COMAH Regulations: Tiers, Safety Reports, and Enforcement

The COMAH regulations, formally the Control of Major Accident Hazards Regulations 2015, are the UK framework that requires operators holding large quantities of dangerous chemicals to prevent major accidents and limit the harm any accident could cause to people and the environment. The rules took effect on 1 June 2015 and originally transposed the EU’s Seveso III Directive (2012/18/EU) into UK law.¹ They remain in force as retained legislation after Brexit, and the Health and Safety Executive continues to enforce them across Great Britain. Whether a site stores chlorine for water treatment or processes ammonia at industrial scale, COMAH duties begin the moment on-site inventories cross specific thresholds.

Which Tier Applies to Your Site

COMAH sorts regulated establishments into two categories based on the quantity of dangerous substances present or likely to be present at any one time. Lower-tier sites hold quantities above a lower qualifying threshold but below the upper one. Upper-tier sites hold quantities at or above the upper threshold, and they face significantly heavier duties, including a full safety report and external emergency planning.

Schedule 1 of the regulations sets out both named substances and generic hazard categories with their qualifying quantities in tonnes. The variation is dramatic:²

Chlorine: 10 tonnes lower tier, 25 tonnes upper tier
Anhydrous ammonia: 50 tonnes lower tier, 200 tonnes upper tier
Hydrogen: 5 tonnes lower tier, 50 tonnes upper tier
Methanol: 500 tonnes lower tier, 5,000 tonnes upper tier
Ammonium nitrate: 5,000 tonnes lower tier, 10,000 tonnes upper tier
Phosgene (carbonyl dichloride): 0.3 tonnes lower tier, 0.75 tonnes upper tier

Highly toxic substances like phosgene bring a site into scope at quantities measured in hundreds of kilograms. Common industrial solvents like methanol only become relevant at hundreds of tonnes. Operators need to identify every dangerous substance present and check each one against both the named-substance list and the generic hazard categories.

The Aggregation Rule

A site might hold several chemicals, none of which reaches its own qualifying threshold, and still fall within COMAH. Schedule 1 sets out an aggregation rule: divide the quantity of each substance by its relevant qualifying threshold, then add the fractions. If the total reaches 1 or more, the site is in scope.²

The calculation runs twice. Check first against upper-tier thresholds. If the sum is 1 or more, the site is upper tier. If not, repeat the calculation using lower-tier thresholds. A sum of 1 or more at that stage makes it a lower-tier site. If neither calculation reaches 1, the site sits outside COMAH.

Notifying the Competent Authority

Every COMAH establishment, whether lower or upper tier, must formally notify the Competent Authority before starting operations. Regulation 6 requires the notification to cover:³

Operator name, registered business address, and full address of the establishment
Name and position of the person in charge of the site
Identification, quantity, and physical form of every dangerous substance present or likely to be present
Description of the activities or proposed activities at the installation
Details of neighbouring sites, nearby developments, and any factors that could cause or worsen a major accident

New establishments must submit two notifications: one within a reasonable period before construction begins, and another before operations start.³ HSE guidance suggests allowing three to four months before the intended start of operation. Operators use HSE’s standard notification form and submit it by email; an acknowledgement should arrive within ten days, and HSE asks operators to follow up if it does not.⁴

Notification is not a one-time task. Operators must notify in advance of any significant increase or decrease in dangerous substance quantities, changes to the nature or physical form of those substances, modifications that could affect major accident hazards, permanent closure, or changes to the operator’s contact details.³

The Competent Authority itself is a joint body. One arm is the Health and Safety Executive, or the Office for Nuclear Regulation for nuclear sites. The other is the relevant environmental regulator: the Environment Agency in England, Natural Resources Wales in Wales, and the Scottish Environment Protection Agency in Scotland.⁵ Regulatory costs are recovered from operators on an hourly basis, with both HSE and the environmental regulator billing for the time they spend on review and inspection.⁶

Major Accident Prevention Policy

Every COMAH site, regardless of tier, must produce and maintain a Major Accident Prevention Policy (MAPP). The document sets out the operator’s overall approach to controlling major accident risks, including the goals and principles the organisation follows.⁷ It is not a shelf document. The MAPP must be backed by a functioning safety management system that defines organisational structure, individual responsibilities, training arrangements, and internal procedures for hazard control.⁸

Regular internal audits matter. Operators need documented reviews showing the policy is being followed in practice, not simply written down. The Competent Authority examines these records during inspections, and enforcement notices and fines can follow where the system exists only on paper. The most common failure is the gap between what the policy says and what actually happens on the shop floor.

