Guidance on the interaction between COSHH and REACH (Registration, Evaluation, Authorisation and Restriction of Chemicals)
OC 253/13
This OC provides advice to inspectors on the interaction of the Control of Substances Hazardous to Health Regulations 2002 (COSHH) and Regulation (EC) no. 1907/2006 concerning the Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH).
REACH and COSHH both impose requirements on the use of hazardous chemicals in the workplace, and downstream users will now find themselves faced with two sets of duties. Although REACH and COSHH should ultimately complement one another, their requirements overlap to some extent and this has the potential to give rise to inconsistencies in their application. This OC aims to identify those areas where COSHH and REACH interact, and to provide guidance for inspectors on how to assess compliance with the requirements of both regimes.
This is the third of three OCs dealing with REACH; other OCs contain general advice and guidance on REACH requirements (OC 253/11), and on the UK enforcement regime for REACH (OC 253/12).
Background
REACH (Registration, Evaluation, Authorisation and Restriction of CHemicals) is an EC Regulation that is direct acting in the UK. REACH introduced a scheme for registering and evaluating chemicals, creating a fundamentally new approach to chemicals control by moving the responsibility for risk assessment of substances to manufacturers and importers. It then puts duties on suppliers and 'downstream users' of chemicals, primarily to ensure that the information gained through registration and evaluation is passed down the supply chain, and effectively applied to control risks. REACH also restricts the use of certain dangerous substances, and for other substances of very high concern, use-specific authorisation is required.
REACH came into force on 1 June 2007 and replaced a patchwork of European Directives and Regulations with a single system. COSHH was not revoked or substantially amended by REACH, as REACH did not repeal either the Chemicals Agents Directive or the Carcinogens and Mutagens Directive, both of which relate to workers and which COSHH implements. (Some of the prohibitions in COSHH have been affected by REACH and so parts of regulation 4 and Schedule 2 have been amended accordingly.)
Article 2(4) of REACH states that it applies 'without prejudice' to existing Community workplace and environmental protection legislation, and so employers will have to meet the requirements of both REACH and COSHH. It follows that compliance with one regime cannot justify failure to comply with the other.
While REACH and COSHH share the same philosophy, in that both regimes have as their objectives the better protection of human health, there are a number of differences in how they set about achieving those ends:
- REACH is a very broad ranging Regulation, and its requirements encompass occupational health and safety, environmental protection and consumer protection; COSHH is focussed solely on the first of these.
- COSHH requires all employers to assess the risks to employees' health created by work with hazardous substances, and identify the necessary controls. REACH places the onus of risk assessment and the identification of the necessary controls much higher up the supply chain (on the manufacturer or importer). Because of this, COSHH risk assessments are more likely to be site-specific, while the risk management measures identified by REACH are likely to be more broad-based.
- COSHH covers all work activities involving hazardous substances at a workplace, including process derived substances eg fumes, dusts. REACH will not address process-derived substances, but instead addresses the manufacture of a substance and all its identified uses across the EU, provided the substance is manufactured or imported by the registrant at 10 tonnes per year or more.
- REACH is substance-driven, and the risk assessments will relate to the use of that substance throughout the supply chain. It is unlikely to take into account the other substances in use on any one particular site or the interactions of different substances in certain processes. COSHH tends to be more process-driven, ie the employer looks at the process being carried out, including existing controls, and then at all the substances used in the process.
- REACH exempts a number of substances from REACH entirely, for example, waste, or substances covered by legislation on the carriage of dangerous substances or mixtures. Other substances have partial exemptions from REACH, for example, a substance used in medicinal products or food. Annexes IV and V of REACH also contain a range of substances to which its use-related requirements do not apply
Risk assessments and 'exposure scenarios' under REACH
Every registration of a substance under REACH will require the submission of a technical dossier to the European Chemicals Agency (ECHA). For substances imported or manufactured in quantities of 10 tonnes or more per year, the registration must also be accompanied by a chemical safety report (CSR). The CSR is the documentation concerning the registrant's chemical safety assessment (CSA), essentially a risk assessment, for that substance. It contains a detailed summary of information on the properties of the substance that are hazardous to human health and the environment. For substances classified as dangerous, an assessment of exposure and risk is also required. This includes the operational conditions and risk management measures required to control risks from the use of the substance.
