Is a Legionella Risk Assessment a Legal Requirement?
There is no Act of Parliament called the Legionella Regulations, which is why this question is so often answered badly. The duty is real and enforceable, but it sits inside general health and safety law. Here is where it comes from, who carries it, and what follows if it is ignored.
The short answer
In almost all cases, yes. If you are an employer, self employed, or in control of premises in connection with work, you have a legal duty to assess and control the risk of exposure to Legionella bacteria from your water systems. The duty comes from general health and safety law, and ACOP L8 is how the Health and Safety Executive expects it to be met.
The confusion is understandable. Search for the law on Legionella and you will find L8, COSHH, the 1974 Act and HSG274 all described loosely as regulations. They are not the same kind of document and they do not carry the same weight. Knowing which is which determines what you are obliged to do and what you are merely advised to do.
This page deals only with the legal question. For the survey itself, read what a Legionella risk assessment involves.
Which regulations create the duty?
Four documents do the work. Two are law, one is an Approved Code of Practice, one is guidance.
The duty is created by the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002, supported by the Management of Health and Safety at Work Regulations 1999. ACOP L8 is the Approved Code of Practice explaining how to comply, and HSG274 is the HSE technical guidance that sits underneath it.
| Document | Status | What it does |
|---|---|---|
| Health and Safety at Work etc. Act 1974 | Primary legislation | Sections 2, 3 and 4 place duties on employers toward employees, toward non employees affected by the work, and on anyone in control of premises. |
| COSHH Regulations 2002 | Secondary legislation | Legionella bacteria are a biological agent and therefore a substance hazardous to health. Regulation 6 is the assessment duty. |
| Management of Health and Safety at Work Regulations 1999 | Secondary legislation | Requires risk assessment, access to competent help, emergency procedures and co-operation between duty holders. |
| ACOP L8, fourth edition 2013 | Approved Code of Practice | Practical advice on complying with the above, with a special legal status in prosecutions. Still the current edition. |
| HSG274 Parts 1 to 3 | Guidance | Technical detail on cooling systems, hot and cold water systems, and other risk systems. Not compulsory, but it is the yardstick. |
Why ACOP L8 is not legislation, and why that does not help you
L8 is titled Legionnaires' disease. The control of legionella bacteria in water systems. Approved Code of Practice and guidance on regulations. The fourth edition was published in 2013 and remains current. There is no fifth edition, whatever a supplier may tell you.
People sometimes read "Code of Practice" as optional. It is not, in any way that helps a duty holder. The Code sets out its own standing on its second page:
However, the Code has a special legal status. If you are prosecuted for breach of health and safety law, and it is proved that you did not follow the relevant provisions of the Code, you will need to show that you have complied with the law in some other way or a Court will find you at fault.
ACOP L8, fourth edition, 2013
In practice that reverses the burden. You may use alternative methods, but you have to be able to demonstrate them. Note too that L8 contains two kinds of text. Bold text carries Approved Code of Practice status. Normal type is guidance, and following it is not compulsory unless the Code says so. The fourth edition gave ACOP status to five areas specifically: risk assessment, the role of the appointed responsible person, the control scheme and its contents, the review of control measures, and the duties of those supplying water systems. Our guide to ACOP L8 compliance for building managers goes further into it.
Who holds the duty?
The duty holder is the employer where the risk from their undertaking affects employees or others, a self employed person where their undertaking creates a risk, or the person in control of premises or systems in connection with work. In a let building where the landlord retains responsibility for maintenance, that is the landlord.
That definition comes from paragraph 28 of ACOP L8, which is Approved Code of Practice text rather than guidance. Where several parties are involved, responsibility follows control: whoever can inspect, maintain and alter the water system is the party the law looks to.
Two consequences are worth stating plainly. First, the duty holder must appoint a competent person, often called the responsible person, with sufficient authority and knowledge of the installation to see that control measures are carried out. Paragraph 29 is equally direct about the assessor, who must also be competent.
