ACOP L8 and Legionella Testing: What Higher-Risk Premises Need

For a two-bed flat, a basic legionella risk assessment and some sensible controls are usually all the law asks for — we cover that ground in who needs a legionella risk assessment and how often. But a care home, a school, or a healthcare site is a different animal: tanks, calorifiers, long pipe runs, little-used outlets, and occupants who are more vulnerable to infection. For these higher-risk premises, ACOP L8 asks for considerably more, and "do we need testing?" becomes a real question. Here's what actually applies.

What ACOP L8 is — and who it applies to

L8 is the HSE's Approved Code of Practice, Legionnaires' disease: The control of legionella bacteria in water systems. Its companion, HSG274, carries the technical detail across hot and cold water systems, evaporative cooling, and other risk systems. Neither is a free-standing law — they interpret the duties in the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH).

"Who does ACOP L8 apply to?" is broader than people expect. It applies to any duty holder — an employer, or anyone in control of premises or a work activity — wherever there's a water system and a reasonably foreseeable risk of exposure. A care provider, a school trust, an NHS body and a managing agent are all caught. The duty is to assess the risk, control it, keep records, and review.

Risk assessment vs testing — the bit that confuses people

This is where money gets wasted and duties get missed, so it's worth being precise.

The risk assessment is mandatory. Every duty holder with a relevant water system must have a suitable and sufficient assessment, and act on it.

Testing — water sampling for legionella — is risk-based, not automatic. HSG274 does not require routine microbiological sampling for most hot and cold water systems where temperatures and controls are being maintained. The routine control is temperature monitoring, not lab tests. Sampling becomes appropriate where the assessment indicates it: where you can't reliably keep hot water hot and cold water cold, where the system is complex or has a history of problems, in healthcare and other high-susceptibility settings, or following a suspected case.

So a contractor selling you an annual "legionella test" for every site as a blanket requirement is usually selling something the guidance doesn't mandate. What the guidance does expect from a higher-risk site is a managed, monitored control scheme.

What higher-risk premises actually need

For care homes, schools, healthcare and larger estates, a one-page assessment isn't enough. ACOP L8 and HSG274 point to a managed regime:

• A responsible (competent) person appointed to manage the scheme.
• A written scheme of control — what's controlled, how, and by whom.
• Temperature monitoring of sentinel and representative outlets on a defined cadence, with hot stored above 60°C and distributed above 50°C, cold below 20°C.
• Inspection of tanks, calorifiers and little-used outlets, with flushing of low-use outlets to prevent stagnation.
• Sampling where indicated by the assessment — and, in healthcare premises, in line with the stricter water-safety guidance (HTM 04-01) and a water safety group.
• Records of all of it — because the records are what an inspector, an insurer or a coroner will ask for.

Care settings sit at the sharp end of this: residents are more susceptible, and the registered provider carries the accountability.

How often to review

There's no fixed statutory interval. The duty is to review the assessment regularly and whenever there's reason to believe it's no longer valid — after changes to the water system, the building or its use, or following a suspected case. The day-to-day monitoring (temperatures, flushing) runs continuously; the assessment itself is revisited periodically. We go deeper on cadence in the legionella overview.

The "L8 certificate" myth — even for complex sites

There is no legal "L8 certificate" or "legionella certificate," and that holds even for a large care group. The HSE has been explicit that duty holders are not required to produce one. What demonstrates compliance is the assessment, the written scheme of control, and the monitoring records — a living set of evidence, not a sticker with an expiry date. If you're being sold an annual certificate as the whole job, you're paying for reassurance, not compliance.

What happens if you don't

The HSE and local authorities enforce under the 1974 Act. Breaches carry unlimited fines and imprisonment, and providers have been prosecuted following outbreaks. Your assessment, scheme and records are your defence — and their absence is the prosecution's case.

Where it fits

Legionella sits alongside fire, electrical and gas in the statutory set — see the complete UK property compliance guide.

Unlike the others, L8 has no neat expiry date printed on a certificate — which is exactly why it gets forgotten on a busy multi-site estate. Proprietas lets you set the review cadence per site, tracks legionella as a first-class obligation alongside the monitoring records, and reminds you before it lapses, so the one regime without a hard deadline doesn't become the one you overlook. See how it works, or try the document scanner on a recent assessment.

This is a plain-English overview, not legal advice — your duties depend on your premises, your water systems and the people who use them.