Guidance · Reviewed September 2026
Who has to carry out a legionella risk assessment, what a good one covers, the temperature limits that control the risk, and what has to keep running afterwards — the part most sites get wrong.
The short answer
If you are an employer, a landlord or anyone in control of premises with a water system, assessing the risk from Legionella is a legal duty. Where the assessment finds a foreseeable risk you also need a written scheme of control, a named responsible person and records showing the scheme is actually being run. There is no fixed review interval — the test is whether the assessment is still valid.
Who Holds the Duty?
A legionella risk assessment identifies where Legionella bacteria could multiply in a water system, who could be exposed, and what controls are needed. The duty sits with whoever controls the premises or the system, which in practice is one of four groups.
Employers
Any workplace with a water system, however simple. For a small, low-risk system the assessment may be short, but it still has to be done.
Residential landlords
Landlords must assess the risk in the properties they let. A typical home with a combination boiler and no stored water is usually low risk and quick to assess.
Those in control of premises
Building owners, facilities managers and managing agents, including for shared systems in multi-occupied buildings.
Principal contractors
Temporary supplies, welfare units, site accommodation and part-commissioned systems sit outside the permanent building’s assessment and are frequently overlooked.
Higher-risk settings include care homes, hospitals and dental practices, hotels, leisure centres and spas, schools, food production sites, and anywhere operating cooling towers, evaporative condensers or spa pools. Buildings with low occupancy, seasonal use or long void periods carry an elevated risk because of stagnation, not despite it. On construction and refurbishment projects the duty forms part of wider CDM responsibilities.
Where the Duty Comes From
| Source | What it requires |
|---|---|
| Health and Safety at Work etc. Act 1974 | General duties to employees and to others affected by the undertaking, including tenants, visitors and the public. |
| Management of Health and Safety at Work Regulations 1999 | A suitable and sufficient risk assessment, and competent help to carry it out. |
| COSHH Regulations 2002 | Legionella is a biological agent, so exposure must be assessed, prevented or adequately controlled. |
| ACoP L8 | HSE’s Approved Code of Practice. It has special legal status: if you did not follow it, you would have to show you complied in some other way. |
| HSG274 Parts 1 to 3 | The technical guidance: evaporative cooling systems (Part 1), hot and cold water systems (Part 2) and other risk systems (Part 3). |
A poor legionella risk assessment can be worse than none at all. It creates a paper record saying the risk was considered, which is exactly the document an inspector will read back to you if something goes wrong.
What a Legionella Risk Assessment Covers
- A schematic of the water system, including tanks, calorifiers, pipework runs and outlets
- Identification of risk systems: hot and cold water services, cooling towers and evaporative condensers, spa pools, humidifiers, vehicle wash systems, and sprinkler and fire-fighting systems
- Dead legs, blind ends, redundant pipework and infrequently used outlets
- Temperature checks against the accepted control regime
- Tank condition, lids, insulation, screening and materials in contact with water
- Occupancy and the vulnerability of the people who could be exposed
- Management arrangements: the responsible person, competence, training and record-keeping
- Prioritised remedial recommendations rather than a generic list
The recognised standard for the assessment itself is BS 8580-1:2019, which sets out how a legionella risk assessment should be scoped, carried out and reported. It is a useful yardstick when comparing assessors or judging a report you have already been given.
Free Envico risk assessment tools
The method behind a legionella assessment is the same discipline applied to any workplace risk: identify the hazards, decide who might be harmed, evaluate the controls and record the findings. Our free tools and templates cover that general method.
The Temperature Control Regime
Temperature is the main control for most hot and cold water systems, because Legionella multiplies between roughly 20°C and 45°C. HSG274 Part 2 sets the accepted targets. Our guide to Legionella and Legionnaires’ disease explains where the bacteria grow and the wider controls.
Hot water stored: 60°C or above
In the calorifier or water heater.
Hot water at outlets: 50°C within one minute
55°C in healthcare premises.
Cold water: below 20°C within two minutes
At outlets and in storage tanks.
Where hot water at these temperatures creates a scalding risk, for example in care settings, thermostatic mixing valves are fitted close to the outlet. They need their own maintenance, and the assessment should cover them.
Water Testing and Sampling
Legionella sampling is carried out to BS 7592 and analysed by a UKAS-accredited laboratory, usually alongside total viable count testing. Sampling supports a risk assessment. It does not replace one. A clear sample tells you what was in that outlet on that day, and nothing about the design faults that will cause the next problem.
Cooling Towers and Evaporative Condensers
These must be notified to the local authority
Cooling towers and evaporative condensers carry the most demanding control regime, set out in HSG274 Part 1, and sit squarely inside the legionella risk assessment. Under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992 you must also notify your local authority in writing that the equipment exists, and tell them when it changes or is taken out of use.
