Every duty holder with a water system used or affected by work must have a suitable and sufficient Legionella risk assessment, review it at least every two years, and implement a written scheme of control. Failure to do so is a breach of the Health and Safety at Work Act 1974 with unlimited fines on conviction.
The legal framework
Legionella is treated as a substance hazardous to health under the Control of Substances Hazardous to Health Regulations 2002 (COSHH). The underlying duty is the Health and Safety at Work etc Act 1974. Compliance is measured against the Approved Code of Practice L8 (4th edition) and the technical guidance in HSG274 Parts 1–3.
An Approved Code of Practice carries special legal status: if you are prosecuted and you have not followed it, a court will find you at fault unless you can show you complied by an equally effective means.
What a suitable risk assessment covers
A competent Legionella Risk Assessment (LRA) will:
- Identify and evaluate potential sources of risk (cooling towers, evaporative condensers, hot and cold water systems, spa pools, humidifiers, decorative fountains).
- Assess the likelihood of exposure — including dead legs, low-use outlets, temperature stagnation.
- Set out the control regime the duty holder must operate.
- Nominate roles: duty holder, responsible person, deputy.
- Identify remedial works with priority scoring.
Commission the LRA from an assessor registered with the Legionella Control Association (LCA). LCA registration is the accepted competence benchmark in the UK.
The written scheme of control
This is the operational document. It sits alongside the LRA and covers:
- Temperature regime — cold ≤20°C at sentinel outlets, hot ≥50°C (55°C in healthcare) at outlets within one minute
- Weekly flushing of little-used outlets
- Monthly temperature checks on all little-used outlets, plus representative sentinel outlets weekly
- Quarterly calorifier flow/return temperatures
- Annual TMV service on all high-risk outlets
- Annual cold water storage tank inspection and periodic chlorination
- Annual shower head descale
When to act on a positive sample
HSG274 Part 2 sets clear action levels for Legionella in hot and cold water systems:
- <100 cfu/L — system under control
- 100–1,000 cfu/L — review the risk assessment and remedial actions
- >1,000 cfu/L — immediate action: check control measures, disinfect the system (thermal or chemical), resample
Positive results in showers or spa pools carry a lower threshold and usually trigger immediate remediation.
Remedial routes
- Thermal disinfection — flushing all outlets at 60°C for five minutes; fastest and cheapest for most domestic systems
- Chemical disinfection — chlorination at 50 ppm for one hour or 20 ppm for two hours per BS 8558
- Remedial pipework — removal of dead legs, replacement of galvanised pipework showing scale, installation of TMVs
Evidence pack
- Current LRA (dated within 2 years)
- Written scheme of control
- Log book of temperatures, flushing and remedial actions
- Sampling certificates from a UKAS-accredited laboratory
- LCA certificate for your monitoring contractor
- Asset register with schematic drawings
Duty holders who cannot produce this pack in an unannounced HSE visit face an improvement notice at best and prosecution at worst.
Frequently asked
Who is the duty holder for Legionella?
The employer, self-employed person, or person in control of premises where work activities are carried on. Landlords with responsibility for water systems in let residential premises are also duty holders.
How often should an LRA be reviewed?
At least every two years, and whenever there is a significant change to the water system, its use, the building occupancy, or the outcome of monitoring suggests the assessment is no longer valid.
Do I need to sample for Legionella?
Sampling is not always required by law but is expected where control measures may not be effective, following an outbreak, or where the risk assessment identifies it. HSG274 recommends sampling at least annually in higher-risk systems.
What is a written scheme of control?
A documented set of measures to control the risk from Legionella: temperature regime, flushing schedule, TMV service, calorifier inspections, and responsibilities for each task.
Sources & further reading
