A legionella assessment examines water systems, exposure risks and necessary controls. In Great Britain, employers and relevant landlords have duties under health and safety law, supported by HSE’s Approved Code of Practice L 8. Northern Ireland has separate corresponding legislation. The assessment should be proportionate to the system and people at risk.

The duty isn’t new. It sits under the Control of Substances Hazardous to Health Regulations 2002, regulation 6, supported by sections 2, 3 and 4 of the Health and Safety at Work etc. Act 1974 and by regulation 3 of the Management of Health and Safety at Work Regulations 1999. ACOP L8 — the fourth edition — translates those general duties into specific operational expectations for water systems.

This page covers what the law requires, how an assessment is carried out, what good control measures look like, and the specific position for residential landlords.

What legionella is and why it matters

Legionella is a family of bacteria that occurs naturally in fresh water at low concentrations. It becomes a health risk when it multiplies in artificial water systems — hot and cold water systems in buildings, cooling towers, spa pools, evaporative condensers — and is then breathed in as fine water droplets. Inhalation of contaminated aerosol can cause legionnaires’ disease, a serious form of pneumonia, particularly in older people, immunocompromised people and people with underlying lung conditions.

Legionella can multiply in water between about 20°C and 45°C. Temperature control, prevention of stagnation and suitable system maintenance help control risk. Killing bacteria depends on both temperature and exposure time; a single hot reading does not establish that a whole system is controlled.

The duty is to prevent exposure where reasonably practicable or otherwise adequately control it. A risk assessment determines whether further measures are needed; not every small water system requires an extensive control scheme.

Three pieces of legislation interact.

The legislation

The Health and Safety at Work etc. Act establishes duties to employees and others affected by an undertaking. HSE explains that landlords’ responsibilities to tenants arise under section 3, supported by COSHH; they do not depend only on classifying a rented dwelling as non-domestic premises under section 4.

The Management of Health and Safety at Work Regulations 1999 require a suitable and sufficient risk assessment of all foreseeable risks. Legionella is a foreseeable risk in any building with a water system.

The Control of Substances Hazardous to Health Regulations 2002 (COSHH) explicitly cover legionella as a biological agent. Regulation 6 — the COSHH risk assessment duty — requires a specific assessment of the risk from exposure to legionella. We cover the COSHH framework more generally on our COSHH risk assessment page.

Codes, guidance, and standards

ACOP L8 — Legionnaires’ disease: The control of legionella bacteria in water systems — is the HSE’s Approved Code of Practice for the area. ACOP L8 has a special legal status under section 17 of the Health and Safety at Work Act: it isn’t itself legislation, but if a duty-holder is prosecuted for a breach and hasn’t followed ACOP L8, the court will treat that as evidence of failure to comply unless the duty-holder can show they met the duty in an equally effective way.

HSG274 — the Legionnaires’ disease technical guidance — sits alongside ACOP L8 in three parts. Part 1 covers evaporative cooling systems; Part 2 covers hot and cold water systems (the part most premises need); Part 3 covers other risk systems including spa pools and humidifiers. Most legionella risk assessments work from HSG274 Part 2.

Healthcare water systems also need the relevant national healthcare guidance, including HTM 04-01 for England. BS 8580-1 provides recommendations for legionella risk assessment of water systems; its scope is not limited to ordinary domestic hot and cold supplies.

Who must carry out the assessment

The legal duty falls on the duty-holder, which depends on the type of premises and the type of water system involved.

In a workplace, the duty-holder is usually the employer. In a non-domestic building, the duty-holder is whoever has control of the premises — typically the owner, landlord, managing agent or facilities manager. In a multi-let commercial building, the freeholder is usually the duty-holder for the building-wide water systems and the individual tenants for any systems within their own demise.

For residential rented property, the landlord is the duty-holder regardless of whether the property is a single house, a flat, an HMO or sheltered housing. We come to the residential landlord position in detail below.

The duty-holder appoints a “responsible person” — someone with sufficient authority, competence and knowledge of the water systems to take operational responsibility for the assessment and the controls. The responsible person may be an employee or an external specialist. Where the systems are complex, the responsible person almost always needs to engage technical specialists, often members of the Legionella Control Association.

