If someone has just asked you to prove your Legionella compliance, an auditor, an insurer, a new client, or your own board, and you are not certain what that proof looks like, this is written for you.

The short version: a risk assessment on its own does not make you compliant. Compliance is what comes after it, the monitoring, the records, the repairs and the reviews that show you are keeping the risk under control week after week. Most businesses that get caught out had a risk assessment. They just did not have everything that should have followed it.

This guide sets out what the law actually expects, who is accountable, and the gaps we most often find when we walk into a building, so you can judge whether your own arrangements would hold up to a hard look.

What Does Legionella Compliance Actually Mean?

Legionella compliance means keeping the risk from your water systems under control continuously and being able to prove it. It is a cycle, not a certificate.

The cycle is the same in every building. You assess the risk, write down how you will control it, put those controls in place, monitor that they are working, record what you do, and review it as the building changes. Training the people responsible runs through all of it.

The trap is treating the risk assessment as the whole job. It is the map, not the journey. An assessment with no monitoring behind it tells you what could go wrong and does nothing to stop it. Monitoring with no records leaves you unable to prove anything when an inspector or insurer asks. And controls that are never reviewed quietly stop matching the building the moment a tenant changes or a wing is added.

Who Is Responsible for Legionella Compliance?

Legal responsibility sits with the duty holder, usually the employer, the building owner, or whoever controls the premises. For most readers, that means you, your organisation, or the landlord or managing agent above you.

The duty holder appoints a responsible person to manage and control the day-to-day. That person needs real authority and genuine knowledge of water systems, not just a general health and safety background. They can sit inside your organisation or be a competent external specialist.

Here is the part that catches people out. You can hand the work to a contractor. You cannot hand over the duty. If a provider misses a flush, skips a temperature check, or gives you incomplete records, the legal accountability is still yours, with your name on it. Specialists lower your risk and do the heavy lifting, but they do not take the responsibility off you.

The Key Legal Requirements Every Business Should Meet

Your duties come from the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). 

How to comply is set out in the HSE’s Approved Code of Practice (ACoP L8), with the technical detail in HSG274. ACoP L8 is not a law in its own right, but if you do not follow it, you have to prove you controlled the risk just as effectively another way. In an inspection or a prosecution, it is the yardstick.

That is the law. Here is what it means you actually have to do.

Your core legal duties

Assess the risk

Get a suitable and sufficient Legionella risk assessment done by a competent person, covering every water system on site, not just the obvious ones.

Appoint a responsible person

Name someone with the authority and training to manage control day to day.

Write a scheme of control

Set out how each risk is controlled, by whom, how often, and what happens when a reading falls out of range.

Put the controls in place

Keep hot water hot and cold water cold, flush outlets that sit unused, and keep the system clean. Legionella multiplies between 20°C and 45°C.

Monitor routinely

Check temperatures, inspect tanks and calorifiers, and sample water where the assessment calls for it.

Keep records

Write everything down. Monitoring records should be kept for at least five years, and you must record the significant findings of your assessment if you employ five or more people.

Review regularly

Update the assessment whenever the building, its use or its water system changes, and at sensible intervals in between.

On their own, each of these is a task. Together, they are the evidence trail that shows you are in control, which is the whole point of routine monitoring. When we are asked to review a site that believes it is compliant, this is the list we check against, and it is usually one or two of these, not all seven, where things have quietly slipped.

Common Compliance Gaps Businesses Overlook

Most compliance failures are quiet. Not a dramatic breach, just small gaps that open up between reviews and sit there unnoticed. These are the ones we find most often on site.

  • The assessment is years old. The building has moved on, and the assessment has not. A refurbishment, a new wing, or a change of use can leave it describing a system that no longer exists.
  • The monitoring stopped quietly. Checks were set up, then the schedule slipped when someone left or got busy. Monitoring only protects you if it actually happens, on time, every time.
  • The recommendations were filed, not fixed. The report flagged remedial work, and it went in a drawer. A known risk you did nothing about is a worse position than one you never spotted.
  • The records have holes. The work might be happening, but if it is not written down, you cannot prove control when asked. On paper, that looks the same as not doing it at all.
  • Nobody actually owns it. Responsibility was never pinned to a name, so tasks slip between roles. Every site needs one person who knows the water system is theirs.

Keeping Your Business Compliant Over the Long Term

Staying compliant means keeping every part of that cycle turning, often across several buildings and more than one type of water system. For a stretched estates or facilities team, the hard part is rarely understanding the rules. It is finding the time and the competent hands to stay on top of them.

This is why many organisations bring in one specialist partner rather than juggling separate contractors for assessment, monitoring, sampling and repairs. One team running the whole water hygiene programme means fewer gaps between tasks, clearer accountability, and a single, complete set of records when someone asks to see them.

Life Environmental covers the full cycle: Legionella risk assessments, monitoring, water analysis, remedial works and staff training, all to ACoP L8 and HSG274, across commercial, education and healthcare estates.

The proof is in the difficult sites. At the University of Bath, the team manages water hygiene across 127 buildings, from laboratories to halls of residence, on a contract running since 2022. It has delivered 100% statutory compliance with zero backlog on risk-critical tasks, working daily alongside the University’s own responsible person. 

That is continuous control on one of the more complex estates in the country, held to UKAS, ISO 9001 and ISO 45001 standards, whether you run one building or a portfolio.

Is Your Legionella Compliance Up to Date?

A risk assessment in a folder is not compliant. Compliance is the monitoring, the records, the repairs and the reviews that follow it, kept up consistently and ready to show.

If you cannot say for certain that all of that is happening across your sites, it is worth finding out now, on your terms, rather than during an inspection on someone else’s. Check when your last assessment was done, whether monitoring is actually on schedule, and whether your records would survive a hard look.

If there are gaps, or you would simply rather hand the whole programme to a team that does this every day, Life Environmental’s water hygiene specialists can review where you stand and what it would take to close them. Talk to the team to start that conversation.