Here is what UK law actually requires, broken down by the three types of legionella "testing."

The three types of legionella testing

Most of the confusion comes from conflating these three activities.

Risk assessment requirements

Every duty holder must have a documented legionella risk assessment. This is the legal baseline — without it, you cannot demonstrate compliance.

The assessment identifies hazards in your water system and sets out the control measures needed. It must be reviewed regularly (at least every two years) and updated after any changes to the water system or building use.

For landlords of simple residential properties, self-assessment is permitted. For complex systems, a specialist assessor is needed.

See our guide to risk assessments for landlords for the full process.

Temperature monitoring requirements

ACoP L8 and HSG274 Part 2 require ongoing temperature monitoring as a primary control measure. This means:

Monthly checks:

• Hot water at sentinel outlets: must reach 50°C or above within one minute of running
• Hot water storage (cylinder/calorifier): must be 60°C or above
• Cold water at sentinel outlets: must be below 20°C

Sentinel outlets are the nearest and furthest outlets from the hot water source — these represent the temperature extremes in your system.

What "monitoring" means in practice:

• Use a calibrated thermometer (digital probe thermometers are inexpensive and widely available)
• Run the outlet for one minute, then take the reading
• Record the reading with date, outlet location, temperature, and who performed the check
• Flag any readings outside thresholds for investigation

This is not optional. Temperature records are the primary evidence of ongoing compliance that inspectors look for after the risk assessment itself.

Use the Temperature Compliance Checker to verify your readings against L8 thresholds.

Microbiological testing — when it IS required

Routine microbiological testing (sending water samples to a lab for legionella culture) is not required for most domestic hot and cold water systems. HSE guidance does not mandate it for standard residential, commercial, or educational properties.

However, microbiological testing IS required or recommended in these circumstances:

If you do commission microbiological testing, samples must be analysed by a UKAS-accredited laboratory to have any evidential value. You can search for accredited testing labs on the UKAS website.

Other ongoing requirements

Beyond the risk assessment and temperature monitoring, ACoP L8 requires:

• Flushing — weekly for outlets unused for seven or more days. See our flushing guide.
• Showerhead cleaning — quarterly descaling and disinfection
• TMV servicing — annual where thermostatic mixing valves are installed
• Written scheme of control — documenting all of the above. See our written scheme guide.
• Record keeping — all monitoring, flushing, cleaning, and servicing must be recorded and available for inspection

What inspectors focus on

In a compliance check, inspectors typically ask for:

1. The risk assessment (documented, signed, reviewed within two years)
2. Temperature monitoring logs (regular, consistent, readings within thresholds)
3. Flushing records (if applicable — evidence of regular flushing of unused outlets)
4. The written scheme of control (ties everything together)

The absence of records is treated as non-compliance. Even if you have been performing all the checks, without written records you cannot demonstrate compliance.

Summary: what you must do

For most UK duty holders with standard hot and cold water systems:

• Must do: Risk assessment, temperature monitoring (monthly), flushing (weekly for unused outlets), showerhead cleaning (quarterly), record keeping, written scheme of control
• Do not need to do: Routine microbiological testing, "legionella certificates", annual professional inspections (unless system is complex)

For the full regulatory framework, see our ACoP L8 and HSG274 guide.

This guide covers legionella testing requirements under UK health and safety law as of 2026. Legislation and guidance may be updated — check the HSE website for the latest version of ACoP L8 and HSG274. This is general compliance guidance, not legal advice.

Sources

• HSE — ACoP L8: Legionnaires' disease
• HSE — HSG274: Legionnaires' disease technical guidance
• HSE — Legionella and Legionnaires' disease
• HSE — Legionella and landlords' responsibilities

ACoP L8 requires duty holders to prepare and implement a written scheme proportionate to the risk in their water system. For a landlord with a simple domestic system, this may be a brief document. For complex buildings with cooling towers or large distribution networks, a detailed multi-section scheme is expected. Here is what it should contain and how to write one that will satisfy an inspector.

What a written scheme of control is

The written scheme of control ties together all of your legionella control measures into one document. Think of it as an operating manual for your building's water hygiene management.

It answers four questions:

1. What control measures are in place?
2. Who is responsible for each task?
3. What is the monitoring schedule?
4. What happens when something goes wrong?