REACH will also see the introduction of a new type of exposure control benchmark, the derived no-effect level (DNEL). The DNEL must be derived by the registrant as part of their chemical safety assessment. DNELs must reflect the likely routes, duration and frequency of exposure, and if more than one route of exposure is likely to occur (oral, dermal or inhalation), then a DNEL must be established for each route of exposure and for the exposure from all routes combined. It may also be necessary to identify different DNELs for each relevant human population (eg workers, consumers and humans liable to exposure indirectly via the environment) and possibly for certain vulnerable sub-populations (eg children, pregnant women).
An 'exposure scenario' (ES) specifies the conditions of use (the operational conditions and risk management measures) necessary to ensure risks are adequately controlled. The exposure scenario is communicated to downstream users by being annexed to safety data sheets (SDSs) provided when the substance is supplied. The risk management measures will be designed to ensure that the relevant DNEL(s) can be met. Registrants will have to provide ESs for all identified uses. An 'identified use' of a substance or mixture is a use that is intended by an actor in the supply chain, or a use that is made known to a supplier by a downstream user.
Given the phased introduction of the registration-related requirements in REACH, their introduction will not be complete until 2018. Even after that, they will only be required for substances subject to registration and manufactured or imported in quantities of 10 tonnes or more per year and classified as dangerous. Nevertheless, where and when they are available, the exposure scenario should provide a downstream user with improved information about hazards, uses and risk management measures on which an assessment under regulation 6(1) of COSHH can be based.
When information generated by REACH is received by downstream users via an extended SDS, it is important that this triggers a review of existing COSHH assessments and controls.Approach
Although REACH places responsibility for the identification and assessment of chemical hazards and risks on those ultimately responsible for their manufacture or importation into the EU, this does not change the responsibility COSHH places on employers for assessing risks and deciding how to control them in the individual workplace. This means downstream users are now faced with two sets of obligations under REACH and COSHH.
To assist inspectors in assessing whether downstream users have complied with the requirements of both REACH and COSHH, the flowchart below combines the sets of obligations in COSHH and REACH. (OC 253/11 contains more information about the specific duties REACH imposes in relation to the use of chemicals.)
Step 1: Application
Article 2 of REACH exempts a number of substances from REACH entirely, for example, waste, or substances covered by legislation on the carriage of dangerous substances or preparations. Other substances have partial exemptions from REACH, for example, the requirements imposed on downstream users by Title V do not apply to the extent that a substance is used in medicinal products or food. Annexes IV and V of REACH also contain a range of substances to which Title V requirements do not apply.
Some industrial processes will generate 'substances hazardous to health' as defined by COSHH, but the resulting substances may not be subject to registration requirements. This means that no CSR/CSA (and resulting exposure scenario) will be developed. Examples of these include wood dust, welding fume, diesel engine exhaust fume etc.
Step 2: Restrictions
Article 67(1) of REACH prohibits the use of a substance (on its own, in a preparation or in an article) outside the conditions of a restriction given in Annex XVII. The scope of a restriction can vary from either an outright (or near outright) ban, to setting conditions on certain activities, processes or applications.
REACH repealed and replaced the previous legislative regime (the Marketing and Use Directive) from 1 June 2009. As the Marketing and Use Directive had been transposed into UK law via a number of different statutory instruments, the REACH Enforcement Regulations 2008 made consequential amendments and revocations to the relevant UK legislation. This includes amendments to parts of regulation 4 and Schedule 2 of COSHH.
Step 3: Authorisation
In order to place on the market or use substances with properties that are deemed to be "substances of very high concern" (SVHCs), dutyholders must apply for an authorisation. Substances requiring authorisation are those appearing on Annex XIV of REACH, and are present on that Annex because they are either:
- carcinogenic, mutagenic or toxic to reproduction (CMR) category 1 and 2;
- persistent, bioaccumulative and toxic (PBT) or very persistent and very bioaccumulative (vPvB), based on the criteria in Annex XIII of REACH; or
- identified from scientific evidence as being of equivalent concern to those above to humans or the environment on a case-by-case basis, such as endocrine disrupters.
