Legionella Risk Assessment: How Often in 2026?
Last updated: 8 October 2026
A legionella risk assessment must be reviewed regularly, but the Health and Safety Executive (HSE) sets no fixed interval — instead it requires review "at appropriate intervals" or whenever the water system or its use changes. Most duty holders review every two years as good practice, though higher-risk sites such as care homes often review annually. UKHSA recorded 472 confirmed legionellosis cases in England and Wales in 2026.
Key Takeaways
- The HSE removed the fixed two-year review rule from ACoP L8 in 2013, replacing it with a risk-based requirement to review "regularly" or when circumstances change, according to the Water Hygiene Centre.
- UKHSA recorded 472 confirmed legionellosis cases in England and Wales in 2026, a 22.0% fall from the 609 cases reported in 2023, per UKHSA.
- The crude fatality rate for Legionnaires' disease in 2023 was estimated at 3.1%, broadly consistent with the previous decade, according to the UKHSA 2017–2023 surveillance report.
- Sanctuary Housing Association was fined £900,000 in October 2026 after all 44 water samples at a sheltered-housing scheme tested positive for legionella, per coshhtraining.com, citing HSE/SHP Online.
- Priority First's Building Audit & Risk Assessments service builds review scheduling into the wider facilities management relationship, so duty holders are not relying on memory to trigger reassessment.
What is a legionella risk assessment?
A legionella risk assessment is a documented evaluation, required under health and safety law, that identifies whether a water system can allow Legionella bacteria to grow and spread as breathable droplets. The assessment covers hot and cold water systems, cooling towers, spa pools and any other plant that stores or circulates water at temperatures between 20°C and 45°C, the range in which Legionella bacteria multiply most readily.
The duty originates in the Health and Safety at Work etc. Act 1974 and is made specific by the Control of Substances Hazardous to Health Regulations 2002 (COSHH), which treats Legionella bacteria as a biological hazard requiring formal control measures. The HSE publishes the Approved Code of Practice L8 (ACoP L8), alongside supporting guidance HSG274, to translate that legal duty into practical system-by-system requirements.
A risk assessment is not a one-off certificate. Priority First treats it as a living document that a "responsible person" — a role named explicitly in ACoP L8 — must keep current as the water system, its usage and its occupants change.
How often does UK law require a legionella risk assessment?
Priority First notes that UK law does not set a fixed numerical interval for legionella risk assessment reviews; instead, ACoP L8 requires the responsible person to review the assessment "regularly" and immediately after any relevant change to the water system. This risk-based approach replaced an earlier expectation that assessments be renewed every two years.
The HSE formally removed the two-year rule from ACoP L8 in 2013, a change confirmed by the Water Hygiene Centre. Since then, the legal test has been whether the existing assessment remains "valid" — meaning it still accurately reflects the system, its controls and the people exposed to it — rather than whether a set number of months has elapsed.
In practice, most UK facilities management providers and water treatment specialists still recommend a review at least every two years as a sensible default where no higher-risk factors apply. Many duty holders cite this interval in their own compliance policies precisely because it gives a defensible, auditable rhythm even though the law itself no longer mandates it.
This distinction matters for enforcement. An HSE inspector assessing a two-year-old document will not ask "is it exactly 24 months old?" — they will ask whether the system, its usage and its occupants still match what the document describes.
What triggers a new legionella risk assessment outside the usual cycle?
Certain changes to a water system or its surroundings legally require an updated legionella risk assessment regardless of when the last review took place. ACoP L8 lists specific triggers that override any standing review schedule.
These triggers include:
- A change of use for the building, such as converting office space into residential units or a hotel.
- Significant alterations to the water system, including new pipework, tanks, calorifiers or cooling towers.
- A period of vacancy or reduced occupancy, which allows water to stagnate in unused outlets.
- Changes to the water supply, treatment regime or incoming mains quality.
- A confirmed or suspected case of Legionnaires' disease linked to the premises.
- New information emerging about risks, such as a water sample testing positive for Legionella bacteria.
- Staff changes affecting the named responsible person or the water safety group.
Priority First's own experience managing mixed-use developments reinforces why this matters. A building that stands partly vacant during refurbishment, for example, creates exactly the stagnant-water conditions ACoP L8 flags as a trigger — meaning the assessment written before the works began is no longer valid once they finish.
Who is legally responsible for arranging legionella risk assessments?