HSG274 Part 2, Appendix 2.2 provides guidance on the content of a written scheme for hot and cold water systems.

The 6 sections every written scheme needs

1. System description

A concise description of the building's water system:

• Water supply source (mains, private supply)
• Hot water generation (combi boiler, stored cylinder, calorifier, point-of-use heaters)
• Cold water storage (tank, direct mains feed)
• Distribution: a list or schematic of all pipe runs and outlets
• Any high-risk features: dead legs, long pipe runs, infrequently used outlets, TMVs

This section should reference the risk assessment — the two documents work together.

2. Named responsible persons

For a landlord with a small portfolio, the duty holder and responsible person are often the same person. For larger organisations, these roles are typically separated.

3. Control measures

Document each control measure, mapped to the hazards identified in the risk assessment:

4. Monitoring and recording schedule

A clear timetable of checks, who performs them, and where the records are kept:

5. Corrective action procedures

What to do when something goes wrong:

Temperature failure: If a monthly temperature check returns a reading outside thresholds (hot below 50°C at outlet, cold above 20°C):

• Investigate the cause within 24 hours (thermostat setting, insulation, pipe routing)
• Re-check after correction
• Record the failure, investigation, and corrective action
• If the failure cannot be resolved: consult a water hygiene specialist

Positive legionella sample (if testing is performed):

• Isolate the affected system or outlet immediately
• Notify the responsible person and, depending on concentration, the local authority
• Arrange disinfection
• Investigate root cause
• Review and update the risk assessment
• Record all actions

Missed monitoring tasks:

• Perform the missed task as soon as identified
• Record the gap and the reason
• Review whether any additional risk exists (e.g., an outlet was not flushed for three weeks — flush for longer and monitor temperature)

6. Review and update log

The written scheme is a living document. Record every update:

Review the written scheme whenever the risk assessment is reviewed, when the water system changes, or when monitoring reveals a pattern of non-compliance.

How it connects to the risk assessment

The risk assessment and the written scheme are two halves of the same compliance framework:

An inspector will expect to see both documents. The written scheme must reflect the current risk assessment — if the assessment identifies dead legs, the written scheme must include a flushing schedule for those dead legs.

Common mistakes

• Copying a generic template without editing it. The written scheme must be specific to your building. A template is a starting point, not a finished document.
• Not naming a responsible person. A scheme that says "the landlord will..." without naming who that is lacks accountability.
• No corrective action procedures. What happens when a temperature check fails? If the scheme does not address this, it is incomplete.
• Not updating after changes. Added a new shower room? Removed a dead leg? The written scheme must be updated to match.

Generate a written scheme for your building

A Written Scheme of Control Generator is planned for launch in the coming weeks. In the meantime, LegioLog's free tools can help you get started:

• Risk Assessment Template Generator — creates a building-type-specific risk assessment that the written scheme can reference
• Temperature Compliance Checker — check readings against L8 thresholds
• Flushing Schedule Calculator — generate a flushing schedule for section 4 of your scheme

For the full regulatory context, see our ACoP L8 and HSG274 guide.

This guide covers written scheme of control requirements under ACoP L8 and HSG274 Part 2 for England, Wales, and Scotland. This is general compliance guidance, not legal or professional advice — for site-specific schemes, consult a competent person.

Sources

• HSE — ACoP L8: Legionnaires' disease
• HSE — HSG274: Legionnaires' disease technical guidance

Here is a building-by-building breakdown of who needs one, who does not, and what triggers the requirement.

The legal trigger

The requirement comes from the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). These apply to anyone who is:

• An employer with premises containing a water system, or
• A person in control of premises (landlords, building managers, facilities managers)

ACoP L8 is the Approved Code of Practice that specifies how to comply with these duties in relation to legionella.

Do I need one? Quick reference

If your building has hot and cold water and someone other than you occupies or works in it, you need a risk assessment.

Common misconceptions

"My property is low risk, so I don't need one"

Low risk does not mean no risk. Even a simple flat with a combi boiler and no stored water has some risk — a shower that creates aerosols, an unused second bathroom, pipework running through warm spaces. The assessment may be brief and the conclusion may be "low risk, minimal controls needed" — but the assessment itself must exist.

