Is a legionella risk assessment a legal requirement?

Yes, a legionella risk assessment is a legal requirement. If you have control of premises that contain a water system, whether as an employer, a self-employed person, or a landlord, you have a legal duty to assess the risk from legionella and to control it. This applies to a single rented flat with a combination boiler just as it applies to a hospital, although what a suitable assessment looks like differs enormously between the two.

The duty is sometimes doubted because there is no law called the Legionella Act and no legionella certificate to apply for. The requirement is real nonetheless; it is simply assembled from general health and safety law rather than one dedicated statute.

Where the legal duty comes from

The duty rests on a chain of legislation, explained in full in the UK legal framework:

• the Health and Safety at Work etc Act 1974, sections 2 and 3, which require employers and those in control of premises to protect employees and others from risks to their health;
• the Control of Substances Hazardous to Health Regulations 2002, regulation 6 of which requires an assessment of the risk from exposure to hazardous substances, including biological agents such as legionella;
• the Management of Health and Safety at Work Regulations 1999, which require risk assessment and the arrangements to manage the risks identified.

Sitting beneath these is ACOP L8, the Approved Code of Practice on the control of legionella in water systems. An Approved Code has a special legal status: if you are prosecuted for a breach and it is shown you did not follow the Code, you need to demonstrate you met the requirement some other equally effective way. HSG274 is the technical guidance that puts the numbers, temperatures and frequencies behind it.

Who the duty catches

The duty falls on the duty holder: the employer, the self-employed person, or the person in control of the premises. The HSE states plainly that this includes landlords of residential accommodation, because a tenancy puts the landlord in control of premises where other people live. Letting agents managing property take on the duty by arrangement. Owner-occupiers of their own private homes are outside it, because there is no employment or tenancy relationship. For rented property specifically, see who is responsible for legionella in a rented property.

What the law does not require

Three myths persist, and correcting them matters as much as confirming the duty itself. First, there is no legal legionella certificate: nothing in UK law certifies a property as legionella-free, a point covered in what a legionella certificate actually is. Second, routine testing is not a blanket requirement: for most simple systems the control is temperature and flushing, with sampling reserved for higher-risk systems or where the written scheme calls for it. Third, there is no prescribed format: the law asks for a suitable and sufficient assessment, not a particular form. What matters is that the assessment is real, proportionate, acted on, and kept under review, with records held for at least five years.

What meeting the duty looks like in practice

Complying means four things existing together: an assessment that identifies the risks in your actual system, a scheme for controlling them, people appointed to carry the scheme out, and records proving they did. A template or tool can structure and record that work, and the risk assessment builder is an indicative starting point for exactly that, but no document certifies the system: it records, it never certifies. The substance of what an assessment should contain is set out in what a legionella risk assessment is.