This guide explains what a Legionella risk assessment is, who is legally required to conduct one, what it must cover, and how the written control scheme and documentation obligations follow from it. It focuses on cold water storage systems in multi-storey buildings — the context in which these obligations are most commonly misunderstood.
Maximum cold water storage temperature per HSG274 Pt 2 and ACoP L8
Optimal growth temperature for Legionella pneumophila (HSG274 Pt 2)
Minimum retention period for risk assessment and monitoring records under ACoP L8
The legal basis
The legal requirement to assess and control Legionella risk in building water systems derives from two pieces of legislation: the Health and Safety at Work etc. Act 1974, and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). Together, these impose a duty on employers and those with control of premises to identify and manage risks to health from biological agents — including Legionella bacteria — in workplace environments.
HSE ACoP L8 — special legal status
HSE’s Approved Code of Practice L8, Legionella Bacteria — The Control of Legionella Bacteria in Water Systems (4th edition), gives practical guidance on how to comply with these legal duties. ACoP L8 has special legal weight: while it is not itself legislation, failure to comply with its provisions is admissible as evidence in enforcement proceedings and creates a presumption of negligence unless the dutyholder can demonstrate an equally effective alternative approach.
HSG274 Part 2
HSG274 Part 2, Legionella and the Prevention of Legionellosis — The Control of Legionella Bacteria in Hot and Cold Water Systems, supplements ACoP L8 with practical guidance specific to hot and cold water systems in buildings. It is the primary technical reference for cold water storage tank risk management and is available free at hse.gov.uk.
Both documents are published by the Health and Safety Executive and apply across Great Britain. In Northern Ireland, equivalent provisions apply under the Health and Safety at Work (Northern Ireland) Order 1978.
Who is the dutyholder?
Under ACoP L8, the dutyholder is the person or organisation who has control of premises or a water system. In a multi-storey residential or commercial building, this is typically the building owner or freeholder, the property management company acting on behalf of owners, or the employer where the building is a workplace.
Delegation does not transfer legal duty
Appointing a specialist water hygiene contractor discharges the practical operational tasks — conducting the risk assessment, implementing monitoring, performing cleaning — but it does not transfer the underlying legal duty. The dutyholder remains accountable for ensuring that the contractor is competent, that work is carried out correctly, and that records are maintained and acted upon.
The responsible person
ACoP L8 also requires the dutyholder to appoint a responsible person to manage day-to-day compliance. The responsible person must have sufficient authority, competence, and knowledge to understand the risks and to oversee implementation of the written control scheme. In a large building, this is typically a senior facilities manager or a contracted water hygiene specialist with a clear, documented scope of appointment — including the scope of their authority and responsibility.
What must a Legionella risk assessment cover?
ACoP L8 sets out the minimum content of a Legionella risk assessment. It must identify whether a risk from Legionella is present; identify all potential sources of Legionella risk in the water system; assess the risk associated with each source; evaluate whether existing controls are adequate; and identify any corrective actions needed.
For cold water systems in multi-storey buildings, the assessment must consider the entire cold water installation from incoming mains to point of use — including storage tanks, distribution pipework, deadlegs, outlets, and any supplementary water treatment systems.
The assessment must be site-specific
Generic or template risk assessments not tailored to the actual system configuration, building occupancy, and physical conditions of the premises do not meet the ACoP L8 requirement. An assessment conducted for one building cannot be applied to another, even if the systems appear similar.
Competence of the assessor. The risk assessment must be conducted by someone with sufficient technical knowledge of water systems, microbiology, and control measures — typically a specialist water hygiene consultant or contractor who can demonstrate relevant training, qualifications, and experience.
Temperature thresholds — the primary cold water control measure
Temperature control is the principal means of managing Legionella risk in cold water systems. The HSE thresholds, sourced directly from HSG274 Part 2 and ACoP L8, are as follows.
|
Temperature
|
Significance
|
Source
|
|---|---|---|
|
Below 20°C
|
Target storage and distribution temperature for cold water
|
HSG274 Part 2; ACoP L8
|
|
20°C to 45°C
|
The range in which Legionella can survive and multiply
|
HSG274 Part 2
|
|
Approx. 37°C
|
Optimal growth temperature for Legionella pneumophila
|
HSG274 Part 2
|
|
Above 60°C
|
Legionella are killed rapidly; relevant to hot water disinfection
|
HSG274 Part 2
|
|
Greater than 20°C in cold storage
|
Control failure requiring investigation and corrective action
|
ACoP L8
|
Cold water stored above 20°C does not automatically indicate Legionella colonisation, but it removes the primary physical control. The risk assessment and written control scheme must specify the response to a temperature exceedance — who is notified, within what timeframe, and what investigative or remedial action is required.
