Why this matters.
Any UK business with a water system capable of creating and spreading breathable water droplets — hot and cold water systems, cooling towers, spa pools, showers, or even infrequently used taps — has a legal duty under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH) to assess and control the risk of Legionella bacteria. The Health and Safety Executive’s Approved Code of Practice L8 sets out what “suitable and sufficient” looks like in practice: a written risk assessment, a written control scheme, and a named responsible person, regardless of the size of the business or whether the duty holder is a landlord, employer, or building owner.
Legionnaires’ disease is a serious and sometimes fatal form of pneumonia, and the HSE actively prosecutes employers who fail to manage this risk — landlords, hotels, care homes, gyms, offices, and hospitality businesses have all faced prosecution and substantial fines following outbreaks or inspection failures, even where nobody was harmed. A common and costly mistake is assuming a Legionella risk assessment is a one-off exercise: HSE guidance expects it to be reviewed regularly and whenever the water system, its use, or the building changes, with routine monitoring (such as temperature checks and outlet flushing) carried out and recorded in between.