Guide
Manage legionella risk in water systems
How to identify and control legionella risk in workplace water systems. Covers your duties under ACOP L8, appointing a competent person, written control schemes, temperature monitoring, and cooling tower registration.
When this applies to you
If you are an employer, a landlord, or someone with responsibility for maintaining a building's water systems, you have a legal duty to assess and control legionella risk. This applies to all premises with water systems, not just those with cooling towers or large installations.
Legionella bacteria can grow in any water system where conditions are right: water temperatures between 20 and 45 degrees Celsius, stagnation, sediment, and biofilm. When contaminated water droplets are inhaled, they can cause Legionnaires' disease - a potentially fatal form of pneumonia - or the less serious Pontiac fever.
Many employers wrongly assume legionella risk management only applies to large commercial buildings. In fact, any workplace with hot and cold water systems, showers, cooling towers, spa pools, or even decorative fountains must have a legionella risk assessment in place.
Your legal duties
Your duties come from three sources: the Health and Safety at Work etc. Act 1974 (general duty to protect health), the Control of Substances Hazardous to Health Regulations 2002 (COSHH), and the HSE Approved Code of Practice L8 (4th edition). ACOP L8 has special legal status: if you follow it, you are presumed to be complying with the law. If you do not follow it, you must demonstrate that your alternative approach provides an equivalent level of protection.
How to manage legionella risk
Follow these steps to meet your legal duties. You can carry out simple assessments yourself if you are competent, but most employers will need specialist help for anything beyond a straightforward system.
-
1. Appoint a competent responsible person
You must appoint someone to take day-to-day responsibility for legionella control. This person must understand water systems and legionella risks. For simple systems (a small office with sinks and a water heater), a trained manager may suffice. For complex systems (cooling towers, large hot water networks, spa pools), appoint a specialist water treatment contractor or consultant.
-
2. Carry out a legionella risk assessment
Identify all water systems in your premises, including those that are rarely used. Assess whether conditions exist for legionella growth - water temperatures between 20 and 45 degrees Celsius, stagnation in dead legs or infrequently used outlets, presence of sediment, scale, or biofilm. Record the assessment in writing. Review it regularly, and whenever the water system or building use changes.
-
3. Prepare a written control scheme
Based on your risk assessment, produce a written scheme describing what you will do to control legionella risk. This must cover the water system layout, identified risks, control measures (temperature management, flushing, cleaning, disinfection), monitoring schedule, and who is responsible for each action.
-
4. Implement temperature controls
Hot water must be stored at 60 degrees Celsius or above and distributed at 50 degrees Celsius or above within one minute of running the outlet. Cold water must be stored and distributed below 20 degrees Celsius. These temperature ranges prevent legionella growth. Check and record temperatures regularly - typically monthly for sentinel outlets (nearest and furthest from the calorifier).
-
5. Manage stagnation and dead legs
Flush little-used outlets (showers, taps, toilets) at least weekly. Remove or cap off dead legs in the pipework - sections of pipe that go nowhere and allow water to stagnate. If premises are unoccupied for extended periods, flush the entire system before reoccupation.
-
6. Maintain water system components
Descale and disinfect showerheads and hoses quarterly. Clean and disinfect cold water storage tanks annually. Inspect calorifiers (hot water cylinders) annually. Replace flexible hoses that are deteriorating. Ensure cold water tanks have fitted, close-fitting lids and insect screens.
-
7. Register cooling towers and evaporative condensers
If you have cooling towers, evaporative condensers, or hot/cold water systems that may create a spray, you must notify the local authority in writing. Registration is required under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992. Contact your local council's environmental health department.
-
8. Keep records
Maintain records of your risk assessment, written control scheme, monitoring results (temperature checks, water sampling, inspections), remedial actions taken, and details of your competent person. These records demonstrate compliance and should be readily available for HSE inspection.
Common problems and how to avoid them
Unused outlets and seasonal buildings: Holiday lets, seasonal premises, and buildings with unoccupied floors are high risk because of stagnation. Establish a flushing regime for all outlets, even those not in regular use.
Thermostatic mixing valves (TMVs): These blend hot and cold water to reduce scalding risk but create ideal temperatures for legionella growth downstream. Position TMVs as close as possible to the outlet and keep pipework short. TMVs do not remove the need for hot water storage at 60 degrees Celsius.
Shared water systems in multi-tenanted buildings: The duty falls on whoever has responsibility for maintenance and repair. Landlords, managing agents, and tenants should agree in writing who manages legionella risk for shared systems.
Hot tubs and spa pools: These present elevated legionella risk due to warm, aerated water. Follow HSG282 guidance. Test for legionella bacteria regularly and maintain biocide levels.
What happens if you get it wrong
Failure to manage legionella risk is an offence under the Health and Safety at Work etc. Act 1974 and COSHH 2002. HSE can issue improvement notices, prohibition notices, or prosecute. Individuals with responsibility can face personal prosecution.
In serious cases involving Legionnaires' disease outbreaks, custodial sentences have been imposed on duty holders who failed to manage risks. The Corporate Manslaughter and Corporate Homicide Act 2007 may also apply if management failures lead to death.
What to do next
If you do not have a legionella risk assessment for your premises, arrange one now. For simple water systems, use HSE guidance HSG274 Part 2 to carry out a basic assessment yourself. For more complex systems, engage a specialist water hygiene contractor - look for membership of the Legionella Control Association (LCA).
Review your existing assessment if your water system, building use, or occupancy has changed since it was last assessed.