Legionella Risk Assessment for Blocks of Flats: The Law

In Short

Every communal hot and cold water system in a block needs a legionella risk assessment. The duty comes from the Health and Safety at Work etc. Act 1974 and the COSHH Regulations 2002, not from housing law.
The duty holder is whoever controls the premises and the water system: usually the freeholder, the RMC or the RTM company, with the managing agent’s contract setting out who does what.
Approved Code of Practice L8 covers the assessment, the responsible person and the control scheme. HSG274 Part 2 gives the technical detail for hot and cold water systems.
There is no statutory two-year review cycle and no legionella test certificate in law. What is required is review when the assessment may no longer be valid, and monitoring records kept for at least five years.

If your block has a water system that residents, cleaners or contractors could be exposed to, someone has a legal duty to assess the risk from legionella bacteria and control it. In a leasehold block that duty normally sits with the freeholder, the resident management company or the RTM company. It applies whether or not there is a cold water storage tank, whether or not the company makes a profit, and whether or not anyone is employed.

Who Holds the Duty in a Block of Flats

Section 3(1) of the Health and Safety at Work etc. Act 1974 requires an employer to conduct its undertaking so that people who are not its employees are not exposed to risks to their health or safety, so far as is reasonably practicable. Section 4 places a duty on a person in control of non-domestic premises, or of plant or substances in them, to take such measures as it is reasonable for a person in that position to take to make the premises safe. Section 4(4) is the part directors should read: the duty applies where control is exercised in connection with a trade, business or other undertaking, whether for profit or not. A resident management company limited by guarantee is not outside it.

HSE takes a second route to landlords: it treats them as self-employed under section 53 of the Act, which brings section 3(2) into play, and regulation 2(b) of the Prescribed Undertakings Regulations 2015 catches any activity that may pose a risk to another person.

Where several parties have an interest in one building, HSG274 Part 2 is explicit that duties can be shared and that the split follows the agreements in place. Paragraphs 2.148 to 2.150 describe the usual patterns: the owner takes the whole building, the owner takes the common parts while occupiers take the parts they occupy, or the responsibilities pass to a managing agent. Where the agreement is silent, the duty falls on whoever actually has control. Read your management agreement and confirm in writing who commissions the assessment, who acts as responsible person and who holds the logbook: it is one of the statutory compliance items a director should have checked.

The Law: HSWA, COSHH and Approved Code of Practice L8

Legionella reaches the COSHH Regulations 2002 through the definition of a biological agent in regulation 2(1): a micro-organism which may cause infection, allergy, toxicity or otherwise create a hazard to human health. A biological agent is a substance hazardous to health, so the COSHH machinery applies.

Regulation 6 requires a suitable and sufficient assessment before the work is carried out, and review regularly and immediately where there is reason to suspect it is no longer valid.
Regulation 6 also requires an employer with five or more employees to record the significant findings.
Regulation 7 requires exposure to be prevented or, where that is not reasonably practicable, adequately controlled.
Regulation 9 requires control measures to be maintained, and at regulation 9(4) requires records of examinations, tests and repairs to be kept for at least five years.
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 carries the general risk assessment duty, and regulation 11 requires employers sharing a workplace to co-operate.

Approved Code of Practice L8, Legionnaires’ disease: the control of legionella bacteria in water systems, is the fourth edition, published in 2013 and free to download. An ACOP has a status ordinary guidance does not: if you are prosecuted and it is proved you did not follow the relevant provisions of the Code, you must show you complied with the law in some other way or the court will find you at fault. The fourth edition gave ACOP status to risk assessment, the responsible person, the control scheme and review of control measures. The technical detail moved into HSG274, whose Part 2, in its 2024 edition, covers hot and cold water systems.

Two smaller points. Under RIDDOR, a case of legionellosis in an employee who has worked on cooling towers or on hot and cold water systems likely to be contaminated must be reported. And the 1974 Act extends across Great Britain under section 84, so a block in Plymouth, Truro or Cardiff is on the same footing, unlike much of the building safety regime.

Managing a block where this applies? Our team can talk it through with you.

Which Water Systems in a Block Are in Scope

Start from the aerosol. Legionnaires’ disease is contracted by inhaling small droplets of contaminated water, so the assessment concentrates on anything that stores or recirculates water and anything that can produce a spray:

Communal cold water storage tanks, boosted mains sets, break tanks and the pipework serving them.
Communal calorifiers, plate heat exchangers and any communal heating that also produces domestic hot water.
Rising mains, distribution pipework and dead legs left by past alterations.
Showers in a communal gym, changing room or pool, and any communal laundry.
Hose taps, irrigation and sprinkler systems, jet washes, and ornamental fountains or water features.
Cooling towers or evaporative condensers, rare in residential blocks, which must be notified in writing to the local authority under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992.