"I need a legionella certificate"

There is no such thing as a legionella certificate in UK law. Unlike gas safety (which requires an annual Gas Safety Certificate from a Gas Safe registered engineer), legionella compliance is based on a risk assessment and ongoing records — not a one-off certificate. HSE confirms this explicitly.

"I need to hire a specialist"

Not necessarily. HSE confirms that landlords of simple domestic water systems can carry out their own risk assessment if they are competent. For standard residential properties (combi boiler or stored cylinder, no cooling tower, no complex distribution), a competent landlord can self-assess.

"Legionella testing is legally required"

Routine microbiological testing (sampling water for legionella bacteria) is not required for standard domestic hot and cold water systems. Testing is only needed in specific circumstances — usually for larger or complex systems, or after a positive sample or incident. What IS required is the risk assessment and ongoing temperature monitoring.

What triggers a NEW assessment

You need a fresh risk assessment (not just a review) when:

• You acquire a property with no existing assessment
• A property is newly built or substantially refurbished
• The water system is significantly modified (new storage, new distribution, new outlets)
• The previous assessment is lost or was never documented

For review triggers on an existing assessment, see our guide to risk assessment review frequency.

What happens if you do not have one

Enforcement follows a ladder:

1. Informal advice — an inspector tells you to get one done
2. Improvement notice — formal requirement to produce a risk assessment within a specified timeframe
3. Prosecution — fines and imprisonment under health and safety legislation, with penalties reflecting the severity of the breach

The absence of a risk assessment is not, by itself, a criminal offence — but it is strong evidence of non-compliance if a tenant falls ill or an inspector investigates.

Getting started

For landlords and building managers of standard properties, the process is:

1. Assess — use LegioLog's Risk Assessment Template Generator to create a building-specific template
2. Document — complete the assessment, sign, date, and set a review date
3. Monitor — start the ongoing temperature checks and flushing schedule. Use the Temperature Compliance Checker and Flushing Schedule Calculator to set up your routine.

For the full regulatory background, see our ACoP L8 and HSG274 guide.

This guide covers legionella risk assessment requirements under UK health and safety law. This is general compliance guidance, not legal or professional advice — for site-specific assessments, consult a competent person as defined by ACoP L8.

Sources

• HSE — Legionella and landlords' responsibilities
• HSE — ACoP L8: Legionnaires' disease
• HSE — Identify and assess sources of risk

The good news: for most residential properties, the assessment is straightforward and you can do it yourself. Here is exactly what the law requires and how to comply.

What the law actually says

There is no single "Legionella Act." The legal obligation comes from the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). These require anyone in control of premises to assess and manage risks from hazardous substances — including legionella bacteria.

ACoP L8 (Approved Code of Practice) translates these obligations into specific requirements for water systems. If you are prosecuted and you did not follow ACoP L8, a court will assume you are at fault unless you can prove you complied another way.

Key point for landlords: HSE confirms that health and safety law does not require landlords to produce a "legionella certificate." There is no equivalent of a gas safety certificate or EICR for legionella. What you must have is a documented risk assessment and evidence of ongoing control measures.

Can you do the assessment yourself?

Yes — for simple domestic hot and cold water systems. HSE explicitly states that most landlords can assess the risk themselves if they are competent to do so.

"Competent" means you understand:

• How your water system works (where water is stored, heated, and delivered)
• What conditions allow legionella to grow (stagnant water, temperatures between 20°C and 45°C, scale and sediment)
• What control measures prevent growth (temperature control, regular use/flushing, cleaning)

For a standard residential property with a combi boiler or stored cylinder, this is learnable. For complex systems (large buildings, cooling towers, stored cold water), engage a specialist.

What the assessment must cover

A compliant landlord legionella risk assessment must document:

1. Building and water system details

• Property address and type
• Water system description: combi boiler, stored hot water cylinder, cold water storage tank, or instantaneous heaters
• Number and location of every water outlet (taps, showers, basins)
• Any dead legs (sections of pipework that lead to removed or capped-off outlets)

2. Hazard identification

For each part of the water system, check:

3. Who is at risk

Identify occupants who might be exposed, especially anyone at higher risk: elderly tenants, those with respiratory conditions or weakened immune systems.

