Why Legionella Risk Assessment Matters for UK Commercial Buildings
Legionella bacteria thrive in the water systems of commercial buildings, and an outbreak of Legionnaires' disease can have devastating consequences — for occupants, for visitors, and for the businesses that manage those premises. For facility managers, property owners, and employers across London and the South East, understanding your legal duty to assess and control the risk of legionella is not optional; it is a cornerstone of responsible building management.
Legionnaires' disease, a serious and sometimes fatal form of pneumonia, is caused by inhaling small droplets of water contaminated with legionella bacteria. The Health and Safety Executive (HSE) records several hundred confirmed cases in England and Wales each year, with the true figure widely believed to be higher due to under-diagnosis. Offices, hotels, gyms, care homes, and industrial premises are all potential risk environments wherever water is stored or distributed at temperatures that allow the bacteria to multiply.
This guide explains exactly what a legionella risk assessment involves, who must carry one out, and how facility managers can keep their commercial buildings compliant and safe.
The Legal Framework: What UK Law Requires
Several pieces of UK legislation place clear duties on employers and those in control of premises to manage the risk of exposure to legionella.
The Health and Safety at Work etc. Act 1974
The overarching duty comes from the Health and Safety at Work etc. Act 1974, which requires employers to ensure, so far as is reasonably practicable, the health and safety of employees and anyone else who may be affected by their activities. For building owners and managers, this includes tenants, contractors, and visitors.
The Control of Substances Hazardous to Health Regulations 2002 (COSHH)
COSHH defines biological agents — including legionella — as substances hazardous to health and requires employers to carry out a suitable and sufficient risk assessment. This is the regulation under which a formal legionella risk assessment is required.
HSE Approved Code of Practice L8 and HSG274
The HSE Approved Code of Practice L8 (Legionnaires' disease: The control of legionella bacteria in water systems) is the definitive guidance in the UK. Although following the ACOP is not strictly compulsory, failure to do so may be used as evidence against you in court if you are prosecuted for a breach. In practical terms, ACOP L8 is the standard you need to meet. It is supported by the HSG274 technical guidance in three parts, covering evaporative cooling systems, hot and cold water systems, and other risk systems such as spa pools and humidifiers.
For landlords and for those managing mixed-use London properties with residential units above commercial premises, additional duties arise under the Landlord and Tenant Act 1985 relating to the safe maintenance of water installations.
Which Commercial Buildings Need a Legionella Risk Assessment?
In practice, almost every commercial building in the UK with a man-made water system must have a legionella risk assessment. Examples include:
- Office blocks, business centres, and serviced offices
- Hotels, bed and breakfasts, and serviced apartments
- Gyms, leisure centres, and spas with hot tubs or showers
- Care homes, GP surgeries, and healthcare premises
- Schools, colleges, and universities
- Retail premises with kitchens, toilets, or air conditioning
- Warehouses and industrial premises with cooling towers or evaporative condensers
- Hairdressing and beauty salons with wash basins and spray taps
If your building has hot and cold water systems, cooling towers, evaporative condensers, spa pools, decorative fountains, humidifiers, or any other plant that generates water aerosols, a risk assessment is required.
What Does a Legionella Risk Assessment Cover?
A legionella risk assessment is a structured evaluation of your building's water systems, carried out by a competent person, to identify where legionella bacteria could grow and how people might be exposed. The output is a written document setting out the hazards, who is at risk, and the control measures needed.
System overview and schematic
The assessor will produce or update a schematic drawing of the hot and cold water system, clearly marking tanks, calorifiers, booster pumps, dead legs, and outlet points. Without an accurate schematic, effective control is almost impossible — particularly in older London buildings that have been extended or reconfigured several times.
Identification of hazards
The assessment identifies conditions that favour legionella growth. The bacteria proliferate at temperatures between 20°C and 45°C, in stagnant water, and where biofilm, sediment, scale, or rust are present. Dead legs — sections of pipework where water does not flow — are a classic and common hazard.
Assessment of exposure risk
Not every person in a building is equally at risk. The assessor considers who uses the premises and who is most susceptible: people over 45, smokers, heavy drinkers, and those with weakened immune systems, chronic respiratory or kidney disease. Showers, taps, and other aerosol-generating outlets are the main exposure routes.
Temperature monitoring regime
The assessor will recommend temperature checks appropriate to the system. Hot water should typically be stored at 60°C or above and reach outlets at 50°C or above within one minute. Cold water should remain below 20°C. These temperatures sit outside the range where legionella multiplies.
Remedial actions
Finally, the report lists any remedial actions required — repairs, additional monitoring, decommissioning of dead legs, tank cleans, pipework insulation, or training of responsible staff.
