What is the difference between legionella law, an ACOP, and guidance?

Legionella compliance in the UK works as a ladder of documents. At the top are Acts and Regulations, which create binding duties. In the middle sits ACOP L8, an Approved Code of Practice with a special legal status. Below that are HSE guidance documents such as HSG274, and at the bottom sit British Standards, which are voluntary technical documents. Each rung does a different job, and confusing them leads to two opposite mistakes: treating guidance as if it were law, or treating it as if it were optional to the point of irrelevance.

This page walks down that ladder. For the full picture of the legal framework, see legionella regulations and legislation; the individual documents are covered on ACOP L8, HSG274, and BS 8580-1.

The ladder at a glance

The law: where the duty actually lives

The duty to control legionella comes from general health and safety law, not from any legionella-specific statute. Section 3 of the Health and Safety at Work Act requires employers and those in control of premises to protect people who are not their employees, which is how landlords and building owners are caught. COSHH treats legionella as a biological agent hazardous to health and requires the exposure risk to be assessed and controlled. The Management Regulations add the general duty to assess risks and appoint competent people. That is the whole of the legal layer: broad duties, stated in general terms, deliberately silent on temperatures and flushing schedules.

The ACOP: the hinge of the system

ACOP L8 is where those broad duties acquire practical content, and it is the layer people most often misunderstand. An Approved Code of Practice is not a regulation, so you cannot be prosecuted for breaching L8 itself. But it has a special legal status: if you are prosecuted for breaching HSWA or COSHH and the relevant provision of L8 was not followed, the court treats that as evidence of the breach unless you can demonstrate compliance by equally effective means. In effect, L8 reverses the burden of proof. Follow it and you are presumed to have done the right thing; depart from it and you must prove your way was just as good.

The guidance: no force, but the benchmark

HSG274 and HSG282 are guidance, and they carry no legal weight of their own. Their power is practical. They were written by the same regulator that inspects premises and brings prosecutions, so they describe the standard the HSE itself considers adequate. An inspector comparing your monitoring regime against HSG274 Part 2 is not enforcing the guidance; they are using it to judge whether your controls satisfy the law. The same applies in civil claims and insurance disputes, where the guidance is routinely treated as the definition of what a competent duty holder would have done.

British Standards: voluntary, but persuasive

British Standards sit at the bottom of the ladder. Nobody is obliged to use BS 8580-1 when writing a risk assessment or BS 7592 when taking a water sample. Their value is credibility: they are agreed technical statements of how a competent job is done, so following them is the easiest way to show your work was thorough, and commissioning work to them is the easiest way to specify quality in a contract. When you compare doing your own assessment against hiring a professional, a professional report drafted to BS 8580-1 is one of the concrete things the fee buys.

How to use the ladder

Read the ladder from the top when you want to know whether a duty applies to you, and from the bottom when you want to know how to do the work. The law tells you that you must assess and control the risk. L8 tells you the machinery: assessment, written scheme of control, competent people, records. HSG274 tells you the numbers and frequencies. The British Standards tell you what a properly executed piece of work looks like. Our risk assessment builder is structured along exactly these lines, so the records it produces map onto each rung. Nothing anywhere in the ladder certifies a building as safe; every rung is about assessing, controlling, and evidencing, on a continuing basis.