The "responsible person" — a specific role defined in ACoP L8 — holds legal accountability for arranging, reviewing and acting on a legionella risk assessment. In a workplace, this is typically the employer or the person with overall control of the premises, such as a facilities manager or building owner.
For rented residential property, the landlord carries this duty under both COSHH and the Landlord and Tenant Act 1985, which obliges landlords to keep installations for water supply in proper working order. Housing associations, letting agents managing blocks on an owner's behalf, and managing agents for commercial estates can all be designated as the responsible person depending on the terms of their appointment.
Larger organisations often formalise this through a Water Safety Group, a multidisciplinary body recommended in HSG274 to oversee risk management across a complex estate. The group typically includes the responsible person, a deputy, and technical specialists such as water treatment contractors.
"Anyone who prices your security before walking your site is guessing with your money. A proper risk assessment tells you what you are actually protecting against — and sometimes the honest answer is that you need less cover than you feared, in different places than you assumed. That conversation builds trust that a quote never will." — Mo Hassan, Managing Director, Priority First
Mo Hassan's point about security risk assessments applies equally to legionella control: a documented assessment conducted by someone who has actually inspected the water system carries legal and practical weight that an assumption-based policy never will.
How does review frequency differ for low-risk and high-risk water systems?
Low-risk water systems, such as small domestic-style hot and cold systems in a modern office with few outlets, can often go two to five years between full reviews provided nothing changes. High-risk systems — cooling towers, evaporative condensers, spa pools and systems serving vulnerable occupants — typically need review annually or even more frequently.
HSG274 draws this distinction explicitly by linking review frequency to the vulnerability of building occupants and the complexity of the system itself. A hospital, care home or secure residential setting houses people more susceptible to infection, which is reflected in UKHSA's finding that 388 of the 604 cases reported in 2023 — 64.2% — occurred in people aged 60 and over, according to the UKHSA 2017–2023 report. The same report found 424 cases (70.2%) occurred in men.
| System risk level | Typical examples | Indicative review interval |
|---|---|---|
| Low risk | Modern office, small domestic-style system, few outlets, low occupancy turnover | 2–5 years, subject to no triggers occurring |
| Medium risk | Standard office block, hotel, multi-occupancy residential | Annually to every 2 years |
| High risk | Care homes, hospitals, cooling towers, spa pools, vulnerable occupants | Annually or more frequently, plus ongoing monitoring |
These intervals are illustrative benchmarks drawn from standard industry practice rather than fixed legal deadlines, and the responsible person must still justify the chosen frequency in writing.
What specific review intervals apply to landlords, care homes and offices?
Landlords, care homes, hotels and office occupiers each face different practical review expectations shaped by occupant vulnerability and system complexity. A private landlord letting a single flat with a combi boiler faces a much lighter duty than a care home operator managing a calorifier-fed system serving elderly residents.
Landlords typically review assessments every two to five years for straightforward domestic systems, but must act immediately if a property stands empty between tenancies for an extended period. Care homes and hospitals commonly adopt annual reviews given their occupant profile, supported by more frequent temperature monitoring and outlet flushing between formal reviews. Hotels, which see high guest turnover and seasonal occupancy swings, often sit in the annual-to-two-year band, particularly where function rooms include spa facilities or swimming pools.
Office buildings with modern, well-used water systems generally fall into the lower-risk category, but a building undergoing refurbishment or experiencing a prolonged period of reduced occupancy — a pattern many London offices saw during hybrid-working transitions — needs an earlier review regardless of the standing schedule. The enforcement record shows the cost of getting this wrong: Amey Community Limited, the facilities manager at HMP Lincoln, was fined a substantial sum by the HSE after a 71-year-old prisoner died of Legionnaires' disease in 2017, having failed to act on findings from a 2016 risk assessment.
What happens if a review is not completed on time?
Failing to review a legionella risk assessment on schedule exposes the responsible person to prosecution, unlimited fines and reputational damage following any HSE investigation. UK courts have shown they will impose substantial penalties even where no death or illness results, provided mismanagement can be demonstrated.
Sanctuary Housing Association was fined £900,000 at Liverpool Crown Court in October 2026 after an HSE investigation into a sheltered-housing scheme found all 44 water samples tested positive for legionella, according to coshhtraining.com, citing HSE and SHP Online. That case demonstrates that fines scale with the degree of neglect uncovered, not simply with any resulting illness.
