Do I need a legionella risk assessment?

Looking for the technical detail? Read the version for professionals → ACoP L8 and HSG274 Parts 1 to 3. BS 8580-1 risk assessment and temperature regimes. Sampling under BS 7592 and record keeping.

Do I need one? Yes if your premises has a water system. That is every office and shop and restaurant. Every salon and workshop and rented property.

Does that mean I need water testing? The law requires a risk assessment and a written scheme. HSE says sampling is for the situations the assessment identifies. I think that line is drawn too far for anything with stored water or a shower, and I say why further down. What nobody needs is a monthly sampling contract for a mains fed premises with no tank.

Can I do it myself? Only the assessment of the simplest system and the monthly temperature checks, and only if you are trained. The rest of the control scheme is engineer work. Servicing a TMV or chlorinating a tank is not something an office manager does with a thermometer and a log book.

What the law actually requires

Sampling: what HSE says and what I think

Sampling is where the regulator and the trade part company. Here is the regulator in its own words and then mine in my own box.

What the authority says

Microbiological monitoring of domestic hot and cold water supplied from the mains is not usually required, unless the risk assessment or monitoring indicates there is a problem. The risk assessment should specifically consider systems supplied from sources other than the mains, such as private water supplies, and sampling and analysis may be appropriate.

Legionella monitoring should be carried out where there is doubt about the efficacy of the control regime or it is known that recommended temperatures, disinfectant concentrations or other precautions are not being consistently achieved throughout the system.

HSE then lists when sampling is appropriate. Systems treated with biocide. Systems where the temperatures are not being held. High risk areas and vulnerable people, with care homes and healthcare named. A suspected case or an outbreak. Cooling towers and spa pools have their own regimes. That is the regulator's whole position and it is why routine sampling carries no legal weight for a mains fed office with its temperatures in range.

What I think about sampling

An assessment tells you what the system looks like. A sample tells you what is in it. Those are not the same thing and I have never understood why the trade pretends they are.

Water sits. It sits in a tank, in a dead leg, in a shower nobody has run since the last contractor left. Mains fed or not, a local build up of bacteria is a local problem and nothing on a drawing will find it. The only thing that finds it is a bottle sent to a lab. Not just legionella either. A total viable count, coliforms and E. coli tell you whether the water in your building is the water that came through the stopcock.

London makes it worse. The water is hard and the limescale is everywhere. Scale gives bacteria somewhere to live and it coats the element in a cylinder so the water never gets as hot as the dial says. You do not know the temperature inside every run of pipe. You do not know the pressure is pushing water through every outlet at the rate the drawing assumes. A thermometer on a tap tells you about that tap on that morning. A sample tells you about the system.

So for the simplest premises, a couple of taps and a mains fed heater, I accept what HSE says. Assess, check the temperatures, flush what is not used. For anything with stored water, a shower, a dead leg or people who are old or ill, I think an assessment without a baseline sample is half a job. Two to four samples at £55 each is cheap for knowing. What I object to is the monthly sampling contract sold to a premises with none of those features. That is not control. That is a standing order.

Northern Ireland: the same framework applies under the Health and Safety at Work (Northern Ireland) Order 1978 and the COSHH Regulations (Northern Ireland) 2003.

What this means for your premises

Small simple system. A combi boiler or small cylinder. Mains cold water and no tank. No TMVs. A few outlets all in regular use. This is low risk. A trained person on site can do the assessment. The control scheme is monthly temperatures and flushing anything unused and that person can do those too. This is most small shops and offices and rented homes.

Medium system. Stored hot water or a cold water tank. TMVs on the basins. More outlets and some rarely used. Showers. Still usually low to medium risk. The assessment is more involved and an external assessor is the sensible call. This is also where a baseline sample earns its £110, because stored water is where a local build up starts. You still do the monthly temperatures. An engineer does the rest: the TMV service and the tank inspection and clean and the calorifier and the showerheads.

Higher risk. Care homes and healthcare. Hotels and gyms. Spa pools and cooling towers. Anywhere with vulnerable occupants or equipment that makes a spray. Professional assessment and a proper written scheme. Baseline samples, and HSE agrees for this group. An engineer on a monitoring contract is the right answer here and not an oversell.