Biocide storage and the discharge of treated water bring separate duties under your wider environmental management responsibilities.
After the Assessment: The Written Scheme of Control
Where a foreseeable risk is identified, you need a written scheme of control setting out the tasks, frequencies, control parameters and records that keep the system safe, and a named responsible person with the authority and competence to run it. The assessment is a snapshot; the scheme of control is the thing you have to keep running, month after month, and evidence when asked.
In practice that means weekly flushing of little-used outlets, monthly temperature checks at sentinel outlets and the calorifier, quarterly cleaning of showers and spray taps, and annual inspection of tanks and calorifiers. Our legionella control guide sets out the full monitoring regime, what a written scheme has to contain, the role of the responsible person and what to do when a check or a sample fails.
Records of monitoring, inspections and tests should be kept for at least five years; the risk assessment and written scheme should be kept while they are current and for at least two years afterwards.
Reporting and Outbreaks
When a case is reportable under RIDDOR
Legionellosis in a worker is reportable under RIDDOR 2013 when a doctor has diagnosed it and the person’s work involves water systems that could be a source, such as work on or near cooling towers or hot water services. One diagnosed case is enough to trigger the report.
Cases among residents, guests or members of the public reach the authorities by a different route: the diagnosing doctor notifies public health. Either way an HSE or local authority investigation usually follows, and your risk assessment and monitoring records are the first documents requested. Sites without a working accident and near miss reporting process tend to find out about problems late.
How Often Should It Be Reviewed?
There is no fixed statutory interval. A two-year review cycle is common practice, but the actual test is whether the assessment is still valid. Review it whenever:
- the water system is altered
- the use or occupancy of the building changes
- the responsible person or key staff change
- monitoring results fall outside the control parameters
- a case of legionellosis is suspected among people using the premises
- new guidance is published, or you otherwise have reason to believe it no longer reflects reality
Training
If you are appointing a responsible person, or carrying out flushing, temperature monitoring or tank inspections in-house, those people need formal training and you need a record of it. The route depends on the role.
| If you need to… | Usual route |
|---|---|
| Understand the basics | Legionella and Legionnaires’ Disease Awareness — for anyone who works with or around water systems. |
| Act as the responsible person | Legionella Risk Management for the Responsible Person. |
| Hold the dutyholder role | Legionella Management for Duty Holders. |
| Manage hot and cold water services in depth | BOHS P901 Management and Control of Building Hot and Cold Water Services. |
| Assess risk properly across the business | The wider risk assessment training courses. |
| Compare everything available | All legionella and water treatment courses. |
Frequently Asked Questions
Is a legionella risk assessment a legal requirement?
Yes, for employers, landlords and anyone in control of premises. The duty comes from the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999 and COSHH 2002. ACoP L8 has special legal status: if you are prosecuted and did not follow it, you would need to show you complied in some other way.
Do residential landlords need one?
Yes. Landlords must assess the risk in the properties they let. For a typical house or flat with a simple system, such as a combination boiler and no stored water, the assessment is usually short and the risk low. HSE does not require a “legionella certificate”, and a landlord who understands the system can carry out a simple assessment themselves. Properties with stored water, shared systems or long void periods need more. Recording the findings is only a legal requirement for employers with five or more employees, but a short written record is the simplest way to show the assessment was done.
Who is allowed to carry out the assessment?
A competent person: someone with the training, knowledge and experience to understand your water system and the risks it presents. That can be someone in-house for a simple system. For larger or higher-risk systems most dutyholders use a specialist. Useful indicators are an assessor who works to BS 8580-1 and a company that is a member of the Legionella Control Association.
How much does a legionella risk assessment cost?
It depends on the size and complexity of the water system, not the floor area. The main factors are the number of tanks, calorifiers and outlets, whether there are cooling towers, spa pools or other specialist systems, whether an up-to-date schematic exists, and whether sampling is included. Ask any assessor to quote on the system itself, and check the price covers a site survey, a schematic and a written report to BS 8580-1 rather than a desk-based template.
What happens after the assessment?
You act on the recommendations in priority order, put the written scheme of control in place, appoint and train the responsible person, and start the routine monitoring and record-keeping. Monitoring and inspection records should be kept for at least five years.
Does Envico carry out legionella risk assessments?
No. Envico is an independent training intermediary. This page is guidance, and the courses listed on it are delivered by independent training providers. For the assessment itself you need a competent assessor, as described above.
Related Guidance
General guidance only, reviewed September 2026 against the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999, COSHH 2002, HSE’s Approved Code of Practice L8 and HSG274 Parts 1 to 3. It is not a substitute for a site-specific assessment by a competent person. Envico is an independent training intermediary, does not carry out or arrange legionella risk assessments, sampling or water treatment, and is not affiliated with the HSE.