UK HSE & COMAH 2026: What Operators Should Build, Not Just Document

Quick Facts

• Regulation: Control of Major Accident Hazards Regulations 2015 (COMAH 2015), the UK transposition of Seveso III, retained post-Brexit.
• Regulator: Health and Safety Executive (HSE) jointly with the Environment Agency (England), SEPA (Scotland), NRW (Wales) and the Northern Ireland EA — together the Competent Authority (CA).
• Tiers: Lower-tier and upper-tier, mirrored on Annex I substance thresholds.
• 2026 inspection themes: ageing plant, mechanical integrity, MoC discipline, contractor control, and digital evidence of the Safety Management System (SMS).

What changed in HSE thinking

UK HSE's COMAH Strategic Forum has been clear since 2023: inspections move beyond paper to interrogating live systems. In 2026 you should expect inspectors to:

• Open your permit-to-work system and pull a random energised work permit.
• Open your MoC register and trace a recent change end-to-end into PHA revalidation, training and procedures.
• Pull your mechanical integrity plan and ask why an item is past due.
• Ask for your Tier 1 and Tier 2 process safety events per HSG254 / API 754.
• Ask how you have actioned lessons learned from recent UK and EU incidents.

If any of those answers requires a person to "go and check the spreadsheet", that is now a finding.

COMAH duties to systems map

ALARP, in practice, in 2026

ALARP (As Low As Reasonably Practicable) remains the UK's defining standard. The 2026 expectation is that you can show:

• Risk assessment is current — not the 2018 PHA refreshed by initials.
• Hierarchy of controls has been applied, not assumed.
• Cost-benefit analysis is documented for any control rejected on grounds of gross disproportion.
• Maintenance of safety-critical elements (SCEs) is on schedule, with deviations explicitly accepted by an accountable manager.

This is where digital MoC + PHA + barrier management software earns its keep. A spreadsheet cannot demonstrate ALARP under cross-examination.

Ageing plant — the dominant 2026 theme

The HSE's KP4 ageing programme has been pulling forward: many UK COMAH sites are 30–60 years old and inspectors increasingly ask:

• What is the age and remaining life of each safety-critical element?
• How is corrosion under insulation (CUI) managed across the site?
• Are inspection intervals risk-based or calendar-based?
• Are deferrals authorised at the right level, with a written ALARP justification?

Operators that have moved to a risk-based inspection (RBI) module integrated with EHS and CMMS handle these questions in minutes. Those still on calendar Excel spend weeks preparing for an intervention.

Building the COMAH dashboard your inspector wants to see

Make it boring and machine-fed:

1. Tier 1 and Tier 2 PSE counts, rolling 12 months.
2. MoC backlog by age and risk level.
3. PHA action backlog, with overdue items flagged.
4. Permit-to-work activity with anomalies (e.g., consecutive hot work in same area).
5. Maintenance compliance of safety-critical elements.
6. Training compliance for COMAH-critical roles.
7. Incident closure rate and recurring causes.
8. Audit findings by RBPS element.

This is the dashboard pattern UK operators are standardising on, and it is the single fastest way to demonstrate a working SMS.

Safety report revalidation in 2026

Reg. 8 requires the safety report to be reviewed at least every 5 years and after significant changes. Modern revalidations should:

• Refresh hazard inventory automatically from your chemical management module.
• Re-run consequence modelling with current weather and population data.
• Integrate natech scenarios — flooding, extreme heat, freeze events — given UK climate trends.
• Pull live SMS evidence rather than re-typing narrative.

If your last safety report was a Word document that took 9 months to write, your next one should be a structured deliverable that takes 9 weeks.

How COMAH connects to CSRD and TCFD for UK operators

UK groups in scope of the FCA's TCFD-aligned disclosure rules — and EU-listed parents under CSRD — increasingly need a single incident dataset that satisfies:

• COMAH Article 17 / Schedule 7 reporting (to CA).
• RIDDOR (to HSE).
• ESRS E2 disclosure on pollution incidents.
• TCFD physical risk narratives.

This is a strong argument for consolidating onto an EHS platform that exposes incident data to your sustainability team in real time. See our CSRD readiness checklist for the disclosure side.

Vendor shortlist for UK COMAH operators

Our editorial team's working shortlist for UK upper-tier and lower-tier operators (alphabetical):

• Cority — strong MoC + audit, common in UK chemicals.
• Enablon — deep PSM heritage.
• Ideagen — UK-headquartered, strong on document control and audit.
• Intelex — broad EHS coverage, audit-friendly.
• Sphera — operational risk and PHA depth.
• Tekmon — strong on field execution, permit-to-work and contractor control; growing UK footprint.

For a structured side-by-side, use our comparison engine. For a guided shortlist, run the Get Matched quiz.

A practical 90-day plan for UK COMAH duty holders

Days 0–30 — Diagnose

• List every system that holds COMAH evidence. Mark Excel and SharePoint in red.
• Pull the last 3 years of MoCs, incidents and PHA actions into one register.
• Score yourself against HSE's COMAH inspection criteria for the SMS.

Days 31–60 — Consolidate

• Move permit-to-work and MoC to digital if not already.
• Stand up a COMAH dashboard with the eight KPIs above.
• Integrate mechanical integrity with risk-based intervals.

Days 61–90 — Evidence

• Run a mock intervention with a former HSE inspector if possible.
• Pre-share your COMAH dashboard with your CA inspector at the next liaison meeting.
• Bake the dashboard into management review.

What to stop doing in 2026

• Stop printing permits. A digital permit with energy isolation logic is the modern minimum.
• Stop running MoC in email. It will not survive an intervention.
• Stop tracking PHA actions in PowerPoint. Use software that links action to study to scenario.
• Stop separating EHS and process safety. UK HSE expects an integrated SMS, not two silos.

Final word

COMAH compliance in 2026 rewards operators who have built systems that prove themselves. The HSE is not asking for more paper — it is asking for less paper and more operating evidence. The shortest path to that is consolidating MoC, PHA, PtW, incidents and contractor control on platforms that talk to each other, and making the resulting data visible through one COMAH dashboard.