COMAH Regulations Explained: Duties, Tiers & Enforcement

TL;DR

• Does COMAH apply to your site? If you hold listed dangerous substances above Schedule 1 thresholds, yes — and aggregation can pull you in even when no single substance exceeds its own limit.
• What are the two tiers? Lower tier and upper tier, set by inventory thresholds; upper tier carries the heavier duties, including the safety report.
• Who enforces it? A joint “competent authority” — HSE (or ONR) plus the relevant environmental regulator for each GB nation.

COMAH stands for the Control of Major Accident Hazards Regulations 2015 — the legal regime across Great Britain for preventing major accidents involving dangerous substances and limiting their effects on people and the environment. It implements the EU Seveso III Directive and is enforced jointly by HSE and the relevant environmental regulator.

Around 950 establishments across Great Britain operate under the COMAH regulations (HSE / COMAH Competent Authority, figure in circulation 2024–2026). Each one is a place where a single failure can injure many people at once and contaminate land or water for years.

These are not ordinary workplaces, and COMAH is not ordinary health and safety law. This article explains what COMAH is, why it exists, whether it applies to your site, the operator duties it imposes, who enforces it, how the rules differ across the UK and EU, and what happens when an operator falls short.

What Is COMAH? The Control of Major Accident Hazards Regulations Explained

COMAH is the Control of Major Accident Hazards Regulations 2015 — a Great Britain regime built to prevent major accidents involving dangerous substances and to limit their consequences for people and the environment. It came into force on 1 June 2015, replacing COMAH 1999.

The regime exists to manage a specific class of risk: the rare but catastrophic event. Think bulk fuel fires, toxic gas releases, runaway chemical reactions — not slips, trips, or manual handling.

Two features set the COMAH regulations apart from general workplace law:

• Environment carries equal weight. Harm to groundwater, watercourses, and soil is treated as seriously as harm to people. That is why the regulator includes an environmental authority, not just a safety body.
• It implements Seveso III. COMAH gives effect in GB to the EU Seveso III Directive (2012/18/EU), except for land-use planning, which sits under separate planning legislation.

A common misconception is that COMAH is just another “health and safety” rule. In practice it is a major-accident and process-safety regime, distinct from day-to-day occupational safety. Sites under-resource it precisely because the events it targets are infrequent — which is exactly the wrong instinct when the downside is measured in lives and decades of contamination.

Why COMAH Exists: From Flixborough and Seveso to Buncefield

Every tightening of this regime followed a named disaster — the law is written in the language of lessons learned the hard way. The lineage matters because it explains the regime’s logic.

1. Flixborough, England (1974). A cyclohexane vapour cloud explosion at a chemical plant killed 28 and reshaped UK thinking on major-hazard control, leading toward the CIMAH Regulations 1984.
2. Seveso, Italy (1976). A dioxin release contaminated a wide area and triggered the original EEC “Seveso” Directive — the parent of today’s framework.
3. Seveso II and Seveso III. The directive was strengthened over decades, culminating in Seveso III (2012/18/EU), with tougher public-information and inspection standards.
4. The GB chain. CIMAH 1984 → COMAH 1999 → COMAH 2015, each revision aligning domestic law to the evolving European instrument.

Then came Buncefield. On 11 December 2005 a fuel storage tank at the Hemel Hempstead depot overfilled, releasing a large vapour cloud that ignited into a massive explosion and fire.

The casualty figures were striking for an event of that scale: more than 40 people injured and no fatalities (HSE, 2005). The financial picture was the reverse — estimated costs exceeded £1 billion (IOSH Magazine citing the Environment Agency, 2026), making it the most costly industrial accident in UK history, with serious groundwater contamination from firewater run-off.

The pattern across these incidents is not exotic. It is mundane management-of-change and instrumentation failure — at Buncefield, a level gauge that stuck — escalating because layered safeguards were trusted without verification. That is the lesson dutyholders most often under-weight, and it is the reason HSE’s Buncefield investigation drove tighter standards on overfill protection and secondary and tertiary containment.

Does COMAH Apply to Your Site? Dangerous Substances and the Two Thresholds

COMAH applies when threshold quantities of named dangerous substances or hazard categories are present at an establishment. Regulation 3 and Schedule 1 set the trigger, with classification anchored to the GB CLP Regulation.

There are two thresholds, which create the two tiers — and a catch most operators miss. Aggregation rules mean several substances, each below its own limit, can combine to bring a site into scope or push it up a tier.