Risk factors specific to cold water storage
The Legionella risk assessment must evaluate whether any of the following conditions are present in the cold water storage installation.
Heat gain
Warm plant room
Heat gain from adjacent boiler plant, electrical switchgear, or poorly insulated pipework raises stored cold water temperature. The assessment should include a thermal survey or review of temperature monitoring records over a representative period, including summer months.
Water age
Low turnover / oversized tank
Long residence time allows progressive temperature rise and nutrient accumulation, both of which favour Legionella growth. The assessment should compare design storage volume against actual consumption data. For sizing guidance, see the GRP Cold Water Tanks Guide.
Contamination
Sediment accumulation
Organic sediment provides nutrients for biofilm formation and Legionella colonisation. The assessment should record inspection findings regarding sediment, and the written control scheme must specify a cleaning frequency that prevents significant accumulation.
Ingress risk
Missing or ill-fitting covers
Cold water cisterns must have close-fitting, lockable covers to prevent the ingress of dust, organic matter, insects, and light. Algae growth in tanks exposed to light is a significant contamination risk. The assessment must include an inspection of cover condition and specification.
Monitoring gap
Thermal stratification
In storage tanks above approximately 10,000 litres, warmer water rises to the upper layers. A single temperature sensor at low level may show an acceptable reading while upper layers exceed 20°C. The assessment should identify stratification risk and specify monitoring at multiple heights.
Distribution
Stagnant deadlegs
Branch pipework with no or very low flow creates warm, stagnant zones that can harbour Legionella. The assessment must identify all deadlegs in the cold water distribution system and recommend either removal or a regular flushing regime.
Post-modification and extended shutdown
Any significant modification to the water system, or a shutdown period exceeding approximately seven days, should be treated as a risk event requiring cleaning and disinfection before the system is returned to service. This applies to multi-storey buildings during construction snagging, seasonal closures, or prolonged vacancies.
The written control scheme
Once the risk assessment has identified the Legionella risks and the control measures needed, ACoP L8 requires a written control scheme describing how those measures will be implemented, managed, and monitored. The scheme must be site-specific, sufficiently detailed to enable consistent implementation, kept current as the system and risk assessment change, and available to all personnel responsible for implementation.
For cold water storage systems, the written control scheme will typically address the following areas.
Temperature monitoring
Who monitors, at what frequency, at what locations, using what method, and against what threshold. What action is taken when a temperature exceedance occurs.
Inspection and cleaning frequency
How often cold water storage tanks are visually inspected — quarterly at minimum — and fully cleaned and disinfected — annually at minimum, or more frequently where the risk assessment identifies a higher requirement.
Microbiological sampling
Where sampling is required, the scheme must specify sampling points, frequency, the laboratory tests to be conducted, and the action levels that trigger a response.
Water treatment monitoring
Where supplementary treatment is installed — UV disinfection, chlorine dioxide dosing, or copper-silver ionisation — the scheme must specify operational parameters, monitoring frequency, and the response to system faults or parameter exceedances.
Escalation and notification
Who is notified when control failures occur, within what timeframe, and what actions must follow. Where a Legionella-positive sample is obtained, the scheme must specify the disinfection response and resampling confirmation procedure.
Related Guide
Covers the disinfection procedure in full – including chlorination concentrations, contact times, flushing, and the documentation required at handover or following a system shutdown.
Documentation and records
ACoP L8 requires the dutyholder to keep records of all risk assessment activities, monitoring, inspection, and cleaning. These records must be retained for a minimum of five years and made available to inspectors or enforcement authorities on request.
The minimum record set for a cold water storage system includes:
- The written Legionella risk assessment — site-specific, dated, and signed by the competent assessor
- The written control scheme
- Temperature monitoring logs — dated, location-specific, with results and any actions taken
- Inspection records — dates, findings, defects, and corrective actions
- Cleaning and disinfection certificates — signed by the contractor, with chlorination residuals achieved
- Microbiological sampling results and laboratory reports
- Evidence of contractor competence — training certificates, qualifications, and authorisation records
- Records of any Legionella-positive results, the actions taken, and the outcome of resampling
For cold water storage systems, the written control scheme will typically address the following areas.
