%201.svg)
A legionella risk assessment is a structured examination of the water systems in a building to identify whether conditions could allow legionella bacteria to grow and to decide what controls are needed to reduce the risk of legionnaires' disease. It's a legal requirement for employers and for landlords of rented residential property in the UK, and the standard expected is set out in the HSE's Approved Code of Practice L8.
The duty isn't new. It sits under the Control of Substances Hazardous to Health Regulations 2002, regulation 6, supported by sections 2, 3 and 4 of the Health and Safety at Work etc. Act 1974 and by regulation 3 of the Management of Health and Safety at Work Regulations 1999. ACOP L8 — the fourth edition — translates those general duties into specific operational expectations for water systems.
This page covers what the law requires, how an assessment is carried out, what good control measures look like, and the specific position for residential landlords.
What legionella is and why it matters
Legionella is a family of bacteria that occurs naturally in fresh water at low concentrations. It becomes a health risk when it multiplies in artificial water systems — hot and cold water systems in buildings, cooling towers, spa pools, evaporative condensers — and is then breathed in as fine water droplets. Inhalation of contaminated aerosol can cause legionnaires' disease, a serious form of pneumonia, particularly in older people, immunocompromised people and people with underlying lung conditions.
The bacteria grow best in water temperatures between roughly 20 and 45 degrees Celsius. They die quickly at temperatures above 60 degrees and grow very slowly below 20 degrees. Most of the practical control measures for legionella are about keeping water in the right temperature ranges and avoiding stagnation.
The bacteria are widespread in low concentrations. The duty is not to eliminate legionella but to keep its growth and dispersion suppressed to the point where exposure isn't a meaningful risk.
The legal framework
Three pieces of legislation interact.
The legislation
The Health and Safety at Work etc. Act 1974 sets the general duty: employers must protect their workers, and people in control of premises must protect anyone who could be affected by the building's water systems. The Act applies to landlords because section 4 covers the duties of people in control of non-domestic premises and water systems within them.
The Management of Health and Safety at Work Regulations 1999 require a suitable and sufficient risk assessment of all foreseeable risks. Legionella is a foreseeable risk in any building with a water system.
The Control of Substances Hazardous to Health Regulations 2002 (COSHH) explicitly cover legionella as a biological agent. Regulation 6 — the COSHH risk assessment duty — requires a specific assessment of the risk from exposure to legionella. We cover the COSHH framework more generally on our COSHH risk assessment page.
Codes, guidance, and standards
ACOP L8 — Legionnaires' disease: The control of legionella bacteria in water systems — is the HSE's Approved Code of Practice for the area. ACOP L8 has a special legal status under section 17 of the Health and Safety at Work Act: it isn't itself legislation, but if a duty-holder is prosecuted for a breach and hasn't followed ACOP L8, the court will treat that as evidence of failure to comply unless the duty-holder can show they met the duty in an equally effective way.
HSG274 — the Legionnaires' disease technical guidance — sits alongside ACOP L8 in three parts. Part 1 covers evaporative cooling systems; Part 2 covers hot and cold water systems (the part most premises need); Part 3 covers other risk systems including spa pools and humidifiers. Most legionella risk assessments work from HSG274 Part 2.
For healthcare premises an additional document applies — Health Technical Memorandum 04-01 — published by the Department of Health and Social Care, which sets stricter standards for water systems in clinical settings. BS 8580-1 is the British Standard codifying legionella risk assessment practice for hot and cold water systems.
Who must carry out the assessment
The legal duty falls on the duty-holder, which depends on the type of premises and the type of water system involved.
In a workplace, the duty-holder is usually the employer. In a non-domestic building, the duty-holder is whoever has control of the premises — typically the owner, landlord, managing agent or facilities manager. In a multi-let commercial building, the freeholder is usually the duty-holder for the building-wide water systems and the individual tenants for any systems within their own demise.
For residential rented property, the landlord is the duty-holder regardless of whether the property is a single house, a flat, an HMO or sheltered housing. We come to the residential landlord position in detail below.
The duty-holder appoints a "responsible person" — someone with sufficient authority, competence and knowledge of the water systems to take operational responsibility for the assessment and the controls. The responsible person may be an employee or an external specialist. Where the systems are complex, the responsible person almost always needs to engage technical specialists, often members of the Legionella Control Association.
