Legionella risk assessment: what the law asks for, and what has to follow it

01

What a legionella risk assessment is, and the law behind it

Legionella bacteria can multiply in a building's water system where water sits between 20°C and 45°C, stagnates, or meets rust, sludge, scale and biofilm. People catch Legionnaires' disease, which HSE calls a potentially fatal form of pneumonia, by breathing in small droplets of contaminated water (aerosols) from a shower, a spray tap, a cooling tower or a spa pool. The risk assessment is the dutyholder's way of identifying and assessing whether those conditions exist, and of deciding how to manage the risk.

In Great Britain the duty comes from three pieces of law:

• the Health and Safety at Work etc. Act 1974, whose general duties extend to risks from legionella arising from work activities and premises;
• the Management of Health and Safety at Work Regulations 1999, regulation 3, which requires every employer to make a suitable and sufficient assessment of the risks to employees and to others affected by their work;
• the Control of Substances Hazardous to Health Regulations 2002, regulation 6 (COSHH), which forbids work liable to expose employees to a substance hazardous to health, a biological agent such as legionella included, until the risk has been assessed and the steps to control it put in place.

The Health and Safety Executive (HSE) explains how to meet those duties in the Approved Code of Practice, often called the L8 ACOP, L8, Legionnaires' disease: The control of legionella bacteria in water systems (fourth edition, 2013). Since that edition the risk assessment, the role of the responsible person, the written control scheme and the review of control measures all carry ACOP status. An ACOP has a special legal status: if you are prosecuted for a breach of health and safety law and it is proved that you did not follow its relevant provisions, you will need to show that you complied with the law in some other way. The technical detail sits in HSG274, Legionnaires' disease: Technical guidance, in three parts: evaporative cooling systems, hot and cold water systems, and other risk systems. Its second edition, published in 2024, revised Part 1 only.

L8 says the dutyholder is the employer, where the risk comes from their business; a self-employed person; or the person in control of premises or systems in connection with work, such as a landlord who lets a property but keeps responsibility for its maintenance. In L8's words, all systems require a risk assessment, however not all systems will require elaborate control measures.

In Northern Ireland, the Health and Safety Executive for Northern Ireland has approved L8 for use in Northern Ireland, alongside the Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003.

02

What a legionella risk assessment covers

The assessment looks at each water system as a whole: pipework, pumps, tanks, valves, showers, heat exchangers and softeners, and the dead legs and parts used only now and then, where growth can go unnoticed and then contaminate the rest. The person carrying it out should be able to say whether:

• water is stored or recirculated;
• the water temperature in all or part of the system may be between 20°C and 45°C;
• there are deposits, such as rust, sludge, scale, organic matter and biofilms, that support bacterial growth;
• water droplets can be produced and, if so, dispersed;
• employees, contractors, visitors or the public could be exposed to those droplets, and whether any of them are especially vulnerable through age, illness or a weakened immune system.

In practice that means a site survey of all the water systems. HSG274 Part 2 summarises what the finished assessment should include:

• clear allocation of management responsibilities;
• the competence and training of key personnel;
• a description of the water system, including an up-to-date schematic diagram;
• an evaluation of the risk;
• safe operating procedures for the water system, including the controls in place;
• monitoring, inspection and maintenance procedures;
• the results of monitoring, inspection and any checks already carried out;
• the limitations of the assessment, such as areas that could not be reached;
• arrangements to review the assessment regularly, and particularly when there is reason to suspect it is no longer valid.

Temperature is central to the survey, because temperature control is the traditional way of keeping legionella down. HSG274 Part 2 says cold water should be kept, where possible, below 20°C, and hot water stored at 60°C or more and distributed so that it reaches 50°C (55°C in healthcare premises) within one minute at the outlets; the assessor records whether the system achieves that.

The schematic is not a formal technical drawing: it is a simple, accurate sketch of the layout, including parts out of use, readable by someone new to the building.

03

Who can carry out a legionella risk assessment

The dutyholder must make sure the assessment is done, but need not do it personally. HSE's page on how to identify and assess sources of risk says you may carry it out yourself if competent, or get help from a competent person inside or outside your organisation: someone with sufficient training and experience or knowledge and other qualities to assist you properly.

