If your building has a water system that could create water droplets or spray, you probably need a legionella risk assessment. But the details matter.
Answer the questions below to find out where you stand.
Do I need a legionella risk assessment?
Takes about 2 minutes. Your answers help us give you specific guidance.
What type of premises do you have?
Select the option that best describes your situation.
The short answer
You need a legionella risk assessment if:
- You're an employer or self-employed person with premises
- You're a landlord (including of a single residential property)
- You control premises where people could be exposed to legionella
- Your water system could produce spray, mist, or aerosols
- You have hot and cold water storage, showers, cooling towers, or spa pools
You probably don't need one if:
- You live in your own home with standard plumbing and don't rent it out
- You have only simple mains-fed cold water with no storage or spray systems
- You have absolutely no control over the premises or water systems
The legal background
Unlike fire safety, there isn't a single "Legionella Control Order." Instead, requirements come from general health and safety law:
Health and Safety at Work Act 1974
Places a duty on employers and those in control of premises to ensure the health and safety of employees and others who might be affected by their activities. This includes protecting people from legionella.
Control of Substances Hazardous to Health Regulations 2002 (COSHH)
Legionella bacteria are classified as a biological agent hazardous to health. COSHH requires you to:
- Assess the risk of exposure
- Prevent or control the risk
- Keep records of assessments and control measures
- Appoint a competent person to manage risks
Approved Code of Practice L8
The HSE's ACOP L8: Legionnaires' disease — The control of legionella bacteria in water systems provides practical guidance on compliance. While not law itself, courts treat ACOPs as the standard for what is "reasonably practicable."
If you're an employer, landlord, or have any control over a water system that could expose people to legionella, you have a legal duty to assess and manage the risk.
Who needs a legionella risk assessment?
Employers and business owners
Any business with employees needs to assess legionella risks. This applies even if you only have a simple office with toilets and a kitchenette. The assessment may conclude that risks are low and controls are straightforward, but you still need to document this.
Landlords (including residential)
All landlords have duties under COSHH, including:
- HMO landlords: Must conduct comprehensive assessments of water systems in common areas and individual units
- Blocks of flats: Assessment needed for common water systems (shared tanks, pipework)
- Single-let properties: Yes, even single houses and flats require an assessment — landlords control the water system and tenants are "others who might be affected"
- Holiday lets: Short-term accommodation has higher risks due to irregular use
Many landlords are unaware of their legionella duties. Unlike gas and electrical safety certificates, legionella risk assessments aren't routinely requested, but they are legally required.
Care providers
Care homes, nursing homes, and supported living facilities face heightened scrutiny. Residents are typically in higher-risk groups, and the Care Quality Commission (CQC) expects robust water safety management.
Facility managers and managing agents
If you manage a building on behalf of others, you likely have control over the water systems and therefore duty to assess legionella risks.
Charities and voluntary organisations
Community centres, church halls, sports clubs — if you control the premises and water systems, you need an assessment.
What triggers the requirement?
You need a legionella risk assessment if your water system includes:
High-risk systems (always require assessment):
- Cooling towers or evaporative condensers
- Hot tubs, spa pools, or hydrotherapy pools
- Water features or fountains
- Humidifiers or air washers
- Emergency showers or eye-wash stations
Common systems (usually require assessment):
- Hot and cold water storage tanks
- Showers (including electric showers)
- Taps that could create spray
- Long pipe runs or complex plumbing
- Dead-legs (unused pipe sections)
- Water systems in buildings left unoccupied for periods
Lower-risk systems (may need basic assessment):
- Simple mains-fed systems with no storage
- Regularly used, well-maintained systems
- Domestic-scale systems with predictable, frequent use
The question isn't "Do I have legionella?" but "Could legionella grow in my water system and reach people?" Most water systems can support legionella growth under the right conditions.
What about landlords specifically?
Landlords' legionella duties cause particular confusion. Here's the position:
Your legal duty
Under COSHH, as the person in control of a residential property's water system (even if tenants use it), you must:
- Identify and assess sources of risk
- Implement control measures to minimize risk
- Keep records of the assessment
- Review the assessment regularly (at least every 2 years or when circumstances change)
What this means in practice
For a simple residential property (house or flat with standard plumbing):
- Conduct a basic risk assessment (you may be able to do this yourself)
- Check for stored water tanks, dead-legs, or rarely-used outlets
- Ensure the system is simple, well-maintained, and in regular use
- Provide tenants with basic information (flush taps after holidays, report issues)
- Keep records
For more complex properties (HMOs, flats with communal systems):
- Professional assessment recommended
- Implement temperature monitoring and flushing regimes
- Provide tenants with clear instructions
- Inspect regularly
- Keep comprehensive records
Tenant responsibilities
Tenants should:
- Use the water system normally and regularly
- Report maintenance issues promptly (dripping taps, broken showers, low temperature)
- Follow any instructions provided by the landlord
- Flush taps and showers after absence
The HSE has clarified that landlords of single residential properties can conduct their own simple assessments if the system is straightforward. However, if in doubt, professional assessment provides certainty and liability protection.
