UK law does not set a fixed “expiry date” for a legionella risk assessment. Under the Health and Safety at Work etc. Act 1974, the Control of Substances Hazardous to Health Regulations 2002 (COSHH) and the HSE Approved Code of Practice L8, duty holders must keep the assessment suitable and sufficient, review it regularly, and revisit it whenever there is reason to believe it is no longer valid. The old “every two years” rule of thumb is industry practice in some sectors, not a statutory calendar date.

For landlords, workplaces, care, hospitality, education and multi-occupied housing, this guide sets out what ACoP L8 and HSG274 expect, when a review is triggered, and when a fresh professional legionella risk assessment is the sensible next step.

What the law actually says about review frequency

There is no regulation that says “review every 12 months” or “every 24 months” for legionella. HSE’s landlord guidance is explicit: the law does not prescribe annual or biennial review. You must review the assessment periodically in case anything changes, and you must be able to show that risks remain under control.

ACoP L8 is the recognised route to compliance for controlling legionella in water systems. It expects duty holders to:

  • identify and assess sources of risk
  • prepare a written scheme of control where required
  • implement, manage and monitor precautions
  • keep records
  • appoint a competent person (often called the responsible person for legionella control)
  • review the assessment and control measures so they stay valid

Technical detail for hot and cold water systems, cooling towers and other risk systems sits in HSG274 Parts 1–3. The higher the hazard and the more complex the system, the tighter the monitoring — and the more often you should check the assessment still matches reality.

When you must review (trigger events)

Calendar reminders help. Trigger events matter more. Review the assessment promptly if any of the following apply:

  • the water system has been altered (new calorifier, tanks, showers, spa, dead legs removed or added)
  • the building’s use or occupancy has changed (for example, an HMO conversion, student lets after a long void, or a care setting with more vulnerable residents)
  • monitoring results show loss of temperature control, stagnation, or other control failures
  • there is a confirmed or suspected case of Legionnaires’ disease linked to the premises
  • you receive new information about risk (updated HSE guidance, insurer requirements, or enforcement advice)
  • the written scheme is not being followed, or records show gaps in flushing, cleaning or temperature checks

HSE’s landlords’ responsibilities page also stresses voids: water must not stagnate. Outlets should be used regularly; if a property is empty for an extended period, you need a flushing regime or other controls (and a review of whether your previous assessment still fits that pattern of use).

Practical review intervals by risk profile

Because the statute is risk-based, sensible intervals look different for a simple domestic let and a care home. The following is industry practice aligned with L8 / HSG274 thinking — not a substitute for your own assessment:

  • Simple domestic rental (low risk): a proportionate self-assessment is often enough at the outset. Review when anything changes, and at sensible intervals (many landlords revisit around every two years or at tenancy change / major works). Keep a short record of what you checked.
  • HMO / multi-occupied residential: more outlets, shared systems and intermittent use raise risk. Plan a documented review at least annually, and sooner after voids, refurbishment or licence conditions that mention water hygiene.
  • Offices and light commercial: typically annual review of the assessment and control scheme, with routine temperature and flushing checks in between as the scheme requires.
  • Hotels, leisure and spa facilities: aerosol-generating outlets and variable occupancy usually justify more frequent competent review and tighter monitoring under HSG274.
  • Care homes and healthcare: vulnerable occupants and complex systems normally need closer control, often with professional assessment and more frequent formal review, alongside any sector guidance (for example HTM 04-01 in dental settings).

If your last assessment is several years old or silent on controls and monitoring, commission a fresh suitable and sufficient assessment rather than a light “tick and date”.

The “every two years” myth

Many letting agents, insurers and training notes still talk as if a legionella risk assessment “expires” after two years. That language comes from older practice and from commercial convenience, not from a hard legal deadline in current L8. HSE removed the idea of a fixed biennial cycle as a legal prescription; what remains is the duty to keep the assessment valid.

Two years can still be a useful planning horizon for unchanged low-risk domestic systems. It is a poor excuse for ignoring voids, temperature failures or alterations — and the wrong answer for higher-risk premises that need annual (or more frequent) professional review.

Related point: there is still no legal “legionella certificate”. HSE is clear that sampling is not routinely required for typical domestic systems, and that landlords do not need a test certificate. What you need is an assessment and control — see our companion article Do I Need a Legionella Certificate?.

What a competent review should cover

Whether you self-review a simple domestic system or instruct a competent assessor, a meaningful review is more than rewriting the date on the front page. Check that:

  • the system description still matches what is on site (schematic or asset list)
  • temperature regimes remain appropriate (hot stored around 60°C, distribution that can deliver hot water safely, cold water kept cold and moving)
  • little-used outlets and dead legs are identified and managed
  • shower heads and other aerosol sources are cleaned on a sensible cycle
  • void / low-occupancy procedures exist and are followed
  • monitoring records exist where the scheme requires them
  • actions from the last assessment are closed out or re-prioritised

For employers and facilities managers with more complex plant, see Legionella Risk Assessment for Employers and Facilities Managers. If you are unsure whether you need sampling versus assessment, start with Legionella Testing vs Risk Assessment.

Records, enforcement and why “we meant to review” fails

Employers with five or more employees must record significant findings. Landlords of simple domestic lets are not always under that threshold, but HSE still advises keeping a record — if someone contracts Legionnaires’ disease, you may need to show you assessed and controlled the risk.

Enforcement sits under HSWA and COSHH. Courts can impose unlimited fines, and investigators look for a current suitable assessment, a workable written scheme where needed, and evidence that monitoring actually happened.

Next step for duty holders

If your assessment is outdated, silent on review triggers, or you have had voids, works or temperature problems since it was written, arrange a professional review. Safety Certificates matches you with vetted assessors for legionella risk assessments across the UK — start with a free quote and we will route the right competence for your property type.

Get a free legionella risk assessment quote · Legionella risk assessment service

Frequently asked questions

Is a legionella risk assessment legally required every two years?

–>

No. Current HSE guidance does not prescribe a fixed two-year legal interval. You must review regularly and whenever the assessment may no longer be valid. Two years is sometimes used as a planning cycle for low-risk domestic systems that have not changed.

How often should landlords review a legionella risk assessment?

Review when anything changes (system, occupancy, monitoring results) and periodically so the assessment stays current. Simple domestic lets can often be self-assessed and revisited at sensible intervals; HMOs and higher-risk premises usually need more frequent documented review.

Do I need water sampling every time I review?

Usually not for typical domestic hot and cold water systems. HSE says sampling is only needed in specific circumstances. Temperature control and keeping water moving are the primary day-to-day controls for most rented homes.

What if my property has been empty over summer?

Treat extended vacancy as a review trigger. Flush outlets before reoccupation, check temperatures, clean shower heads, and update the assessment if the pattern of use or the system has changed.

Can I review the assessment myself?

For many simple domestic systems, yes — HSE says most landlords can assess and manage the risk themselves if they are competent and inclined. For complex systems, care, hospitality, dental waterlines or larger commercial plant, instruct a competent person.

Where can I read the official rules?

Start with HSE’s ACoP L8, HSG274 technical guidance, and the landlords’ responsibilities page linked above. Those are the primary sources duty holders and courts look to.