Second, buying in a specialist does not move the duty. A legal duty under section 3 of the 1974 Act cannot be passed on by means of a contract. You can delegate the work, not the responsibility for it having been done properly, which is why the choice of assessor matters more than the invoice. See how much a Legionella risk assessment costs for what should be in the price, and Legionella risk assessments for landlords if you let residential property.
Is there an exception for very low risk systems?
Not from the assessment itself. ACOP L8 states that all systems require a risk assessment, but that not all systems will require elaborate control measures. The exemption people have in mind applies to the control regime that follows, not to whether an assessment has to be carried out in the first place.
This is the most commonly misquoted point in the sector, and it is usually misquoted in a way that leaves the duty holder exposed. A simple, well used, low risk system may need nothing more than a short written assessment concluding that risks are low and are being properly managed. That conclusion is still the output of an assessment, and it still has to be recorded and revisited when something changes.
The scope test is straightforward. The duty applies to premises controlled in connection with a trade, business or other undertaking where water is used or stored and where there is a means of creating and transmitting droplets that may be inhaled. Showers, spray taps, hoses, humidifiers and water features all create that aerosol, so few working buildings fall outside it. A finding of low risk also has to come from someone competent to make it.
What does the duty actually oblige you to do?
Five things. Identify and assess the sources of risk. Prepare a written control scheme where one is appropriate. Implement, manage and monitor the precautions. Keep records of what was done. Appoint a competent person with enough authority and knowledge of the installation to see it through.
Those five points come from paragraph 2 of ACOP L8. An assessment on its own does not discharge the duty. It is the first of five steps, and enforcement problems almost always arise in the last four.
- Assess. A suitable and sufficient assessment identifying the risk of exposure from work activities and water systems, and the precautions needed.
- Write the scheme. Where a risk needs controlling, a written scheme setting out how it will be prevented or controlled, and who does what.
- Do it and monitor it. Temperature monitoring, flushing of low use outlets, tank inspection and cleaning, on the stated frequency rather than when someone remembers.
- Record it. Records of the precautions are part of the duty in their own right. In an investigation the log is the evidence, and undocumented work is treated as work that did not happen.
- Review. Revisit the assessment whenever there is reason to think it is no longer valid: system changes, changes in use or occupancy, or controls that are not performing.
What happens if you do not carry one out?
Failure to assess and control Legionella risk is a breach of health and safety law. It can lead to enforcement action by the HSE or the local authority, including improvement and prohibition notices, and to prosecution. Enforcement does not require anyone to have fallen ill. The breach itself is the offence.
The consequences tend to arrive together rather than singly.
- Enforcement notices. An improvement notice requires the breach to be put right within a set period. A prohibition notice stops the activity, which can mean taking showers, a tank or a building out of use.
- Prosecution. If it is proved you did not follow the relevant provisions of ACOP L8, you must show you complied some other way or the court will find you at fault.
- Insurance. Cover is usually conditional on meeting statutory obligations. A missing assessment or an empty monitoring log is the sort of gap an insurer points at when a claim is made.
- Civil claims. An employee, tenant, resident or visitor who becomes ill can bring a claim, and the compliance record is the first document requested.
- Disruption. Remedial programmes carried out under pressure, after an incident, cost far more than the assessment would have done.
Where to go next
This page answers the legal question only. The rest of the detail lives on these pages.
Get your duties reviewed
If you are unsure whether the duty falls on you, or whether your records would stand up to inspection, the quickest way to find out is to have someone look at the system and the paperwork together. London Water Treatment carries out Legionella risk assessments in London and the surrounding areas from our base in Brentford, for residential and commercial premises, along with testing, sampling, monitoring, disinfection and remedial work where the assessment calls for it.
Call 020 4532 7773, or review your duties with us using the enquiry form. Tell us the property type, whether there is a cold water storage tank or a calorifier, and whether an assessment has ever been carried out.
Not sure the duty is being met?
We will tell you what applies to your building, what is missing, and what needs doing first.