What about care homes?
Care homes face the most stringent requirements. Residents are typically in high-risk groups (elderly, with underlying health conditions), and the consequences of an outbreak could be severe.
CQC expectations:
- Comprehensive legionella risk assessment by a competent person
- Detailed written control scheme
- Regular water temperature monitoring (often weekly)
- Monthly checks of calorifiers, TMVs, and sentinel outlets
- Quarterly cleaning and disinfection of showerheads
- Six-monthly or annual water sampling
- Staff training on water safety
- Clear records of all activities
Who is responsible:
- The registered manager is accountable to CQC
- A designated responsible person should oversee day-to-day water safety
- Many care homes appoint external specialists for assessments and water sampling
CQC inspections routinely check water safety management. Inadequate controls can lead to requirement notices or even prosecution if residents are put at risk.
What about offices?
Standard offices typically present lower legionella risks, but assessment is still required.
Typical office scenario:
- Simple hot and cold water system
- Toilets with spray taps or mixer taps
- Kitchen area with hot water
- Regular weekday use
- Occasional periods of closure (weekends, holidays)
What you need:
- Basic risk assessment identifying water sources
- Confirmation that water is used regularly
- Flushing protocol for after extended closures (e.g., Christmas shutdown)
- Temperature checks occasionally to verify hot water is hot and cold water is cold
- Simple records
Professional assessment recommended if:
- The office has showers or complex plumbing
- There are multiple floors with long pipe runs
- Some areas are used infrequently
- You have air conditioning with humidifiers or cooling systems
What does a legionella risk assessment involve?
A compliant legionella risk assessment should:
1. Identify hazards
- Map all water systems (hot, cold, storage, distribution)
- Identify sources of aerosols (showers, taps, cooling towers, etc.)
- Note any stored water or infrequently used sections
2. Assess who is at risk
- Consider vulnerable groups (elderly, immunocompromised, smokers, those with lung conditions)
- Evaluate exposure routes (who uses showers, who drinks the water, etc.)
3. Evaluate the likelihood of legionella growth
- Water temperatures (ideal growth range: 20-45°C)
- Stagnation (infrequently used outlets, dead-legs)
- Nutrients (rust, scale, biofilm, organic matter)
4. Document findings
- Schematic diagrams of water systems
- Photographs of key equipment
- Temperature measurements
- Assessment of current control measures
- Risk rating for each identified hazard
5. Recommend control measures
- Temperature management (hot above 50°C at outlets, cold below 20°C)
- Regular flushing of little-used outlets
- Cleaning and descaling programs
- Monitoring and inspection schedules
- Staff training requirements
6. Create a written control scheme
- Who is responsible for water safety
- What checks are required and how often
- What records must be kept
- Review and audit procedures
DIY vs. professional assessment
You might assess the risk yourself if:
- You have a simple, well-understood water system
- The premises is low-risk (small office, simple rental property)
- You're competent to understand water systems and legionella control
- You're willing to take responsibility for the assessment
Resources for DIY assessment:
- HSE's ACOP L8 guidance
- HSE's free template for landlords
- Industry guides from professional bodies
You should use a professional if:
- You have complex water systems (multiple tanks, long pipe runs)
- High-risk premises (care homes, hospitals, large hotels)
- Cooling towers or spa pools
- You're unsure about any aspect of legionella control
- You want liability protection
What to look for in a professional:
- Membership of the Legionella Control Association (LCA)
- Experience with your type of premises
- Willingness to explain findings clearly
- Provision of a written control scheme and actionable recommendations
An assessment is only useful if you implement the recommended controls and maintain records. Many organisations conduct assessments but fail to follow through with ongoing management.
Common questions
Frequently Asked Questions
The HSE recommends reviewing assessments at least every two years, or sooner if there are significant changes to the water system, building use, or occupants. Care homes and high-risk premises often review annually. Any time you modify plumbing, change water treatment, or have periods of building vacancy, you should review the assessment.
