Almost every organisation that controls a building needs a legionella risk assessment, and most that think they are exempt are not. The duty does not depend on the size of the building or whether anyone has ever been ill. It depends on one thing: do you have a water system capable of harbouring legionella and producing a breathable spray? For nearly every workplace, care home, gym, school and let property, the answer is yes.
This guide sets out who legally needs an assessment, what it must cover, who can carry it out, and how often it has to be reviewed.
Why the assessment is a legal requirement
The requirement flows from the general duty in the Health and Safety at Work etc. Act 1974 and the specific duty in Regulation 6 of the COSHH Regulations 2002 to assess the risk from a hazardous biological agent. The Approved Code of Practice ACOP L8 then makes explicit that this begins with a legionella risk assessment of the water system.
ACOP L8 has special legal standing. If you follow it, you are taken to have complied with the law. If you do not, you must be able to show you achieved an equivalent standard by another route. In practice that makes the risk assessment the foundation of the whole thing — without it, there is no defensible position.
Who needs one
You need a legionella risk assessment if you are the duty holder — the employer, or the person in control of premises or a water system — and you fall into any of these very common categories:
- Employers with any premises containing a water system
- Landlords of residential or commercial property — this is widely misunderstood; residential landlords have a clear duty for the systems they control
- Care homes, hospitals and clinics — higher-risk because occupants are more vulnerable
- Gyms, hotels and leisure centres — showers and, often, spa pools
- Schools, nurseries and colleges
- Offices, shops, warehouses and factories
- Anyone operating a cooling tower, evaporative condenser or spa pool — the highest-risk systems
The common myth is that small or low-occupancy premises are exempt. They are not. A small office with a hot water cylinder and a couple of showers still has a system capable of growing legionella and still needs an assessment — it will simply be a proportionate, straightforward one.
Landlords — the most misunderstood duty
Residential landlords frequently believe legionella has nothing to do with them. It does. A landlord is the duty holder for the water system in a let property, and is expected to assess and manage the risk. For most ordinary domestic rentals this is simple and proportionate — a basic assessment, sensible controls such as not leaving systems stagnant between tenancies, and advice to tenants — and it usually does not require bringing in a specialist. But “simple” is not the same as “not required”.
What the assessment must cover
A suitable and sufficient legionella risk assessment identifies where the risk arises and what must be done. It should cover:
- A description of the whole water system — ideally with an up-to-date schematic showing tanks, calorifiers, pipework and outlets
- Potential sources of risk — dead legs, little-used outlets, stored water, temperatures in the danger zone, aerosol-producing equipment
- Who could be exposed — employees, residents, visitors, and any vulnerable groups
- An assessment of the likelihood and severity of exposure
- The control measures required — temperature regime, flushing, cleaning, and monitoring
- Who is responsible — the named responsible person and the management arrangements
- Records and review — how the scheme will be documented and when it will be revisited
The output is not just a report to file. It drives the written control scheme — see legionella control in water systems for the practical measures it feeds into. The general principles of assessment are the same ones covered in our risk assessment guide.
Who can carry it out
The law requires a competent assessor, not a licensed one. Competence means the right combination of knowledge, training and experience for the system in question — and that is a sliding scale:
- A simple domestic or small-office system can often be assessed in-house by someone who has had appropriate legionella awareness training and understands the control principles.
- A complex system — a large building, a care home, anything with a cooling tower or spa pool — needs a specialist legionella risk assessor, and usually an external one.
The duty holder is responsible for judging whether the assessor is genuinely competent for the system. Bringing in a contractor does not transfer the legal duty; it discharges part of it, provided the contractor is competent and the work is checked.
How often must it be reviewed
There is no fixed statutory interval, but ACOP L8 requires the assessment to be reviewed regularly and whenever there is reason to believe it is no longer valid. A common convention is a review every two years, but the events matter more than the calendar. Review immediately after any of the following:
- Changes to the water system — new pipework, removed fittings, a replaced calorifier
- A change in the use of the building or the occupancy
- A period the system was shut down or left stagnant
- Positive legionella sample results
- New information about risks or control measures
- A case of Legionnaires’ disease linked to the premises
An assessment that has not been reviewed after a relevant change is, in effect, no longer valid — and an inspector will treat it that way.
What enforcement looks like
The HSE and local authorities enforce the legionella duty. Where an outbreak or a death is linked to a failure, the consequences are serious: legionella cases have resulted in substantial fines and, where the failings were grave, custodial sentences under health and safety and corporate manslaughter law. Even without an incident, an inspection that finds no assessment, or an out-of-date one, can lead to an improvement notice.
Further reading
Frequently asked questions
Who needs a legionella risk assessment?
Any duty holder — an employer or the person in control of premises or a water system. That includes employers with any premises, residential and commercial landlords, care homes, gyms, hotels, schools, offices, and anyone operating a cooling tower or spa pool. Small or low-occupancy premises are not exempt; their assessment is simply more proportionate.
Do residential landlords need a legionella risk assessment?
Yes. A landlord is the duty holder for the water system in a let property and must assess and manage the legionella risk. For most ordinary domestic rentals this is simple and proportionate — a basic assessment, sensible controls such as avoiding stagnation between tenancies, and advice to tenants — and does not usually require a specialist, but it is still required.
Who can carry out a legionella risk assessment?
A competent person — the law requires competence, not a licence. A simple domestic or small-office system can often be assessed in-house by someone with appropriate legionella awareness training. A complex system, or one with a cooling tower or spa pool, needs a specialist assessor. The duty holder must judge whether the assessor is competent for the specific system; using a contractor does not transfer the legal duty.
How often should a legionella risk assessment be reviewed?
There is no fixed statutory interval. ACOP L8 requires review regularly and whenever the assessment may no longer be valid — after changes to the water system, a change of use or occupancy, a shutdown or stagnation, positive legionella samples, new risk information, or a linked case of Legionnaires’ disease. A two-year cycle is a common convention, but the triggering events matter more than the calendar.
What must a legionella risk assessment cover?
A description of the whole water system, the potential sources of risk such as dead legs and stored water in the growth range, who could be exposed and any vulnerable groups, the likelihood and severity of exposure, the control measures required, the named responsible person and management arrangements, and how the scheme will be recorded and reviewed.
Legionella awareness training
Our Legionella Awareness course covers the duty holder and responsible person roles, where risk arises in a water system, and the principles behind a legionella risk assessment and control scheme.
Related: What is legionella? · Legionella control in water systems · Risk Assessment Awareness · COSHH Awareness
£9 per course. CPD accredited, 100 % online, verifiable e-certificate on completion. Pay for 2, get 3 — any 3 courses for £18.
Important: this is a CPD-accredited awareness course and general information, not legal advice. It builds underpinning knowledge of the legionella control framework. It does not by itself make someone a competent legionella risk assessor for a complex water system, which requires specialist training and experience appropriate to that system. Where your system warrants it, engage a specialist assessor; the legal duty remains with the duty holder.