Legionella Regulations and Legislation: The UK Legal Framework

There is no single "Legionella Act" in the UK. The legal duty to control legionella comes from the Health and Safety at Work etc. Act 1974, the COSHH Regulations 2002 and the Management of Health and Safety at Work Regulations 1999. ACOP L8 and HSG274 are guidance, not standalone law.

Is there a specific legionella law in the UK?

People search for "legionella regulations" expecting to find a dedicated piece of legislation. There is not one. No statute in the UK is called the Legionella Act, and no set of rules exists solely for legionella bacteria. The duty is genuine and enforceable, but it sits inside the general health and safety law that applies to every workplace and every water system, not a bespoke legionella code.

This matters because the framework is layered. At the top is primary legislation that sets a broad duty. Beneath it sit regulations that make the duty specific. Beneath those sit an Approved Code of Practice and technical guidance that describe how the Health and Safety Executive (HSE) expects you to meet it. Knowing which layer you are reading tells you whether you are looking at a legal requirement or a recommended method.

The practical consequence is that you cannot comply by pointing at a single document. You meet the duty by identifying the risk, controlling it, and keeping records that show what you did. A legionella risk assessment is the foundation the whole framework rests on.

The Health and Safety at Work etc. Act 1974: the overarching duty

Sections 2 and 3 do the heavy lifting

The Health and Safety at Work etc. Act 1974 (HSWA) is the primary legislation. Section 2 places a duty on employers to protect the health and safety of their employees, so far as is reasonably practicable. Section 3 extends that duty to anyone else who might be affected by the work, which is why a landlord, a facilities manager or a holiday-let owner falls within scope even when no employee is present.

The Act does not mention legionella by name, and it does not need to. Legionella is a foreseeable risk arising from a water system, and the Act's general duty is wide enough to capture it. Breaching the Act is a criminal offence, and it is HSWA that ultimately underpins prosecutions and fines when control fails.

Because the Act sets a duty rather than a method, it tells you that you must act but not how. That detail comes from the regulations and guidance below.

Health and Safety Executive: HSWA 1974, COSHH 2002, Management Regs 1999, ACOP L8 and HSG274; BSI BS 8580-1:2019

COSHH 2002 and the Management Regulations 1999: where the duty bites

COSHH treats legionella as a hazardous substance

The Control of Substances Hazardous to Health Regulations 2002 (COSHH) classify legionella as a biological agent. COSHH requires you to assess the risk from that agent and to prevent or adequately control exposure to it. This is the regulation that turns the Act's broad duty into a specific obligation to assess and manage legionella in water systems.

Sitting alongside COSHH, the Management of Health and Safety at Work Regulations 1999 require a "suitable and sufficient" risk assessment and the appointment of one or more competent people to help meet your legal duties. Together, these two sets of regulations are why a written risk assessment and a named responsible person are not optional extras but the mechanism the law actually works through.

For most premises, COSHH and the Management Regulations are the instruments an inspector will cite. They apply whether you run a factory, a care home, an office or a block of flats with a communal water system.

ACOP L8 versus HSG274: legal status against recognised guidance

An Approved Code of Practice has a status that ordinary guidance does not

This is where most of the confusion lives. ACOP L8 and HSG274 are the two documents everyone cites as "the legionella regulations", yet neither is legislation, and they do not carry equal weight.

ACOP L8 is an Approved Code of Practice. It has a special legal status: if you are prosecuted for a breach of health and safety law and you did not follow the relevant provisions of the code, a court will find you at fault unless you can show you controlled the risk in an equally effective way. In practice, following L8 is treated as the benchmark for meeting the law.

HSG274 is technical guidance, published in three parts covering evaporative cooling systems, hot and cold water systems, and other risk systems such as spa pools. Guidance is not legally binding. You are free to depart from it, provided you achieve the same standard of control by another route and can justify the decision. The temperature figures most people quote, storing hot water at 60°C, distributing it at 50°C, and keeping cold water below 20°C, come from this guidance rather than from an Act. The 20 to 45°C range in which legionella multiplies is the reason those figures exist.

Hold onto the distinction: L8 sets the bar you are measured against; HSG274 describes one recognised way to clear it. The table below sets out where each instrument sits.

What the legislation actually requires you to do

Five practical duties the law expects

Strip away the document names and the legal framework asks for a repeatable cycle. Whatever your sector, the duties look the same:

• Assess the risk. Carry out and record a risk assessment of your hot and cold water systems, and review it whenever the system or its use changes.
• Appoint a competent person. Name a responsible person with enough authority, knowledge and training to manage the control scheme.
• Put controls in place. Where a real risk is found, prepare a written scheme of control and act on it, usually through temperature control and the management of stagnation.
• Monitor and record. Keep records of monitoring, inspection and any remedial work. For an employer with five or more employees, keeping these records is itself a legal requirement.
• Review. Revisit the assessment periodically and after any change, outbreak or significant alteration to the system.

None of these steps certifies a system as safe or a duty holder as compliant. They record what you have identified and done, which is what the law and an inspector expect you to be able to show.

Related and sector-specific law: landlords, RIDDOR, healthcare and the devolved nations

The framework changes shape by sector

Rented property. Landlords carry the same duty under HSWA and COSHH. There is no separate "landlord legionella certificate" required by law, despite the phrase circulating widely. What the law expects is a proportionate assessment and appropriate control. See who is responsible in rented property.

Reporting. Under RIDDOR, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, a case of legionellosis in an employee who was exposed at work must be reported to the enforcing authority.

Risk assessment method. BS 8580-1:2019 is the British Standard giving a code of practice for how to carry out a legionella risk assessment. It is a voluntary standard rather than law, but it is widely used to give the assessment a consistent, defensible structure.

Healthcare. Health and social care settings follow the additional Health Technical Memorandum HTM 04-01, which reflects the higher risk to vulnerable patients and expects hot water delivered at around 55°C.

Devolved nations. HSWA, COSHH and ACOP L8 apply across Great Britain. Northern Ireland runs a parallel regime enforced by HSENI, including RIDDOR (NI) 1997, so the document references differ while the underlying duties mirror each other.