The assessment in practice
The legionella risk assessment follows the same general structure as any other UK risk assessment — the five-step method — applied to water systems specifically.
Step one — identify the hazards
Map the water systems in the building. Where is water stored? Where is it heated? Where does it flow, and at what temperatures? Are there cold-water storage tanks? Calorifiers (hot water cylinders)? Showers and aerosol-producing outlets? Dead legs (lengths of pipework where water doesn't move)? Infrequently used outlets? Spray taps, drinking fountains, decorative fountains, humidifiers? Each of these is a potential point where legionella could grow or disperse.
Step two — decide who might be harmed
Tenants, employees, residents, visitors, contractors. Particular attention is needed for vulnerable groups: older people, immunocompromised people, smokers, people with underlying respiratory conditions. Care home residents, hospital patients and people receiving treatment that suppresses the immune system are at materially higher risk.
Step three — evaluate and decide controls
The HSE has been explicit that the level of detail should be proportionate to the risk. For most domestic rental properties — small water systems, regular turnover — a brief assessment recording the few risk factors and the simple controls is sufficient. For complex healthcare or commercial systems — large stored volumes, cooling towers, vulnerable populations — the assessment is correspondingly more detailed.
Step four — record the findings and put a written scheme in place
ACOP L8 specifically requires a written scheme of control where significant risks are identified. The written scheme is the operational document that records what's being done, by whom, how often, and with what records. It's distinct from the assessment itself: the assessment identifies the risk, the scheme operationalises the controls.
Step five — review
When systems change, when occupants change, after any incident, after any inspection that highlights a concern, and at intervals proportionate to the risk. There is no fixed legal review period — despite what some online guides say.
Control measures: the technical core
For hot and cold water systems, the basic control principle is straightforward. Keep hot water hot, cold water cold, and keep the water moving.
Hot water should be stored at 60 degrees Celsius and reach 50 degrees within a minute at every outlet (55 degrees in healthcare settings, where the standards are higher). At these temperatures legionella doesn't multiply. The calorifier (hot water cylinder) is the storage point; flow temperatures should be checked at sentinel outlets — typically the outlet nearest to and the outlet furthest from the calorifier.
Cold water should be kept below 20 degrees. Cold water storage tanks should be insulated and away from heat sources; in older buildings tanks in the loft are vulnerable in summer.
Stagnation is the third enemy. Water that doesn't move sits at ambient temperature and stratifies, with the cooler bottom layers entering the 20–45 degree growth zone. Outlets that aren't used regularly should be flushed weekly. Dead legs — sections of pipework that no longer feed anything but still hold water — should be removed when the system is altered. Vacant properties between tenancies need active flushing or thorough flushing before reoccupation.
Aerosol-producing outlets are the dispersal route. Showers, spray taps, hose-pipe sprays, cooling tower drift, humidifiers. These need particular attention because they're how contaminated water actually enters the lungs.
Cleaning and descaling. Limescale and biofilm provide a habitat for the bacteria. Shower heads and hoses should be cleaned and descaled regularly — typically quarterly in higher-risk settings, less often where risk is low.
Thermostatic mixing valves (TMVs) present a particular challenge: they blend hot and cold water at the outlet to a safe temperature for the user (around 38–43 degrees) and create a small reservoir of water inside the valve at exactly the temperature legionella prefers. Where TMVs are installed they need specific maintenance and the assessment should record their presence.
The landlord position
Residential landlords are subject to the same duty as commercial duty-holders but the HSE has been specific that the application is proportionate. Most domestic rental properties contain small, simple water systems — a mains-fed cold supply, a combi boiler or small cylinder, a few outlets — with regular daily use that turns the water over rapidly. The HSE has explicitly confirmed that a landlord's assessment of these systems doesn't need to be in-depth or detailed, and that for most domestic rentals the risk is generally low.
What the landlord does need to demonstrate is that they have considered the risk, recorded their assessment, and put proportionate controls in place. For a typical rental property that means:
- A documented assessment, dated, recording the system type, the risk factors identified, and the conclusion.
- Simple controls: keep the hot water cylinder set to 60 degrees, flush the system before each new tenancy, remind tenants in writing to flush outlets after the property has been vacant.
