If you employ people, or you run the buildings they work in, legionella is not a landlord-only problem. The Health and Safety Executive is plain about it: if you are an employer, you must consider the risks from legionella. On a typical commercial site that duty sits with the employer, the facilities manager, or both. A legionella risk assessment for employers is how you show you have considered that risk — not a certificate, and not a laboratory sample. Start with the system you actually have
Use the free Legionella Risk Calculator, then arrange a legionella risk assessment through our nationwide network of assessors if the picture is more than a kettle and a combi boiler.

Who the ACoP L8 duty holder is

The legal backbone is the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). HSE’s Approved Code of Practice L8 (ACoP L8) explains how those duties apply to water systems. It is aimed at employers, people in control of premises, and anyone with health and safety responsibilities for others.Two roles get mixed up:
  • The duty holder is the employer or the person in control of the premises. The legal buck stops here.
  • The responsible person is the competent person appointed to manage the risk day to day — staff, an FM contractor, or an external specialist. Appointing them does not transfer the legal duty.
In a leased commercial office the landlord typically owns the incoming main, tanks, calorifiers and cooling plant in the common parts. The employer still has a duty for the floor they control: kitchenettes, showers, little-used WCs and any water they store or recirculate. If the lease is silent, both sides remain exposed. Write the split into the written scheme.A warehouse often looks simple until you add emergency showers, vehicle wash, evaporative condensers or a cooling tower. Those are not domestic-type systems. On a multi-site FM contract the client is usually still the duty holder; the FM firm is often the appointed responsible person. That only works if the contract gives them authority, competence and a clear scope. “We do compliance” is not a written scheme of control. Do not assume the landlord “does the water”
If your demise has showers, stored water or little-used outlets, you cannot point at the managing agent and stop there. HSE looks at who actually controls the system.

What ACoP L8 and HSG274 actually require

HSE’s summary is short: identify and assess sources of risk; manage any risks; prevent or control them; keep the right records; and carry out any other duties that apply, such as notifying a cooling tower. ACoP L8 gives those steps weight as an Approved Code of Practice. Follow it and you will normally be doing enough to comply with the law. Ignore it, and if you are prosecuted you will have to prove you complied some other way.The technical how-to is in HSG274: Part 1 for evaporative cooling systems (cooling towers and evaporative condensers); Part 2 for hot and cold water systems; Part 3 for other risk systems such as humidifiers, vehicle wash and ornamental water features.Every system needs a risk assessment. Not every system needs an elaborate control programme. A simple assessment may show the risks are low and already properly managed. Then keep those controls going and review the assessment when the system or the building’s use changes. A suitable assessment names the responsible person, describes the system, identifies where bacteria could grow and where people could inhale aerosol, sets out the controls, and records monitoring and review.

Cooling towers, evaporative condensers, and ordinary hot and cold water

Treat these as different jobs. Cooling towers and evaporative condensers create large volumes of aerosol and sit under HSG274 Part 1. You must notify your local authority if you have one, and tell them when it is taken out of use. Sampling is normally part of the control scheme, not an optional extra.Most offices and warehouses have domestic-type hot and cold water — HSG274 Part 2 — with temperature control as the usual strategy. The risk is real (showers, spray taps, little-used outlets) but it is a different order of plant from a cooling tower. Other plant falls under Part 3. If you do not know which category a piece of kit sits in, the assessment has not finished.

Temperature control: 20°C, 50°C and 60°C

Where temperature is the primary control, keep stored and distributed cold water below 20°C where you can. Store hot water at least at 60°C. Distribute it so it reaches 50°C at the outlet within one minute (55°C in healthcare — a different regime). Legionella multiplies between roughly 20°C and 45°C; below 20°C it is effectively dormant; at 60°C it is killed rapidly.Little-used outlets are the facilities manager’s everyday problem, especially where hybrid working has emptied half the taps on a floor. Flush unused outlets regularly, or isolate and drain them — and put that in the written scheme so it actually happens.

The written scheme of control — and when sampling is extra

The assessment tells you what could go wrong. The written scheme is how you stop it: a description of the system, the control measures, who does the checks, and what happens when a result is out of spec. Temperature logs, tank inspections, showerhead cleaning, TMV servicing and flushing all live here. Keep the assessment and scheme while they are current and for at least two years afterwards; keep monitoring records for at least five years. There is no legionella MOT, and no separate certificate that replaces the assessment.Sampling is not a substitute. For ordinary hot and cold water in a standard office it is usually verification — used when monitoring says the controls are not working, or when you have higher-risk plant such as a cooling tower. We have already set out the difference between testing and a risk assessment; the short version for employers is: assess first, sample when the scheme or the risk says you should. 💧 Workplace assessment: For an office, warehouse or multi-site contract, book a legionella risk assessment through our nationwide network, or request a quote.

Review regularly — there is no strict two-year rule

The old “every two years” wording was taken out of ACoP L8. Review the assessment regularly, and whenever the system, the building’s use, the responsible person or the monitoring results change, or if Legionnaires’ disease is linked to the premises. Two years is a common industry habit for a stable office. It is not a legal expiry date. Review when the building changes, not when a calendar says so
Hybrid working, a mothballed wing, a new calorifier, a contractor handover — those are the moments the assessment goes stale.

What HSE enforcement actually looks at

HSE and local authorities can issue improvement or prohibition notices and prosecute under the 1974 Act. They look for three things: did you assess the risk, did you appoint someone competent, and did you run the scheme you wrote down? Buying a report and filing it does not meet the duty.

How to get the duty in hand

1

Map who controls which systems

Write down the split between landlord plant, your demise, and any FM scope. Name the duty holder and the responsible person.2

Commission a suitable assessment

Have a competent person assess the systems against ACoP L8 and the relevant part of HSG274. Beyond a kettle and a combi, that is almost always an on-site visit.3

Run the written scheme, then review it

Put checks and flushing on a rota. Keep the records. Review when the system or the building’s use changes — not when a calendar says two years are up.

Need a Legionella Risk Assessment for Your Workplace?

Request a quote through our nationwide network via the quote form.

Guidance only — not legal advice. Requirements depend on the premises and enforcing authority. Arrange a formal on-site assessment where needed.