Do I need a legionella risk assessment?
If your premises has a water system, yes, and for a small low-risk building it is a simpler job than the industry lets on. The difference between the risk assessment (required) and water sampling (usually not), what the monthly checks are, who can do it, what it should cost, and the sampling contracts you do not need.
Looking for the technical detail? Read the version for professionals → ACoP L8, HSG274 Parts 1 to 3, BS 8580-1 risk assessment, temperature regimes, sampling under BS 7592 and record-keeping.
Do I need one? Yes, if your premises has a water system. That's every office, shop, restaurant, salon, workshop and rented property.
Does that mean I need water testing? Usually no. The law requires a risk assessment and a written scheme to control the risk. Sampling is for specific situations the assessment identifies. This is the single most oversold distinction in workplace compliance.
Can I do it myself? For a small, simple system, HSE says yes. For a large or complex one, no.
What the law actually requires
The Health and Safety at Work Act 1974 (sections 2, 3 and 4) and the Control of Substances Hazardous to Health Regulations 2002 (regulations 6, 7, 8, 9 and 12) require anyone in control of premises to identify and assess the risk from legionella, prevent or control it, appoint a responsible person, and keep records. HSE Approved Code of Practice L8 has special legal status: follow it and you are presumed compliant; depart from it and you must show you did something at least as good.
HSE's technical guidance for the systems most premises have. It sets out the control scheme: hot water stored at 60 degrees and distributed so it reaches 50 degrees within a minute at outlets; cold water below 20 degrees; monthly temperature checks at sentinel outlets; weekly flushing of little-used outlets; annual tank inspection; and a review of the assessment when anything changes. Not law, but it's the benchmark.
HSG274 is clear that routine sampling is not required for most hot and cold water systems. It's indicated where control is uncertain or failing, where there are vulnerable people (healthcare, care homes), where the system is complex, or during an outbreak investigation. Cooling towers and spa pools have their own sampling regimes. For an office, a shop or a rented flat, sampling is a decision, not a duty.
Insurers rarely ask about legionella for low-risk premises. Commercial leases often require the tenant to hold the assessment for the demise and the landlord for shared systems. Letting agents have a habit of requiring a "legionella certificate" from landlords; there is no such statutory document.
Northern Ireland: the same framework applies under the Health and Safety at Work (Northern Ireland) Order 1978 and the COSHH Regulations (Northern Ireland) 2003.
What this means for your premises
Small, simple system (combi boiler or small cylinder, mains cold water, no tank, few outlets, all in regular use): low risk. A competent person on site can do the assessment, and the control scheme is monthly temperatures and flushing anything unused. This is most small shops, offices and rented homes.
Medium system (stored hot water, cold water tank, more outlets, some rarely used, showers): still usually low to medium risk. The assessment is more involved, an external assessor is often sensible, and the monthly checks matter more.
Higher risk (care homes, healthcare, hotels, gyms, spa pools, cooling towers, evaporative condensers, anywhere with vulnerable occupants or aerosol-generating equipment): professional assessment, a proper written scheme, and possibly sampling.
Your options
Option A: do it yourself, for small simple systems
Use HSE's guidance for small systems. Identify the system (where the water comes in, where it's heated, where it's stored, every outlet), identify the risks (stagnation, dead legs, temperatures in the 20 to 45 degree range, aerosol-generating outlets like showers), write down the controls (temperatures, flushing, tank checks, who does what), name the responsible person, and keep a log.
Who it fits: small premises with simple systems and a sensible manager. Rented homes.
Cost: an afternoon. Then ten minutes a month for the checks.
Option B: an external assessment, with checks done in-house
An assessor from a Legionella Control Association member company assesses the system and gives you a written report with a schematic, the risks, the sentinel outlets and a control scheme. You then run the monthly checks yourself and review the assessment when anything changes.
Who it fits: stored water, tanks, showers, more than a handful of outlets, or any premises where nobody wants to own it.
Cost: £200 to £400 for a small business. Then the checks, in-house, free.
Option C: full outsourcing
Assessment, monthly monitoring visits and log-keeping by a contractor. Sensible for higher-risk premises or multi-site operators. For a single small premises it's paying £30 to £60 a month for someone to read two thermometers.
