Legionella Risk Assessments: Legal Requirement or Myth?

Legionella Risk Assessments: Legal Requirement or Myth?

A legionella risk assessment is a legal requirement for landlords in England; a legionella certificate is not. The duty comes from section 3(2) of the Health and Safety at Work etc. Act 1974 and the COSHH Regulations 2002. HSE states that most landlords can carry out the assessment themselves.

This article is for general information purposes only and does not constitute legal advice. Landlords should seek independent legal advice for their specific circumstances. It describes the position in England.

Where does the duty come from?

The confusion here is not about whether a duty exists. It does. The confusion is about what discharging it involves.

HSE guidance states that section 3(2) of the Health and Safety at Work etc. Act 1974 makes provision for health and safety legislation to apply to landlords, so that a duty of care is owed to tenants. Under section 53 of the same Act, landlords are regarded as self-employed, which is what brings a person letting out a property within a framework that otherwise reads as if it is about workplaces. The Control of Substances Hazardous to Health Regulations 2002 then supply the mechanism, since they cover biological agents including legionella and require the risk to be identified, assessed and controlled.

The Approved Code of Practice, published by HSE as L8, gives guidance on how those duties apply to those in control of premises, landlords included.

HSE defines a landlord widely for this purpose. Its guidance treats a landlord as anyone who rents out a property they own under a lease or licence shorter than seven years, and applies the duties across local authorities, housing associations, private landlords, housing co-operatives and hostels. Letting a single room in your own home is caught.

What does HSE actually expect?

Something considerably lighter than the market often implies. HSE's guidance describes the practical and proportionate application of the law as a duty to assess the risk that does not require an in-depth, detailed assessment.

The reason is the risk profile. HSE states that risks from hot and cold water systems in most residential settings are generally considered low, because of regular water usage and turnover. Its example of a typical low risk system is one where:

• daily water usage is inevitable and sufficient to turn over the entire system
• cold water comes directly from a wholesome mains supply, with no stored water tanks
• hot water is fed from instantaneous or low volume heaters supplying outlets at 50°C, and the only outlets are toilets and wash hand basins

The guidance goes on to say that a simple assessment may show there are no real risks and that these are being properly managed, so no further action is needed. It also notes that the risk is further lowered where instantaneous water heaters such as combi boilers and electric showers are installed, because there is no water storage.

A typical modern flat on mains water with a combi boiler is close to the bottom of the risk range. That does not remove the duty to assess. It changes what the assessment reasonably concludes.

What control measures are expected?

Temperature is the core of it. HSE describes temperature as the most reliable way of minimising exposure risk in most domestic hot and cold water systems, and summarises the principle as keeping hot water hot, cold water cold, and keeping it moving.

The specific measures listed in the guidance are:

Tenants have a part in this and should be told about it. HSE guidance says tenants should be advised not to adjust the temperature setting on the cylinder, to clean showerheads regularly, and to report problems with hot water heating so action can be taken. Showers matter more than other outlets because they create and disperse the water droplets that carry the risk, though HSE notes that regular use reduces it and that instantaneous electric showers pose less risk as they are generally cold fed and heat only small volumes.

What about empty properties?

This is where the risk genuinely rises, and where landlords are most likely to have a gap.

HSE guidance warns against letting water stagnate and calls for careful management of properties left vacant for extended periods, giving student accommodation empty over the summer as its example. The general principle it states is that outlets on hot and cold water systems should be used at least once a week to maintain flow and reduce stagnation. For longer voids it suggests considering a suitable flushing regime or draining the system.

A landlord with a property between tenancies, undergoing refurbishment, or held empty during a sale is squarely in this territory. It is also the one scenario where a dated record is worth keeping without hesitation, because a flushing regime is a series of actions rather than a single conclusion.

Do you need a certificate, a test, or an accredited assessor?

No to all three, on the guidance as it stands.

A certificate. HSE guidance states that health and safety law does not require landlords to obtain or produce a legionella test certificate. HSE has also addressed the sale of these products directly, publishing a myth busting panel case responding to consultants and letting agents who suggested that the revised L8 code had imposed new obligations on domestic landlords. The panel's view was that the legislation had not changed and that the misunderstanding imposes unnecessary financial burdens on landlords who are charged for testing and certificates they do not need.

A test. HSE guidance states that testing or sampling for legionella is not usually required for domestic hot and cold water systems and is only needed in very specific circumstances, pointing to Part 2 of its technical guidance HSG274 for the detail. It is explicit that testing should not be confused with temperature monitoring, which is the reliable way of confirming a system is under control.