Article 56 of REACH states that a manufacturer, importer or downstream user shall not place a substance listed on Annex XIV on the market for a use, or use it themselves, unless that use has been authorised (or one of the relevant exceptions applies).
If a downstream user intends to use a substance subject to authorisation, and an authorisation for the proposed use has already been obtained by an actor further up the supply chain, the downstream user does not have to obtain a separate authorisation. In such circumstances the downstream user must instead notify ECHA of their use (Article 66(1)), and ensure the use of the substance is in accordance with any conditions of authorisation (Article 56(2)).
Step 4: Use within the exposure scenario
A proposed use of a substance may be outside the conditions described in an exposure scenario, or otherwise against the advice of the supplier (as communicated on the SDS or otherwise). This may be the case with novel or unusual uses of substances, as these may fall outside the typical uses identified by the exposure scenario. In such situations, REACH gives the downstream user two routes forward:
- the downstream user has a right to make a proposed use known to his supplier, with the aim of making this an identified use (Article 37(2)). The supplier should then update their registration information accordingly before next supplying the substance to that downstream user. The supplier does have the right to refuse to accept the use for reasons of protection of human health or the environment;
- alternatively, should the downstream user not wish to make their use known to their supplier (eg for reasons of commercial confidentiality), or should the supplier not accept their use, then REACH effectively requires the downstream user to take over the registration responsibility. In such circumstances, the downstream user must normally prepare a chemical safety assessment (Article 37(4)), and report certain information to ECHA about their use (Article 38(1)).
This is in addition to the other (non-statutory) options a downstream user may elect to take in such circumstances. For instance, they could change their use to bring it within the exposure scenario, find another supplier who is able to support the use, or replace the substance or process with an alternative substance or process.
Exposure scenarios will not be required for all substances, eg substances that are not subject to registration, or substances that are registered but which are manufactured or imported in quantities of less than 10 tonnes per year, or are not classified as dangerous. Where there is no exposure scenario, step 4 can be disregarded.
Step 5: Perform / review existing COSHH assessment
Under regulation 6 of COSHH, dutyholders must still make a suitable and sufficient assessment of the risks to employees' health created by work with hazardous substances. Preventing exposure to substances hazardous to health is a fundamental requirement of COSHH, and will still need to be every employer's first consideration. Where substitution is being considered, one of the factors that needs to be taken into account is the harmful properties of the proposed replacement. In the context of REACH, this should include considering any risks to the environment created by the proposed replacement.
As part of the risk assessment, COSHH specifically requires employers to consider information on health effects provided by their supplier, including information contained in any relevant SDS. Article 37(5) of REACH builds on this duty, stating that downstream users must identify and apply appropriate measures to adequately control risks identified in any of the following:
- the SDS they are supplied with (or for substances that do not require an SDS, any other information on risk management measures supplied with the substance); or
- their own chemical safety assessment, if they are required to prepare one
This duty extends only insofar as the risk management measures are 'appropriate', which implies a level of assessment. If the downstream user decides that certain risk management measures are inappropriate, they will need to be able to demonstrate and justify their reasoning, with reference to their COSHH assessment. Downstream users should document any decision not to apply REACH risk management measures in their COSHH assessment, along with the reasons for it. Downstream users are also required by Article 34 of REACH to report any information on the SDS that might call into question the appropriateness of the risk management measures.
Step 6: Apply / implement control measures
Downstream users should not only apply REACH risk management measures, but should also ensure their use is effective. In applying / implementing the measures identified by the COSHH assessment, downstream users will need to note the following:
- Article 60(10) of REACH requires the holder of an authorisation to ensure that, notwithstanding any conditions of authorisation, exposure is "reduced to as low a level as is technically and practically possible". This differs from the typical UK legislative approach of "reasonably practicable". However, for carcinogens and mutagens the difference in practice may not be significant. Ultimately it will be for a court to determine what the differences are, if any.
