Legionella Risk Assessment Requirements UK (2026 Guide)

Last updated: 28 October 2026

A legionella risk assessment is a legal duty under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002, requiring every UK employer, landlord and building owner with a water system to identify and control the risk of Legionnaires' disease. UKHSA recorded 472 confirmed legionellosis cases in England and Wales in 2026.

Key Takeaways

• UKHSA recorded 472 confirmed cases of legionellosis in England and Wales in 2024, a 22.0% fall compared with 2023 — UK Health Security Agency.
• The estimated incidence of Legionnaires' disease in 2024 was 0.7 per 100,000 population, down from 1.0 in 2023 — UK Health Security Agency.
• Amey Community Ltd was fined £600,000 plus £15,186.85 costs after a prisoner died of Legionnaires' disease at HMP Lincoln, despite a 2016 risk assessment having flagged the risk — HSE / Legionella Control International.
• Priority First advises that there is no fixed "two-year rule" in UK law — ACoP L8 instead requires the risk assessment to be reviewed whenever circumstances suggest it may no longer be valid.
• Priority First notes that HSE does not issue a "legionella certificate" — compliance is demonstrated through a documented, competently produced risk assessment and an active written scheme of control.

What is legionella and why does it require a risk assessment?

Legionella is a bacterium that occurs naturally in water and soil and can multiply to dangerous concentrations in artificial water systems such as cooling towers, hot and cold water tanks, and spa pools. Legionnaires' disease is the severe pneumonia that develops when a person inhales contaminated water droplets, or aerosols, small enough to reach the lungs.

The risk exists wherever water is stored or recirculated at temperatures between roughly 20°C and 45°C, the range in which legionella bacteria thrive. UKHSA's 2026 surveillance data shows that 63.9% of legionellosis cases (296 individuals) were aged 60 or over, and 68.0% (315 cases) were male, demonstrating that the disease disproportionately affects older adults and men — a pattern facilities managers should factor into risk assessments for care homes, hotels and residential blocks with older populations.

Just over half of exposures in 2026 were acquired in the community at 51.6% (239 cases), with 43.8% (203 cases) linked to travel outside the UK and 4.5% (21 cases) healthcare-associated, according to UKHSA. The case fatality rate was estimated at 2.8% in 2026, broadly unchanged from 2023, per the same UKHSA data. A risk assessment exists to identify every point in a water system where conditions favour bacterial growth — stagnant pipework, infrequently used outlets, incorrect temperatures — before anyone is exposed.

Is a legionella risk assessment a legal requirement in the UK, and under which legislation?

Yes — a legionella risk assessment is a statutory duty in England, Scotland and Wales under the Health and Safety at Work etc. Act 1974 (HSWA), which places a general duty on employers to protect the health of employees and anyone affected by their undertaking. Priority First points to the Control of Substances Hazardous to Health Regulations 2002 (COSHH) as the instrument that then makes that duty specific: COSHH treats legionella bacteria as a hazardous substance and requires a suitable and sufficient assessment of the risk it poses.

The Health and Safety Executive's Approved Code of Practice L8, fourth edition, published in 2013, sets out how duty holders meet these legal obligations in practice. HSE's supporting technical guidance, HSG274, is published in three parts covering hot and cold water systems, cooling towers and evaporative condensers, and other risk systems such as spa pools.

There is no separate "Legionella Act" — the duty flows from HSWA and COSHH, interpreted through ACoP L8. Full legislative text is available on legislation.gov.uk. A common misconception is that HSE issues a "legionella certificate"; it does not. What HSE inspectors look for is documented evidence of a competent risk assessment and an active written scheme of control.

Who is legally responsible for carrying out a legionella risk assessment?

The duty holder is legally responsible for a legionella risk assessment, and that term covers employers, landlords, and anyone in control of premises with a water system, including commercial buildings, residential blocks and managed estates. HSE guidance states plainly that "if a tenant were to contract Legionnaires' disease from the water system in their home, the landlord may be liable to prosecution under HSWA" — HSE.

For a commercial office, the employer or the managing agent typically holds the duty. For a residential block in Mayfair, Chelsea or Knightsbridge, the freeholder or managing agent is usually the duty holder, even where day-to-day building management is contracted out. Responsibility cannot simply be assigned away by hiring a contractor — HSE confirms the duty holder must ensure that the person who carries out the risk assessment and provides advice on prevention and control of exposure must be competent to do so.

