Legionella Risk Assessments: Who Needs One and What to Check

Legionella is one of those areas where the paperwork feels like it could swallow you whole, but the underlying principles are straightforward once you know the framework. Whether you're a plumber maintaining commercial plant rooms, a heating engineer commissioning a new system, or a property manager responsible for a block of flats, understanding what the law actually requires — and what a proper risk assessment involves — will keep you right.

The Legal Duty: What ACOP L8 Actually Says

The Health and Safety at Work Act 1974 places a general duty of care on employers and those in control of premises. For water systems specifically, that duty is fleshed out by the Control of Substances Hazardous to Health Regulations 2002 (COSHH) and the associated Approved Code of Practice L8: Legionella — The Control of Legionella Bacteria in Water Systems. HSG274 provides the technical guidance that runs alongside L8.

The key point most people miss: the duty falls on the dutyholder — typically the employer, building owner, or person in control of premises. Landlords, facilities managers, and business owners cannot delegate that responsibility away by simply hiring a contractor. They can delegate the task, but the duty remains theirs. If you're advising clients, make sure they understand that distinction.

Who Is a Dutyholder?

Under L8, the following are considered dutyholders with a legal obligation to manage legionella risk:

• Employers with a water system on their premises
• Landlords of residential properties (including Houses in Multiple Occupation — HMOs)
• Managing agents acting on behalf of building owners
• Facilities managers responsible for commercial, industrial, or public buildings
• Responsible persons for holiday lets and short-term rental properties

Single-occupancy domestic properties let to private tenants sit in a grey area — there's no blanket legal requirement for a formal written risk assessment, but HSE guidance is clear that landlords should still consider the risk and take reasonable precautions. For any HMO or multi-occupancy building, a written assessment is expected.

What Systems Need to Be Assessed?

Not every water system carries the same level of risk. L8 identifies systems where water is stored, recirculated, or can reach temperatures that promote legionella growth (20–45°C) as the priority. The higher the risk of water becoming aerosol and being inhaled by people, the greater the scrutiny required.

High-Risk Systems

• Cooling towers and evaporative condensers (notifiable to the local authority)
• Hot and cold water services in commercial, industrial, and healthcare premises
• Spa pools, hydrotherapy pools, and whirlpool baths
• Humidifiers and air washers
• Dental unit waterlines
• Vehicle wash systems and decorative water features with spray

Lower-Risk Systems (But Still Requiring Consideration)

• Domestic hot and cold water systems in small residential properties (low-risk, but not zero-risk)
• Closed heating and chilled water circuits (risk is generally low provided system is sealed and inhibited)
• Water heaters with storage below 20°C or above 60°C throughout

The risk assessment process itself determines where each system sits. You cannot assume low risk without going through the assessment — that assumption is exactly the kind of shortcut that ends up in a coroner's report.

What a Legionella Risk Assessment Must Cover

A suitable and sufficient risk assessment isn't a tick-box exercise — it's a technical evaluation of whether the system is designed, operated, and maintained in a way that controls the risk. Here's what needs to be examined.

System Description and Schematic

Document what's there. Hot water cylinders, cold water storage tanks (CWSTs), calorifiers, pumps, water treatment equipment, and every outlet fed by the system. Photograph tanks, cylinders, and plant rooms. Record materials (copper, plastic, galvanised) — older galvanised steel tanks and pipework are particularly prone to harbouring legionella-supporting biofilm and sediment.

Temperature Survey

Temperature is the primary control. L8 sets clear benchmarks:

• Cold water: should be stored and distributed below 20°C
• Hot water: should be stored at 60°C and reach all outlets within one minute at 50°C or above
• Blended (TMV outlets): typically 41–43°C at the mixed outlet — acceptable provided hot supply remains above 50°C at the outlet before mixing

During the assessment, take and record temperatures at a representative sample of outlets — typically the first draw, then after 60 seconds of flushing. Document every reading with the date, time, and location. This becomes your baseline for future monitoring comparisons. A legionella risk assessment certificate should reference these readings directly.

Dead Legs and Infrequently Used Outlets

Any section of pipework that terminates without regular flow is a dead leg. Water sitting stagnant in a warm pipe is a textbook environment for legionella multiplication. Identify every dead leg — redundant connections, capped-off old outlets, mothballed plant — and either remove them or establish a flushing regime. The same applies to outlets used less than weekly: showers in spare rooms, taps in storage areas, emergency eyewash stations.

