UK COMAH 2026: What Operators Should Build, Not Just Record

Quick Facts

• Regulation: Control of Major Accident Hazards Regulations 2015 (COMAH 2015), in force since 1 June 2015, which implement the majority of the Seveso III Directive in Great Britain. Northern Ireland has its own COMAH Regulations (Northern Ireland) 2015.
• Regulator: in Great Britain, the Competent Authority (CA) is HSE (or the Office for Nuclear Regulation for nuclear establishments) acting jointly with the Environment Agency in England, Natural Resources Wales or the Scottish Environment Protection Agency (regulation 4).
• Tiers: Lower-tier and upper-tier, set by the substance thresholds in Schedule 1.
• CA delivery guides: the CA publishes the delivery guides its inspectors use, including major hazard leadership, human factors, KPIs, containment, emergency planning, flood preparedness and mechanical integrity.

What to be ready to show inspectors

HSE's instruction to its major hazards inspectors on key performance indicators, listed among the CA delivery guides, says that without KPIs, operators in major hazards sectors cannot demonstrate that their major hazard management system is effective (HID KPI delivery guide). The KPI guide does not list the items below; they are our suggested starting set, chosen because each one records a control on a major accident scenario. Be ready to show an inspector, from the systems you actually use:

• Your permit-to-work system, with a random energised work permit.
• Your MoC register, with a recent change traced end-to-end into PHA revalidation, training and procedures.
• Your mechanical integrity plan, with the reason any item is past due.
• Your Tier 1 and Tier 2 process safety events as defined in API RP 754, alongside the leading and lagging indicators described in HSE's HSG254.
• How you have actioned lessons learned from recent UK and EU incidents.

If any of those answers requires a person to "go and check the spreadsheet", fix that before the inspector asks.

COMAH duties to systems map

ALARP, in practice, in 2026

Regulation 5 requires every operator to take all measures necessary to prevent major accidents and limit their consequences for human health and the environment, and to demonstrate to the CA that it has done so. HSE's guidance on the Regulations (L111, paragraphs 79 to 91) says prevention should follow a hierarchy based on reducing risk to as low as reasonably practicable (ALARP): adopt relevant good practice as a minimum, then ask what more you can do to reduce the risks and explain why you have not done it. In practice, be able to show that:

• Risk assessment is current, not the 2018 PHA refreshed by initials.
• Hierarchy of controls has been applied, not assumed.
• The reasoning is documented for any control you rejected as not reasonably practicable.
• Maintenance of safety-critical elements (SCEs) is on schedule, with deviations explicitly accepted by an accountable manager.

Ageing plant and mechanical integrity

Schedule 2 requires the SMS to address the management and control of the risks associated with ageing equipment and its corrosion. The CA's Mechanical Integrity Delivery Guide, which replaced the Ageing Plant delivery guide it published in 2010, is used to assess how well an operator manages mechanical integrity and plant ageing, including ageing mechanisms such as corrosion, erosion, fatigue and obsolescence. Questions to be ready for:

• What is the age and remaining life of each safety-critical element?
• How is corrosion under insulation (CUI) managed across the site?
• Are inspection intervals risk-based or calendar-based?
• Are deferrals authorised at the right level, with a written ALARP justification?

Building the COMAH dashboard your inspector wants to see

Make it boring and machine-fed:

1. Tier 1 and Tier 2 PSE counts, rolling 12 months.
2. MoC backlog by age and risk level.
3. PHA action backlog, with overdue items flagged.
4. Permit-to-work activity with anomalies (e.g., consecutive hot work in same area).
5. Maintenance compliance of safety-critical elements.
6. Training compliance for COMAH-critical roles.
7. Incident closure rate and recurring causes.
8. Audit findings by element of the CCPS Risk Based Process Safety (RBPS) framework, if that is the structure your audits follow.