An accredited assessor. HSE guidance states that in most cases the actions needed are simple and straightforward, that compliance does not need to be burdensome or costly, and that most landlords can assess the risk themselves without being professionally trained or accredited. A landlord who does not feel competent can arrange for someone else to do it, which is a choice rather than an obligation.

None of this makes buying an assessment wrong. A landlord with a large portfolio, a complex system with storage tanks, or no confidence in their own judgement may sensibly pay for one. The point is that it is a commercial decision, not a statutory requirement, and it should not be sold as the latter.

Why the myth persists

The confusion has a traceable origin. HSE revised the L8 Approved Code of Practice, and in the aftermath a number of consultants and letting agents presented the revision as having imposed new obligations on landlords of domestic rented property.

HSE responded through its myth busting challenge panel. The panel's stated view was that this was wrong, that the legislation had not changed, and that the misinterpretation imposes unnecessary financial burdens on landlords who are charged for legionella testing and certificates they do not actually need. The duty to assess and control the risk had always existed; what the revised code did was make it clearer, which was then read by some as novelty.

The commercial incentive did the rest. A duty that most landlords can discharge themselves for nothing is difficult to sell. A duty repackaged as an annual certificate with a renewal date is straightforward to sell, and sits neatly alongside the genuine annual and five yearly certificates a landlord already buys. That is why legionella assessments are frequently quoted as part of a compliance bundle at a price, and why the term "legionella certificate" circulates despite HSE saying no such requirement exists.

The practical consequence for a landlord is a filtering question rather than a refusal. If a service is being offered, is it being offered as a legal requirement or as a convenience? The first claim is wrong. The second may be perfectly reasonable, particularly where a property has stored water, a complex system, or a landlord who would rather have a specialist's judgement on record.

What about HMOs and larger systems?

The low risk profile HSE describes assumes a small domestic system with high turnover. Some properties do not fit it.

Storage is the main variable. A property with a cold water storage tank and a hot water cylinder holds water at temperatures that can sit within the range in which legionella grows, and the tank introduces the debris risk that the tight fitting lid measure addresses. Larger HMOs with long pipe runs, infrequently used outlets in vacant rooms, and multiple showers depart further from the low risk example, since HSE identifies showers as the outlets that create and disperse the droplets carrying the risk.

None of this changes the legal position. There is still no certificate requirement and no prescribed frequency. What changes is what a competent assessment would reasonably conclude, and the point at which a landlord might sensibly decide their own judgement is not the right basis for the decision. HSE's own framing supports this: it says most landlords can assess the risk themselves, and that those who do not feel competent can arrange for someone else to do it.

HSE guidance states that landlords are not necessarily required to record the findings of the assessment, since that is a statutory duty only for employers with five or more employees, but that it may be wise to keep a record for your own purposes.

On frequency, the guidance is equally clear that the law does not prescribe an annual or biennial review. It says the assessment should be reviewed periodically in case anything changes. It also makes a practical suggestion that landlords with access difficulties can make appropriate checks during visits that are happening anyway, such as gas safety checks or routine maintenance.

The absence of a prescribed frequency is why the annual legionella assessment sold as a compliance product has no statutory basis. A system that has not changed does not generate a new risk each January.

Is anyone actually checking?

Not proactively. HSE guidance states that HSE and local authority inspectors do not proactively inspect domestic premises or ask for evidence that a landlord has carried out a risk assessment.

The exposure arrives afterwards. The same guidance states that if a tenant were to contract Legionnaires' disease from the water system in their home, the landlord may be liable to prosecution under the 1974 Act, and would have to demonstrate to a court that they had fulfilled their legal duty.

That reverses the usual compliance logic. There is no inspection to prepare for and no certificate to produce, but if the worst happens the landlord is proving a historic state of affairs to a criminal standard from whatever material exists. A dated note of the assessment, the control measures set, and the information given to the tenant costs nothing to keep and is the only thing that answers the question.

Two adjacent regimes are worth knowing about. Water supply hazards fall within the Housing Health and Safety Rating System under the Housing Act 2004, so a local housing authority assessing a property can consider them, and the implied term of fitness for human habitation in section 9A of the Landlord and Tenant Act 1985 is assessed by reference to those hazards. Neither creates a certificate requirement, but both mean the subject can surface through a route other than HSE, including when a council requests compliance records.

A legionella assessment is not a certificate with an expiry date, which is exactly why it goes missing. LLCR lets landlords record the assessment date, the control measures set, and the information given to tenants as a dated entry alongside statutory certificates, so the record exists if it is ever needed.