Legionella fines and prosecutions: what UK enforcement looks like

A legionella prosecution is HSE or local authority action against a duty holder who failed to manage legionella risk, usually under the Health and Safety at Work etc. Act 1974. UK fines range from a few thousand pounds to several million, depending on culpability, harm and turnover.

What triggers a case is the failure to manage that risk: no risk assessment, no records, or ignoring an inspector's notice. You do not need legionella bacteria present, or anyone to have fallen ill, for the Health and Safety Executive to prosecute.

What a legionella prosecution actually is

A legionella prosecution is a criminal case brought against a duty holder who failed to manage the risk of legionella bacteria in a water system. Most cases are brought by the Health and Safety Executive (HSE), or by the local authority for lower-risk premises such as offices, shops and hotels.

The charge is almost always a breach of the Health and Safety at Work etc. Act 1974, usually section 2 (protecting employees) or section 3 (protecting the public). The court measures your conduct against the Approved Code of Practice ACOP L8 and the technical guidance in HSG274. Failing to follow an approved code is admissible as evidence that you breached the law, so in practice L8 and HSG274 set the bar you are judged against.

A legionella HSE prosecution is not always limited to the organisation. Directors and managers can be prosecuted personally under section 37 where an offence was committed with their consent, connivance or neglect.

What triggers a legionella prosecution

HSE does not prosecute because bacteria exist. It prosecutes because a duty holder did not do what the law requires. The failures that turn up again and again in reported legionella court cases are:

• No legionella risk assessment, or one that was written and then ignored.
• No written scheme of control setting out how the system is kept safe.
• Temperatures never monitored, so nobody could show cold water stayed below 20°C or hot water reached 60°C stored and 50°C at the tap (55°C in healthcare). See temperature control.
• No log book or monitoring records, so there is no evidence any control ever happened.
• Ignoring an improvement notice, or failing to act after sampling returned high counts.

A case can start after an outbreak or a death, but just as often it starts with a routine inspection, a complaint, or a referral from an environmental health officer. Actual harm raises the penalty, but it is not what creates the offence.

HSE prosecutions and published UK court reports

The range of UK legionella fines and penalties

There is no fixed tariff for a legionella fine. Since the Sentencing Council's 2016 guideline for health and safety offences, courts set fines from three factors: culpability (how far short of the standard you fell), the likelihood and seriousness of harm, and the organisation's turnover. A large company and a small landlord can commit the same breach and receive very different penalties.

Magistrates' courts historically capped fines at £20,000, but for health and safety offences that cap has been removed, so magistrates can now impose unlimited fines. The most serious cases go to the Crown Court, where fines are unlimited and custodial sentences are available. The largest legionella-related fines have run into the millions: Bupa Care Homes was prosecuted after the death of an 86-year-old resident and fined £3 million (later reduced to £1.5 million on appeal).

The table below shows how real UK outcomes have landed. Browse the full list in the enforcement tracker and the underlying data index.

The legionella prosecution myth: you do not need bacteria or a death

The most common misunderstanding is that you can only be prosecuted if legionella is found in your water, or if someone catches Legionnaires' disease. Both are wrong.

The offence is the failure to manage a foreseeable risk. A water system can test completely clear and still leave you exposed, because the duty is to assess the risk, put controls in place, and keep records. HSE has secured convictions where no one fell ill and where sampling found nothing, purely on the basis that the duty holder had no risk assessment and no monitoring in place.

The reverse is worth understanding too. Finding legionella in a sample is not automatically an offence, and it does not, by itself, mean you will be prosecuted. What matters is whether you had a reasonable regime and acted on the result. Detecting bacteria and responding properly puts you in a far stronger position than a clean sample with nothing recorded behind it. That is the real distinction: the presence of bacteria is a prompt to act, and the absence of records is the thing that gets prosecuted.

How enforcement escalates before court

Prosecution sits at the top of a ladder, and most duty holders meet the lower rungs first:

• Advice and guidance during an inspection, usually recorded in a letter.
• Improvement notice requiring specific action by a deadline. Ignoring it is a separate criminal offence.
• Prohibition notice stopping use of a system or building where the risk is serious and immediate.
• Fee for Intervention (FFI), where HSE recovers the cost of its time investigating a material breach, charged at an hourly rate.
• Prosecution, where the breach is serious, repeated, or caused harm.

Because ignoring a notice is itself an offence, some duty holders end up in court not for the original legionella failing but for failing to act on the warning they were already given. That is the point where a manageable problem becomes a penalty for legionella non-compliance.

What courts expect you to have recorded

When an inspector or a court asks what you did about legionella, they are asking for documents, not reassurance. The evidence they expect to see is:

• A current risk assessment that identifies the risk systems.
• A named responsible person with defined duties.
• A written scheme of control and dated monitoring records showing temperatures and, where relevant, sampling results against the 100 and 1,000 CFU per litre action levels.
• Records of remedial action whenever something fell out of range.

None of this makes a system safe on its own, and no document guarantees compliance. What records do is prove the risk was being managed, which is exactly what is missing in most prosecuted cases. Recording each check as you carry it out is the single most effective protection against a case that turns on the fact that nothing was written down.