- Any relevant workplace exposure limits (WELs) set in relation to COSHH will still need to be observed. In practice, application of the full suite of REACH risk management measures in an exposure scenario may result in achievement of a WEL because these are based on the DNEL(s) derived from the CSA. As the process for deriving DNELs is more conservative than for WELs, the DNEL is likely to impose the more stringent level of protection. However, exposure scenarios may not always be present, and downstream users may not necessarily have implemented all REACH risk management measures (see above).
- There are additional requirements in COSHH relating to the use of carcinogenic or mutagenic substance (a substance carrying the risk phrase R45, R46 or R49, or substances or processes listed in COSHH Schedule 1). In such cases, exposure must be reduced to as low a level as is reasonably practicable by COSHH regulation 7(7)(c), and the requirements of regulation 7(5) must be observed. (Note that carcinogens and mutagens may also be subject to authorisation under REACH, in which case the conditions of authorisation may be even more stringent.)
- There are also additional requirements in COSHH relating to the use of asthmagens, in which case exposure must be reduced to as low a level as is reasonably practicable by regulation 7(7)(c).
Step 7: Hierarchy of control
The control measures identified and applied by steps 5 and 6 above should be implemented in the order of priority specified in COSHH regulation 7(3). The hierarchy of controls also features in a REACH guidance publication on how to compile a chemical safety report. In particular, reliance should only be placed on suitable personal protective equipment where control of exposure cannot be achieved by other means.
Step 8: Principles of good practice
COSHH will only regard control of exposure as adequate if the principles of good practice as set out in Schedule 2A are applied. Dutyholders will therefore need to ensure that the risk management measures applied reflect the principles of good practice; if not, the COSHH assessment will need to be reviewed and the control measures changed as appropriate.
Step 9: Other requirements of COSHH
COSHH contains a number of other provisions which 'build' on the more general duties in regulation 7. These may have already been adequately addressed by the application of the above process, but employers will need to satisfy themselves that compliance has indeed been achieved with them. These requirements relate to the use of control measures (regulation 8), maintenance, examination and testing (regulation 9), monitoring (regulation 10), health surveillance (regulation 11), information, instruction and training (regulation 12) and arrangements to deal with accidents, incidents and emergencies (regulation 13).
Steps 10, 11, 12 & 13: Record, keep information, review & consult
Article 36 of REACH requires downstream users to assemble and keep available all the information they require to carry out their duties under REACH for a period of at least 10 years after the last use of the substance in question. Any additional requirements imposed by COSHH to keep information for longer periods of time (eg for 40 years in regulations 10 and 11) must also be observed. The COSHH assessment should be recorded if the employer has five or more employees (regulation 6(4)).
Regulation 6(3) of COSHH requires the assessment to be reviewed regularly and immediately if there is evidence to suggest it is no longer valid, or where there has been a significant change in the circumstances of the work activity to which it relates. When new information generated by REACH is received by downstream users, it is important that this triggers a review of existing COSHH assessments and controls. If a downstream user has prepared their own CSR, then this too must be kept up to date (REACH Article 37(7)).
Regulation 12 of COSHH requires that workers and their representatives are provided with suitable and sufficient information, instruction and training, which should include the main findings of the COSHH assessment. REACH (Article 35) requires that workers and their representatives are granted access by their employer to information provided by suppliers (eg the SDS) in relation to substances or preparations that they use or may be exposed to in the course of their work.
Questions and answers
What if a downstream user can demonstrate compliance with COSHH but not REACH?
REACH and COSHH requirements apply 'without prejudice' to each other and so compliance with one regime cannot be used as a justification for failure to comply with the other.
What if the downstream user has achieved adequate control under COSHH but has not followed the REACH risk management measures?
Just because the downstream user has achieved adequate control under COSHH, it does not mean that the REACH requirements can be ignored. However, the downstream user might be able to demonstrate that their existing control measures achieve an equivalent level of protection, and that the REACH controls are not appropriate for them. Downstream users will need to justify any such position with reference to their COSHH assessment.
Downstream users should remember that there may still be circumstances in which they must nevertheless prepare a CSR (for uses outside the conditions described in an exposure scenario, or uses that are against the advice of the supplier).