- Action on any known higher-risk features — cold water storage tanks (particularly older ones in lofts), instantaneous water heaters that don't reach safe temperatures, infrequently used shower facilities, vulnerable tenants such as those in sheltered accommodation.
- A review if the system changes, if the property is vacant for an extended period, or if the tenant changes.
A landlord can carry out the assessment themselves for a typical property — there's no legal requirement to engage a contractor. Where the property has cold water storage, complex pipework, multiple occupancy (HMOs), or vulnerable tenants, professional assessment becomes more appropriate.
Some letting agents now require landlords to engage external assessors as a matter of policy. That's a procurement preference, not a legal mandate, but it's increasingly common.
There's a recurring myth that landlords need to "test the water" or pay for laboratory analysis. The HSE has never required this for typical domestic rentals. The assessment is the legal requirement; sampling is occasionally appropriate where the assessment identifies a specific concern, but it's not a default.
Records and review
The records expected for a legionella risk assessment include:
The assessment itself, with hazards identified, controls in place and any further action needed. The written scheme of control where the risk is significant — typically commercial premises, healthcare, hotels, residential blocks with shared water systems. Temperature monitoring records where temperature monitoring is part of the scheme. Maintenance and cleaning records for tanks, calorifiers, showerheads. Records of any sampling carried out.
There is no fixed legal review period. ACOP L8 requires review when there is reason to suspect the assessment is no longer valid or when the system has changed. Many online guides cite "every two years" as a review period — this is a convention adopted by some industry providers, not a legal requirement, and we cover the actual review duty on our how often should a risk assessment be reviewed page.
For complex commercial systems, the controls within the written scheme run on shorter cycles — monthly temperature monitoring, quarterly showerhead inspection, annual deep clean, six-monthly cooling tower sampling — but those are operational frequencies for the scheme, not review intervals for the assessment.
Who can carry out the assessment
The competence requirement is the same as elsewhere in UK health and safety: skills, knowledge, experience and training appropriate to the complexity of the systems being assessed.
For a single rental property, a landlord who has reviewed the HSE guidance and understands the system can typically carry out their own assessment. For commercial premises, healthcare, multi-let buildings or any premises with cooling towers, the assessor should be a specialist — typically a member of the Legionella Control Association, holding relevant qualifications (City & Guilds 6042 in legionella risk assessment is a common credential), with documented experience in the relevant type of system.
Engaging a specialist doesn't transfer legal responsibility from the duty-holder. The duty-holder is expected to take reasonable steps to verify the assessor's competence — checking professional registration, qualifications, indemnity insurance and references. We discuss this in more detail on our page on who can carry out a risk assessment.
For organisations who want to develop in-house competence — particularly housing providers, facilities managers and managing agents with portfolios of property — formal Risk Assessment Training provides the methodological foundation, with legionella-specific training layered on top.
Frequently asked questions
Is a legionella risk assessment legally required for landlords?
Yes. All landlords of rented residential property in the UK have a legal duty to assess and control the risk of legionella exposure to tenants. The HSE has been clear that for most domestic rentals the assessment can be proportionate to the low risk involved, but the assessment itself is required regardless.
How often does a legionella risk assessment need to be reviewed?
There is no fixed legal review period. ACOP L8 requires review when there is reason to suspect the assessment is no longer valid or when the water system has changed. Some industry sources cite "every two years" but this is convention, not law. Higher-risk systems warrant more frequent review.
Can landlords carry out their own legionella risk assessments?
For typical domestic rentals, yes. The HSE explicitly allows landlords to carry out their own assessments where the system is simple and the risk is low. For HMOs, properties with cold water storage tanks, sheltered accommodation, or buildings with vulnerable tenants, professional assessment becomes more appropriate.
What temperatures should water be kept at to control legionella?
Hot water should be stored at 60 degrees Celsius and reach 50 degrees at every outlet within a minute (55 degrees at the outlet in healthcare settings). Cold water should be kept below 20 degrees. The aim is to keep water out of the 20–45 degree range in which legionella multiplies.
Is ACOP L8 the law?
No. ACOP L8 is an Approved Code of Practice with special legal status under the Health and Safety at Work etc. Act 1974. Failure to follow it can be used as evidence of failure to comply with the underlying duty, but a duty-holder can comply with the law in an equally effective way without following ACOP L8 to the letter.