Yes. Failure to assess and control legionella risks is a breach of COSHH and the Health and Safety at Work Act. The HSE can issue improvement notices, prohibition notices, or prosecute. Fines are unlimited in the Crown Court. If someone contracts legionnaires' disease due to your negligence, you could face imprisonment and, in the worst cases, corporate manslaughter charges.
Not always. Legionella bacteria are present in most water systems at low levels. Testing tells you if bacteria are present, but not necessarily if your controls are adequate. The HSE emphasizes that controlling water temperatures and preventing stagnation is more important than routine sampling. However, sampling may be appropriate for high-risk premises, after remedial work, or to verify control measures are effective.
A risk assessment is the initial document identifying hazards and recommending controls. A water hygiene inspection (or water testing visit) is an ongoing activity to check that controls are working — measuring temperatures, inspecting for scale or corrosion, taking water samples if needed. You need the assessment first, then regular inspections to ensure compliance.
As the landlord and property owner, you retain the duty to ensure a legionella risk assessment is conducted. However, you can delegate the task to your managing agent. Ensure your agency agreement specifies who is responsible for legionella compliance. Even if the agent conducts the assessment, you remain ultimately accountable, so ask for evidence that it's been done.
Water stored at temperatures above 60°C kills legionella bacteria. The HSE recommends: hot water stored at 60°C or higher, distributed so it reaches at least 50°C at all outlets within one minute, and cold water stored and distributed below 20°C. Thermostatic mixing valves (TMVs) can be fitted at outlets to prevent scalding while maintaining safe storage temperatures.
There's no such thing as a 'legionella certificate' in the way there's a gas safety certificate. What you need is a written legionella risk assessment documenting your water systems, identified risks, and control measures. Some water treatment companies issue certificates after sampling or inspections, but these don't replace the requirement for a full risk assessment.
Your tenancy agreement should include clauses allowing access for safety inspections and maintenance. Give proper notice as specified in the agreement (usually 24 hours). If a tenant persistently refuses access, you may need legal advice, as you cannot fulfill your COSHH duties without assessing the water system. Document all attempts to gain access.
Stagnant water systems are high-risk. Before reoccupying, you should flush all outlets thoroughly (run taps and showers for at least 5 minutes each), check water temperatures, and consider chlorination or professional cleaning if the building has been empty for an extended period. Update your risk assessment to reflect the changes in use. Some premises may require water sampling before reoccupation.
Yes, instantaneous water heaters that draw directly from the cold mains without storage have lower legionella risk, provided the cold supply itself is safe. However, showerheads and hoses can still harbour bacteria if not cleaned regularly, and any stored cold water upstream is still a potential risk. They're not risk-free, just lower risk than systems with stored hot water.
What happens if you don't comply?
Legionella enforcement may be less visible than fire safety enforcement, but it's taken very seriously — particularly after legionnaires' disease outbreaks.
Potential consequences:
- Improvement notices requiring specific actions within a timeframe
- Prosecution with unlimited fines (companies have been fined hundreds of thousands of pounds)
- Imprisonment for up to two years for individuals in serious cases
- Corporate manslaughter charges if legionnaires' disease results in death
- Civil claims from individuals who contract the disease
- Reputational damage — legionella outbreaks attract significant media attention
- CQC enforcement action for care providers (requirement notices, suspension of registration)
Legionnaires' disease is a notifiable disease. If someone contracts it, the local authority and HSE will investigate potential sources, including your premises if there's any connection. Having no risk assessment or inadequate controls significantly increases your liability.
Getting started
If you've determined you need a legionella risk assessment:
1. Appoint a responsible person
Identify who in your organisation will oversee water safety. This person should be competent (trained or experienced) and have authority to implement changes.
2. Gather information about your water systems
- Locate water storage tanks
- Map the distribution of hot and cold water
- Identify all outlets (taps, showers, toilets, outside taps)
- Note any special features (cooling systems, water features)
3. Conduct or commission the assessment
Decide whether you can assess the risk yourself or need professional help. Document everything.
4. Implement control measures
Don't let the assessment sit on a shelf. Implement the recommended actions.
5. Establish monitoring and record-keeping
Set up a schedule for temperature checks, flushing, and other control measures. Keep records.
6. Review regularly
Reassess every two years or when circumstances change.
Need expert help with your legionella assessment? A qualified water hygiene specialist can assess your systems, implement controls, and give you peace of mind that you're fully compliant.
Related content
- What is a legionella risk assessment?
- Landlord legionella responsibilities explained
- Water system safety checker tool
Disclaimer: This guidance is for general information and is based on UK law and HSE guidance as of December 2025. It does not constitute legal or professional advice. For specific situations, consult a qualified water hygiene specialist or health and safety advisor. Laws and guidance may change.