4. Control measures

Document what you are doing (or will do) to manage each identified hazard:

• Hot water stored at 60°C or above, delivered at 50°C or above at outlets
• Cold water below 20°C
• Weekly flushing of infrequently used outlets
• Quarterly showerhead descaling
• Void management — flush all outlets before new tenants move in

5. Monitoring schedule

Specify the ongoing checks:

• Monthly temperature monitoring at sentinel outlets
• Weekly flushing of unused outlets
• Quarterly showerhead cleaning
• Review date for the risk assessment itself

6. Responsible person

Name the duty holder — you as the landlord, or someone you have appointed to manage legionella compliance.

What about HMOs?

HMOs carry additional considerations:

• Shared bathrooms — multiple occupants use the same showers, increasing aerosol exposure
• Vacant rooms — when one room in an HMO is unlet, its outlets need weekly flushing
• Tenant turnover — flush all outlets during voids; assess whether the risk profile changes with new occupants
• Modified pipework — HMO conversions often create dead legs where original plumbing was capped off rather than removed

For multi-property portfolios, tracking assessments, review dates, and monitoring schedules across buildings becomes the main challenge.

What inspectors check

Local authority environmental health officers and HSE inspectors will look for:

1. A written risk assessment exists — not just "I thought about it"
2. It is specific to the property — not a generic template filed without review
3. It has been reviewed — dated, signed, with a next review date within two years
4. Evidence of ongoing monitoring — temperature logs, flushing records, showerhead cleaning records
5. Control measures match the risks — if the assessment identifies dead legs, there should be evidence of flushing or removal

The absence of records is treated as the absence of compliance.

What it costs

If you self-assess a simple residential property, the cost is your time — typically 30-60 minutes per property for the initial assessment, plus 15-30 minutes per month for ongoing temperature checks and flushing.

If you hire a specialist, typical costs range from roughly £75-150 for a basic residential assessment, though prices vary by provider, location, and property complexity.

For a multi-property portfolio, self-assessment can significantly reduce costs compared to outsourcing. The ongoing monitoring (temperature logs, flushing) is the same regardless — it cannot be outsourced for a one-off fee.

Get started with a template

LegioLog's Risk Assessment Template Generator creates a landlord-specific template with pre-populated hazards and control measures for your property type. It covers all seven sections required by ACoP L8.

For the full regulatory background, see our ACoP L8 and HSG274 guide. For guidance on review frequency, see how often to review your risk assessment.

This guide covers legionella risk assessment requirements for landlords in England, Wales, and Scotland under ACoP L8. This is general compliance guidance, not legal or professional advice — for site-specific assessments, consult a competent person as defined by ACoP L8.

Sources

• HSE — Legionella and landlords' responsibilities
• HSE — ACoP L8: Legionnaires' disease
• HSE — Identify and assess sources of risk

Here is exactly how long to flush, which outlets need it, and how to document it properly.

How long to run taps when flushing

HSG274 Part 2 does not specify a single fixed duration. Instead, it states that outlets should be flushed until the temperature at the outlet stabilises and is comparable to the supply water temperature.

In practice, this means:

* These are rules of thumb for typical domestic pipe runs. Flush longer if the temperature has not stabilised — the key test is reaching supply temperature, not a fixed time.

The two-minute guideline covers most residential and small commercial properties. For buildings with long pipe runs between the water source and distant outlets, you may need to flush for longer — check the temperature at the outlet to confirm the water is now at supply temperature.

Run both hot and cold. Flushing only the cold tap leaves hot water stagnant in the hot pipework. Both must be run.

Which outlets need flushing

Any outlet not used for seven or more consecutive days is classed as an infrequently used outlet under HSG274 and must be flushed before the next use.

Common examples:

• Vacant rental properties — every tap and shower between tenancies
• Guest rooms in hotels and B&Bs — any room not occupied for a week
• Seasonal facilities — outdoor taps, summer kitchen areas, pool showers
• Unoccupied flats in HMOs — vacant units within a shared building
• Infrequently used meeting rooms — office kitchenettes, secondary bathrooms
• School buildings during holidays — all outlets in closed wings or buildings

If you have a building where some outlets are rarely used but the building itself is occupied, those specific outlets still need weekly flushing.

How often to flush

For properties with outlets that are consistently underused, setting up a weekly flushing schedule is simpler than tracking individual outlet usage. Flush every unused outlet at the same time each week and record it.