The assessment in practice

The legionella risk assessment follows the same general structure as any other UK risk assessment — the five-step method — applied to water systems specifically.

Step one — identify the hazards

Map the water systems in the building. Where is water stored? Where is it heated? Where does it flow, and at what temperatures? Are there cold-water storage tanks? Calorifiers (hot water cylinders)? Showers and aerosol-producing outlets? Dead legs (lengths of pipework where water doesn’t move)? Infrequently used outlets? Spray taps, drinking fountains, decorative fountains, humidifiers? Each of these is a potential point where legionella could grow or disperse.

Step two — decide who might be harmed

Tenants, employees, residents, visitors, contractors. Particular attention is needed for vulnerable groups: older people, immunocompromised people, smokers, people with underlying respiratory conditions. Care home residents, hospital patients and people receiving treatment that suppresses the immune system are at materially higher risk.

Step three — evaluate and decide controls

The level of detail should reflect the risks. Small, straightforward domestic systems with regular use can often be assessed briefly, while complex systems or vulnerable occupants may need specialist assessment. Frequent tenant turnover is not itself a protective control.

Step four — record the findings and put a written scheme in place

ACOP L8 specifically requires a written scheme of control where significant risks are identified. The written scheme is the operational document that records what’s being done, by whom, how often, and with what records. It’s distinct from the assessment itself: the assessment identifies the risk, the scheme operationalises the controls.

Step five — review

When systems change, when occupants change, after any incident, after any inspection that highlights a concern, and at intervals proportionate to the risk. There is no fixed legal review period — despite what some online guides say.

Control measures: the technical core

Vertical temperature scale showing legionella growth range and safe storage temperatures

For hot and cold water systems, the basic control principle is straightforward. Keep hot water hot, cold water cold, and keep the water moving.

Where temperature is the control method, store hot water at 60°C or above and distribute it so that it reaches at least 50°C within one minute at appropriate outlets, or 55°C in healthcare premises. Check the hot supply before any mixing valve where relevant. Also assess scalding: suitably located and maintained TMVs can protect vulnerable users without lowering storage temperatures.

Cold water should be kept below 20 degrees. Cold water storage tanks should be insulated and away from heat sources; in older buildings tanks in the loft are vulnerable in summer.

Avoid stagnation, remove redundant pipework and flush infrequently used outlets at least weekly or as required by the control scheme. Flush safely without creating unnecessary aerosol exposure. Vacant properties need a suitable flushing or other management regime before reoccupation.

Aerosol-producing outlets are the dispersal route. Showers, spray taps, hose-pipe sprays, cooling tower drift, humidifiers. These need particular attention because they’re how contaminated water actually enters the lungs.

Keep systems, showerheads and hoses clean. HSE recommends dismantling, cleaning and descaling showerheads quarterly or according to the risk assessment; healthcare and care settings require particular attention to vulnerable occupants.

Thermostatic mixing valves reduce scalding risk by blending water near the point of use. Their location, commissioning and maintenance must be assessed because mixed water can support bacterial growth. Set safe outlet temperatures for the users and activity; there is no single universal 38–43°C setting for every outlet.

The landlord position

Decision tree helping landlords identify low-risk vs professional legionella assessment

Residential landlords are subject to the same duty as commercial duty-holders but the HSE has been specific that the application is proportionate. Most domestic rental properties contain small, simple water systems — a mains-fed cold supply, a combi boiler or small cylinder, a few outlets — with regular daily use that turns the water over rapidly. The HSE has explicitly confirmed that a landlord’s assessment of these systems doesn’t need to be in-depth or detailed, and that for most domestic rentals the risk is generally low.

The landlord must assess the risk and implement proportionate controls. A written record is useful even where the general fewer-than-five-employees recording exemption applies. For a typical low-risk property, consider:

  • A proportionate assessment identifying the system, relevant risks and controls; keeping a dated record helps future review.
  • Simple controls: keep the hot water cylinder set to 60 degrees, flush the system before each new tenancy, remind tenants in writing to flush outlets after the property has been vacant.
  • Action on storage tanks, redundant pipework, infrequently used outlets or vulnerable occupants where these increase risk. Instantaneous heaters generally reduce risk because they do not store large volumes of warm water.
  • A review if the system changes, if the property is vacant for an extended period, or if the tenant changes.