The system inside each demised flat normally falls outside the company’s assessment, but that follows the lease rather than custom. Where a leaseholder sublets, HSE treats them as a landlord with their own duty inside the flat. Where a flat is empty for a long period, outlets should be used at least once a week, with a flushing regime or draining down for long voids. HSG274 Part 2 paragraph 2.47 warns of the same risk in the gap between pressure testing with water and full occupation: flush weekly, keep temperatures below 20 °C and maintain residual chlorine. That makes it a live issue at handover of a new development.

What a Suitable and Sufficient Risk Assessment Covers

The assessor is looking for water anywhere in the system between 20 °C and 45 °C, stored or recirculated water, nutrients such as rust, sludge, scale, organic matter and biofilms, droplets that can be produced and dispersed, and exposed people made more susceptible by age, illness or a weakened immune system. HSE sets out what the written output should contain:

Management responsibilities, the name of the competent person, and a description of the system.
The competence and training of key personnel.
Any identified potential sources of risk.
The means of preventing the risk, or the controls in place.
Monitoring, inspection and maintenance procedures.
Records of monitoring results and of the inspections and checks carried out.
Arrangements to review the assessment, particularly where there is reason to suspect it is no longer valid.

L8 paragraph 29 requires the duty holder to ensure that whoever carries out the assessment and advises on control is competent. BSI publishes BS 8580-1:2019, Water quality. Risk assessments for Legionella control. Code of practice, which HSE and HSG274 both cite. It is a paid-for standard, so ask an assessor to confirm they work to it rather than taking clause references on trust.

If the assessment concludes there is no reasonably foreseeable risk, or that risks are insignificant and properly managed, L8 paragraph 31 says no further measures are needed. That is a common outcome for a small block fed directly from the mains. It is not a licence to stop: existing controls must be maintained and the assessment reviewed if anything changes.

Where a risk is found, L8 requires a written control scheme: a description of the system with an up-to-date schematic, who is responsible for the assessment and its implementation, safe operation, the control methods, what checks will be carried out and how often, and the remedial action if the scheme proves ineffective. The responsible person of L8 paragraph 51 takes day to day responsibility and needs sufficient authority, competence and knowledge of the installation. You can appoint a contractor, but HSE is clear that ensuring the treatment meets the required standard stays with the competent person.

Temperature Control and the Monitoring Frequencies

Temperature is the traditional and, for most residential buildings, the most reliable control. HSE states the targets plainly: cold water below 20 °C where possible, and hot water stored at least at 60 °C and distributed so that it reaches 50 °C within one minute at the outlets. The 55 °C figure you may see quoted applies to healthcare premises, not to a block of flats.

The intervals below come from Table 2.1 of HSG274 Part 2. They are recommendations, not statutory deadlines: your risk assessment sets the regime for your building.

Routine checks for hot and cold water systems, drawn from Table 2.1 of HSG274 Part 2
What is checked	What the guidance expects	Frequency
Calorifier temperatures	Flow thermostat modulating as close to 60 °C as practicable without going below it, and return not below 50 °C	Monthly
Calorifier internal condition	Inspect through the hatch or with a boroscope and clean by draining. Where there is no hatch, purge debris from the base to a drain	Annually, or as indicated by the rate of fouling
Hot water sentinel outlets	At least 50 °C within one minute of running at the nearest and furthest outlets and long branches	Monthly
Cold water sentinel taps	Below 20 °C within two minutes of running at the taps nearest to and furthest from the tank	Monthly
Other outlets	A temperature profile of the whole system built up over a defined period	A representative selection on a rotating basis
Cold water storage tanks	Inspect and carry out remedial work where necessary	Annually
Stored cold water temperature	Tank temperature remote from the ball valve, recorded against the incoming mains temperature	Annually in summer, or as indicated by temperature profiling
Thermal insulation	Intact, with weatherproofing considered where components are exposed outdoors	Annually
Communal showers and spray taps	Removable heads, inserts and hoses dismantled, cleaned and descaled	Quarterly, or as indicated by the rate of fouling
Infrequently used outlets	Flushed until the temperature stabilises and purged to drain. Anything unused for seven days or more goes on the flushing regime	Weekly, or as the risk assessment indicates
Thermostatic mixing valves	Assess whether the valve is needed and remove it if not. Where needed, inspect, clean, descale and disinfect associated strainers and filters	Annually, or on a frequency set by the risk assessment

Remote temperature and flow monitoring is now common, and HSE accepts that automated monitoring allows early detection of control failures, recommending that its use rests on a specific legionella risk assessment and is agreed by a competent person. In a large block that can be better evidence than a monthly clipboard round.