So “does COMAH apply to my site?” is rarely a one-off answer. It is a live duty tied to what is actually held at any given moment.

Typical sectors in scope include:

• Chemical manufacturing — reactive intermediates, toxic and flammable bulk stocks.
• Fuel, oil, gas, LPG and LNG storage and distribution — large flammable inventories of the Buncefield type.
• Explosives — manufacture and bulk storage.
• Some warehousing and distribution — where aggregated dangerous goods cross thresholds.
• Distilling and alcohol maturation — large flammable-liquid holdings.
• Emerging questions — large battery energy storage and bulk electrolyte inventories are an active scope discussion.

A frequent failure mode is treating COMAH status as static. A new product line, an inventory change, or a reclassification under CLP can silently move a site over a threshold without anyone re-running the calculation.

One important caution: substance-specific tonnages must come from the legislation, not a blog. For the authoritative figures and the aggregation method, work directly from Schedule 1 of COMAH 2015 and L111: A guide to the COMAH Regulations 2015.

Upper Tier vs Lower Tier COMAH: What Changes

The practical consequence of tier is the weight of obligation. The difference between upper tier and lower tier COMAH comes down mainly to two heavy additions for upper-tier sites: a formal safety report and a written internal emergency plan.

Duty	Lower tier	Upper tier
Notify the competent authority	Yes	Yes
Major Accident Prevention Policy (MAPP)	Yes	Yes
Safety report	No	Yes
Internal emergency plan	No	Yes
Information for external emergency plan	No	Yes
Public information	Yes (extended under COMAH 2015)	Yes (enhanced)

That table is the bridge into the duties themselves.

COMAH Operator Duties Explained

The headline duty applies to every operator: take all measures necessary to prevent major accidents and limit their consequences. This is Regulation 4, and the duties scale from there with tier.

Across all tiers, three obligations apply:

• General duty (Regulation 4). Take all measures necessary for prevention and mitigation — applying ALARP for human risk and best available technology (BAT) for environmental risk.
• Notification (Regulation 6). Notify basic establishment details to the competent authority.
• Public information (Regulations 17–18). Provide information to the public, a duty COMAH 2015 extended to lower-tier sites.

Here is where interpretation matters. “All measures necessary” is routinely misread as “all reasonably practicable measures.” COMAH deliberately sets a higher bar where hazards are high, and the proportionality language does not license cost-based corner-cutting on major-accident controls. For the full breakdown, the authoritative source is the main duties under COMAH 2015 (HSE).

Lower Tier Duties: The Major Accident Prevention Policy (MAPP)

The defining lower-tier duty is the major accident prevention policy (MAPP) under Regulation 7. It is a written policy supported by a safety management system covering the Schedule 2 elements:

• Organisation and personnel — roles, responsibilities, competence, and training for major-hazard control.
• Hazard identification and evaluation — systematic assessment of major-accident scenarios.
• Operational control — safe procedures for plant, processes, and equipment.
• Management of change — controlling modifications before they erode safety margins.
• Planning for emergencies — foreseeing and preparing for credible incidents.
• Monitoring, audit and review — checking the system actually works, then correcting it.

Upper Tier Duties: Safety Report, Emergency Plans and Public Information

Upper-tier operators carry the heaviest load. These duties exist because the inventories involved can produce off-site consequences, so the regulator demands documented proof rather than assurance.

1. Prepare a COMAH safety report (Regulations 8–9, Schedule 3 content). It must demonstrate — not merely assert — that all measures necessary are in place.
2. Review the safety report. At least every five years, and whenever there is a material change to the plant or process.
3. Produce an internal emergency plan (Schedule 4). A worked plan for responding to a major accident on site.
4. Supply information for the external emergency plan (Regulation 13). Give the local authority what it needs to plan the off-site response.
5. Provide enhanced public information (Regulation 17(2)). More detailed public-facing information than lower-tier sites.

Safety reports commonly degrade into compliance documents that no longer match the plant. A report that is not revised when the plant changes is the documented form of the exact gap that caused Buncefield — the management-of-change link is not a technicality.

Who Enforces COMAH? The Competent Authority

A persistent misunderstanding is that HSE enforces COMAH on its own. It does not — enforcement runs through a joint “competent authority” that pairs a safety regulator with an environmental one.

