By Delta Force Group — Integrated facilities management across 500+ UK sites. Learn about our Water Compliance services.
UK-specific guidance: This guide reflects UK expectations for legionella control. Always follow your site risk assessment and current guidance. Last reviewed: 28 February 2026.
📌 Key Takeaways: Employer Compliance
- •Legal Duty: Under general health and safety laws, employers are legally mandated to identify, manage, and prevent the risks of legionella in their facilities.
- •Risk Assessment: You must conduct a "suitable and sufficient" legionella risk assessment, mapping your system layout, operational details, and necessary precautions.
- •Competent Person & Testing: You must appoint a "responsible person" to oversee your written control scheme, which involves continuous monitoring, accurate record-keeping, and routine legionella testing.
A legionella risk assessment is a mandatory evaluation required by health and safety law to identify, assess, and manage the risks of legionella bacteria exposure in workplace water systems. As an employer or person in control of premises, you have a legal responsibility to understand these health risks and take appropriate precautions.
If you haven't yet read the fundamentals, start with our companion guide: What Is Legionella? A Complete Guide to Legionella Control.
Your Legal Duties as an Employer
Under general health and safety laws, such as the Control of Substances Hazardous to Health Regulations (COSHH), employers must provide a framework of actions to assess, prevent, or control the risk of bacteria like Legionella.
You are legally required to ensure that:
- •Sources of risk are identified and assessed
- •Risks are managed, prevented, or controlled
- •Correct records are kept and maintained
The HSE Approved Code of Practice (L8) and HSG274 guidance provide the detailed framework for compliance. Delta Force Group's Water Compliance services are structured around these standards.
How to Conduct a Legionella Risk Assessment
You must ensure a "suitable and sufficient" risk assessment is completed. While you may be competent to carry this out yourself, you can also call on advice from within your organisation or hire a suitably competent external contractor.
A complete risk assessment should include:
- 1System Layout: An up-to-date plan or schematic diagram showing the layout of the plant or water system, including any parts temporarily out of use.
- 2Operation Details: A description of the correct and safe operation of the system.
- 3Precautions: The specific control methods and precautions you will take.
- 4Checks and Testing: The checks to carry out to ensure the control scheme is effective, and how often they occur.
- 5Remedial Actions: The steps to take if your written scheme proves ineffective.
If your assessment shows the risks are low and are being properly managed, you may not need to take further action, though you must review the assessment regularly in case system conditions change.
Appointing a Competent Person
You must appoint a competent person—often called the "responsible person"—to help you meet your duties and take responsibility for controlling the identified risks. This person must possess sufficient authority, competence, skills, knowledge of the system, and experience. This could be yourself, one or more workers, or an external contractor.
💡 From Our Experience
A common mistake we see across multi-site organisations is the assumption that appointing a single "responsible person" covers all locations. In practice, each site may have different water system configurations, usage patterns, and risk profiles. We recommend a named responsible person per site—or at minimum per region—with clear escalation to a central compliance lead. Our Hard FM team helps clients structure this governance effectively.
Legionella Testing, Monitoring, and Record Keeping
If you identify a risk that you cannot completely prevent, you must implement a written control scheme. Part of this scheme involves continuous monitoring, checks, and legionella testing.
If you have five or more employees, you are legally required to record your significant findings and the steps taken to control the risks. Records should include:
- •The details of the system's operational state
- •The written control scheme
- •The results and dates of any monitoring inspection, test, or check carried out
⚠️ RIDDOR Reporting
If an employee falls ill with flu-like symptoms, a doctor can use a urine or blood test to decide whether the illness is Legionnaires' disease. Under RIDDOR regulations, employers must report any cases of legionellosis in an employee whose job involves working on water systems likely to be contaminated.
TMV Requirements for Vulnerable Settings
If you operate a facility with vulnerable people (like a care home) where whole-body immersion in baths or showers occurs, there is a scalding risk from hot water. Fitting a TMV Type 3 is required in these specific instances to prevent water from discharging at temperatures above 44°C.
Frequently Asked Questions
What if I hire a contractor for water treatment?
If you employ contractors to carry out water treatment or testing, the competent person in your organisation is still ultimately responsible for ensuring the work is carried out to the required standard.
Do I need a thermostatic mixing valve (TMV)?
If you operate a facility with vulnerable people (like a care home) where whole-body immersion in baths or showers occurs, there is a scalding risk from hot water. Fitting a TMV Type 3 is required in these specific instances to prevent water from discharging at temperatures above 44°C.
How often should a legionella risk assessment be reviewed?
Risk assessments should be reviewed regularly, particularly when there are changes to the water system, building use, or occupancy. As a minimum, most guidance recommends a formal review at least every two years, or sooner if circumstances change.
Who is legally responsible for legionella compliance?
Under general health and safety laws, the employer or person in control of premises is legally responsible. They must appoint a competent "responsible person" to manage and oversee the written control scheme for legionella risk.
Conclusion
Legionella risk assessments and testing are not optional—they are a core employer obligation under UK health and safety law. By conducting thorough assessments, appointing a competent responsible person, and maintaining accurate records, you protect your people, your organisation, and your compliance standing.
Delta Force Group's Water Compliance services provide end-to-end support—from risk assessment through to ongoing testing, monitoring, and planned preventive maintenance. We operate across healthcare, education, commercial, and industrial sectors nationwide.
Contact us today to discuss your legionella compliance requirements.