How Often Should a Legionella Risk Assessment Be Carried Out?

There is no fixed legal interval for a legionella risk assessment. Under the HSE's Approved Code of Practice ACOP L8, the assessment must be reviewed regularly — commonly taken as at least every two years — and immediately whenever there is a significant change to the water system, the building or its use, or any reason to believe the assessment is no longer valid.

That's the short answer. The longer answer matters, because "regularly" is a risk-based judgement, not a date on a certificate, and treating it as a fixed two-year tick-box is exactly how premises drift out of compliance.

What the law actually says

Legionella control in the UK rests on the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). The how is set out in the HSE's Approved Code of Practice and guidance L8 ("Legionnaires' disease: The control of legionella bacteria in water systems") and the technical guidance HSG274.

On frequency, ACOP L8 is deliberately not prescriptive. It requires the risk assessment to be reviewed regularly, and specifically whenever there is reason to believe the original assessment may no longer be valid. There is no "every X months" written into the law — because the right interval depends on the system, the building and how it's used. A simple, low-occupancy office and a care home with stored hot water and vulnerable residents are not on the same clock.

The two-year rule of thumb

Because "regularly" needs a working number, the industry norm that has settled is review at least every two years. Most dutyholders and water-treatment providers operate on that cycle, and it's a defensible baseline for a stable system with no changes.

Two things to keep straight:

• Two years is practice, not law. It's the sensible default, not a statutory minimum you can point to as a ceiling. A higher-risk system may warrant more frequent review.
• The two-year clock is the maximum gap, not a licence to ignore the system in between. The risk assessment review is separate from the ongoing monitoring and control tasks (temperature checks, flushing of little-used outlets, tank inspections) that HSG274 expects far more frequently — often monthly or even weekly.

When you must review sooner

The trigger-based review is where the real duty lives, and where premises get caught. Reassess immediately — regardless of when the last review was — whenever:

• the water system is altered, extended or partially decommissioned (new pipework, a new calorifier, dead legs created by removed fittings);
• the use or occupancy of the building changes — a wing reopened, a change of use, more or more-vulnerable occupants;
• control measures are found to be ineffective — temperatures out of range, positive sample results;
• there is a case of legionellosis associated with the system;
• new information about the risks becomes available; or
• key personnel change — the responsible person or competent help moves on and continuity is at risk.

Any one of these can make yesterday's assessment invalid today. A two-year-old assessment on a system that was re-plumbed six months ago is not a current assessment.

Who is responsible

The duty falls on the dutyholder — the employer, the person in control of the premises, or the landlord (including for the common water systems of let residential buildings). The dutyholder must ensure a suitable and sufficient assessment is carried out and kept current, appoint a responsible person to manage the scheme, and make sure whoever does the work is competent.

You can — and for anything non-trivial, should — bring in a competent person or specialist to carry out the assessment. But as with every statutory regime, the legal duty stays with the dutyholder. If the assessment is out of date or the controls lapse, it's the dutyholder answering to the HSE, not the contractor who wrote the report.

Frequently asked questions

How often should a legionella risk assessment be reviewed?

There is no fixed legal frequency. ACOP L8 requires the assessment to be reviewed regularly and whenever there is reason to believe it is no longer valid. Common practice is to review at least every two years, and to reassess immediately after any significant change to the water system, the building or its use.

Is a legionella risk assessment a legal requirement in the UK?

Yes. Under the Health and Safety at Work etc. Act 1974 and COSHH 2002, dutyholders must assess and control the risk of legionella. The HSE ACOP L8 and HSG274 set out how. The assessment itself is mandatory; only its review frequency is left to a risk-based judgement rather than a fixed interval.

What changes require a legionella risk assessment to be redone?

Review whenever the water system is altered or extended, the building use or occupancy changes, control measures are found to be ineffective, there is a case of legionellosis linked to the system, new information about the risk emerges, or the responsible people change. Any of these can make the original assessment invalid.

Who is responsible for the legionella risk assessment?

The dutyholder, usually the employer, landlord, or whoever is in control of the premises. They can appoint a competent person to carry out the assessment, but the legal duty to manage the risk stays with the dutyholder and cannot be delegated away.

Where this fits

Legionella (L8) is one of a dozen statutory regimes an estates team carries at once, and — like the fire risk assessment — it's risk-based rather than hard-dated, which is exactly why the review slips. For duties beyond timing (who is responsible, certificate myths, simple vs higher-risk premises), see the full legionella risk assessment & L8 duties guide and the deeper ACOP L8 testing explainer. Our statutory compliance calendar for estates teams maps every regime, who's liable, and how often each is due.

The recurring failure isn't forgetting legionella exists — it's a review date that slipped, or a system change that never triggered a reassessment. L8 tracking in Proprietas holds the next review per building, drives it from valid to due-soon to overdue, and chases it before it lapses — with remedials raised into work orders. Try it on one of your own assessments before committing to anything.

This is a plain-English overview for dutyholders and estates teams, not legal or health-and-safety advice — your specific duties depend on your water systems and how the premises are used.