Hotter water brings a different hazard. There is a scalding risk where water leaves taps above 44 °C. HSE says the risk is minimal for most people where water is delivered up to 50 °C at hand wash basins and that a warning notice may be enough, but where vulnerable people can reach baths or showers a Type 3 thermostatic mixing valve must limit the discharge to 44 °C. In sheltered schemes that needs a recorded decision, and the checks belong in the planned preventative maintenance programme.

How Often the Assessment Should Be Reviewed

There is no legal two-year cycle. HSE states directly that the law does not prescribe review on an annual or biennial basis. COSHH regulation 6 requires review at regular intervals and immediately where there is reason to suspect the assessment is no longer valid. L8 paragraph 47 gives the triggers, and this is the list to work from rather than a date in a diary:

Changes to the water system or the way it is used.
Changes to the use of the building.
New information about risks or control measures.
Checks showing that control measures are no longer effective.
Changes to key personnel.
A case of Legionnaires’ disease or other legionellosis associated with the system.

A two-year interval is a common and defensible planning assumption for a block with stored water and communal plant. Treat it as a judgement recorded in the assessment, not a rule imposed by statute, and bring it forward if plant is replaced, a tank removed or readings start failing. Where an organisation controls many similar units, HSG274 Part 2 paragraph 2.146 accepts assessing a representative proportion first, chosen on similar design, size, age and water supply, with the rest covered on a rolling programme.

Records: What to Keep and for How Long

L8 paragraph 71 lists what the records should contain: who is appointed to conduct the assessment and to manage and implement the written scheme, the significant findings, the scheme and its implementation, which parts of the system are in use, and the results and dates of every monitoring inspection, test or check.

Retention has two figures. L8 paragraph 72 says records should be kept throughout the period they are current and for at least two years afterwards, and that records of any monitoring inspection, test or check should be kept for at least five years. COSHH regulation 9(4) separately requires records of examinations, tests and repairs of control measures to be available for at least five years. Five years is the safe planning figure.

The duty to write anything down bites only on employers with five or more employees, which most resident management companies are not. HSE says so, and adds that keeping a record is still wise. Take that seriously: inspectors do not proactively inspect domestic premises, but if someone contracts Legionnaires’ disease from the system the duty holder may face prosecution and must show a court that the duty was fulfilled. Keep the file where the property manager, the contractor and any on-site staff can reach it, and expect it to be requested in the LPE1 management pack.

Managing a block where this applies? Our team can talk it through with you.

Sampling, Test Certificates and Cost

Sampling water for legionella is not the same as monitoring temperatures, and for most blocks it is not needed. HSE’s position is that hot and cold water systems are generally enclosed, so significant contamination is less likely than in cooling towers and microbiological monitoring is not usually required. HSG274 Part 2 paragraph 2.119 says the same for mains-supplied systems, and flags private water supplies as the case to consider specifically.

Testing becomes appropriate where there is doubt about the control regime, or where recommended temperatures or disinfectant concentrations are not consistently achieved. Sampling should then follow BS 7592, with analysis by a UKAS-accredited laboratory in a proficiency scheme such as the one run by the UK Health Security Agency, applying a detection limit of no more than 100 legionella bacteria per litre for culture-based methods. Open systems such as cooling towers and spa pools are different: routine testing there should be at least quarterly.

Ignore anyone selling a legionella test certificate. HSE states in terms that health and safety law does not require a landlord to obtain or produce one. What you should hold is an assessment, a control scheme if one is needed, and dated monitoring records.

The cost of assessment and routine monitoring is normally recoverable through the service charge where the lease permits recovery of compliance and maintenance costs, and it should appear as a named line in the service charge budget. Section 19 of the Landlord and Tenant Act 1985 limits recovery to costs reasonably incurred and to works of a reasonable standard, which is a useful discipline when comparing quotations. HSE points duty holders to schemes for checking a contractor, including the Legionella Control Association code of conduct, and the duty stays with you whoever you appoint.

