Legionella compliance tends to get filed mentally under “that’s an HMO thing” — a landlord problem for residential blocks with shared water tanks, not something that applies to an office, a retail unit, or a commercial let. That’s a genuine misunderstanding, and an expensive one if it’s wrong. Legionella control applies to any water system capable of creating and spreading breathable water droplets, and that covers a far wider range of commercial buildings than most landlords assume.
Here’s what the law actually requires, who’s responsible for it, and what staying compliant actually looks like in practice.
Who’s Actually Responsible
Under UK health and safety law, responsibility for controlling legionella risk falls to whoever has control of the premises and its water systems — commonly referred to as the “duty holder” or “responsible person.” For a commercial landlord, that’s often the landlord or their managing agent where they control shared building systems, though in a fully repairing lease it can sit with the tenant for systems within their demise. The key point is that this responsibility doesn’t disappear because a property is let rather than owner-occupied — it simply needs to be clearly assigned, in writing, so it’s obvious who’s actually accountable for each water system in the building.
What the Law Actually Requires
Legionella control in the UK sits under the Health and Safety at Work Act and the COSHH Regulations, with the Health and Safety Executive’s Approved Code of Practice L8 — Legionnaires’ disease: The control of legionella bacteria in water systems — as the core guidance document, supported by the more technical HSG274 guidance and the risk assessment methodology set out in BS8580-1:2019.
In practice, that framework requires four things:
A legionella risk assessment. Every water system that could create a risk — hot and cold water systems, cooling towers, evaporative condensers, and any system producing a spray or aerosol — needs a documented risk assessment carried out by a competent person. Even where the assessment concludes the risk is low, the assessment itself still needs to exist in writing and be kept on file; “we assumed it was fine” isn’t a defensible position if an inspector or an incident ever asks for it.
A written scheme or water hygiene management plan, setting out the system layout, the control measures in place, who’s responsible for what, and the monitoring regime that keeps the system within safe parameters.
Ongoing monitoring and maintenance, which is where most of the actual day-to-day compliance work happens — things like temperature checks at outlets (legionella bacteria multiply fastest in roughly the 20–45°C range, which is why keeping hot water hot and cold water cold matters so much), regular flushing of infrequently used outlets, descaling and cleaning of shower heads and aerators, periodic inspection of tanks and cylinders, and water sampling where the risk assessment calls for it.
Records that can actually be produced. Risk assessments, the management plan, monitoring logs, and any remedial actions taken all need to be kept and genuinely accessible — not filed away somewhere nobody can find them when they’re needed.
What This Applies To — More Than You’d Think
Legionella risk isn’t limited to large residential blocks with communal tanks. Any commercial building with a hot and cold water system carries some level of risk that needs assessing, even if the conclusion is that the risk is low and requires only basic monitoring. The risk increases meaningfully with certain features: water systems with infrequently used outlets (a seasonal building, a part-let floor, an unused shower room), large or complex pipework with dead legs, cooling towers or evaporative condensers (which also carry a separate notification duty to the local authority), and any system where water temperature can sit within the growth range for extended periods.
This is exactly why a mixed, older commercial portfolio — the kind common across Bristol’s building stock — needs this assessed property by property rather than assumed from one standard template. A straightforward modern office with a combi boiler and no stored hot water is a very different risk profile to an older building with a water storage tank and a part-vacant floor.
What Happens If It’s Ignored
Legionella falls within the same HSE enforcement framework as other workplace health and safety breaches — inspectors can issue improvement or prohibition notices, and serious or repeated non-compliance can lead to prosecution under the Health and Safety at Work Act. Beyond the regulatory risk, an actual legionella incident carries obvious and serious consequences for anyone exposed, along with the reputational and insurance fallout that follows a preventable outbreak traced back to a building that was never properly assessed.
The pattern here mirrors general HSE enforcement more broadly — compliance work done quietly and consistently in the background is cheap, while non-compliance discovered during an inspection or, worse, after an incident, is not.
Making This Part of an Ongoing Routine, Not a One-Off Task
Legionella control isn’t a certificate you obtain once and file away — it’s an ongoing monitoring routine that only works if it’s actually maintained. That makes it a textbook example of the kind of system we’ve written about in our guide to PPM vs reactive maintenance: legionella control sits firmly on the “non-negotiable PPM” side of that balance, alongside fire and gas safety, precisely because the consequence of treating it reactively is a genuine safety incident rather than an inconvenience.
Our property maintenance guide covers where water hygiene sits within a wider PPM schedule alongside gas safety, EICR, and fire risk — the compliance obligations that, taken together, make up most of a landlord’s statutory maintenance burden.
How Mobius Approaches This
Water hygiene and legionella monitoring form part of the plumbing and drainage work our FM & MEP team delivers for commercial and domestic clients across Bristol and the South West, alongside electrical, HVAC, gas, renewables and refrigeration compliance. Rather than treating legionella control as a standalone certificate to chase once a year, we build it into the same ongoing PPM relationship we run for a building’s other statutory compliance needs — risk assessment, monitoring, and record-keeping that’s actually available when you need it, not just when an inspection’s been booked.
If you’re not sure whether your current water hygiene arrangements meet what’s actually required for your building, get in touch with our team and we’ll talk through what a proper risk assessment and monitoring regime should look like for your specific property.