Safety report revalidation in 2026

Regulation 10 requires the operator to review the safety report, and revise it where necessary, no later than five years after it was last sent to the CA, and also after a major accident, when new facts or knowledge justify it, before modifications that could have significant consequences for major accident hazards, and after significant changes to the SMS. Modern revalidations should:

• Refresh hazard inventory automatically from your chemical management module.
• Re-run consequence modelling with current weather and population data.
• Integrate natech scenarios such as flooding, extreme heat and freeze events. Schedule 3 lists natural causes, for example earthquakes or floods, among the causes of major-accident scenarios, and the CA publishes a delivery guide on flood preparedness.
• Pull live SMS evidence rather than re-typing narrative.

How COMAH incident data connects to other reporting

The same incident records can feed several reports:

• Major accident reporting to the CA under regulation 26.
• Reports under RIDDOR 2013.
• ESRS E2 pollution disclosures, for groups reporting under the EU CSRD where pollution is material (the CSRD's scope was narrowed by Directive (EU) 2026/470, so check whether your group is still covered): from financial years beginning on or after 1 January 2027, disclosure requirement E2-4 of the revised ESRS covers material emissions of pollutants from own operations, including those due to environmental accidents (Delegated Regulation (EU) 2026/1563).
• Climate-related physical risk disclosures, where your group makes them.

Keeping these in one EHS platform that your sustainability team can also read means each report starts from the same record. See the CSRD readiness checklist in our ESRS implementation guide for the disclosure side.

Worked example: does this plant change trigger a safety report review?

The scenario is invented. An upper-tier operator proposes to add a second bulk storage vessel and raise the maximum inventory of one dangerous substance. Regulation 10 lists the situations in which the safety report must be reviewed and, where necessary, revised; the table maps the proposal to those triggers and to the records that show the answer.

Two further checks sit outside that table. The change may alter the substance quantities that decide the operator's tier under Schedule 1, and HSE's notification page says an operator must notify the competent authority a reasonable period before operation (usually three to four months) when modifications to the substance inventory move an establishment between lower and upper tier. In the system, the test is whether one MoC record shows the screening decision, the reviewers, the revised scenario in the safety report, the training and procedure changes, and the closure of the actions, without anyone reconstructing it from email. This is an illustration, not advice on any real plant; the competent authority decides what a safety report must contain.

Questions to put to a software vendor for a COMAH site

This site does not rank vendors, and the product records show what each vendor documents, not what it delivers on your plant. The same questions should go to every candidate:

1. Can a management of change record carry a mandatory major hazard screening step and link to the affected scenarios, procedures and training?
2. Can the product show the age and remaining life of safety-critical elements and the justification for a deferred inspection, or does it hold only a due date?
3. Does a permit link to the isolation and to any conflicting permit on the same plant?
4. Can recommendations from hazard studies be tracked to closure with an owner, a date and an approval for any extension?
5. Can an inspector be given read-only access to a defined set of records, and is that access logged?
6. Can the evidence behind a given safety report statement be exported with the dates of the underlying records?

For documented capabilities by product, see the process safety management software, management of change and asset integrity management pages, the bow-tie and barrier management page, and the capability map. The oil and gas and energy and utilities sector guides give the industry view of the same software categories. The glossary entries for PSM, management of change, bow-tie and permit to work explain the terms. For the EU parallel, see the Seveso III guide, and for the US process safety rules the OSHA recordkeeping and PSM update.

Evaluate the proposed COMAH evidence workflow

Use the process safety management, permit-to-work and incident management guides to identify documented scope. Ask each vendor to trace a live plant change through risk review, authorization, changed procedures and action closure; then retrieve the evidence used for the safety report.

Price the named applications, interfaces and implementation responsibilities. Use the linked comparison’s published inclusion rule and the same evidence checks for every qualifying product. Sponsored placements are additional and labelled; commercial status does not determine organic eligibility.