How to flush safely

Flushing sounds straightforward — turn on the tap and wait. But there are specific precautions:

1. Minimise splashing. Legionella bacteria travel through water droplets (aerosols). Run taps gently rather than at full blast, and keep the outlet pointed into the basin or drain.
2. Ventilate the room. Open windows or run ventilation while flushing showers.
3. Showerheads on. Flush showers with the showerhead attached, not removed. The hose and head contain standing water that needs clearing too.
4. Check temperature. At the end of the flush, check the water temperature to confirm it has reached supply temperature — hot water above 50°C at the outlet, cold water below 20°C.

Recording flushing — what to log

ACoP L8 requires records of all control measures. A flushing log should capture:

For a property with 10 outlets, recording this on paper takes 5-10 minutes per flush cycle. Across a portfolio of properties, the paperwork adds up quickly.

What happens if you skip flushing

Stagnant water is the primary condition for legionella growth. Water sitting in pipes between 20°C and 45°C for extended periods allows bacteria to multiply. When the tap is eventually turned on — particularly a shower — those bacteria are aerosolised and can be inhaled.

The risk is not theoretical. Buildings that re-opened after extended closures without proper flushing protocols have experienced legionella growth in stagnant water systems.

From a compliance perspective, flushing records are commonly requested during compliance checks. No records means no evidence of compliance, regardless of whether you actually flushed.

Building a flushing schedule for your property

The practical steps:

1. List every outlet — go room by room and record every tap, shower, and water outlet
2. Identify which are infrequently used — any outlet not used at least weekly
3. Set a weekly flushing schedule — same day each week, same person responsible
4. Record every flush — date, outlet, duration, temperature, person
5. Review the schedule when occupancy changes — new tenants, seasonal closures, building works

LegioLog's Flushing Schedule Calculator generates a recommended flushing schedule based on your building type and outlet count — including a printable checklist you can use each week.

For the full regulatory context, see our ACoP L8 and HSG274 guide.

This guide covers legionella flushing requirements under HSG274 Part 2 for England, Wales, and Scotland. This is general compliance guidance, not legal or professional advice — for site-specific flushing protocols, refer to your building's legionella risk assessment.

Sources

• HSE — HSG274: Legionnaires' disease technical guidance
• HSE — ACoP L8: Legionnaires' disease
• HSE — Managing legionella in hot and cold water systems

Here is what a complete legionella risk assessment template must include — and how to tell a useful one from a box-ticking exercise.

The 8 sections every legionella risk assessment template needs

A legionella risk assessment that meets ACoP L8 and HSG274 Part 2 requirements must cover:

1. Building and system description

The template should capture: building address, type (residential, commercial, healthcare), number of floors, number of water outlets, water supply source, and a description of the water system (combi boiler, stored hot water cylinder, cold water storage tank, instantaneous heaters).

Red flag: Templates that only ask for address and building name without a water system inventory are incomplete.

2. Responsible person details

ACoP L8 requires a named responsible person — the duty holder or someone they have appointed to manage legionella compliance. The template needs fields for: name, role, contact details, and the date they were appointed.

3. Water system schematic or description

For complex buildings, a schematic showing pipe runs, tanks, outlets, and dead legs is valuable. For simple domestic properties, a written description of the hot and cold water systems is sufficient — but it must identify every outlet and storage point.

4. Hazard identification

This is where most free templates fall short. The assessment must systematically check for:

• Water stored between 20°C and 45°C (the legionella growth zone)
• Stagnant water in dead legs, unused pipework, or infrequently used outlets
• Scale and sediment build-up (provides nutrients for bacteria)
• Biofilm in pipework (supports bacterial colonies)
• Aerosol-generating outlets (showers, spa pools, cooling towers)
• Materials that support bacterial growth (rubber washers, natural fibre gaskets)

A template with a simple "Yes/No — is there a risk?" checkbox does not meet this requirement.

5. Risk rating

Each identified hazard needs a risk rating — typically High, Medium, or Low based on the likelihood of legionella growth and the potential for exposure. The template should explain the rating criteria rather than leaving it to guesswork.

6. Control measures

For each hazard, the template must record what control measures are in place and whether they are adequate. This includes:

• Temperature control (hot water stored at 60°C, delivered at 50°C at outlets, cold water below 20°C)
• Flushing regime for infrequently used outlets
• Cleaning and descaling schedule for showerheads
• Dead leg removal or management
• TMV servicing schedule

7. Monitoring schedule

The template needs to specify what checks are required and how often — temperature monitoring, flushing, cleaning — so the duty holder knows exactly what ongoing tasks the assessment has identified.

