Is legionella covered by COSHH?
On this page
Key points
- COSHH 2002 treats legionella as a biological agent, which makes controlling it a specific regulatory duty, not just good practice.
- Four regulations do the work: regulation 6 (assess), regulation 7 (control exposure), regulation 9 (maintain the controls), and regulation 12 (inform and train).
- Your legionella risk assessment is the COSHH assessment for this hazard; you do not need two documents.
- ACOP L8 is the approved code showing how to meet COSHH for legionella, and HSG274 supplies the technical method.
COSHH, the Control of Substances Hazardous to Health Regulations 2002, is the regulation that makes legionella control a specific legal duty. Because COSHH's definition of a hazardous substance includes biological agents, legionella falls squarely inside it, and four of its regulations map directly onto the legionella regime every duty holder knows: assess, control, maintain, inform.
Most duty holders meet COSHH for legionella without ever writing "COSHH" on a document, because the legionella framework under ACOP L8 is how the HSE expects the COSHH duties to be discharged for this particular agent. This page shows where the two join up. For the wider legal map, see the regulations and legislation guide.
Why legionella is a COSHH issue at all
COSHH is usually associated with chemicals: solvents, dusts, fumes. But its definition of "substance hazardous to health" expressly includes micro-organisms that create a hazard comparable to those chemicals. Legionella qualifies, and the approved classification of biological agents places Legionella pneumophila in Hazard Group 2: capable of causing human disease, a potential hazard to people exposed, unlikely to spread through the community, and usually treatable.
That classification is why an inspector citing the law on legionella will typically cite COSHH. The Health and Safety at Work etc. Act 1974 states the broad duty; COSHH makes it specific to this bacterium; ACOP L8 then describes the framework the HSE expects you to use to satisfy both.
The four regulations that do the work
| COSHH regulation | What it requires | The legionella equivalent |
|---|---|---|
| Regulation 6: assessment | Assess the risk to health from the hazardous agent before work exposes people to it | The legionella risk assessment: identify the system, the exposure routes, who is at risk |
| Regulation 7: prevention or control of exposure | Prevent exposure where reasonably practicable; otherwise adequately control it | The written scheme of control: temperature control, flushing, cleaning, removal of dead legs |
| Regulation 9: maintenance of control measures | Keep engineering controls and systems of work in efficient working order | The monitoring regime: temperature checks, inspections, servicing, all recorded |
| Regulation 12: information, instruction and training | Tell people about the risks and the precautions, and train them to work safely | Training the responsible person and anyone who carries out checks |
Read down the right-hand column and you have the whole of a normal legionella compliance regime. That is not a coincidence: ACOP L8 was written to give practical effect to COSHH for water systems, so following L8 is the recognised way to comply with the regulations behind it.
One assessment, not two
A question that comes up in audits is whether the file needs a document literally titled "COSHH assessment" for legionella. It does not. Regulation 6 requires a suitable and sufficient assessment of the risk from the agent; a legionella risk assessment following BS 8580-1 does that job in more depth than any generic COSHH form. Duplicating it in a second format creates two documents to keep consistent and reviewed, which is a compliance risk in itself.
Where COSHH thinking genuinely adds something is at the edges. Regulation 7's hierarchy, prevent exposure first, control it only where prevention is not reasonably practicable, is the right test for design decisions: removing a dead leg beats flushing it forever, and replacing a spray tap beats descaling it every month. And regulation 12 is a reminder that training is a legal duty, not an optional extra: the person running the weekly flush needs to know why the outlet is on the list and what temperature it should reach.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
Where COSHH stops and L8 starts
COSHH is hazard-neutral: the same regulations cover wood dust, bleach and legionella alike. It tells you to assess and control exposure, but nothing about water temperatures, calorifiers or shower heads. That specificity is what ACOP L8 and HSG274 provide, and it is why the three documents are always cited together. If COSHH is the reason the duty exists, L8 is how you show you met it, and HSG274 is where you find the numbers, such as hot water stored at 60°C and cold water kept below 20°C.
COSHH supplies the duty, L8 supplies the framework, HSG274 supplies the figures. A legionella file that satisfies the L8 framework satisfies COSHH for this hazard.
Landlords and COSHH
COSHH's duties fall on employers for their employees, which prompts landlords to ask whether it applies to them at all. The honest answer is that the destination is the same even though the route differs: section 3 of the 1974 Act extends the duty to people affected by your undertaking, tenants included, and ACOP L8 is written to cover landlords on that basis. A landlord who carries out a proportionate assessment and records it is doing everything COSHH would have asked anyway. See who is responsible in rented property for the landlord-specific position, and the risk assessment builder for a structured way to record it.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
Frequently asked questions
Is legionella covered by COSHH?
Yes. COSHH covers substances hazardous to health, and its definition of a substance includes micro-organisms. Legionella is treated as a biological agent under the Control of Substances Hazardous to Health Regulations 2002, which is what turns the general duty in the Health and Safety at Work etc. Act 1974 into a specific obligation to assess and control exposure to legionella in water systems.
Do I need a separate COSHH assessment for legionella?
No. A legionella risk assessment carried out in line with ACOP L8 and BS 8580-1 is the COSHH assessment for this hazard: it identifies how people could be exposed, who is at risk, and how exposure will be controlled, which is exactly what regulation 6 requires. Producing a second, parallel document adds nothing. What matters is that the one assessment is suitable, sufficient, recorded and reviewed.
What hazard group is legionella?
Legionella pneumophila is classified in Hazard Group 2 under the approved classification of biological agents: an agent that can cause human disease and might be a hazard to workers, but is unlikely to spread to the community, and for which treatment is usually available. Hazard Group 2 does not require containment-level laboratories for ordinary building water systems, but it does require the exposure risk to be assessed and adequately controlled.
Does COSHH apply to landlords?
COSHH binds employers in respect of their employees, but the practical answer for landlords is that the same outcome is required anyway. Section 3 of the Health and Safety at Work etc. Act 1974 extends the duty to people affected by your undertaking, which includes tenants, and ACOP L8 is written on the basis that landlords assess and control the risk. So while the legal route differs, a landlord ends up doing the same assessment and control work COSHH points to.
Related water hygiene products and services from trusted UK providers will appear here.