Correction, 27 September 2026: this section previously excluded commercial partners categorically. That is not the organic inclusion rule. The authored shortlist has been replaced with the same evaluation tasks for every candidate; the earlier unsupported footprint claim remains withdrawn.

A practical 90-day plan for UK COMAH duty holders

Days 0–30 — Diagnose

• List every system that holds COMAH evidence. Mark missing ownership, approval, revision and retrieval controls, regardless of which system holds the record.
• Pull the last 3 years of MoCs, incidents and PHA actions into one register.
• Score yourself against the CA's published MAPP and SMS assessment criteria from its safety report assessment manual.

Days 31–60 — Consolidate

• Move permit-to-work and MoC to digital if not already.
• Stand up a COMAH dashboard with the eight KPIs above.
• Integrate mechanical integrity with risk-based intervals.

Days 61–90 — Evidence

• Run a mock intervention with a former HSE inspector if possible.
• Pre-share your COMAH dashboard with your CA inspector at the next liaison meeting.
• Bake the dashboard into management review.

What to stop doing in 2026

• Consider retiring printed permits. A digital permit can carry energy isolation logic, if your risk assessment supports the change.
• Avoid running MoC in email. An email thread is hard to trace end-to-end.
• Avoid tracking PHA actions in slide decks. Use a record that links each action to the study and the scenario.
• Stop separating EHS and process safety records where the same incidents, actions and people appear in both.

Final word

COMAH compliance in 2026 rewards operators who have built systems that prove themselves. Regulation 5 requires operators to demonstrate to the CA that they have taken all measures necessary, and that demonstration rests on operating evidence more than on paper. This guide suggests consolidating MoC, PHA, PtW, incidents and contractor control on platforms that talk to each other, and making the resulting data visible through one COMAH dashboard.

Frequently asked questions

Does COMAH 2015 apply in Northern Ireland?

No. Northern Ireland has its own COMAH Regulations (Northern Ireland) 2015, linked in the quick facts. This article covers Great Britain.

How often must the safety report and the MAPP be reviewed?

Regulation 10 requires the safety report to be reviewed, and revised where necessary, no later than five years after it was last sent to the competent authority, and also on the other occasions listed above. Regulation 7 requires the major accident prevention policy to be reviewed no later than five years after it was last reviewed.

Is ALARP a software feature?

No. ALARP is a judgement about whether further risk reduction is reasonably practicable, as HSE's guidance on regulation 5 explains. Software can hold the reasoning, the controls considered and the decision, so that the judgement can be shown to the competent authority.

Sources

• legislation.gov.uk: Control of Major Accident Hazards Regulations 2015 (SI 2015/483), Control of Major Accident Hazards Regulations (Northern Ireland) 2015 and Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
• HSE: Introduction to COMAH and the COMAH Competent Authority and A guide to the COMAH Regulations 2015 (L111)
• COMAH Competent Authority: procedures and delivery guides, including the Mechanical Integrity Delivery Guide, the HID KPI delivery guide and the MAPP and SMS safety report assessment criteria
• HSE: Developing process safety indicators (HSG254)
• API: RP 754, Process Safety Performance Indicators, fourth edition (August 2026)
• EUR-Lex: Commission Delegated Regulation (EU) 2026/1563 amending the ESRS

Revised 4 October 2026: regulations 4, 5, 7, 10 and 26, Schedules 1 to 3, the in-force date and the HSE delivery guides were re-checked against legislation.gov.uk and hse.gov.uk (the Regulations show no outstanding amendments and HSE announces no 2026 change); the revised ESRS E2-4 citation was checked against Regulation (EU) 2026/1563. The text was changed where it read as fact but was our suggestion (the evidence list, the "stop doing" list) and the CSRD scope note was added. A worked example, vendor questions and an FAQ were added.

Corrected 23 September 2026: claims about named vendors that no source we could check supported were removed or reworded to match each product's researched profile.

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the regulations cited now link to their official texts.