If you are a director and unsure where your building stands, the first step is not a survey. Establish three things: who is named as responsible person, when the last assessment was done and what it concluded, and whether monthly temperature records exist for the past year. Plymouth Block Management’s property managers pick up water hygiene records during formal inspections every three months, which usually shows whether the gap is a missing assessment or a missing monitoring routine. If you would like us to look at your building’s water hygiene file, ask for a property manager.

Legionella Questions

The points that come up most often when a board first looks at this.

Do We Need a Legionella Risk Assessment If the Block Has No Water Tank?

Yes. The duty attaches to the system you control, not to the presence of storage. What changes is the likely outcome: a small block fed directly from the mains, with hot water from instantaneous or low volume heaters and high daily turnover, is HSE’s own example of a low risk case, and the assessment may properly conclude that no further measures are needed. Record that reasoning.

Who Pays for the Legionella Risk Assessment in a Leasehold Block?

It is normally a service charge cost, provided the lease allows recovery of compliance, health and safety or maintenance expenditure. Section 19 of the Landlord and Tenant Act 1985 limits recovery to costs reasonably incurred and works of a reasonable standard, so keep the quotations and the agreed scope.

Is a Legionella Certificate Needed to Sell a Flat?

No. HSE states that health and safety law does not require a landlord to obtain or produce a legionella test certificate. Conveyancers do commonly ask about legionella in the management pack, and the right answer is the current risk assessment and recent monitoring records rather than a certificate that does not exist in law.

Does the Management Company Have to Assess Inside Each Flat?

Usually not. The split follows the lease and any management agreement, and HSG274 Part 2 describes the common arrangement where the owner takes the common parts and occupiers take the parts they occupy. Where the agreement is silent, the duty falls on whoever actually has control. A leaseholder who sublets has their own duty inside their flat.

What Temperature Should Communal Hot Water Be?

HSE states that hot water should be stored at least at 60 °C and distributed so that it reaches 50 °C within one minute at the outlets, and that cold water should be kept below 20 °C where possible. Against that, water above 44 °C at a tap is a scalding risk, so where vulnerable people can reach baths or showers a Type 3 thermostatic mixing valve must limit the discharge to 44 °C.

Plymouth Block Management is an ISO 9001:2015 certified managing agent (certificate FS 685565, audited by BSI) and a member of The Property Ombudsman, providing residential block management across Devon, Cornwall and the wider South West.

Sources

Everything above is taken from these, not from a summary of them:

Legionnaires’ disease: what you must do Health and Safety Executive
Legionella and landlords’ responsibilities Health and Safety Executive
Legionnaires' disease: what you must do. Identify and assess sources of risk Health and Safety Executive
Legionnaires' disease: what you must do. Managing the risk Health and Safety Executive
Legionnaires' disease: what you must do. Monitoring and keeping records Health and Safety Executive
Legionnaires' disease: what you must do. Preventing or controlling the risk Health and Safety Executive
Legionnaires' disease: what you must do. Duties under other regulations Health and Safety Executive
Hot and cold water systems Health and Safety Executive
Testing and monitoring your water system for legionella Health and Safety Executive
Legionnaires’ disease: the control of legionella bacteria in water systems. Approved Code of Practice and guidance (L8, fourth edition, 2013) Health and Safety Executive
Legionnaires' disease Part 2: the control of legionella bacteria in hot and cold water systems (HSG274 Part 2, 2024 edition) Health and Safety Executive
Control of Substances Hazardous to Health Regulations 2002, regulation 6 legislation.gov.uk
Control of Substances Hazardous to Health Regulations 2002, regulation 9 legislation.gov.uk
Control of Substances Hazardous to Health Regulations 2002, regulation 2 legislation.gov.uk
Health and Safety at Work etc. Act 1974, section 4 legislation.gov.uk
Health and Safety at Work etc. Act 1974, section 3 legislation.gov.uk
Health and Safety at Work etc. Act 1974 (General Duties of Self-Employed Persons) (Prescribed Undertakings) Regulations 2015 legislation.gov.uk
Landlord and Tenant Act 1985, section 19 legislation.gov.uk
Notification of Cooling Towers and Evaporative Condensers Regulations 1992 legislation.gov.uk

Spotted something wrong, or something that has moved on? Email move@plymouthblockmanagement.com and we will correct the page.

Unfamiliar with a term? Our leasehold and block management glossary defines it.

Help with this in your block

Our team provides block management across Devon, Cornwall and the South West and can talk you through your options.

Call 01752 257338