That distinction matters because enforcement falls on the duty holder, not only the contractor. The 2025 Amey Community Ltd prosecution illustrates this precisely: the firm had conducted a risk assessment in 2016 but had not acted on its findings, and was still fined £600,000 plus £15,186.85 costs after a prisoner's death at HMP Lincoln, per HSE reporting. Commissioning an assessment is not the end of the duty; acting on it is.

As Mo Hassan, Managing Director of Priority First, puts it: "Compliance fails quietly. Certificates lapse, checks get missed in handovers between contractors, and everything looks fine until an incident or a sale forces an audit. The fix is unglamorous: one owner for the whole compliance calendar, evidence filed as work is done, and no assumption that the previous contractor left things in order."

Which premises and water systems need a legionella risk assessment?

Any premises with a water system capable of storing or circulating water at between 20°C and 45°C needs a legionella risk assessment, which in practice covers almost every commercial and residential building in the UK. High-risk systems include cooling towers, hot and cold water storage tanks, calorifiers, spa pools, and any pipework with infrequently used outlets such as showers in vacant flats.

Healthcare settings carry an additional layer of guidance through the Department of Health's HTM 04-01, which sits alongside ACoP L8 for NHS and care environments. Vacant properties deserve particular attention: stagnant water in an empty flat or unoccupied office is a classic legionella breeding ground, which is why Priority First's vacant property services include regular water system checks as part of broader inspection routines, alongside alarm response and visible deterrence.

How do you carry out a legionella risk assessment step by step?

A legionella risk assessment follows a structured sequence: survey the water system, identify sources of risk, assess who could be exposed, evaluate existing controls, and record findings in a written scheme of control. ACoP L8 and HSG274 set out this methodology in detail, and HSE expects the process to be proportionate to the complexity of the system.

In practice, the steps are:

1. Survey the system — map every water source, tank, outlet and pipe run, including dead legs and infrequently used outlets.
2. Identify risk factors — check for temperatures between 20°C and 45°C, stagnation, scale, biofilm, and debris that could harbour bacteria.
3. Assess exposure potential — consider who uses the building, including vulnerable groups such as residents over 60, given UKHSA's finding that 63.9% of 2026 cases were in that age group.
4. Review existing controls — check temperature records, disinfection regimes and any prior remedial work.
5. Record findings — produce a written report naming specific risks, actions required, and timescales.
6. Establish a written scheme of control — the ongoing management plan that follows directly from the assessment.

Each step should be documented with photographs and dates, not just narrative description, because an assessment that cannot be evidenced is difficult to defend if HSE investigates after an incident.

Can a legionella risk assessment be done in-house, or does it need a certified professional?

A legionella risk assessment can legally be carried out in-house, provided the person doing it is competent, which HSE defines as "the combination of training, skills, experience and knowledge that a person has and their ability to apply them to perform a task safely." There is no single mandated qualification, but recognised routes include City & Guilds legionella control courses and the BOHS P901 qualification.

HSE's ACoP L8 is explicit that "the duty holder must ensure that the person who carries out the risk assessment and provides advice on prevention and control of exposure must be competent to do so" — HSE. For a simple system in a small office with a single water heater, a trained in-house manager may genuinely meet that bar.

In-house vs outsourced: the trade-off

For multi-occupancy residential blocks, mixed-use developments or anything with cooling towers, most duty holders commission a specialist, because the competence bar in HSE's guidance is genuinely difficult to meet without dedicated training and ongoing CPD.

What should a legionella risk assessment report include, and how often is it reviewed?

A compliant legionella risk assessment report must name every water source surveyed, document identified risks, state the control measures required, and set clear timescales for remedial action. It should also record the assessor's competence basis and the date of assessment, since both HSE and insurers will ask for this evidence after any incident.

There is no statutory fixed renewal period — the "two-year rule" often quoted online is not written into ACoP L8. Instead, HSE guidance requires review "whenever there is reason to suspect it is no longer valid," which in practice includes:

• A change to the water system (new pipework, extension, refurbishment)
• A change of building use or occupancy
• Results from monitoring that suggest control measures have failed
• A significant period of disuse, such as an extended vacancy
• No material change at all — many duty holders still choose an annual review as reasonable practice, even though the law does not mandate it.