No qualification or accreditation is required by law. L8 asks that whoever carries it out knows the potential sources of legionella and their risks, the measures to take, and how to keep those measures effective. In a simple building that may be someone on the premises team. With stored water, calorifiers, showers, a partly empty estate or care home residents, many dutyholders bring in a specialist assessor, and L8 expects them to make reasonable enquiries that the consultant is competent and properly equipped.

BS 8580-1:2019, Water quality. Risk assessments for Legionella control. Code of practice, is the British Standard for how to conduct legionella risk assessments, both for the first time and when a previous one is reviewed or audited. HSG274 points to it for further detail. It is a benchmark for method, not law.

Two other roles sit beside the assessor:

• The responsible person. L8 says the dutyholder should appoint a competent person or persons to take day-to-day responsibility for controlling any risk the assessment identifies, with sufficient authority, competence and knowledge of the installation. In a large building that is often the facilities or estates manager; a competent self-employed dutyholder may appoint themselves.
• Contractors. A water treatment or water hygiene contractor may carry out much of the work, but HSE says that before engaging one you should be satisfied they can do the work to the standard you require, and the responsibility for making sure it is done to that standard does not pass to the contractor.

In buildings with several occupiers, the extent of each party's duty depends on the agreement between them, such as a contract or tenancy agreement. HSG274 Part 2 gives the example of a managing agent responsible, by contract, for the water from the incoming mains to where it enters each tenant's space, with each tenant responsible from there. Where no contract says, the duty falls on whoever controls the premises or that part of them, and a managing agent's contract should say clearly who does what (see our guide to managing agent responsibilities).

04

How often a legionella risk assessment is reviewed

There is no fixed legal interval. HSE's guidance Legionella and landlords' responsibilities says in terms that the law does not prescribe that the risk assessment be reviewed on an annual or biennial basis; it is important to review it periodically in case anything changes. A review every two years, often quoted, is a choice and not a legal requirement.

What the law does require is review. COSHH regulation 6 says the assessment must be reviewed regularly and immediately if there is reason to suspect it is no longer valid, if there has been a significant change in the work, or if the results of monitoring show it is necessary. L8 calls the record of the assessment a living document and says an indication of when to review it, and what to consider, should be written down. Its list of reasons to review includes:

• changes to the water system or its use;
• changes to the use of the building in which the water system is installed;
• new information about risks or control measures;
• the results of checks showing the control measures are no longer effective;
• changes to key personnel, such as a new responsible person;
• a case of Legionnaires' disease or legionellosis associated with the system.

Set a review date when the assessment is written, as L8 asks, and bring it forward when a trigger occurs. The routine record shows the fourth trigger best: monthly temperatures drifting below target, or weekly flushing that has stopped, mean the controls are not working.

05

From the assessment to the written scheme and the records

Where the assessment finds a reasonably foreseeable risk that cannot be avoided, L8 says there should be a written scheme for controlling it, properly put into practice and managed. The scheme should include, where appropriate:

1. an up-to-date plan of the water system, including parts temporarily out of use (a schematic diagram is enough);
2. a description of the correct and safe operation of the system;
3. the precautions to take;
4. the checks to carry out to show the scheme is effective, and how often;
5. the remedial action to take if the scheme is shown not to be effective.

Point four is where the assessment becomes routine work: weekly flushing, monthly sentinel temperatures, quarterly descaling, annual tank inspections, covered in our guide to routine legionella checks. The assessment's own recommendations should have an owner, a priority and a date.

Under regulation 3(6) of the Management Regulations and COSHH regulation 6(4), an employer with five or more employees must record the significant findings; with fewer there is no statutory duty to write anything down, though L8 says a record may be useful. HSE's page on monitoring and keeping records lists what to keep:

• the person or people responsible for the risk assessment, and for managing and implementing the written scheme;
• the significant findings of the risk assessment;
• the written control scheme and details of its implementation;
• the state of operation of the water system, in use or not in use;
• the results of any monitoring, inspection, test or check carried out, and the dates.