Your options

Option A: do it yourself, only if you are competent

ACoP L8 says the assessment must be done by someone competent and HSE accepts that for a small simple system that can be a trained person on site. Use HSE's guidance for small systems. Draw the system. Where the water comes in and where it is heated and stored. Every outlet. Find the risks. Stagnation and dead legs. Temperatures between 20 and 45 degrees. Showers and anything else that makes a spray. Write down the controls. Temperatures and flushing and tank checks and who does what. Name the responsible person. Keep a log.

What competent means here. You have had legionella awareness or responsible person training and can show the certificate. You can read a hot and cold water system from the plant to the last tap. You can spot a dead leg or a cold feed running warm or a cylinder that never reaches 60. You know what the sentinel outlets are and why those ones. You know when a system has stopped being simple. That is the moment there is a tank or a shower or a calorifier or anyone vulnerable on the premises, and you know to stop there. If you cannot do all of that, you are not competent for this system.

Who it fits: a small premises on the mains with instantaneous hot water and no stored water, run by someone with the training above. Rented homes.

Cost: an afternoon. Then ten minutes a month for the checks.

The risk if you get it wrong. Legionnaires' disease kills about one in ten of the people who catch it. The outbreaks in this country that reached court were traced to systems nobody competent had looked at. After a case the assessment and the log are examined by the local authority and HSE together. An assessment that missed a tank or a dead leg because the person who wrote it did not know to look for one is not a defence. It is the charge sheet.

Option B: an external assessment, monthly checks in house, engineer tasks bought in

An assessor from a Legionella Control Association member company assesses the system and gives you a written report with a schematic and the risks and the sentinel outlets and a control scheme. You run the monthly temperature checks yourself. A water hygiene engineer does the tasks on the scheme that need tools and chemicals and a drained system. You review the assessment when anything changes.

Who it fits: stored water or tanks or showers or TMVs. More than a handful of outlets. Any premises where nobody wants to own it.

Cost: £250 for a small simple premises and £350 for an office or shop. Add two baseline samples at £55 each where there is stored water or a shower. Then the monthly checks in house, free. Then the engineer visit once a year for what the scheme lists.

Option C: full outsourcing

Assessment and monthly monitoring visits and log keeping by a contractor. Sensible for higher risk premises or multi site operators. For a single small premises with no stored water it is paying about £45 a month for someone to read two thermometers.

Who does what: the control scheme

This is where the trade blurs the line and where this page tries not to. The written scheme lists tasks. Some are yours. Most are not.

You do, with training:

• Monthly temperatures at the sentinel outlets. Hot at 50 within a minute. Cold under 20 within two.
• Weekly flushing of any outlet that is not in regular use.
• Reading the log and spotting a trend.
• Telling the engineer when something changes. A new shower. An outlet taken out of use. A refit.

A water hygiene engineer does:

• Thermostatic mixing valve service and fail safe test. Annually.
• Expansion vessel flush or drain. Monthly to annually depending on the vessel and the assessment.
• Cold water tank inspection. Annually. Clean and disinfection when the inspection finds it needs it.
• Calorifier drain and inspection. Annually. Flushing the base to clear sediment.
• Showerhead and hose descale and disinfection. Quarterly.
• Dead leg removal and any plumbing change the assessment calls for.
• Sampling where the assessment or the editor says so.

The line is simple. If the task needs the system drained or a chemical or a tool other than a thermometer, it is engineer work. If your assessment hands those tasks to the person on site, the assessment is wrong about who is competent.

What it should cost

Assessment: about £250 for a small simple premises. About £350 for an office or shop with more than a handful of people. From £800 for larger or higher risk sites. Monthly temperature checks in house cost nothing. Outsourced they are about £45 a visit. Sampling where it is indicated is £55 a sample plus the visit. Two to four samples is usual where any are needed.

Engineer tasks: a TMV service is £55 a valve. A small cold water tank inspection and clean and disinfection is £340. Calorifier inspection and showerhead descale are usually done on the same visit and priced per item. Published guides do not price them on their own, so get them itemised in writing before the visit. A premises with one tank and four TMVs should expect about £560 a year on the engineer side.

Figures are typical prices taken from published commercial price guides and checked October 2026. Same method on every page. Larger or more complex premises sit above them.

Check what else your business needs

Legionella is one of the specific assessments under your general risk assessment. If the building is older, asbestos is the other one most small businesses miss. Run the Compliance Check to see the full picture.