Why Do You Need a Legionella Risk Assessment?
Updated: Oct 9
Every hot and cold water system, cooling tower and storage tank in your building is quietly doing one of two things: staying safe, or becoming a breeding ground for a bacterium that can kill. There’s no visible warning sign for the difference. That’s precisely why the law doesn’t leave it to chance — and why a Legionella risk assessment is the starting point for every facilities manager, care home operator and landlord’s water compliance obligations.
IN BRIEF • It’s the law. A suitable and sufficient Legionella risk assessment is required under health and safety law, not just recommended. • The duty can’t be handed off. You can appoint a specialist to do the work, but responsibility stays with the duty holder. • It needs to stay current. Review it regularly and whenever your water system, building use or occupancy changes. • Skipping it is expensive. Recent UK fines run to hundreds of thousands of pounds — and insurers may refuse cover. |
It’s Not a Best Practice. It’s the Law.
Legionella control in the UK isn’t guided by a single, standalone regulation — it’s built into the core of health and safety law. The duty to assess and manage the risk comes from:
The Health and Safety at Work etc. Act 1974 (Sections 2, 3 and 4), which places a general duty on employers and those in control of premises to protect people from foreseeable harm
The Control of Substances Hazardous to Health Regulations 2002 (COSHH), Regulation 6, which specifically requires an assessment of health risks — including biological agents like Legionella
The Management of Health and Safety at Work Regulations 1999, Regulation 3, which requires a suitable and sufficient risk assessment of work activities
The Health and Safety Executive’s Approved Code of Practice L8, supported by the technical guidance in HSG274, sets out what ‘suitable and sufficient’ actually looks like in practice. ACOP L8 isn’t law in itself, but it carries real legal weight: follow it, and a court will treat you as having met your legal duty. Deviate from it, and you’ll need to prove — after the fact, often in front of a magistrate — that whatever you did instead achieved an equivalent standard. Few organisations want to make that case reactively.
Together, this framework requires four things of any premises where water is stored, used or recirculated in a way that could generate breathable droplets:
A documented risk assessment
A named competent person to hold day-to-day responsibility
A written scheme of control setting out how the risk is managed
Records proving the scheme is actually being followed
ACOP L8 requires the risk assessment to be reviewed regularly, and whenever there’s reason to believe it’s no longer valid — for example after changes to the water system, building use or occupancy. Most duty holders and insurers work to a review cycle of no more than two years as good practice.
Who Actually Carries This Responsibility
The law assigns responsibility to the duty holder — whoever has overall control of the premises or the water system within it. In practice, that means:
Facilities management companies
FM companies managing water systems on behalf of a client are frequently the ones expected to demonstrate day-to-day control, even where ultimate legal liability sits with the building owner. Contracts rarely make this distinction as clearly as they should.
Care homes and healthcare providers
Care providers carry a double obligation. Alongside HSWA, COSHH and ACOP L8, the CQC assesses water safety directly under Regulation 12 (Safe care and treatment) and Regulation 15 (Premises and equipment) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. Inspectors expect to see a current risk assessment, an active written scheme, monitoring records and staff training evidence — not as a formality, but because residents are disproportionately vulnerable. Age, immunosuppression and respiratory illness are all recognised risk factors for Legionnaires’ disease, which is precisely the population many care settings house.
Property managers and landlords
Landlords are duty holders the moment they let a property with a water system — a position set out in HSE guidance and reinforced by prosecutions involving rented and multi-occupancy accommodation. A vacant or intermittently occupied unit, ironically, is often higher risk: stagnant water is exactly the condition Legionella needs to establish itself.
Delegating the assessment to a specialist doesn’t transfer the legal duty.
It remains the duty holder’s responsibility to ensure the person doing the work is genuinely competent — and to be able to demonstrate that if asked.
What Happens When It’s Skipped
463 confirmed cases in England and Wales in 2024 |
63.9% of cases were in people aged 60 and over |
2.8% case fatality rate — roughly 1 in 35 |
Source: UK Health Security Agency, 2024. A further 57 cases were recorded in Scotland (Public Health Scotland).
