In a venue that usually means buying a ready-diluted product instead of a concentrate, fitting dosing equipment so nobody decants by hand, ventilating the chemical store properly, and keeping two products that should never meet in different places. Gloves and goggles still matter, but an assessment that opens with them has skipped the part that does the most good.

When a COSHH assessment has to be reviewed

There is no fixed legal interval for reviewing a COSHH assessment. Regulation 6 of the 2002 Regulations requires the assessment to be reviewed regularly, and forthwith if there is reason to suspect it is no longer valid, if there has been a significant change in the work it relates to, or if monitoring results show a review is necessary. A change of supplier, a reformulated product, new equipment, a different storage arrangement or an incident each trigger a review on their own timetable, whatever date is written on the form. A fixed review date is still worth setting, because it stops an assessment drifting quietly out of date while nobody is watching, but that date is a management habit rather than a legal deadline, and it never replaces the duty to review when something changes. The same regulation requires an employer with five or more employees to record the significant findings of the assessment and the steps taken to meet the control duty. A named approval step, from draft to signed off, matters as much as the content, because it records who accepted the assessment and when, which is precisely what is missing when a site changes hands or a manager moves on. Our practical guide to COSHH and risk assessments covers how to word control measures so they are followed rather than filed.

Training, protective equipment and health surveillance

Staff cannot use a substance safely if nobody has shown them how, and the burden of proof sits with the employer to demonstrate that information, instruction and training were given. A short induction covering dilution, the protective equipment required, and what to do when a product is splashed or spilled is usually enough, provided it is recorded against the individual and repeated when the product or the job changes. Agency and casual staff deserve particular attention, not because of any published incident rate, but because they meet unfamiliar products more often than permanent staff do. Health surveillance sits alongside training rather than inside it. HSE describes it as any activity that obtains information about employees' health and helps protect them from health risks at work, and sets out when it is necessary: where there is a disease associated with the substance in use, where that disease or adverse change can be detected and further harm reduced, and where conditions in the workplace make it likely the disease will appear. Health surveillance guidance is the page to work from before deciding a venue needs it, or that it does not.

Incidents, records and what an inspector asks for

Not every splash needs to go further than the accident book, but some do. Whether a chemical incident is reportable under RIDDOR turns on what the injury is, how long it keeps somebody off their normal duties, and whether a listed disease has been diagnosed and linked to work. Where there is genuine doubt, a free RIDDOR reportability checker settles the question before the entry is written, and our guide to which accidents you must report, and when sets out the thresholds. Everything below that bar still belongs in the local record, because a run of minor skin irritation against the same product is a signal to look at dilution or gloves long before anyone is seriously hurt. What carries weight with an inspector is what can be produced on request: the register, dated assessments, training records and the incident log. Gaps are what draw attention, whether that is an assessment with no review date, a substance with no data sheet attached, or a member of staff with no training record for a product they use daily. Keeping COSHH and risk assessment records in one place removes much of the chasing that lets those gaps open, and the same argument applies to fire risk assessments in hospitality, which are often looked at during the same visit.

Where Zynthio fits

Zynthio holds the substance register and the venue risk assessments as structured records rather than as scans. A substance carries its hazards, the protective equipment it needs, how it is stored and how it is disposed of, and its first aid, emergency and spillage procedures, with the safety data sheet attached and given an expiry date, so an expired sheet counts alongside a missing one rather than alongside a valid one. A COSHH assessment records the hazards, who might be harmed and how, the controls in place and the controls still needed, the exposure route, the risk before and after those controls, the emergency procedures, whether training is required and which course delivers it, and whether health surveillance is needed. Approving an assessment supersedes and archives the one it replaces, and re-bases the review clock from the approval date. The review cycle is set on the substance at six or twelve months, and an assessment reads as current, due soon within 30 days, or overdue. Venue risk assessments are the second register, scored on a 5 by 5 matrix banded low at 1 to 4, medium at 5 to 12 and high at 13 to 25, with templates by category carrying suggested hazards, controls and the legal basis. One limit is worth stating plainly, because it changes how the system has to be used: those due states are shown, but nothing emails or pushes a reminder, so opening the dashboard has to be somebody's routine. The COSHH and risk assessment software page sets out how both registers are put together.

See how Zynthio handles this