The make-up varies by GB nation:

• The safety side — HSE for most establishments, or the Office for Nuclear Regulation (ONR) for nuclear sites.
• England — HSE/ONR working with the Environment Agency (EA).
• Scotland — HSE/ONR working with the Scottish Environment Protection Agency (SEPA).
• Wales — HSE/ONR working with Natural Resources Wales (NRW).

The competent authority’s powers are substantial:

• Inspection programmes — planned interventions based on the site’s hazard profile.
• Safety report examination — formal assessment of upper-tier reports.
• Power to prohibit operation — where prevention or mitigation measures are seriously deficient.
• Cost recovery — the authority recovers its COMAH costs from operators on an actuals basis.

The dual environmental-plus-safety model is the practical reason containment carries equal weight to ignition control. Bunding and firewater management matter as much to a COMAH inspector as flame detection — a point single-discipline safety teams often underestimate.

COMAH Across the UK and EU: Jurisdiction Matters

COMAH 2015 covers Great Britain only — England, Scotland and Wales. It is not a UK-wide instrument, and assuming otherwise is one of the most common errors in commentary on the regime.

Northern Ireland runs a separate but equivalent regime administered by HSENI. The EU applies Seveso III directly, and the Republic of Ireland has its own implementing regulations.

Jurisdiction	Instrument	Enforcing body	Key difference
Great Britain	COMAH Regulations 2015	HSE/ONR + EA/SEPA/NRW	Retained domestic regime
Northern Ireland	Separate equivalent regime	HSENI + NIEA	Administered outside GB
European Union	Seveso III Directive (2012/18/EU)	National competent authorities	Directly applied across members
Republic of Ireland	S.I. 209 of 2015	HSA + EPA	National Seveso III transposition

The post-Brexit position is the part most worth pinning down:

• COMAH is retained in GB. It remains fully in force.
• No automatic Seveso alignment. GB is no longer bound to adopt future amendments to the Seveso III Directive.
• EU-notification duty revoked. The obligation to notify major accidents to the European Commission (Schedule 5) was removed on EU exit.

For a multi-site operator with locations in both GB and Northern Ireland — or in the EU and Ireland — the trap is assuming one compliance approach covers everything. Divergence here is now structural, not theoretical, and a 2025 Post-Implementation Review of COMAH 2015 (legislation.gov.uk impact assessment, 2025) confirmed the retained status while signalling possible simplification — including a clearer “major accident” definition and a review of the safety-report process.

What Happens If You Don’t Comply?

Enforcement under COMAH rarely follows a single dramatic failure. More often it follows an accumulation of unaddressed minor deficiencies that an inspection surfaces — the regulatory equivalent of the latent-condition pattern that precedes most major accidents.

The competent authority’s response typically escalates:

1. Inspection findings and improvement notices — requiring specific shortcomings to be fixed within a set period.
2. Prohibition notices — stopping an activity, or the whole operation, where measures are seriously deficient.
3. Prosecution — for serious or persistent breaches, leading to fines and, in the gravest cases, custodial sentences for individuals.
4. Operational and reputational fallout — loss of permit confidence, insurance consequences, and damaged stakeholder trust.

Legal disclaimer. This article reflects a general HSE professional understanding of Great Britain’s COMAH requirements as of the last-reviewed date above. It is not legal advice. Specific compliance questions, enforcement situations, or prosecution risk should be directed to qualified legal counsel in the applicable jurisdiction. COMAH sits within the framework of the Health and Safety at Work etc. Act 1974, and regulatory content here was reviewed against COMAH 2015 as in force on the last-reviewed date.

The point the competent authority keeps returning to is this: compliance is demonstrated, not assumed. What gets assessed is whether the operator can show, with current evidence, that the necessary measures are genuinely in place.

Frequently Asked Questions

Where COMAH Is Heading

The regime is settling into a post-EU-exit shape rather than standing still. The 2025 Post-Implementation Review confirmed COMAH’s retained status while opening the door to simplification — a clearer definition of “major accident” and a review of how safety reports are produced and assessed.

At the same time, the Buncefield 20-year retrospectives circulating through 2025–26 (IOSH Magazine, 2026) are pulling attention back to the failure modes that never really went away: management-of-change drift, instrumentation reliability, and the integrity of secondary and tertiary containment. The COMAH regulations have always been written after the event; the value for operators is in acting before it.

For anyone assessing whether and how COMAH applies, the honest takeaway is that scope and compliance are live, not fixed. Treat the safety report, the MAPP and the emergency plans as documents that must keep pace with the plant — because the gap between paper and reality is exactly where the next major accident waits.