Every duty holder with a water system used or affected by work must have a suitable and sufficient Legionella risk assessment, review it at least every two years, and implement a written scheme of control. Failure to do so is a breach of the Health and Safety at Work Act 1974 with unlimited fines on conviction.
The legal framework
Legionella is treated as a substance hazardous to health under the Control of Substances Hazardous to Health Regulations 2002 (COSHH). The underlying duty is the Health and Safety at Work etc Act 1974. Compliance is measured against the Approved Code of Practice L8 (4th edition) and the technical guidance in HSG274 Parts 1 to 3.
An Approved Code of Practice carries special legal status. If you are prosecuted and you have not followed it, a court will find you at fault unless you can show you complied by an equally effective means. That is why "we do temperature checks" is not a defence unless it is written into a scheme of control and logged.
Water hygiene rarely sits on its own. If you are mapping the full statutory picture across a portfolio, the UK duty holder compliance guide sets out how the regimes stack up.
Who the duty holder is
The duty holder is the employer or the person in control of the premises where work activities are carried on. Landlords with responsibility for water systems in let premises are duty holders in their own right. In managed property the role is frequently delegated by contract to a managing agent, which does not remove the freeholder's residual exposure.
Under HSG274 the duty holder must appoint a named responsible person with sufficient authority, competence and knowledge, plus a deputy. Naming a job title with no deputy is one of the most common findings in an HSE visit.
What a suitable risk assessment covers
A competent Legionella Risk Assessment (LRA) will:
- Identify and evaluate potential sources of risk, including cooling towers, evaporative condensers, hot and cold water systems, spa pools, humidifiers and decorative fountains.
- Assess the likelihood of exposure, including dead legs, low-use outlets and temperature stagnation.
- Set out the control regime the duty holder must operate.
- Nominate roles: duty holder, responsible person, deputy.
- Identify remedial works with priority scoring and target dates.
- Include a schematic of the water system that matches the building as it is now.
Commission the LRA from an assessor registered with the Legionella Control Association (LCA). LCA registration is the accepted competence benchmark in the UK.
Review intervals at a glance
| Trigger | Action | Typical interval |
|---|---|---|
| No change to the system or its use | Review the LRA | At least every 2 years |
| Change of use, refurbishment, extension | Reassess affected systems | Immediately |
| Case of Legionnaires' disease linked to the site | Full reassessment and investigation | Immediately |
| Control measures found ineffective | Reassess and revise the written scheme | Immediately |
| Prolonged low occupancy or building closure | Reassess flushing and recommissioning regime | Before reoccupation |
Care settings run tighter than the general rule because of the vulnerability of the occupants. Our legionella testing frequency guide for care homes sets out the monitoring calendar in detail.
The written scheme of control
This is the operational document. It sits alongside the LRA and covers:
| Task | Frequency | Target |
|---|---|---|
| Sentinel outlet temperatures | Weekly | Cold at or below 20C within 2 minutes, hot at or above 50C within 1 minute (55C in healthcare) |
| Flushing of little-used outlets | Weekly | Run to temperature, recorded per outlet |
| Temperature checks, all little-used outlets | Monthly | As sentinel targets |
| Calorifier flow and return temperatures | Quarterly | Flow at or above 60C, return at or above 50C |
| Calorifier drain-down and inspection | Annually | Free of scale and debris |
| TMV service on high-risk outlets | Annually | Per manufacturer, strainers descaled |
| Cold water storage tank inspection | Annually | Sound lid, insect screen, no ingress or stagnation |
| Shower head descale and disinfect | Quarterly | Per HSG274 Part 2 |
When to act on a positive sample
HSG274 Part 2 sets clear action levels for Legionella in hot and cold water systems:
| Result (cfu/L) | Interpretation | Action |
|---|---|---|
| Under 100 | System under control | Continue the scheme, no action |
| 100 to 1,000 | Some evidence of colonisation | Review the risk assessment and control measures, resample |
| Over 1,000 | Significant colonisation | Immediate action: check controls, disinfect thermally or chemically, resample |
Positive results in showers or spa pools carry a lower practical threshold and usually trigger immediate remediation, because the exposure route is direct aerosol.
Remedial routes
- Thermal disinfection, flushing all outlets at 60C for five minutes. Fastest and cheapest for most domestic systems, but needs occupant scald controls in place.
- Chemical disinfection, chlorination at 50 ppm for one hour or 20 ppm for two hours per BS 8558. Requires the building to be out of use for the duration.
- Remedial pipework, removal of dead legs, replacement of galvanised pipework showing scale, installation or relocation of TMVs.
The cheapest long-term route is usually pipework. Repeat disinfection on a system with structural dead legs buys three months at a time and never closes the finding.
Evidence pack
- Current LRA, dated within two years, with a schematic that matches the building
- Written scheme of control naming the responsible person and deputy
- Log book of temperatures, flushing and remedial actions
- Sampling certificates from a UKAS-accredited laboratory
- LCA certificate for your monitoring contractor
- Asset register with outlet references matching the log
Duty holders who cannot produce this pack in an unannounced HSE visit face an improvement notice at best and prosecution at worst.
Related reading: the care home compliance checklist, the schools compliance checklist and the contractor vetting guide for checking LCA registration before you appoint.
Working with TICDesk
TICDesk is a UK procurement desk for testing, inspection and compliance work. Tell us the site or portfolio, the state of your current records and your deadline, and we introduce up to three vetted, LCA-registered water hygiene providers, typically within 48 hours. The service is free to the client and TICDesk earns a success fee from the contractor. Visit our water hygiene desk or open a brief.
Frequently asked
Who is the duty holder for Legionella?
The employer, self-employed person, or person in control of premises where work activities are carried on. Landlords with responsibility for water systems in let residential premises are also duty holders.
How often should an LRA be reviewed?
At least every two years, and whenever there is a significant change to the water system, its use, the building occupancy, or the outcome of monitoring suggests the assessment is no longer valid.
Do I need to sample for Legionella?
Sampling is not always required by law but is expected where control measures may not be effective, following an outbreak, or where the risk assessment identifies it. HSG274 recommends sampling at least annually in higher-risk systems.
What is a written scheme of control?
A documented set of measures to control the risk from Legionella: temperature regime, flushing schedule, TMV service, calorifier inspections, and responsibilities for each task.
Sources & further reading
