Compliance
Legionella control: the duty, the assessment and the records
The short answer
Anyone in control of premises must assess and control the risk of exposure to Legionella. There is no statutory testing interval; the risk assessment sets the monitoring regime, and ACOP L8 with HSG274 sets out how to do it. Monthly temperature monitoring is common practice in many systems, not a legal frequency.
Legionella is the compliance area where a generic schedule is most obviously inadequate. Two buildings of the same size can need entirely different regimes depending on their water systems, occupancy pattern and dead legs. The assessment is not paperwork before the work — it is the thing that determines the work.
What is required, and where it comes from
- Legal requirement
Identify and assess sources of risk from Legionella, and prevent or control the risk of exposure.
Source: Health and Safety at Work etc. Act 1974; COSHH Regulations 2002, Regulation 6
- Standard or approved code
Follow the Approved Code of Practice: appoint a responsible person, prepare a written scheme of control, monitor it, and keep records for at least five years.
Source: ACOP L8, with technical guidance in HSG274 Parts 1–3
An ACOP has special legal status — depart from it and you must show you achieved compliance another way.
- Typical practice
Monthly temperature monitoring of sentinel outlets, quarterly checks on lesser-used outlets, annual calorifier inspection and tank checks are typical in hot and cold water systems.
Source: HSG274 Part 2, common practice
Typical, not universal. The written scheme, not a template, sets what applies.
- Risk-based
Review the risk assessment when the system, its use or occupancy changes, or if there is reason to believe it is no longer valid. Intermittently occupied buildings need particular attention to flushing.
Source: ACOP L8, risk-based review
- Risk-based
Cooling towers and evaporative condensers carry substantially higher risk and must additionally be notified to the local authority.
Source: Notification of Cooling Towers and Evaporative Condensers Regulations 1992
What proves it was done
Compliance is demonstrated with records, not intentions. These are the documents an enforcing authority, an insurer or a purchaser’s solicitor will ask for.
- A current written Legionella risk assessment naming its author and date
- The written scheme of control, describing what is monitored and at what frequency
- Temperature monitoring records against sentinel and representative outlets
- Tank, calorifier and shower head inspection and cleaning records
- Records of remedial action where readings fell outside control parameters
- Records retained for at least five years
Where this usually goes wrong
- A risk assessment carried out once and never reviewed after the system changed
- Monitoring performed but out-of-parameter readings not acted on — records that prove non-compliance rather than compliance
- Buildings left intermittently occupied without a flushing regime
- Dead legs created by refurbishment and never removed or recorded
- Responsibility assumed to sit with the water hygiene contractor rather than the duty holder
What happens if it is missed
Legionnaires' disease is potentially fatal and outbreaks are investigated rigorously. Prosecutions under health and safety legislation carry unlimited fines and, in the most serious cases, custodial sentences. Corporate manslaughter charges have followed outbreaks linked to poorly managed systems.
This page is general information about compliance obligations in commercial property, not legal advice. Legislation cited applies to England and Wales unless stated; Scotland and Northern Ireland differ, particularly on fire safety. Duty holders should confirm their position against current legislation and a competent assessment of their own premises.
Frequently Asked Questions
Common inquiries regarding contract scopes, SLAs, compliance audits, and onboarding.
The law does not set an interval. It requires you to assess the risk and control it. The written scheme of control produced from your risk assessment sets the monitoring frequencies, and those will differ between buildings.
Direct Engineering Accountability. No Bureaucratic Delays.
Whether you require a comprehensive Hard & Soft FM contract, single-site mechanical & electrical maintenance, or an urgent specialist survey, EntireFM deploys certified engineers and dedicated account managers nationwide.
Comprehensive Statutory Compliance Management
Structured PPM scheduling, periodic engineering testing, statutory record keeping, and digital audit logs.
Central Operations Helpdesk
Direct helpdesk triage, reactive engineer dispatch, and clear SLA performance tracking.
Need help with legionella (l8)?
We survey what applies, what you can evidence, and what needs doing — then hold the calendar so it does not slip.