A landlord can carry out the assessment themselves for a typical property — there’s no legal requirement to engage a contractor. Where the property has cold water storage, complex pipework, multiple occupancy (HMOs), or vulnerable tenants, professional assessment becomes more appropriate.

A letting agent may specify additional contractual requirements. These should be distinguished from the legal duty: there is no universal requirement for a landlord to buy a professional “legionella certificate”.

There’s a recurring myth that landlords need to “test the water” or pay for laboratory analysis. The HSE has never required this for typical domestic rentals. The assessment is the legal requirement; sampling is occasionally appropriate where the assessment identifies a specific concern, but it’s not a default.

Records and review

The records expected for a legionella risk assessment include:

The assessment itself, with hazards identified, controls in place and any further action needed. The written scheme of control where the risk is significant — typically commercial premises, healthcare, hotels, residential blocks with shared water systems. Temperature monitoring records where temperature monitoring is part of the scheme. Maintenance and cleaning records for tanks, calorifiers, showerheads. Records of any sampling carried out.

There is no fixed legal review period. ACOP L8 requires review when there is reason to suspect the assessment is no longer valid or when the system has changed. Many online guides cite “every two years” as a review period — this is a convention adopted by some industry providers, not a legal requirement, and we cover the actual review duty on our how often should a risk assessment be reviewed page.

Inspection, temperature checks, cleaning and sampling follow the system-specific control scheme and relevant HSG 274 guidance. Do not apply one generic calendar to every system: cooling towers, healthcare supplies and small domestic systems have different requirements.

Who can carry out the assessment

The competence requirement is the same as elsewhere in UK health and safety: skills, knowledge, experience and training appropriate to the complexity of the systems being assessed.

The assessor needs competence appropriate to the system. A landlord may assess a simple low-risk system personally; complex systems may need specialist help. LCA registration and relevant training can support selection but are not statutory qualifications or automatic proof of suitability.

Engaging a specialist doesn’t transfer legal responsibility from the duty-holder. The duty-holder is expected to take reasonable steps to verify the assessor’s competence — checking professional registration, qualifications, indemnity insurance and references. We discuss this in more detail on our page on who can carry out a risk assessment.

For organisations who want to develop in-house competence — particularly housing providers, facilities managers and managing agents with portfolios of property — formal Risk Assessment Training provides the methodological foundation, with legionella-specific training layered on top.

Frequently asked questions

Is a legionella risk assessment legally required for landlords?

In Great Britain, relevant residential landlords must assess and control risks from legionella under health and safety law. A simple low-risk domestic system may need only straightforward proportionate action. Northern Ireland has separate corresponding requirements.

How often does a legionella risk assessment need to be reviewed?

There is no fixed legal review period. ACOP L8 requires review when there is reason to suspect the assessment is no longer valid or when the water system has changed. Some industry sources cite “every two years” but this is convention, not law. Higher-risk systems warrant more frequent review.

Can landlords carry out their own legionella risk assessments?

For typical domestic rentals, yes. The HSE explicitly allows landlords to carry out their own assessments where the system is simple and the risk is low. For HMOs, properties with cold water storage tanks, sheltered accommodation, or buildings with vulnerable tenants, professional assessment becomes more appropriate.

What temperatures should water be kept at to control legionella?

Where temperature control is used, store hot water at 60°C or above, distribute it to reach at least 50°C within one minute at appropriate outlets, or 55°C in healthcare, and keep cold water below 20°C. Assess scalding separately and use suitable mixing controls near outlets where needed; measure the hot supply before mixing where appropriate.

Is ACOP L8 the law?

No. ACOP L8 is an Approved Code of Practice with special legal status under the Health and Safety at Work etc. Act 1974. Failure to follow it can be used as evidence of failure to comply with the underlying duty, but a duty-holder can comply with the law in an equally effective way without following ACOP L8 to the letter.

Sources & references

Make sure your team is competent to identify hazards and control risks at work.

Explore the Risk Assessment Training course →
Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about workplace health & safety, risk assessment and accredited online training for Risk Assessment Training, part of Online CPD Academy.