Appointing a Responsible Person
ACOP L8 requires that a Responsible Person is appointed to take day-to-day responsibility for controlling legionella risk. For many London commercial properties, this is the facilities manager, building manager, or an external facilities management partner. The Responsible Person must be competent — meaning they have sufficient knowledge, training, authority, and resources to carry out the role properly. They should be clearly named in your written scheme of control, and deputies appointed to cover holidays or absences.
The Written Scheme of Control
If your risk assessment concludes there is a reasonably foreseeable risk — and for almost all commercial buildings, it will — you must prepare and implement a written scheme of control. This document describes:
- The water systems present and their layout
- The control measures in place (temperature regimes, chlorination, disinfection)
- The monitoring tasks, how often they are carried out, and who is responsible for them
- The remedial actions to be taken when control limits are exceeded
- The record-keeping requirements and review intervals
Records of all monitoring, inspections, cleans, and remedial works must be kept for at least five years and be available to enforcing authorities on request. Missing or patchy records are one of the most common findings in HSE enforcement action.
Practical Control Measures for London Commercial Buildings
Regular temperature monitoring
Weekly flushing of little-used outlets (those used less than once per week), monthly temperature checks on sentinel taps (nearest and furthest from the calorifier), and annual inspections of cold water storage tanks are typical minimum requirements for most office buildings.
Tank inspection and disinfection
Cold water storage tanks should be inspected at least annually and cleaned and disinfected when sediment, biofilm, damage, or vermin ingress is identified. In older London buildings — particularly those with loft tanks or rooftop plant rooms — access can be challenging, but compliance is non-negotiable.
Showerhead cleaning and descaling
Showerheads, spray taps, and hoses must be dismantled, cleaned, and descaled at least quarterly, with disinfection using an appropriate biocide. Hotels, gyms, and leisure premises typically need more frequent schedules because of heavier use and higher exposure to aerosols.
Dead leg removal
Any length of pipework where water becomes stagnant — an unused tap, a disconnected fixture, a redundant branch — should be removed or capped at the main. During refurbishments and office fit-outs, failure to remove dead legs is a frequent and expensive oversight.
Review after changes or long vacancies
Any significant change to the water system or to building use — an office reconfiguration, a new tenant, a long vacancy — triggers a review of the risk assessment. Legionella risk rose markedly in many UK commercial buildings after the 2020 lockdowns, when water systems sat unused for extended periods, and the same principle applies to any building that has been partially unoccupied during hybrid working shifts.
Common Pitfalls Facility Managers Should Avoid
- Treating the assessment as a one-off. Risk assessments are living documents. Review them at least every two years, or sooner if circumstances change.
- Assuming your managing agent has it covered. Always confirm in writing who is responsible for what. Duties can fall through gaps between freeholder, landlord, and tenant.
- Ignoring cold water. Many outbreaks originate in cold water systems that sit above 20°C in warm plant rooms or poorly insulated risers.
- Inadequate record-keeping. Missing or incomplete records are one of the most common HSE enforcement findings.
- Using unqualified assessors. A bargain-basement, tick-box assessment can leave significant hazards undetected. Look for assessors registered with the Legionella Control Association or similar bodies.
A written scheme of control is only as good as the day-to-day discipline behind it. Temperature logs, flushing records, and tank cleans must be carried out consistently — not just when an audit is due.
How Legionella Control Fits With Wider Facilities Management
Legionella control sits naturally within a broader programme of planned preventative maintenance. Coordinated facilities management teams work with commercial clients across London and the South East to integrate water hygiene schedules, tank inspections, and showerhead descaling with other commercial cleaning and building maintenance activities, and to keep accurate records that stand up to scrutiny.
Whether you are responsible for a single office or a multi-site portfolio, combining legionella control with the rest of your building maintenance programme reduces cost, improves visibility, and ensures that nothing falls between the cracks. It also makes it far easier to demonstrate compliance during tenant due diligence, insurance reviews, or an HSE inspection.
Final Thoughts
A legionella risk assessment is not merely a piece of paperwork — it is a genuine safeguard for the people who occupy, work in, and visit your premises. London's commercial property landscape, with its mix of Victorian conversions, modern high-rises, and mixed-use developments, presents a particularly varied set of water-system challenges. A methodical, well-documented approach, backed by a competent Responsible Person and a disciplined written scheme of control, is the foundation of compliance.
If you are unsure whether your current arrangements are sufficient, the sensible first step is a review of your existing risk assessment and monitoring records. The cost of thorough legionella control is a tiny fraction of the human, financial, and reputational cost of an outbreak.
