Legionella risk assessments and checks: what employers need to know

Reviewed by Phil Pinnington, Head of Audit and Consultancy, British Safety Council

Published: 14 October 2026

Legionella can pose a serious health risk in workplaces where water is stored, circulated or may stagnate. If it isn’t properly controlled, exposure can lead to Legionnaires’ disease, a severe, potentially fatal form of pneumonia.

Employers have a responsibility to identify and manage the risk of exposure to Legionella in the workplace. This includes understanding where the bacteria can grow, how people may be exposed, and what controls are needed to protect workers and others who use the premises.

This guide explains the key Legionella checks employers may need to conduct, what the law requires, and how to assess and control the risk.

What is Legionella and where can it be found?

Legionella is a type of bacteria found naturally in water. It can become a health risk when it grows in man-made water systems and people inhale contaminated water droplets released into the air.

Legionella can grow in stored or recirculated water, particularly when the temperature is between 20°C and 45°C. Rust, sludge and scale can also provide nutrients that encourage the bacteria to grow. Contamination can also get in from outside, for example from birds roosting around a poorly covered rooftop water tank.

In workplaces, the most common sources of Legionella include hot and cold-water systems, showers, cooling towers, evaporative condensers, and spa pools (in leisure and hospitality settings).

What Legionella checks must employers be aware of?

The checks needed to manage the risk of exposure to Legionella will depend on the type of water system, and the risks identified and the frequency of use. However, there are some common areas employers are likely to need to monitor. The frequencies below are based on HSE guidance for hot and cold-water systems; your risk assessment should confirm what applies to your premises.

For more detailed guidance, employers should refer to HSE’s advice on monitoring and reviewing Legionella controls.

Is a Legionella risk assessment a legal requirement?

Yes. If you are an employer or responsible for managing premises, you have a legal duty to assess the risk of exposure to Legionella. HSE states that all water systems require a risk assessment, although the level of detail needed will depend on the system and the risks identified.

The Health and Safety at Work etc. Act 1974 places duties on employers to protect the health and safety of workers and others who may be affected by their work. The Control of Substances Hazardous to Health Regulations 2002 (COSHH) more specifically require employers to assess and control risks from hazardous substances, including bacteria such as Legionella. The Management of Health and Safety at Work Regulations 1999 also require employers to assess risks to workers and others. If your premises have a cooling tower or evaporative condenser, you must also notify your local authority.

Some people are at greater risk of developing Legionnaires’ disease, including people over 45, smokers and people who drink alcohol heavily, and those with chronic respiratory or kidney disease, diabetes, lung or heart disease, or a weakened immune system. Where these groups may be exposed, particularly in care homes or healthcare settings, the risk assessment should identify controls that are proportionate to the risk.

A Legionella risk assessment should consider the water system, possible sources of exposure, who may be affected and how exposure will be prevented or controlled. In practice, this is a technical job. It involves surveying the entire system, producing schematic drawings showing where pipes, tanks and outlets are, checking temperatures and, depending on the system, taking water samples. Even for an office, the report will be very detailed. If you have five or more employees, you must record the significant findings of the assessment.

If the assessment shows that exposure risk is low and already being properly managed, no further action may be needed at that stage. However, existing controls must be maintained and the assessment reviewed regularly.

Who is responsible for managing Legionella risks in the workplace?

Employers are responsible for making sure Legionella risks in the workplace are accurately assessed and effectively managed.

They should appoint a competent person, often known as the ‘responsible person’, to help manage any identified risks and take day-to-day responsibility for the control measures. This could be the employer, someone within the organisation or an external specialist, as long as they have the skills, knowledge and experience needed for the role. This role is different from carrying out the risk assessment itself. Day-to-day checks, such as temperature monitoring and flushing, can usually be done by trained staff, while the risk assessment normally calls for a specialist assessor.

How often should Legionella checks and risk assessments be reviewed?

There is no set period for reviewing Legionella checks and risk assessments. The right review frequency will depend on the water system and the risks identified.

Employers should review risk assessments regularly and whenever there is reason to think they may no longer be valid. A review may be needed if the water system or use of the building changes. It may also be necessary if new information about the risk becomes available or checks show that existing controls are no longer effective.

How employers can reduce the risk of Legionella

Employers can reduce the risk of Legionella by managing water systems carefully and putting appropriate controls in place.
Depending on the water system, this may include:

• Managing water temperatures: keep hot and cold water at temperatures that help prevent Legionella from growing.
• Preventing stagnant water: remove unnecessary pipework and make sure little-used outlets are managed in line with the risk assessment.
• Keeping water systems and outlets clean: regular cleaning and maintenance can help prevent the build-up of materials that encourage bacterial growth.
• Controlling water spray: take steps to reduce the release of water droplets where there is a risk of exposure.
• Monitoring control measures: check that controls remain effective and keep records in line with the risk assessment.

HSE provides more detailed guidance on preventing and controlling Legionella risks.

Legionella awareness training

Managing Legionella risks requires regular checks, effective controls and clear responsibilities. Employers should make sure assessments are carried out properly and that anyone responsible for control measures has appropriate training, knowledge and experience.

Legionella awareness training can help workers understand the health risks associated with Legionella, how exposure can happen and why regular checks and control measures matter. Your risk assessment sets out what needs to be done; awareness training helps you understand it and respond to it.

British Safety Council’s Legionella Awareness course covers legal responsibilities, common risks, control measures, monitoring and review. It provides awareness-level knowledge that complements, rather than replaces, the competence needed by anyone with day-to-day responsibility for Legionella control measures. It doesn’t qualify you to carry out a Legionella risk assessment.