8. Review date and signature

Every assessment must be signed, dated, and have a next review date. Without these, the document has no status in an inspection.

Common problems with free templates

Looking at the templates currently available online for "legionella risk assessment template," the most common issues are:

• Generic forms — designed for any building type, with no guidance specific to landlords, care homes, or dental practices
• Missing hazard identification — a checklist of Yes/No questions rather than a systematic hazard review
• No control measures section — identifies risks but does not record what is being done about them
• No monitoring schedule — the assessment stops at identification without creating an ongoing compliance plan
• Static PDF format — cannot be updated. Every review requires printing a fresh form and starting from scratch
• No building-type context — a residential flat has different risks than a care home with a cooling tower

Static PDF vs interactive template

Most free templates are downloadable PDFs or Word documents. They work for a one-time assessment but create problems over time:

The initial risk assessment is a point-in-time exercise. But ACoP L8 requires ongoing monitoring — temperature logs, flushing records, cleaning records — that a static template cannot manage.

Building-type-specific templates matter

A template designed for an HMO should pre-populate common outlet types (shared bathrooms, multiple kitchen taps), flag stagnation risks from vacant rooms, and include fields for tenant void management. A care home template should account for vulnerable occupants, TMVs at every outlet, and more frequent monitoring requirements.

Generic templates miss these nuances, which is exactly what HSE inspectors look for — evidence that the assessment is specific to your building, not a form downloaded and filed without thought.

Generate a template for your building type

LegioLog's Risk Assessment Template Generator creates a template tailored to your building type — HMO, care home, dental practice, hotel, school, or office. It pre-populates relevant hazards and control measures so you start with a complete document rather than a blank form.

For the full regulatory context behind these requirements, see our ACoP L8 and HSG274 guide.

This guide covers what a compliant legionella risk assessment template should contain under ACoP L8 and HSG274. This is general compliance guidance, not legal or professional advice — for site-specific assessments, consult a competent person.

Sources

• HSE — ACoP L8: Legionnaires' disease
• HSE — HSG274: Legionnaires' disease technical guidance
• HSE — Legionella and landlords' responsibilities

The longer answer depends on your building type, water system complexity, and whether anything has changed since the last assessment. Here is what ACoP L8 and HSG274 require.

What ACoP L8 says about review frequency

The 2013 edition of ACoP L8 removed the previous fixed two-year interval. Instead, it requires the risk assessment to be reviewed "regularly" and "whenever there is reason to suspect it is no longer valid."

In practice, every two years has become a common industry benchmark, though L8 itself requires review "whenever there is reason to suspect it is no longer valid." Most duty holders and assessors treat the two-year interval as a reasonable baseline for low-risk properties.

Events that trigger an immediate review

Regardless of when your last review was, you need a fresh assessment if any of these happen:

• Water system changes — new pipework, removed outlets, boiler replacement, additional water storage
• Building use changes — different occupant type, change from residential to commercial, new high-risk areas (showers added, spa installed)
• Extended building closure — any period where the building was unoccupied and water systems were stagnant (extended closures are a known risk factor for legionella growth in unused systems)
• Positive legionella sample — any detection of legionella bacteria triggers an immediate review and corrective action
• Near-miss or incident — any event suggesting the control measures are not working
• Refurbishment or construction — dust and debris can contaminate water systems
• Change of duty holder — new landlord, new building manager, change of responsible person

Review frequency by building type

These intervals are the maximum gap between reviews. Any trigger event requires an immediate review regardless.

What "reviewing" actually means

A review is not just re-reading the previous document. A proper review involves:

1. Physical inspection — walk the building and check every outlet, tank, and pipe run against the previous assessment
2. Temperature checks — verify that stored and delivered water temperatures still meet thresholds (hot water stored at 60°C or above, delivered at 50°C or above at outlets, cold water below 20°C)
3. System changes — identify any new pipework, removed outlets, or changes since the last assessment
4. Occupancy changes — note any difference in building use or occupant type
5. Control measure effectiveness — are the existing controls still working? Are temperature logs showing consistent compliance?
6. Update the risk assessment document — amend and re-sign with the new review date

If you carry out your own assessment on a simple domestic property, this process can take 30-60 minutes per property. Complex buildings typically require a specialist assessor.

