BS 8580-1: The British Standard for Legionella Risk Assessment

BS 8580-1:2019 is the British Standard that sets out how to carry out a legionella risk assessment. It is a code of practice from BSI giving recommendations on assessing the risk of Legionnaires' disease from man-made water systems.

The standard is often confused with the law itself. It is not. It is a voluntary code of practice that describes the recognised method for the assessment that ACOP L8 and COSHH require, which is why auditors and insurers treat it as the benchmark for good practice.

What BS 8580-1:2019 covers

BS 8580-1:2019 was published by BSI on 30 January 2019. Its full title is "Water quality. Risk assessments for Legionella control. Code of practice", and it replaced the older BS 8580:2010, which is withdrawn.

The standard gives recommendations and guidance on how to assess the risk of Legionnaires' disease from man-made water systems. That includes hot and cold water services, cooling towers, evaporative condensers, spa pools and any other system that can generate and disperse a water aerosol.

One point is easy to miss: BS 8580-1 is a code of practice in the form of guidance. It does not prescribe a single correct way to run every assessment, and it is not a form you fill in. It sets out the principles a competent legionella risk assessment should follow, what a good assessment should contain, and how the risk should be judged and recorded.

BS 8580 vs ACOP L8 and HSG274: which one is the law?

A common misconception is that a "BS 8580 assessment" is a legal requirement, or that the standard replaces ACOP L8. It does neither.

The legal duty comes from the Health and Safety at Work etc Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). These require dutyholders to assess and control the risk from legionella. ACOP L8 is the HSE's Approved Code of Practice, and it carries special legal status: follow it and you can be taken to have complied with the law; depart from it and you must show you achieved compliance another way. HSG274 (Parts 1 to 3) is HSE technical guidance on how to control legionella in specific system types.

BS 8580-1 sits alongside these documents. ACOP L8 and HSG274 tell you what has to be controlled. BS 8580-1 describes how the risk assessment behind those controls should be carried out. A useful way to hold it: L8 is the legal expectation, BS 8580-1 is the recognised method. The table below shows where each document sits.

HSE ACOP L8, HSG274 and BSI BS 8580-1:2019 / BS 8580-2:2022

What a BS 8580 legionella risk assessment includes

The standard sets out the building blocks of a competent assessment. In practice a BS 8580-1 assessment should capture:

• A description and asset register of the water system, ideally with an up-to-date schematic diagram
• Where conditions favour legionella growth, such as water stored or stagnating in the 20°C to 45°C range, dead legs, infrequently used outlets and areas of low turnover
• Who could be exposed, including anyone more susceptible to infection
• The existing control measures and how well they are working, for example whether cold water stays below 20°C and hot water is stored at 60°C and delivered at 50°C (55°C in healthcare)
• A risk rating or score reflecting the likelihood and consequence of exposure
• Clear, prioritised recommendations and a date for review

BS 8580-1 also stresses that the assessment is a description of risk at a single point in time. It records what was found and what should be done. It does not, on its own, make a system safe. See our page on legionella temperature control for the figures the assessment checks against.

BS 8580-1 vs BS 8580-2 vs BS 8558

The numbering trips people up, so it helps to separate the three standards.

BS 8580-1:2019 covers legionella risk assessment. BS 8580-2:2022 is its companion part, covering risk assessment for Pseudomonas aeruginosa and other waterborne pathogens whose control is not fully addressed by legionella guidance. If your concern is Legionnaires' disease, Part 1 is the relevant document. If you are assessing augmented care settings or other Pseudomonas risks, Part 2 applies.

BS 8558 is a different standard entirely. It covers the design, installation, testing and maintenance of services supplying water for domestic use within buildings, and is the guidance companion to the Water Supply (Water Fittings) Regulations. BS 8558 deals with how water systems are built and supplied. BS 8580-1 deals with assessing the legionella risk within them. The two are complementary rather than alternatives.

Is a BS 8580 assessment a legal requirement, and who can carry one out?

No law names BS 8580-1 as mandatory. What the law requires is a suitable and sufficient risk assessment carried out by a competent person. BS 8580-1 has become the recognised benchmark for what "suitable and sufficient" looks like, so auditors, insurers and enforcing officers commonly expect an assessment to follow it, even though it remains a voluntary standard.

On competence, BS 8580-1 places weight on the assessor having the knowledge, training and experience to understand the water system and judge the risk. A generic checklist completed by someone unfamiliar with the system is unlikely to meet the standard. The dutyholder remains responsible for acting on the findings, whoever carries out the assessment. See our page on the legionella responsible person role for how that accountability works.

From BS 8580 assessment to a working record of control

An assessment that follows BS 8580-1 is only the start. Its recommendations have to become a live record: temperature checks, outlet flushing, tank inspections and any sampling, each logged as it is done. Many systems fall down here, not in the quality of the original assessment but in whether its actions are carried out and evidenced afterwards.

Our free legionella risk assessment template gives you a structured place to record what your BS 8580 assessment found and to log each control as you complete it. It is a recording tool, not a certificate of compliance, and it does not replace a competent assessment of your specific system.