Records are kept while current and for at least two years afterwards; results of monitoring, inspections, tests and checks, with their dates, for at least five years. L8 says all records should be signed, verified or authenticated by those who did the work.

A legionella test certificate is not part of this: HSE says health and safety law does not require landlords to obtain one. Laboratory sampling is not usually needed for a well-controlled hot and cold water system either, as HSE's page on testing and monitoring your water system explains.

06

Where the record fails, and what SiteClara does about it

The assessment itself is rarely where things go wrong. It is written by someone competent and goes into a folder. The failure comes afterwards: nobody owns the weekly flush of the disused changing room shower once the caretaker leaves; the monthly sentinel readings stop over the summer; a reading of 44°C is written down and never passed on. At review the assessor finds a log book with gaps, or one filled in neatly a page at a time, and cannot tell whether the controls were ever working.

SiteClara is aimed at that gap between the written scheme and the routine. The building puts a printed QR poster, with an NFC tag if staff prefer to tap, at the places the scheme names: the little-used outlets, the sentinel taps, the calorifier and the tank room. Staff scan with their own phone, with no app to install, and see the checks due at that spot. They mark each one done, or say what stopped them, with a photo when one is asked for, such as the thermometer in the stream. The time and the person are recorded as it happens.

A supervisor sees which checks are due, done and missed, and can record the reason for a miss. A fault found on a check, such as a tap that will not run hot, goes on the team's list of jobs until someone closes it. Each day the supervisor approves a report that goes to nominated management or client contacts the next morning. When the assessment is reviewed, that record shows the reviewer which controls were carried out, where, by whom and when.

07

Questions people ask

Is a legionella risk assessment a legal requirement?

Yes: in Great Britain every employer and every person in control of premises, landlords included, must identify and assess the risk of exposure to legionella in their water systems, as HSE's page on what you must do explains under the Health and Safety at Work etc. Act 1974, the Management Regulations 1999 and COSHH. Under regulation 6(4) of the Control of Substances Hazardous to Health Regulations 2002, an employer with five or more employees must also record the significant findings.

Can I do my own legionella risk assessment?

Yes, if you are competent: HSE's page on how to identify and assess sources of risk says you may carry it out yourself, or call on a competent person with sufficient training and experience or knowledge to help you. HSE's guidance on landlords' responsibilities adds that most landlords can assess the risk themselves and do not need to be professionally trained or accredited.

How often should a legionella risk assessment be completed in Scotland?

There is no fixed interval in Scotland or anywhere else in Great Britain: regulation 6(3) of the COSHH Regulations 2002, which extends to England, Wales and Scotland, says the assessment must be reviewed regularly and at once if there is reason to suspect it is no longer valid, the work has changed significantly or monitoring shows it is necessary. HSE's guidance on landlords' responsibilities says the law does not prescribe an annual or biennial review.

Can I perform a legionella risk assessment online, or from a free template?

A template can help set out the record, but not replace the visit: HSG274 Part 2, the technical guidance on hot and cold water systems, says the practical risk assessment should include a site survey of all the water systems. A form completed online without anyone looking at the tanks, heaters and outlets is unlikely to be suitable and sufficient for anything beyond the simplest building.

Is legionella testing mandatory in the UK?

No, not for a typical hot and cold water system: HSE's page on testing and monitoring your water system says microbiological monitoring is not usually required there, unless there is doubt about the control regime or the recommended temperatures or disinfection levels are not being consistently achieved. Open systems such as cooling towers, evaporative condensers and spa pools should be tested at least quarterly, and HSE's guidance Legionella and landlords' responsibilities says health and safety law does not require a legionella test certificate.

08

Further reading, and a list to take away

HSE publishes L8, all three parts of HSG274 and its pages on what you must do free on its website; BS 8580-1:2019 is available from BSI.

For the legionella risk assessment in your building, check that:

• every water system you control has a current assessment, by someone competent, including parts out of use;
• the boundaries are clear where a landlord, managing agent and tenants share a building;
• its recommendations have owners, priorities and dates;
• a written scheme sets out the checks, their frequency and what happens when one fails;
• a responsible person is named, and a review date is written down and brought forward after a change or a failed check;
• significant findings are recorded, and records of checks kept for at least five years.