What legal status does an Approved Code of Practice have?
On this page
Key points
- Health and safety rules come in three tiers: law (Acts and regulations), Approved Codes of Practice, and plain guidance. Only the first tier creates offences on its own.
- An ACOP is approved under section 16 of the Health and Safety at Work etc. Act 1974; section 17 gives it special evidential status in court.
- The burden-of-proof effect: fail to follow the code, and you must prove your alternative was equally effective. The prosecution does not have to prove it was not.
- HSG274 is guidance, not an ACOP: you may depart from it with justification, but it describes the recognised method for the figures everyone quotes.
- A departure from L8 must be decided, justified and recorded in the risk assessment. An undocumented departure is indistinguishable from neglect.
An Approved Code of Practice sits between law and guidance. It is not an offence to break one, but if you are prosecuted for breaching health and safety law and you did not follow the relevant code, the court treats the breach as proved unless you can show you complied in another, equally effective way. That reversal of the usual burden of proof is what gives ACOP L8 its force.
This page explains the machinery behind that status: where an ACOP comes from, how section 17 of the Health and Safety at Work etc. Act 1974 makes it bite, and what a defensible departure actually looks like. For what the code itself requires, see ACOP L8 explained and the L8 hub.
The three tiers of health and safety rules
Everything the HSE enforces falls into one of three tiers, and confusing them is the root of most arguments about whether something is "a legal requirement".
| Tier | Examples | Made by | Effect of not following it |
|---|---|---|---|
| Law: Acts and regulations | HSWA 1974; COSHH 2002; Management of Health and Safety at Work Regulations 1999 | Parliament | Breach is a criminal offence in itself; prosecution must prove the breach |
| Approved Code of Practice | ACOP L8 | HSE, with the approval of the Secretary of State, under HSWA section 16 | Not an offence in itself, but admissible as proof of a breach of the underlying law unless you show equal compliance |
| Guidance | HSG274, HSG282, industry guides | HSE or industry bodies | No evidential status; you may depart with justification, but it describes the recognised method |
The practical reading: the law tells you that you must control the risk, the ACOP tells you the framework the HSE expects you to use, and the guidance fills in the technical numbers, such as storing hot water at 60°C and keeping cold water below 20°C.
How an ACOP gets its status
Section 16 of the Health and Safety at Work etc. Act 1974 lets the HSE approve codes of practice it considers suitable for giving practical guidance on meeting the Act and the regulations made under it, subject to the consent of the Secretary of State. That approval is the whole difference between an ACOP and a pamphlet. Before approval, the HSE must consult, and the code is drafted to give practical direction on duties that the law states only in general terms.
Section 17 then does the work in court. It provides that where a code is in force and a duty holder is prosecuted for breaching a duty the code covers, a failure to observe the code "shall be admitted in evidence", and the duty is treated as breached unless the accused proves they satisfied the duty in some other way that was at least as effective.
The burden-of-proof point, in plain English
In most criminal cases the prosecution must prove its case. Section 17 creates a limited exception. Once the prosecution shows (a) that the code's provisions were relevant to your situation and (b) that you did not follow them, the breach of the underlying law is taken as established. It is then your job to prove your alternative method controlled the risk at least as well.
Follow the code and the law is presumed met. Depart from it and the presumption flips: you must prove your way was just as good, with records that were written at the time.
Two things follow. First, an inspector who finds you doing less than L8 will ask why, and "we did not think it applied to us" is not a defence unless the risk assessment records that reasoning. Second, the strength of your position is decided by your paperwork: if you cannot show, from documents written at the time, what you did and why it was sufficient, there is effectively no alternative case to put. That is why the record-keeping duties run through every part of legionella management.
What a defensible departure looks like
Departing from the code is lawful, but it is a decision, not an omission. A defensible departure has three parts:
- A specific finding. The risk assessment identifies why the code's standard approach does not fit this system: for example, a small mains-fed office with no stored water, where the code's storage-focused checks do not engage.
- An equivalent control. The assessment records what is done instead and why that controls the risk at least as effectively, not merely more cheaply.
- A review trigger. The assessment says when the departure will be revisited, so a change to the system does not leave yesterday's justification standing.
Contrast that with the pattern in most prosecuted cases: no recorded assessment, no recorded reasoning, and a gap between what the code expected and what actually happened that nobody can explain after the event. The first pattern is a judgement call; the second is a breach waiting for an inspector.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
A short decision aid: can I do it differently?
Before departing from anything in L8 or HSG274, work through three questions:
- Is it the code or the guidance? Departing from guidance (HSG274) needs justification; departing from the ACOP itself needs justification that will survive a courtroom. Know which document you are departing from.
- Can I state, in one sentence, why the standard approach does not fit? If you cannot write that sentence, you do not yet have a departure; you have a shortfall.
- Where is it written down? If the answer is not "in the risk assessment, with a review date", the departure does not exist as far as an inspector is concerned.
If all three answers hold, record the decision and move on with confidence. If any fails, the recognised route is the safer one: follow the code, log the controls in a log book, and use the temperature checker to keep the routine numbers honest. For the wider framework, see the regulations and legislation guide.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
Frequently asked questions
Is an Approved Code of Practice mandatory?
Not in the way a regulation is. You cannot be prosecuted simply for breaking an Approved Code of Practice. But under section 17 of the Health and Safety at Work etc. Act 1974, if you are prosecuted for breaching the underlying law and it is proved you did not follow the relevant part of the code, you are treated as having breached the law unless you can show you complied in some other, equally effective way. That makes the code mandatory in effect for anyone who cannot justify a departure.
What is the difference between an Approved Code of Practice and guidance?
An Approved Code of Practice, such as ACOP L8, is approved under section 16 of the Health and Safety at Work etc. Act and carries special evidential status in criminal proceedings: a failure to follow it counts against you unless you prove equivalent compliance. Guidance, such as HSG274, has no such status. You may depart from guidance freely, provided you still meet the underlying legal duty, though in practice guidance describes the recognised way to do that.
What happens if you don't follow ACOP L8?
Nothing automatically. The consequence appears only if something goes wrong: an inspector finds your arrangements lacking, or you are prosecuted. At that point, not following L8 shifts the work onto you. Rather than the prosecution proving your method was inadequate, you must show your alternative controlled the risk to at least the same standard. If your records cannot demonstrate that, the court will find the breach proved.
Can you depart from ACOP L8?
Yes, but the departure must be deliberate, justified and recorded. You need to show that what you did instead controlled the risk at least as effectively as the code's method, and that reasoning should be written into your risk assessment at the time, not reconstructed afterwards. A silent departure, where you simply did less than the code without a documented justification, is the position most prosecuted duty holders find themselves in.
Related water hygiene products and services from trusted UK providers will appear here.