Legionella and Water Hygiene: What ACOP L8 Requires of Employers

Legionella bacteria occur naturally in water systems, and in most circumstances present no meaningful risk. The danger arises when conditions allow the bacteria to multiply — stagnant water, temperatures between roughly 20°C and 45°C, and a means of creating a fine spray or aerosol that can be inhaled, such as a cooling tower, shower, or spray tap. Legionnaires' disease, the pneumonia-like illness legionella bacteria can cause, is entirely preventable with proper water system management, which is precisely why the law places a clear, ongoing duty on employers and those in control of premises rather than treating it as a one-off inspection item.

The legal framework: ACOP L8

The relevant legal duties sit under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 1999 (COSHH), since legionella is treated as a hazardous biological agent under COSHH. The HSE's Approved Code of Practice, known as ACOP L8 — "Legionnaires' disease: The control of legionella bacteria in water systems" — sets out what compliance actually looks like in practice, with the more detailed technical guidance found in the companion document HSG274.

An Approved Code of Practice has a particular legal status: it isn't itself the law, but a court will treat compliance with an ACOP as satisfying the underlying legal duty, and departing from it means having to demonstrate an equally effective alternative approach. In practice, this means ACOP L8 functions as the de facto compliance standard that dutyholders are expected to follow.

Who counts as a duty holder?

The duty is not limited to specialist facilities with cooling towers. ACOP L8 identifies duty holders broadly as employers, those in control of premises, and anyone with health and safety responsibilities for others. This means the duty applies just as much to an office with a hot and cold water system, a hospitality business with guest showers, or a gym with spa facilities, as it does to an industrial site with a large evaporative cooling system — the level of risk and the corresponding level of control required will differ enormously, but the underlying duty to assess and manage the risk applies across all of them.

What duty holders must actually do

ACOP L8 sets out a clear sequence of obligations:

• Identify and assess risk. Carry out a legionella risk assessment covering the water systems on-site, identifying where conditions favourable to bacterial growth could arise.
• Prepare a scheme. Put in place a written scheme for preventing or controlling the identified risk — this typically covers things like water temperature management, flushing of little-used outlets, and descaling of shower heads and other fittings prone to scale and biofilm build-up.
• Implement, manage and monitor. Carry out the precautions identified in the scheme on an ongoing basis, and monitor that they're actually being followed and remain effective.
• Keep records. Maintain records of the risk assessment, the scheme, and the monitoring and maintenance activity carried out — these records are what demonstrate compliance if ever questioned by an inspector or, in the worst case, following an actual case of Legionnaires' disease linked to the premises.
• Appoint a responsible person. Name a competent person — sometimes called the "responsible person" — accountable for managing legionella risk on behalf of the organisation.

ACOP L8 also clarifies the responsibilities of water system suppliers and installers, recognising that dutyholders are often reliant on third-party contractors for elements of system design, installation, and specialist maintenance work such as cooling tower servicing.

Why this isn't a one-off task

A legionella risk assessment is not a certificate to be filed once and forgotten. Water systems, occupancy patterns, and building use all change over time — a wing of a building falling into lower occupancy, a change to hot water system configuration, or an extended closure period can all shift the risk profile meaningfully. HSG274 guidance points to periodic review as standard good practice, with a full reassessment expected whenever there's a material change to the water system or its use, and a routine review at least every two years even where nothing has obviously changed, so that the written scheme keeps pace with how the building is actually operating rather than how it operated when the original assessment was carried out.

Getting the basics right day to day

Much of ongoing legionella control comes down to unglamorous routine tasks: keeping hot water genuinely hot and cold water genuinely cold (since it's the intermediate temperature range where risk peaks), flushing outlets that aren't used regularly, and keeping shower heads and taps free of scale and biofilm. These overlap naturally with wider premises and hazardous substance control responsibilities that many facilities teams already manage, which is why legionella control tends to work best when it's built into a routine premises maintenance schedule rather than treated as a standalone compliance exercise.

Frequently asked questions

Does ACOP L8 apply to a normal office with a standard water system?

Yes. Duty holders under ACOP L8 include any employer or person in control of premises, regardless of whether the site has a high-risk system like a cooling tower or a standard office hot-and-cold water supply. The level of control needed will differ, but the underlying duty to assess and manage risk applies broadly.

Is ACOP L8 itself the law?

ACOP L8 is an Approved Code of Practice, not primary legislation, but a court treats compliance with it as satisfying the underlying legal duties under the Health and Safety at Work Act and COSHH. Departing from it requires demonstrating an equally effective alternative.

How often should a legionella risk assessment be reviewed?

HSG274 guidance points to reassessment whenever there's a material change to the water system or its use, with a routine review at least every two years as standard good practice even without an obvious trigger.

Legionella control is one of those compliance areas where the individual actions are simple, but the discipline of keeping records and reviewing the risk assessment on a genuine schedule is what separates a compliant scheme from a lapsed one. Learnsignal's CPD courses cover UK workplace health and safety compliance across water hygiene and the wider range of physical and biological hazard categories.