Commercial Legionella Risk Assessment: The UK Guide for Duty Holders
If the Health and Safety Executive knocked on your door tomorrow and asked for evidence of your current Legionella risk assessment, would you be able to produce a dated, site-specific document within minutes?
For many commercial property managers, this is the compliance gap that goes unnoticed until something goes wrong. Legionella is one of the most strictly regulated water hygiene risks in UK commercial premises, and the law does not care whether you knew about your obligations or not. The duty holder is responsible by default.
This guide covers what a Legionella risk assessment is, who is legally required to have one, what an assessment examines, the temperatures and conditions that matter, and what happens when duty holders get it wrong.
What is a Legionella risk assessment?
A Legionella risk assessment is a written evaluation of the potential for Legionella pneumophila bacteria to grow and spread within a building’s water systems. It is required under the Health and Safety at Work Act 1974 and the Control of Substances Hazardous to Health Regulations 2002, and is detailed in the Approved Code of Practice L8 (ACoP L8) and HSE technical guidance HSG274.
The assessment identifies sources of risk, the people who could be exposed, the likelihood of bacteria proliferating, and the control measures already in place. It must be carried out by a competent person and reviewed regularly.
Who is legally responsible?
Responsibility falls on the duty holder, which in commercial premises is typically the employer, building owner, or person in control of the premises. The legislation also distinguishes between a responsible person (overall accountability) and a competent person (technical management of the risk).
Common duty holders include landlords of commercial properties, occupiers of office buildings, retail premises owners, healthcare facility operators, hospitality managers, and warehouse and manufacturing operators. If your premises have hot and cold water systems, cooling towers, evaporative condensers, or spa pools, you have a Legionella duty whether you have formally documented it or not.
Legionella control temperatures
| Temperature | Effect on Legionella | Commercial Compliance Reference |
|---|---|---|
| Above 60°C | Killed within 2 minutes | Hot water storage minimum |
| 50 to 60°C | Killed within minutes to hours | Hot water distribution and outlet minimum |
| 20 to 50°C | Active growth range | Avoid in storage and distribution |
| Below 20°C | Dormant but viable | Cold water maximum |
Water temperature is the single most important factor in controlling Legionella. The HSE specifies clear control parameters that every commercial water system should be monitored against, with records kept to evidence compliance.The growth range from 20 to 45°C is widely accepted as the critical zone where Legionella multiplies most rapidly. Any part of a water system that holds water in this range, particularly with stagnation, presents a heightened risk.
How often should a Legionella risk assessment be reviewed?
The HSE requires Legionella risk assessments to be reviewed regularly, and always when there is reason to believe the original is no longer valid. The two-year benchmark for a full review is widely accepted across industry, but it is not a statutory minimum. Any significant change in the system, occupancy, or risk profile resets the clock.
| Trigger | Action Required |
|---|---|
| Standard review interval | Full review every two years as best practice |
| Change to the water system | Updated risk assessment |
| Change of building use or occupancy | Updated risk assessment |
| Significant change in control measures | Updated risk assessment |
| Outbreak or suspected case of Legionnaires’ disease | Immediate review and investigation |
| Findings suggest existing assessment is no longer valid | Updated risk assessment |
What does a Legionella risk assessment cover?
A compliant assessment examines the entire water system, including:
- Asset register: a schematic of the system with all components identified.
- Temperature monitoring: hot and cold water temperatures recorded at sentinel points.
- Stagnation risk: dead legs, infrequently used outlets, and low-flow areas.
- Tank and cistern condition: inspection of stored water assets for sediment, contamination, or microbial growth.
- Control measures in place: existing flushing regimes, biocides, and treatment programmes.
- Competency check: confirmation that the people managing the system are trained and capable.
The output is a written report identifying current risks, recommended actions, and a schedule of ongoing monitoring tasks.
Consequences of non-compliance
Failure to manage Legionella risk is treated seriously by enforcement bodies. The HSE can issue improvement notices, prohibition notices, and prosecute under the Health and Safety at Work Act 1974. Recent prosecutions have resulted in fines of hundreds of thousands of pounds, and in cases involving fatalities, custodial sentences for directors.
- Insurance void. Business insurance policies routinely require evidence of Legionella compliance.
- Reputational damage. Outbreaks attract national news coverage and Environmental Health Officer involvement.
- Business interruption. An outbreak can force temporary closure while investigations and remediation take place.
Managing Legionella compliance across multiple sites
For property managers responsible for multiple premises, the difficulty is consistency. Each site has its own water system, its own last assessment date, and its own ongoing monitoring tasks. The most common failure mode is missed reviews, where an assessment from three years ago is treated as still valid because no one is tracking the renewal date.
A unified approach combines a centralised compliance register, scheduled reviews flagged ahead of time, and a single competent partner producing assessments in a consistent format. This is what proper planned preventative maintenance looks like for water hygiene.
Where to go from here
At TMS Facilities Management, our Electrical & Compliance team carries out Legionella risk assessments, water temperature monitoring, and water system remediation across commercial sites throughout the UK and Ireland. We hold all assessments centrally and flag reviews before they expire.If you would like a review of your current Legionella compliance position, get in touch with our team.