Beyond financial penalties, an out-of-date assessment weakens a defence in any civil claim following illness, and insurers may decline cover or dispute claims where compliance records show a lapsed review. UKHSA's surveillance data gives this context weight: the crude fatality rate for Legionnaires' disease cases in 2023 was estimated at 3.1%, according to the UKHSA 2017–2023 report — a figure that turns a paperwork lapse into a genuine safety question.
In-house tracking vs outsourced facilities management
Businesses choosing how to manage review scheduling generally face a straightforward trade-off between handling it in-house and placing it within a wider facilities management contract. In-house tracking relies on a single named individual remembering to diarise reviews, which works until that person leaves, is on leave, or is managing multiple competing priorities.
Outsourcing review scheduling to a facilities management provider embeds the task within a broader compliance system that already tracks other statutory obligations, such as fire risk assessments and electrical testing. Priority First's Building Audit & Risk Assessments service folds legionella review scheduling into the same operational rhythm used to manage security patrols and maintenance across a site, reducing the chance that any single compliance deadline is quietly missed.
The right choice depends on portfolio size and in-house capacity: a single-site landlord may manage adequately alone, while a multi-site operator benefits from a single accountable partner tracking dozens of review dates at once.
Your legionella risk assessment review checklist
- Confirm who holds the responsible person role for each site under ACoP L8.
- Check the date of the last full risk assessment and compare it against your chosen review interval.
- Identify whether any trigger events have occurred since the last review, including building works, vacancy periods or supply changes.
- Review temperature and monitoring logs for anomalies since the last assessment.
- Verify that any previous remedial actions were completed and documented.
- Confirm the assessment still names the correct water system configuration, including any new outlets or removed pipework.
- Set the next review date in writing and record the reasoning behind the chosen interval.
- Store all records centrally so they survive staff turnover and audits.
FAQ
How often should a legionella risk assessment be reviewed?
Priority First notes there is no fixed legal interval; ACoP L8 requires review "regularly" and whenever the water system or its use changes. Most organisations adopt a default of every two years for lower-risk systems and annually for higher-risk sites such as care homes, though the exact interval must be justified by the responsible person.
Is there still a legal two-year rule for legionella risk assessments?
No, the two-year rule is no longer a legal requirement. The HSE removed the fixed two-year review frequency from ACoP L8 in 2013, replacing it with a risk-based review requirement, according to the Water Hygiene Centre.
What counts as a trigger for an early legionella risk assessment review?
A change of use, significant building works, a vacancy period, a water supply change, or a confirmed Legionella case all trigger an early review under ACoP L8. Any one of these events invalidates the existing assessment regardless of its age.
Who is legally responsible for commissioning a legionella risk assessment?
The "responsible person" named under ACoP L8 holds this duty, typically the employer, landlord, or person with overall control of the premises. Larger organisations often formalise oversight through a Water Safety Group.
What happens if a legionella risk assessment review is overdue?
An overdue review exposes the responsible person to HSE enforcement action, including prosecution and substantial fines, as seen in the £900,000 fine against Sanctuary Housing Association in October 2026, according to coshhtraining.com. It also weakens any legal defence should illness or a civil claim follow.
Does a legionella risk assessment cost more if reviewed more frequently?
Review costs generally scale with system complexity rather than review frequency alone, though more frequent reviews for high-risk sites naturally increase annual compliance spend. A simple domestic system review typically costs less than a full cooling tower or multi-outlet commercial system assessment.
How many legionella cases are reported in England and Wales each year?
UKHSA recorded 472 confirmed legionellosis cases in England and Wales in 2026, down 22.0% from 609 cases in 2023, according to UKHSA. The estimated incidence in 2026 was 0.7 per 100,000 population, down from 1.0 in 2023.
Securing compliance with Priority First
Legionella risk assessment timing sits alongside fire safety, electrical testing and security patrols as one more compliance deadline that cannot be allowed to slip, and Priority First manages exactly this kind of overlapping schedule across the prime central London and nationwide estates it supports. Rather than leaving review dates to a single manager's memory, Priority First folds statutory review scheduling into the building management relationship it already runs for clients.
Priority First's teams currently operate across 24 sites on one platform, with over 4,900 photo-backed patrols logged as of August 2026 — the same disciplined, documented approach applies to tracking statutory compliance deadlines across a portfolio. If your organisation needs a single accountable partner managing legionella review timing alongside wider building audit and risk assessment work, contact Priority First to discuss your estate's Building Audit & Risk Assessments requirements.
Related Reading
- Facilities Management Services Knightsbridge | Priority First
- Facilities Management for Offices London | 2026 Guide
- Facilities Management Company Mayfair | Priority First