What if a downstream user has not been provided with a safety data sheet?
Suppliers of substances or preparations classified as 'dangerous' must provide recipients with a safety data sheet (SDS) compiled to REACH requirements. There are also some other circumstances under REACH where a supplier will need to provide a SDS. However, a SDS will not always be required, eg for substances or preparations that are not classified. This means the downstream user may not receive a SDS for every substance or preparation they use.
However, where a SDS is required, the obligation falls on the supplier to ensure one is provided to the downstream user. Simply making them available (eg on a website, or only in response to requests from customers etc) is not enough. However, this does not mean that the SDS must be provided to the same customer every time they order the same substance or preparation; in such circumstances, it is enough to provide the SDS either before or at the time of first delivery of the substance or preparation, providing the SDS is re-sent following any revisions. The SDS can be provided electronically or in writing but must be free of charge.
What if the information on the safety data sheet is missing / inaccurate?
The safety data sheet (SDS), including any annexes, remains a vital communication tool between suppliers and downstream users of chemicals. Accurate, complete and correct information on the safety data sheet (SDS) is essential when considering workplace controls. If inspectors have concerns over the quality or reliability of information provided on a SDS, they should refer the matter either to the relevant regional product safety team, or to the UK REACH Competent Authority (CA).
Inspectors should also remind downstream users that they too have a specific obligation under REACH to report any information on the SDS that might call into question the appropriateness of the risk management measures.
What if there are no exposure scenarios appended to a safety data sheet?
This is to be expected, certainly in the early years of REACH implementation, and even following the final registration deadline in 2018. While a safety data sheet (SDS) must be provided for all substances or preparations classified as dangerous irrespective of the tonnage supplied, exposure scenarios are only required to be developed for those substances registered in quantities of 10 or more tonnes per year and classified as dangerous. SDSs for substances registered in quantities less than 10 tonnes per year (or not requiring registration at all) would not be expected to have exposure scenarios attached.
What should the user do when they receive a revised safety data sheet?
This should trigger a review of their existing COSHH assessment under regulation 6(3).
What if the downstream user purchases the same substance from two or more suppliers, and the risk management information in their safety data sheets is different?
REACH states that 'appropriate' risk management measures must be identified and applied, and so it is for the downstream user to decide, when performing their COSHH assessment, which risk management measures are 'appropriate' in the circumstances. However, in such situations it is possible that some of the risk management measures in the safety data sheets are inappropriate. If this is the case, the downstream user will need to inform the relevant supplier(s), who must then take action.
What should the downstream user do if they do not understand the risk management measures in the safety data sheet?
It is possible that certain terms or phrases used in one industry sector will not be understood in another, or that the downstream user is not sure how to apply the risk management measures to their situation. Inspectors should recommend downstream users contact their supplier for clarification.
What if it is not possible or impractical to apply the risk management measures in a safety data sheet?
This will need to be considered as part of the COSHH assessment. There is a clear expectation in REACH that downstream users should apply the full range of control measures identified in the SDS. But if there are clear and justifiable reasons for not doing so (ie the risk management measures are not 'appropriate'), then it is not a contravention of REACH to take other measures. In such circumstances, the downstream user should be able to demonstrate how the other measures taken provide for an equally effective level of protection, and should document in their COSHH assessment the reasons for not applying the REACH controls. Downstream users should also report any inappropriate risk management measures to their supplier.
What happens where a WEL under COSHH differs from a DNEL under REACH?
The DNEL under REACH is used to determine the appropriate risk management measures, and so full implementation of them should ensure the DNEL is met. Clearly if this level of protection meets or exceeds the WEL then no further action is required. If it does not, then the user will need to consider further controls to ensure the WEL is also met.Further information
UK REACH Competent Authority staff (part of the Chemicals Regulation Directorate) can provide further information on the matters raised by this OC or on the requirements of REACH generally, and would welcome feedback on relevant information or issues. Please get in touch using the REACH Compliance email account
References
European Chemicals Agency, Guidance for downstream users (January 2008), freely available for download.