Cold Water Storage Tanks

Inspect the CWST for condition and cleanliness. Check for:

• Insect ingress or contamination (tanks must be covered and vermin-proof)
• Sediment, biofilm, or sludge at the base
• Ball valve operation and water turnover rate (stagnant water in oversized tanks is a red flag)
• Condition of internal surfaces — lining should be inert and intact
• Tank insulation (cold water must stay cold)

Tanks positioned in warm roof spaces, or oversized tanks with low turnover, require particular attention. A tank that's half-full and barely turning over in a 30°C loft void is a problem waiting to happen.

Calorifiers and Water Heaters

For calorifiers, check primary flow and return temperatures, thermostat settings, and — if accessible — the condition of internal surfaces. Scale and sediment inside a calorifier creates a habitat for legionella and reduces heat transfer efficiency. Record the last service date and any water treatment dosing. Pasteurisation records (if the system uses periodic heat disinfection) should be reviewed and retained.

Showers

Showers produce fine aerosols and are one of the most significant routes of legionella exposure for building occupants. During the assessment, note shower head condition (are they scaling up?), hose condition (rubber hoses are particularly prone to biofilm), and whether any showers are infrequently used. Water hygiene risk assessments often go into additional detail on shower head cleaning and descaling intervals.

Record-Keeping and Ongoing Monitoring

The risk assessment itself is not a one-off document. L8 requires that it be reviewed whenever there's reason to believe it may no longer be valid — after system changes, after a suspected case of legionellosis, after refurbishment, or simply at regular intervals (typically every two years for stable systems, annually for higher-risk premises).

The Written Scheme of Control

Once the assessment is complete, a written scheme of control must be produced. This sets out the specific control measures for the system — temperature monitoring frequencies, flushing regimes for little-used outlets, chemical dosing schedules for cooling towers, and cleaning intervals for tanks and shower heads. The scheme is the operational document; the risk assessment is the evidence base that justifies it.

Monitoring Logbooks

Keep a legionella logbook containing:

• Monthly temperature checks at sentinel outlets (the most remote/representative outlets on each circuit)
• Quarterly temperature checks across a wider sample
• Records of any remedial action taken when readings are out of range
• Cleaning and disinfection records for tanks, calorifiers, and cooling towers
• Flushing records for infrequently used outlets
• Contractor visit reports and any water microbiological testing results

These records must be retained for at least five years. If you're the responsible person managing a system and an enforcement officer asks to see your records, you need to be able to produce them. "We always do it, we just didn't write it down" will not satisfy HSE.

Competency: Who Can Carry Out an Assessment?

L8 requires that the person carrying out the risk assessment is competent — meaning they have sufficient knowledge, training, and experience to understand the risks and evaluate the control measures. There is no single mandatory qualification, but HSE expects assessors to be familiar with L8 and HSG274, understand water system design and legionella biology, and have practical experience of the systems they're assessing.

For most commercial and residential premises, this means using a specialist water hygiene contractor who can demonstrate relevant experience and training. If you're a plumber or heating engineer taking on legionella work yourself — which is entirely reasonable for smaller systems — invest in formal training (City and Guilds 6150, BPEC Water Hygiene, or equivalent) so your competency is demonstrable if challenged.

What you must not do is hand a landlord client a generic template assessment without actually surveying the system. A risk assessment has to be site-specific. A document that lists "hot water cylinder" without recording the actual storage temperature, the condition of the vessel, or the outlet survey results is not a suitable and sufficient assessment — and would not withstand HSE scrutiny.

When Something Goes Wrong

If a case of legionellosis is linked to a premises, HSE will investigate. They will ask for the risk assessment, the written scheme, and the monitoring records. If those don't exist or are inadequate, the dutyholder faces potential prosecution under the Health and Safety at Work Act — unlimited fines, and in serious cases, imprisonment. Beyond that, civil liability to the affected person or their family can be substantial.

The risk of prosecution is real. There have been multiple successful HSE prosecutions in the last decade against landlords, hotel operators, and facilities managers who failed to manage legionella risk adequately. The paperwork and monitoring feel like a burden until you understand what they're protecting against.

Get the assessment done properly, keep the records, review the scheme regularly, and the system essentially manages itself. Ignore it, and you're one outbreak away from a very difficult conversation with an enforcement officer.

Published February 2026. This article is for general guidance only and does not constitute legal or professional advice. Always refer to the relevant standards and consult qualified professionals for definitive requirements.