The cost of getting it wrong

HSE inspectors will check:

• That a written risk assessment exists
• That it has been reviewed within a reasonable timeframe
• That review dates match trigger events (if the building was refurbished and the assessment predates the work, that is a problem)

Enforcement ranges from improvement notices (fix it within a specified timeframe) to criminal prosecution under health and safety legislation.

How to track review dates

For a single property, a calendar reminder works. For multiple properties, review dates quickly become hard to track — especially when trigger events create ad hoc reviews outside the normal cycle.

LegioLog's Risk Assessment Template Generator creates a building-type-specific template that includes a review-date field so your next review date is documented from the start.

For the full regulatory background, see our guide to ACoP L8 and HSG274.

This guide covers legionella risk assessment review requirements under ACoP L8 for England, Wales, and Scotland. This is general compliance guidance, not legal or professional advice — for site-specific advice, consult a competent person.

Sources

• HSE — ACoP L8: Legionnaires' disease
• HSE — Identify and assess sources of risk
• HSE — Legionella and landlords' responsibilities

This guide cuts through the jargon and explains both documents in terms a landlord, care home manager, or building owner can actually act on.

What ACoP L8 actually is

ACoP L8 stands for "Approved Code of Practice L8" — its full title is Legionnaires' disease: The control of legionella bacteria in water systems. It is published by the Health and Safety Executive (HSE).

An Approved Code of Practice has a specific legal status. It is not the law itself — the underlying law is the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). But if you are prosecuted and you did not follow ACoP L8, a court will assume you are at fault unless you can prove you complied another way.

In practice, ACoP L8 is the minimum standard every duty holder should meet.

The current edition was published in 2013 (fourth edition). It replaced an earlier version that included technical guidance — that detail now lives in HSG274.

What HSG274 is — the technical companion

HSG274 is the technical guidance that sits alongside ACoP L8. It is split into three parts:

• Part 1: Evaporative cooling systems (cooling towers, evaporative condensers)
• Part 2: Hot and cold water systems — this is the part relevant to most landlords, care homes, hotels, and offices
• Part 3: Other risk systems (spa pools, humidifiers, water features)

For most duty holders reading this guide, Part 2 is the one that matters. It covers domestic-style hot and cold water systems — the type found in residential properties, care homes, dental practices, schools, and small commercial buildings.

HSG274 Part 1 was updated in 2024 (second edition) with improved guidance on evaporative cooling systems. Part 2 and Part 3 remain in their original editions — check the HSE website for the latest versions.

Who counts as a duty holder

ACoP L8 applies to anyone who is an employer or a person in control of premises where a water system is present. In practice, this means:

• Residential landlords (including HMOs and single lets)
• Care home managers and operators
• Dental and GP practice managers
• Hotel and B&B owners
• School facilities managers
• Commercial landlords (offices, retail units)
• Employers with water systems in their premises

If you own or manage a building with a hot and cold water system, L8 applies to you. There is no exemption for small properties or low-risk buildings — the scope of your obligations may be simpler, but the obligation to assess and manage the risk still exists.

The seven things L8 requires you to do

ACoP L8 and HSG274 together require duty holders to maintain seven categories of compliance records. Here is what each one means in practice:

1. A current written legionella risk assessment

Every building with a water system needs a documented risk assessment. This identifies the hazards in your water system — dead legs, stored water temperatures, infrequently used outlets — and sets out the control measures needed.

HSE confirms that landlords of simple domestic systems can carry out their own risk assessment if they are competent to do so. More complex systems (cooling towers, large buildings) typically require a specialist.

2. Temperature monitoring logs

Hot and cold water temperatures must be checked and recorded regularly:

Legionella bacteria thrive between 20°C and 45°C. The temperature thresholds above keep water outside this danger zone.

3. Flushing records for infrequently used outlets

Any outlet not used for seven or more consecutive days must be flushed by running both hot and cold water. HSG274 Part 2 recommends flushing until the temperature at the outlet stabilises and is comparable to the supply water — typically at least two minutes for taps and showers.

This applies to guest rooms in hotels, vacant flats, seasonal facilities, unused taps in offices, and any outlet that sees irregular use. For detailed flushing guidance, see our guide to legionella flushing run times.

