What ACOP L8 and COSHH require for legionella: who is the duty holder, when you need an assessment, who can do it, controls vs testing, and the 'certificate' myth.

Legionella is the regime most surrounded by confusion and mis-selling. Landlords are told they need an annual "legionella certificate" from a specialist; estates teams over-spend on testing they don't need or skip the assessment they do. Here's what the law actually asks for, and the questions people search for most.

Here's the TL;DR

It's a duty to assess and control, not to certify — under the Health and Safety at Work etc. Act 1974 and COSHH 2002, whoever controls the premises must assess and manage the risk of legionella in the water system. The HSE's Approved Code of Practice is L8, with technical detail in HSG274.
Yes, it's mandatory — but for a simple domestic let it's usually a straightforward assessment, not an expensive specialist visit or a lab test.
No fixed interval — review the assessment regularly and whenever something changes. Roughly every two years is common good practice, sooner if the system or its use changes.
There is no legal "legionella certificate" — the HSE has been explicit that landlords are not required to produce one. The requirement is a risk assessment plus sensible controls, and breaches are criminal.

What legionella is and why it's regulated

Legionella bacteria grow in water systems and cause Legionnaires' disease, a potentially fatal pneumonia, when contaminated water is inhaled as a fine spray — from showers, taps, cooling towers, spa pools. The risk rises in water held between roughly 20–45°C, in stagnant water, and where there's scale or biofilm to feed on.

Because it's a workplace and premises hazard, it's governed by the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH), interpreted through the HSE's Approved Code of Practice L8 and guidance HSG274.

Do you need a legionella risk assessment?

Almost certainly yes — but the size of the job depends on the premises. If you let residential property, run a workplace, or control premises with a water system, you have a legal duty to assess and control the risk. That includes single buy-to-let flats, HMOs, offices, schools and care homes.

What varies is the effort. A modern two-bed flat on mains water with a combi boiler and no stored water is low-risk, and the assessment reflects that. A building with cold-water storage tanks, calorifiers, long pipe runs or vulnerable occupants is higher-risk and needs a fuller, monitored regime — see ACOP L8 and legionella testing for higher-risk premises. What you can't do is skip the assessment because the property looks simple.

Who's responsible

The duty falls on the duty holder — the employer, the person in control of the premises, or the landlord. For most rented homes the duty holder is the landlord or managing agent. You must:

assess the risk of exposure to legionella;
if there's a foreseeable risk, introduce and manage controls;
keep records of the assessment and the controls;
and review it.

A competent person must do the assessment, but for a typical domestic let that's often a straightforward exercise — not necessarily an expensive specialist visit. Larger or more complex systems — care homes, schools, anything with tanks, calorifiers or cooling towers — need a managed L8 control scheme with monitoring.

Who can carry out a legionella risk assessment?

There is no statutory licence or accreditation required to carry one out — the legal test is competence, not a certificate. The assessor must understand the water system, the risk factors, and the controls well enough to produce a suitable and sufficient assessment.

In practice that means:

Simple domestic systems — a landlord or agent who has read the HSE guidance can often carry out and document the assessment themselves. The HSE explicitly says routine cases don't require a consultant.
Larger or higher-risk systems — care homes, schools, blocks with stored water — usually warrant a competent specialist, because the assessment and the ongoing control scheme are more involved.

Beware contractors who imply the law mandates them for a simple flat; it usually doesn't. What matters is that whoever does it is genuinely competent and the assessment is documented.

What a legionella risk assessment involves

A suitable assessment looks at the whole water system and asks where legionella could grow and spread, and who could be exposed. Typically it covers:

the layout of the system — incoming mains, any storage tanks, calorifiers, pipe runs and outlets;
water temperatures, and whether hot stays hot and cold stays cold;
stagnation risks — little-used outlets, dead legs, void periods between tenancies;
who is exposed and how vulnerable they are;
the controls already in place and any actions needed;
and a record of the findings.

The output isn't a pass/fail certificate — it's a written assessment plus a set of controls you then maintain.

How often to review — and how long it lasts

There's no statutory frequency, and a legionella risk assessment doesn't "expire" on a fixed date the way a gas certificate does. The duty is to review the assessment regularly and whenever there's reason to believe it's no longer valid — for example after changes to the water system, the building's use, the occupants, or following any case of the disease.

As a working rule, many duty holders review around every two years, and re-check sooner on any material change. So while people search for "how long does a legionella risk assessment last," the honest answer is: until something changes that could affect the risk — which is why a roughly two-year review is the common good-practice benchmark, not a legal expiry. For the dedicated deep-dive on cadence, change triggers and FAQs, see how often a legionella risk assessment should be carried out.

Day-to-day controls are usually simple and ongoing rather than annual: keep hot water hot and cold water cold, flush little-used outlets, avoid stagnation, keep the system clean.

The certificate myth

This matters because it's where money gets wasted. The HSE has stated plainly that landlords are not required to obtain a "legionella test certificate" and that routine testing is usually unnecessary for simple domestic systems. If a contractor is selling you an annual certificate for a two-bed flat, you're likely paying for something the law doesn't require. What you do need is a documented assessment and evidence you're managing the risk.

What happens if you don't

The HSE and local authorities enforce under the 1974 Act. Breaches carry unlimited fines and imprisonment, and duty holders have been prosecuted following outbreaks. The record of your assessment and controls is your defence.

Where it fits

Legionella sits alongside fire, electrical and gas in the statutory set — see the complete UK property compliance guide.

Unlike the others, legionella has no neat expiry date printed on a certificate — which is exactly why it gets forgotten. Proprietas tracks L8 per site as a first-class obligation, computes the next review, and chases at 90/60/30/7 days so the regime without a hard certificate date doesn't become the one you overlook. See how it works or try the free scanner on a real assessment PDF.

This is a plain-English overview, not legal advice — your duties depend on your premises and water systems.

Legionella Risk Assessment & L8 Duties (UK)