Legionella Certificate: What You Actually Need in the UK

There is no legal "legionella certificate" in the UK. The HSE does not issue, recognise or require one. What the law asks of a landlord or duty holder is a documented legionella risk assessment and records of the control measures you put in place.

The phrase spreads because letting agents, lenders and some training providers use "certificate" as shorthand. Knowing what genuinely satisfies the law, and what does not, saves you paying for paperwork that carries no legal weight.

Is there really no legionella certificate?

Correct. There is no statutory legionella certificate in the UK, and no government body issues one. The HSE is explicit that the law does not require landlords to obtain or produce a 'legionella test certificate'. What the law requires instead is that you assess the risk from legionella bacteria and control it.

The word "certificate" sticks around because three different things get called by that name:

• A risk assessment report is the write-up of a legionella risk assessment. This is the document the law actually cares about.
• A water sample result is a laboratory analysis giving a legionella count in CFU/litre. Useful in some settings, but not routinely needed for simple domestic systems.
• A training certificate is proof that a person passed a legionella awareness course. It says nothing about a specific building.

None of these is a legal "certificate of compliance". Treat any supplier who implies otherwise with caution.

Do you need a legionella certificate as a landlord?

No. A landlord does not need a legionella certificate for a rental property, and asking a letting agent or contractor for one usually means paying for a risk assessment under a misleading label. What you do need is evidence that you have assessed and are managing the risk.

For most domestic rentals the risk is low, and you can carry out the assessment yourself if you are competent to do so. See can I do my own legionella risk assessment for what "competent" means in practice, and do I need a legionella risk assessment for the threshold.

The picture changes with complexity. If you let a large property, a house in multiple occupation with communal tanks, or manage commercial premises, the assessment is more involved and you would normally record it in full. The duty is broadly the same across England, Wales and Scotland, so a "legionella certificate Scotland" search leads back to the same three words: assess, control, record.

HSE, 'Legionella and landlords' responsibilities'; ACOP L8 and HSG274

What the law actually requires

The duty comes from several overlapping pieces of law, none of which mentions a certificate:

• The Health and Safety at Work etc. Act 1974, which places a general duty on employers and those in control of premises.
• The Control of Substances Hazardous to Health (COSHH) Regulations 2002, which treat legionella as a biological hazard.
• The Approved Code of Practice L8 and the technical guidance in HSG274, which set out how to assess and control the risk. See ACOP L8 and HSG274.

In plain terms the law asks you to identify a competent responsible person, carry out a risk assessment, put a written scheme of control in place where needed, and keep records. Core controls centre on temperature: cold water stored below 20°C, hot water stored at 60°C and delivered at 50°C (55°C in healthcare). See legionella temperature control.

"Certificate" language persists mainly because mortgage lenders, insurers and letting agents ask for one in their paperwork. They are really asking for proof the risk is being managed, which a risk assessment and log book provide.

'Legionella compliance certificate' versus a risk assessment

This is where confusion costs money. A "legionella compliance certificate" sounds like a pass mark issued by an authority. It is not. At best it is a supplier's cover sheet wrapped around a risk assessment; at worst it is a badge with no assessment behind it at all.

The distinction matters the way a dead leg differs from a blind end: the label is not the substance. A genuine risk assessment is a working document, not a trophy. It should identify the water system, flag risks such as stored warm water, infrequently used outlets and biofilm, and set out the controls and their review dates.

So when a certificate lands on your desk, look past the front page and read the assessment behind it. If there is no assessment, you have paid for nothing. If the assessment is thorough, the certificate adds nothing the assessment did not already carry.

What proof of compliance actually looks like

If an inspector, insurer or lender asks you to show you are managing legionella, none of them expects a certificate. They expect a paper trail. A complete one usually holds:

• A current legionella risk assessment, dated and reviewed.
• A written scheme of control for anything beyond the simplest system.
• A legionella log book recording temperature checks, flushing of little-used outlets and any remedial work.
• Where sampling has been done, the laboratory results against the action levels of 100 and 1,000 CFU/litre for hot and cold systems. See sampling and action levels.

Record each control as you carry it out. A risk assessment is a snapshot of one day; it is the ongoing record that shows the system is being managed rather than left to chance.

Cost, frequency and who can carry it out

Cost. There is no certificate to buy, so there is no set price. A simple domestic assessment done competently by the landlord costs nothing but time. A professional assessment of a small property typically runs to a few hundred pounds, with larger or commercial sites costing more depending on the number of outlets and system complexity. Be wary of quotes for a "certificate" that turn out to be a basic assessment at a premium.

Frequency. There is nothing to renew. HSE guidance says the risk assessment should be reviewed regularly, and whenever there is reason to believe it is no longer valid, for example a change to the water system, the way it is used, or the people who could be exposed. Reviewing at least every two years is common industry practice.

Who. The assessment must be done by someone competent. A plumber or heating engineer can carry out temperature checks and remedial work, and schemes such as SNIPEF register plumbers for legionella tasks, but doing the plumbing is not the same as being competent to assess the whole system. Laboratory testing for legionella needs a UKAS-accredited lab. Awareness training certificates for individuals typically last two to three years.