4. Quarterly showerhead and flexible hose cleaning

Showerheads and flexible hoses must be cleaned and descaled at least quarterly. These components create aerosols — the fine water droplets that carry legionella bacteria into the lungs — so they are a higher-risk part of the system.

5. TMV servicing records

Thermostatic mixing valves (TMVs) — the valves that blend hot and cold water to deliver safe temperatures at outlets — need regular servicing and functional testing. Frequency depends on the manufacturer's guidance, but annual servicing is typical.

6. Cooling tower and evaporative condenser records

If your building has a cooling tower or evaporative condenser, there are additional registration, testing, and record-keeping requirements under HSG274 Part 1. Most landlords and small building managers do not have these systems, but if you do, these requirements are significantly more onerous.

7. A documented written scheme of control

The written scheme of control is your compliance plan. It documents: what control measures are in place, who is responsible for each task, what the monitoring schedule is, and what to do if something goes wrong (for example, a temperature reading outside thresholds).

Think of it as the operating manual for your building's legionella control — it ties together the risk assessment, temperature monitoring, flushing, and cleaning into one document.

How L8 and HSG274 work together

ACoP L8 tells you what you must do. HSG274 tells you how to do it.

In enforcement, HSE inspectors will check your compliance against both documents. Meeting L8 requirements using HSG274 methods is the most straightforward way to demonstrate compliance.

When to review your risk assessment

ACoP L8 requires risk assessments to be reviewed regularly. The 2013 edition removed the previous two-year fixed interval in favour of a risk-based approach. Reviews should happen:

• At least every two years as a baseline (industry standard, even though L8 no longer specifies a fixed interval)
• Immediately if the water system changes (refurbishment, new pipework, additional outlets)
• Immediately if the building use changes (different occupants, change from residential to commercial)
• After any significant event — extended building closure, positive legionella sample, near-miss

For higher-risk buildings (care homes, healthcare settings), annual reviews are appropriate. For a detailed breakdown of review intervals by building type, see our guide to risk assessment review frequency.

What happens if you do not comply

HSE continues to prioritise legionella compliance in its inspection activity. Local authority environmental health officers also have proactive enforcement powers.

The consequences of non-compliance range from improvement notices to criminal prosecution:

• Improvement notice: requires you to fix the issue within a specified timeframe
• Prohibition notice: requires you to shut down the water system until the risk is controlled
• Criminal prosecution: fines and imprisonment under health and safety legislation, with penalties reflecting the severity of the breach

Legionella risk has been heightened in recent years by buildings that were closed or underused during extended shutdowns, leaving stagnant water in systems. This underscores why ongoing monitoring is essential.

Practical compliance summary

If you manage a building with a hot and cold water system, here is what you need to have in place:

1. Risk assessment — documented, current, reviewed at least every two years or after changes
2. Temperature logs — monthly hot (>50°C at outlets, >60°C stored) and cold (<20°C) readings recorded
3. Flushing schedule — weekly flushing of any outlet unused for seven or more days, records kept
4. Cleaning schedule — quarterly showerhead and hose descaling, records kept
5. TMV servicing — annual or per manufacturer's guidance, records kept
6. Written scheme of control — documented plan tying everything together
7. Responsible person — someone named as responsible for implementing the scheme

You do not need a "legionella certificate" — no such certificate exists in UK law. What you need are records that demonstrate ongoing compliance with the requirements above. For help creating a risk assessment document, see our guide to what a template should include.

Free tools to help

LegioLog offers free tools to help duty holders manage legionella compliance:

• Legionella Risk Assessment Template Generator — generate a building-type-specific template
• Temperature Compliance Checker — check readings against L8 thresholds instantly
• Flushing Schedule Calculator — get a recommended flushing schedule for your building

This guide covers legionella compliance requirements under ACoP L8 and HSG274 for England, Wales, and Scotland. The same regulations apply across Great Britain. Northern Ireland has equivalent provisions under HSENI guidance. This is general compliance guidance, not legal or professional advice — for site-specific assessments, consult a competent person as defined by ACoP L8.

Sources

• HSE — ACoP L8: Legionnaires' disease
• HSE — HSG274: Legionnaires' disease technical guidance
• HSE — Legionella and landlords' responsibilities
• HSE — Identify and assess sources of risk