Safety Reports for Upper-Tier Sites

Upper-tier establishments carry a much heavier documentation burden. Regulation 7 requires them to prepare and submit a comprehensive safety report demonstrating that all necessary measures have been taken to prevent major accidents and to limit any consequences.⁸ The report must cover:

Detailed information about the installations, processes, and dangerous substances
Potential major accident scenarios, their likelihood, and their possible consequences
The safety measures, management systems, and engineering controls designed to prevent each scenario or limit its impact
The internal emergency plan and its connection with external emergency planning

Narrative descriptions alone will not satisfy inspectors. They expect links to relevant engineering standards, records of safety assessments, maintenance documentation, and evidence that competent people are operating and maintaining critical systems.⁸ The safety report must be reviewed and, where necessary, updated at least every five years, or sooner after a major accident or any change that significantly affects the risk profile.

Emergency Plans and Public Information

Upper-tier operators must prepare internal emergency plans covering how the site itself would respond to a major accident. They must also provide local authorities with the information needed to develop external emergency plans, which coordinate the response of fire services, police, ambulances, and local councils. Testing those external plans requires cooperation from Category 1 responders designated under the Civil Contingencies Act 2004.⁷ A plan that has never been tested with real emergency services tends to fall apart when it matters, so regular joint exercises are the only reliable way to find coordination failures before an incident exposes them.

Operators of both lower-tier and upper-tier sites must supply safety information to people living and working within a designated Public Information Zone around the site. The 2015 regulations strengthened the requirements for lower-tier sites compared to the previous rules.⁷ The information must be distributed proactively, updated at least every five years, written in plain language, and made available without anyone having to submit a formal request. People near a hazardous site should know what chemicals are there, what could go wrong, and what to do if an alarm sounds.

Reporting a Major Accident

If a major accident happens, the operator must inform the Competent Authority as soon as practicable and then supply progressively more detailed information as it becomes available. Regulation 26 requires reports on:⁹

What happened and which dangerous substances were involved
Available data on the effects on human health, the environment, and property
The immediate emergency response actions taken
The measures planned to mitigate longer-term consequences and prevent recurrence

The Competent Authority then conducts its own analysis of the technical, organisational, and managerial factors behind the accident. It can require additional remedial measures and will make recommendations to prevent similar events. The local authority where the accident occurred must inform affected members of the public about what happened and what is being done, and the Competent Authority may share information with international organisations where appropriate.⁹

Enforcement and Penalties

COMAH offences are prosecuted under the Health and Safety at Work etc. Act 1974. Breaches can result in improvement notices requiring corrective action, prohibition notices that shut down operations until hazards are addressed, and criminal prosecution. Fines for serious violations are unlimited when tried on indictment in the Crown Court. The regulations require penalties to be effective, proportionate, and dissuasive. Operators found guilty can also be ordered to pay the Competent Authority’s investigation and prosecution costs.

Enforcement tends to be graduated. Inspectors typically begin with improvement notices for less critical shortcomings and reserve prosecution for operators who show persistent disregard for their duties or where failures created genuine risk of a major accident. Inadequate safety reports, missing notifications, and non-functional safety management systems attract the sharpest attention, because they signal systemic breakdowns rather than isolated lapses.

A Note on Scope

COMAH applies in Great Britain only. Facilities in the United States are covered instead by OSHA’s Process Safety Management standard (29 CFR 1910.119) and the EPA’s Risk Management Program (40 CFR Part 68), which together address workplace and community risks from hazardous chemicals under a different structure and different thresholds. Operators running sites in both jurisdictions need to comply with each regime on its own terms; satisfying one does not satisfy the other.

1
Legislation.gov.uk. Impact Assessment for the Transposition of the Seveso III Directive
2
Legislation.gov.uk. The Control of Major Accident Hazards Regulations 2015 – Schedule 1
3
Legislation.gov.uk. The Control of Major Accident Hazards Regulations 2015 – Regulation 6
4
Health and Safety Executive. COMAH Notifications
5
Health and Safety Executive. The COMAH Competent Authority
6
Environment Agency. COMAH Charge Proposals
7
Health and Safety Executive. A Guide to the Control of Major Accident Hazards Regulations 2015
8
Health and Safety Executive. COMAH Safety Reports
9
Legislation.gov.uk. The Control of Major Accident Hazards Regulations 2015 – Regulation 26