What it should cost
Assessment: £80 to £150 for a rented home, £200 to £400 for an office or small business, £500 to £2,000 or more for larger or higher-risk sites. Monthly checks in-house: nothing. Outsourced: £30 to £60 a visit. Sampling, where actually indicated: £40 to £80 a sample plus the visit. Tank clean and disinfection, where the assessment calls for it: £150 to £400.
What you shouldn’t be sold
- Routine water sampling for a low-risk premises. Not required by L8 or HSG274. The assessment and the control scheme are the requirement.
- A "legionella certificate". There's no such statutory document. The risk assessment and the log book are the records.
- Annual paid re-assessment of a simple system. Review when something changes. Two years is a common review point. Annual is a sales cycle.
- Monthly monitoring contracts for a small premises. Two temperatures and a flush log. Yours to do.
- Tank cleans on a schedule with no finding behind them. The tank is inspected annually; it's cleaned if the inspection finds it needs it.
- Chemical dosing or filtration for an ordinary building. Temperature control is the primary method for hot and cold water systems. Chemical treatment is for systems where temperature control can't be achieved.
- A three-year "water hygiene" contract. The duty is an assessment, a scheme and a log. None of that requires a term.
Check what else your business needs
Legionella is one of the specific assessments under your general risk assessment. If the building is older, asbestos is the other one most small businesses miss. Run the Compliance Check to see the full picture.
Sources
- Health and Safety at Work etc. Act 1974 — legislation.gov.uk
- Control of Substances Hazardous to Health Regulations 2002 — legislation.gov.uk
- HSE, Legionnaires' disease: the control of legionella bacteria in water systems, Approved Code of Practice L8 (4th edition) — hse.gov.uk
- HSE, HSG274 Part 2, The control of legionella bacteria in hot and cold water systems — hse.gov.uk
- HSE, Legionella and landlords — hse.gov.uk
- BS 8580-1:2019, Water quality. Risk assessments for Legionella control. Code of practice
- Legionella Control Association — legionellacontrol.org.uk
Quick answers
- Is a legionella risk assessment a legal requirement?
- Yes. Under the Health and Safety at Work Act and the COSHH Regulations, supported by HSE Approved Code of Practice L8, anyone in control of premises with a water system must assess and manage the risk from legionella. That includes offices, shops, landlords and small businesses.
- Do I need legionella testing or sampling?
- Usually not. The legal requirement is a risk assessment and a control scheme. Sampling is only recommended where the assessment says so: complex systems, vulnerable occupants, healthcare, cooling towers, or where temperature control is not working. For an ordinary office or shop, routine sampling is a cost with no legal basis.
- Can I do my own legionella risk assessment?
- Yes, if you are competent, and for a small simple system HSE says the person managing the premises can often do it. That means understanding the hot and cold water system, identifying where water could stagnate or sit between 20 and 45 degrees, and writing down the controls. For larger or complex systems use an assessor from an LCA member organisation.
- How often does a legionella risk assessment need reviewing?
- HSE guidance says review it regularly and whenever there is reason to think it is out of date, such as a change to the system, its use or the people at risk. There is no statutory interval. Two years is a common review point; an annual paid re-assessment of a simple system is not required.
- What are the monthly legionella checks?
- For an ordinary premises: monthly temperature checks at the sentinel outlets (hot above 50 degrees within a minute, cold below 20 degrees within two), flushing any little-used outlets weekly, and checking the cold water tank, if there is one, at least annually. Recorded in a log. Any competent person on site can do them.
- How much does a legionella risk assessment cost?
- A small domestic rental, £80 to £150. An office or small business, £200 to £400. Larger or higher-risk sites, £500 to £2,000 or more. Ongoing monthly checks done in-house cost nothing; outsourced, typically £30 to £60 a visit.
- Do landlords need a legionella risk assessment?
- Yes, for any rented property, but for a simple domestic system it can be done by the landlord or agent and does not need a paid certificate. There is no legal requirement for a landlord legionella certificate, whatever the letting agent says.
- What is a sentinel outlet?
- The tap nearest to and furthest from the water heater or tank, used as the representative points for monthly temperature checks. Your risk assessment should identify them.
This is general information about UK compliance, written for the person paying the bill. It isn’t legal advice. If your situation is unusual, get a professional to look at it.