Records must be reviewed, not merely generated
Temperature logs that show repeated exceedances but no corrective action demonstrate a systematic failure to implement the control scheme. This is itself a serious compliance deficiency — and one that enforcement authorities examine closely.
This guide is provided for general guidance and information purposes only. It does not constitute engineering advice and should not be relied upon as the sole basis for design decisions. © 2026 Tricel Water. All rights reserved.
When must the risk assessment be reviewed?
ACoP L8 requires the risk assessment to be reviewed regularly and whenever there is reason to believe it may no longer be valid. Triggering events include:
|
Trigger
|
Why the assessment may no longer be valid
|
|---|---|
|
Change of use
|
Occupancy type alters water demand patterns and risk profile
|
|
Significant system modification
|
Changes to storage volume, pipework layout, or distribution configuration create new risk pathways
|
|
Change in occupancy pattern
|
Reduced or variable demand increases water age and temperature risk
|
|
Extended shutdown (typically >7 days)
|
Stagnant water in a warm system is a high-risk condition requiring revalidation before reoccupation
|
|
Positive Legionella sample
|
Indicates the existing control measures have failed; the assessment must identify why
|
|
Confirmed or suspected case of Legionellosis
|
May be linked to the water system; investigation and immediate review are required
|
|
Routine review cycle
|
Annually for standard-risk buildings; more frequently for high-risk premises
|
The review must be documented. A risk assessment with no review record cannot demonstrate ongoing compliance.
High-risk premises
Some building types carry a higher inherent Legionella risk because of the vulnerability of their occupants or the operational characteristics of their water systems.
- Care homes, hospitals, and healthcare settings — many occupants are elderly, immunocompromised, or receiving treatments that increase susceptibility to Legionellosis
- Hotels and short-stay accommodation — occupancy patterns create periods of low or zero water use, and many different users share water outlets
- Leisure facilities with spray or aerosol-generating water features
- Buildings with cooling towers or evaporative condensers — subject to separate regulatory requirements under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992
For high-risk premises, the risk assessment will typically recommend more frequent monitoring, supplementary water treatment, and a more intensive maintenance regime than the minimum baseline applicable to standard commercial or residential buildings.
RELATED GUIDE
Full lifecycle coverage – specification, sizing, installation, UK compliance, Legionella control, and maintenance schedules. Includes temperature monitoring and cleaning checklists.
Frequently asked questions
Who is responsible for Legionella risk assessment in a multi-storey building?
The dutyholder under HSE ACoP L8 is the building owner, freeholder, or management company. This responsibility cannot be fully delegated. Appointing a specialist contractor discharges the operational task but not the underlying legal duty. The dutyholder remains accountable for ensuring contractors are competent and work is carried out and documented correctly.
How often should a Legionella risk assessment be reviewed?
ACoP L8 requires the risk assessment to be reviewed regularly and whenever there is reason to believe it may no longer be valid — for example, following a change of use, significant modification to the water system, a period of extended shutdown, positive Legionella sampling results, or a change in occupancy that materially affects water demand or turnover.
What temperature should cold water be stored at to prevent Legionella?
HSE guidance (HSG274 Part 2 and ACoP L8) specifies that cold water should be stored and distributed at or below 20°C. Legionella bacteria can survive and multiply between 20°C and 45°C, with optimal growth at approximately 37°C. A stored temperature exceeding 20°C is a control failure that must trigger investigation and corrective action under the written control scheme.
Does a newly installed cold water tank need a Legionella risk assessment?
Yes. A new installation should have a risk assessment completed before the system is brought into service, or within a defined timescale agreed at handover. The commissioning records — including cleaning and disinfection certificates — form part of the evidence base for the initial risk assessment. The written control scheme should be in place before handover is complete.
What happens if Legionella is found in a cold water sample?
A positive Legionella result is a control failure requiring immediate action. The written control scheme must specify the response: notification of the dutyholder, shock disinfection of the affected system, investigation of the cause, and resampling to confirm clearance before the system is returned to unrestricted use. Depending on the concentration found and the building occupancy, notification of the local authority or Public Health authority may also be required
CONTENTS
Free Download
Complete GRP Cold Water Tank Guide
Full lifecycle coverage — sizing, compliance, installation, Legionella control, and O&M schedules. Includes ready-to-use checklists and a maintenance log template.