A risk assessment is only the start; it must feed directly into a written scheme of control covering temperature monitoring, tank inspections, outlet flushing, and disinfection — ongoing obligations that sit alongside, not instead of, the assessment itself.

Your legionella risk assessment checklist

• Confirm who the duty holder is for every building in your portfolio, in writing.
• Commission a written risk assessment covering every water source, including rarely used outlets.
• Verify the assessor's competence basis — training, qualifications and experience — before instruction.
• Check hot water is stored above 60°C and distributed above 50°C, and cold water below 20°C where practicable.
• Establish a written scheme of control with named responsibilities and inspection frequencies.
• Flush infrequently used outlets, especially in vacant flats or unoccupied offices, on a documented schedule.
• Review the assessment after any change to the system, occupancy or monitoring results — not on a fixed calendar alone.
• File all evidence — photographs, dates, temperature logs — in one accessible compliance record.

FAQ

Is a legionella risk assessment a legal requirement for every UK business?

Yes, in practice almost every employer and landlord with a water system has a legal duty under HSWA 1974 and COSHH 2002 to assess legionella risk. The only exception is where a system genuinely cannot support bacterial growth, which is rare.

Does a legionella risk assessment require water sampling or testing?

Not always — many assessments are based on visual inspection, temperature checks and system review rather than laboratory sampling. Testing is typically triggered when monitoring indicates a control failure or when a cooling tower or higher-risk system is involved.

What is the difference between ACoP L8 and HSG274?

ACoP L8 is HSE's Approved Code of Practice setting out the legal framework under HSWA and COSHH, while HSG274 is the supporting three-part technical guidance explaining how to apply those duties to specific system types. Duty holders are expected to follow both together.

Do landlords need a legionella certificate for a rental property?

No — HSE does not issue a legionella certificate, and no such document exists in law. What a landlord needs is a documented risk assessment carried out by a competent person, kept on file and reviewed when circumstances change.

What happens if a business fails to carry out a legionella risk assessment?

Enforcement can include HSE prosecution under HSWA, with fines reaching hundreds of thousands of pounds in serious cases — Royal United Hospitals Bath NHS Foundation Trust was fined £300,000 plus £37,451.78 costs after pleading guilty to a breach linked to Legionella failings, per Water Hygiene Centre. Failure can also result in civil liability if someone contracts Legionnaires' disease.

How much does a legionella risk assessment typically cost in the UK?

Costs vary with system complexity, but a typical range for a straightforward commercial premises is roughly £150–£600, rising for larger estates, cooling towers or multi-building portfolios. Ongoing monitoring and written scheme management are usually priced separately from the initial assessment.

What are the most common mistakes businesses make with legionella compliance?

The most frequent failure is commissioning a risk assessment but never acting on its findings — exactly the pattern HSE identified in the Amey Community Ltd prosecution. Other common errors include assuming a fixed two-year renewal cycle exists, leaving vacant units unflushed, and failing to document competence or evidence.

Securing compliance across your building portfolio with Priority First

Legionella compliance is one strand of a much wider obligation that building owners and managing agents carry — one that, as this article shows, fails quietly through gaps between contractors rather than through a single dramatic lapse. Priority First's facilities management and building audit services exist precisely to close those gaps, bringing compliance calendars, risk assessments and evidence filing under one accountable partner rather than scattered across handovers.

Priority First already protects over £1.6 billion in client assets across prime central London — including Chelsea, Knightsbridge and Mayfair — West London, and contracts in the West Midlands and Bedfordshire, with every checkpoint, patrol and inspection logged and photo-backed rather than simply asserted. That same evidence-first approach applies to building compliance: work is recorded as it happens, not reconstructed after an audit forces the question.

If your portfolio needs a structured building audit, a legionella risk assessment review, or an accountable owner for your compliance calendar, get in touch with Priority First's Building Audit & Risk Assessments team to discuss your sites.

Related Reading

• Security Compliance Managing Agents: UK Guide 2026
• Best Security Practices for Construction Sites: Ensure Safety and Compliance
• EICR C1, C2, C3 Codes Explained (2026 Guide)

★ Add priorityfirst.co.uk as a preferred source on Google