Blog · Water Safety

Is a Legionella Risk Assessment a Legal Requirement for Businesses?

10 July 2026 · 6 min read
A running tap in a commercial washroom
Key takeaways
  • The duty comes from the Health and Safety at Work Act 1974 and COSHH 2002, with HSE’s Approved Code of Practice L8 setting out what compliance looks like.
  • It applies to employers and anyone in control of premises with a water system, which includes ordinary hot and cold water, not only cooling towers.
  • Compliance means identifying and assessing the risk, appointing a competent person, a written control scheme, and records.
  • HSE can and does prosecute for failures without any outbreak having occurred.

Legionella is the compliance duty that most small and mid-sized businesses have never actioned, usually because they associate it with cooling towers and hospitals. The law does not. If you are an employer or in control of premises with any water system, you must assess the risk of legionella and control it. The assessment is the first, unavoidable step.

Where the duty comes from

The Health and Safety at Work etc. Act 1974 places general duties on employers and those in control of premises to protect employees and others. The COSHH Regulations 2002 require the risk from biological agents, including legionella bacteria, to be assessed and controlled. HSE’s Approved Code of Practice L8 explains how to comply; following it is not itself mandatory, but a court will treat departures from it as evidence of a breach unless you did something equally good.

General information, not legal advice.

Who the duty holder is

The employer, and anyone else in control of premises in connection with a business, including landlords and managing agents for the parts they control. In a let building the tenant is usually the duty holder for the water systems within their demise and the landlord for shared systems and common parts. The duty holder must appoint a competent person (the “responsible person”) to manage the risk, but the legal responsibility stays with the duty holder.

Which premises it applies to

Any with a water system that could create a risk: hot and cold water systems, showers, spray taps, water tanks, cooling towers and evaporative condensers, spa pools, and any other system where water is stored or circulated at the temperatures legionella grows in (roughly 20°C to 45°C) and can be inhaled as droplets. A small office with a kitchen and a WC has a water system. The risk may be low, but the duty to assess it exists. Our guide to legionella in a small office covers proportionality.

Get a legionella risk assessment

Match with competent legionella risk assessors who cover your area. No-obligation quotes.

What compliance requires

  1. Identify and assess the sources of risk: a legionella risk assessment by a competent person.
  2. Appoint a responsible person with the competence to manage the risk.
  3. Prevent or control the risk through a written scheme: temperatures, flushing, cleaning, monitoring.
  4. Keep records of the assessment, the scheme and the monitoring.
  5. Review the assessment regularly and on change.

Enforcement

HSE and local authorities enforce the duty and have prosecuted businesses for having no assessment or no control scheme, regardless of whether anyone fell ill. Legionnaires’ disease can be fatal, and a case traced to your premises brings criminal, civil and reputational consequences that no business wants to explain.

What to do now

If you have no written legionella risk assessment, commission one from a competent assessor. If you have one, check its date and whether the premises have changed; our guide to how often to review covers the triggers. ComSurv matches you with competent assessors who cover your area, with no-obligation quotes.

Sources & further reading

External links open in a new tab. ComSurv is a matching service, not a firm of surveyors, and is not affiliated with these organisations. This article is general information, not legal, surveying or valuation advice; take advice on your specific situation.

Frequently asked questions

Is a legionella risk assessment a legal requirement?+
Yes. Employers and those in control of premises with a water system must assess and control the risk of legionella under the Health and Safety at Work Act and COSHH, following HSE’s ACoP L8.
Does it apply to a small office?+
Yes, though the risk is lower and the assessment and controls are proportionately simpler. The duty to assess exists wherever there is a water system.
Who is the duty holder for legionella?+
The employer, or anyone in control of premises in connection with a business, including landlords and managing agents for the parts they control.
Can HSE prosecute without an outbreak?+
Yes. Businesses have been prosecuted for having no assessment or control scheme without anyone having fallen ill.
Related articles