For a disease that is almost entirely preventable through basic water system management, those are sobering numbers. The enforcement record makes the financial stakes just as clear:
Recent UK Legionella fines |
Amey Community Ltd — HMP Lincoln £600,000 plus costs A prisoner died of Legionnaires’ disease. The company failed to act on its own 2016 risk assessment, had no written scheme of control and wasn’t monitoring water temperatures. |
Large multi-site UK operator £1.8 million Council prosecution found erratic system monitoring, inadequately trained staff and no suitable risk assessments across its sites. |
UK housing provider £900,000 HSE investigation found residents had been put at risk through inadequate water safety management. |
UK manufacturer £800,000 Several employees and a member of the public contracted Legionnaires’ disease linked to poorly managed cooling towers. |
Is your risk assessment current and defensible? We can tell you in one visit.
These aren’t outlying figures, and UK insurers know it. Standard UK public liability policies generally treat Legionella as a gradual, foreseeable risk rather than a sudden one — which means most policies exclude it unless a specific Legionella liability extension has been added. Insurers granting that extension typically ask for evidence of a current risk assessment, a documented management plan and compliance with ACOP L8.
No assessment on file often means no cover — right at the point it would be needed most.
The reputational cost is harder to price but often longer-lasting. For care providers in particular, whose entire proposition rests on resident safety, a Legionella incident doesn’t stay contained to a single news cycle — it follows the organisation into every future inspection, every family’s decision about where to place a loved one, every contract renewal.
The Real Value: A Baseline You Can Build On
Strip away the legal language and the risk assessment answers a simple operational question: where, specifically, in this building is Legionella most likely to establish itself, and what needs to change?
It maps every outlet, tank and dead leg. It identifies temperature control failures, stagnation points and materials that support biofilm growth. It gives you a written scheme that turns ‘we think we’re compliant’ into ‘here’s the evidence’.
That’s why a proper assessment isn’t the end of the compliance conversation — it’s the foundation of it. Everything that follows — routine monitoring, water sampling, TMV servicing, descaling, remediation — is only as good as the risk map it’s built on. Get the baseline wrong, and every subsequent control measure is solving the wrong problem.
Where This Leaves You
If your last risk assessment predates a change to your water system or building use, or it hasn’t been reviewed in the last two years, it’s unlikely to stand up as ‘suitable and sufficient’ if an inspector, insurer or court asks to see it. Given the scale of the fines being issued and the vulnerability of the people most affected, that’s not a gap worth carrying for administrative convenience.
A Legionella risk assessment isn’t paperwork for its own sake. It’s the single document that tells you, with evidence, whether the water running through your building is safe — and it’s the starting point for managing that risk properly, rather than discovering it the hard way.
Need a risk assessment, or a second opinion on yours? H2Flow Water Hygiene Solutions provides Legionella risk assessments as the diagnostic first step in a complete water hygiene programme — from assessment through to monitoring, sampling, TMV servicing and remediation, delivered by one integrated partner. |
Frequently Asked Questions
Is a Legionella risk assessment a legal requirement?
Yes. The Health and Safety at Work etc. Act 1974, COSHH Regulation 6 and the Management of Health and Safety at Work Regulations 1999 together require duty holders to assess and control the risk from Legionella. HSE’s ACOP L8 sets out how to do it.
Who is responsible for Legionella compliance?
The duty holder — whoever has control of the premises or the water system. That’s usually the employer, building owner or landlord. You can appoint a competent specialist to carry out the assessment, but the legal duty stays with you.
How often should a Legionella risk assessment be reviewed?
ACOP L8 requires a review regularly and whenever there’s reason to think the assessment is no longer valid — for example after changes to the water system, building use or occupancy. Many organisations and insurers expect a review at least every two years as good practice.
Do landlords need a Legionella risk assessment?
Yes. Landlords of residential and commercial property are duty holders. The law doesn’t require the assessment to be done by a specialist, but whoever carries it out must be competent — and for larger portfolios a professional assessment gives you a consistent, defensible record across every property.
Sources
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014
UKHSA — Legionellosis in residents of England and Wales: 2024
Public Health Scotland — Legionnaires’ disease surveillance report 2024
HSE — Company failed to manage legionella risk as prisoner dies (Amey, 2024)
Chartered Insurance Institute — Legionella coverage in the UK public liability insurance market
Comments