Last updated: 6 September 2026
Legionella Risk Assessment Frequency: How Often UK Duty Holders Must Review Water Safety in 2026
Legionella risk assessment frequency is not fixed by law at a set number of months — the Health and Safety Executive (HSE) requires duty holders to review the assessment regularly and "as often as necessary," commonly interpreted as at least every two years, or immediately after any change to the water system, occupancy, or a monitoring failure.
Key Takeaways
- The Health and Safety Executive does not set a fixed legal interval for legionella risk assessment reviews. HSE's Approved Code of Practice L8 requires reviews "regularly" and whenever there is reason to suspect the original assessment is no longer valid.
- Most UK facilities managers treat two years as the practical maximum gap between full legionella risk assessment reviews, based on HSE's ACOP L8 guidance.
- UKHSA recorded 472 cases of legionellosis in England and Wales in 2026, a 22.0% decrease compared with 2023 (UKHSA / Legionella Control International, 2026).
- HSE fined Amey Community Limited £600,000 plus £15,186.85 in costs after the company failed to act on a 2016 legionella risk assessment, a failure linked to a prisoner's death (HSE Press Release, 2026).
- HSE fined Sanctuary Housing £900,000 plus £11,480.60 in costs after a legionella outbreak at sheltered housing accommodation, showing enforcement extends well beyond hospitals and hotels (PropertyWire, 2026).
What is a legionella risk assessment?
A legionella risk assessment is a legally required evaluation of a building's water systems that identifies the presence, growth conditions, and control measures needed to prevent Legionella bacteria — the organism responsible for Legionnaires' disease, a severe form of pneumonia — from proliferating and being inhaled by building occupants. UK duty holders carry out this assessment under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH), a set of regulations governing exposure to hazardous substances including biological agents like Legionella. The Health and Safety Executive sets out detailed expectations in its Approved Code of Practice L8 (ACOP L8), a statutory code of practice describing what compliance with the law looks like in practice, and its supporting technical guidance, HSG274.
The assessment covers hot and cold water systems, cooling towers, evaporative condensers, spa pools, and any other water system capable of creating a fine spray or aerosol. It identifies risk factors such as water temperature, stagnation, biofilm, scale, and the presence of vulnerable occupants — anyone over 45, smokers, or people with weakened immune systems, groups that UKHSA data confirms are disproportionately affected.
A legionella risk assessment is not a one-off document. It forms the foundation of an ongoing water safety management scheme that duty holders must actively maintain, monitor, and review.
How often should a legionella risk assessment be carried out?
UK law does not specify a single fixed number of months for legionella risk assessment reviews. HSE's ACOP L8 states that duty holders must review risk assessments "regularly" and specifically whenever there is reason to believe the assessment is no longer valid — for example, after a change of use, a water system alteration, or new monitoring results. In practice, most competent persons and facilities teams treat two years as the maximum acceptable gap between full reviews for a typical low-to-medium risk building, with annual desktop reviews recommended in between.
This "review when necessary" model means duty holders cannot simply file the risk assessment away and revisit it on a fixed calendar date without checking whether anything has changed. The Health and Safety Executive expects an active, evidence-based decision about whether the existing assessment still reflects reality — a discipline that mirrors the way property maintenance software tracks PPM (planned preventative maintenance) schedules against real building conditions rather than a static calendar.
For higher-risk premises — hospitals, care homes, and large multi-site estates — annual full reviews are the accepted norm across the FM compliance sector, reflecting the higher concentration of vulnerable occupants and the greater complexity of pipework and plant.
What ACOP L8 actually requires
ACOP L8 does not use the phrase "every two years" as a legal minimum. It requires the responsible person to review the assessment "at regular intervals," with the frequency determined by the risk level established in the original assessment. HSE's own guidance, summarised by regional health and safety briefings including those issued by Lincolnshire County Council, confirms that a full review becomes necessary whenever:
- The water system, its use, or its operating conditions change.
- New information about risks or control measures becomes available.
- There is a change in personnel, particularly the appointed competent person.
- Monitoring results indicate that control measures are failing.
- There has been a case, or suspected case, of Legionnaires' disease linked to the system.
Why two years became the industry benchmark
The two-year figure became the de facto industry standard because it aligns with the typical lifecycle of building services checks, insurance audit cycles, and HSE inspection expectations. Lincolnshire County Council's health and safety briefing on the 2013 revision of ACOP L8 notes that the "revised ACOP provides greater clarity for duty holders on what constitutes legal requirements and what is guidance," according to Lorraine Medcalf, Legionella Policy Lead at the Health and Safety Executive. That clarity pushed many organisations toward a documented, risk-based two-year cycle rather than an indefinite "as required" approach that inspectors found difficult to audit.
What triggers an earlier legionella risk assessment review?
A trigger event forces a legionella risk assessment review immediately, regardless of when the last full assessment was carried out. The Health and Safety Executive treats these triggers as mandatory review points, not optional best practice, because each one can materially alter where Legionella bacteria can grow or how occupants might be exposed to contaminated aerosol.
Common triggers include building refurbishment, extended periods of low occupancy (such as school holidays or vacant floors), changes to water system design, new or removed outlets, and any positive Legionella sample result above the acceptable threshold. Facilities teams managing multiple sites need a system that flags these events automatically rather than relying on memory or spreadsheets.
The full trigger list
- Change of water system use — for example, converting a building from office to residential use, which alters occupancy patterns and outlet usage.
- Building refurbishment or extension — new pipework runs, dead legs (sections of pipe with little or no water flow, where stagnant water can allow bacteria to multiply), or extended distances between outlets and the main system.
- Extended shutdown or low occupancy — school buildings over summer, hotels during off-season, or offices left partially vacant, all of which increase stagnation risk.
- Change of water supply — a new water source, mains interruption, or connection to a different supply.
- Change in personnel — particularly loss of the competent person or responsible person named in the scheme.
- Monitoring failures — temperature readings outside the safe range (below 50°C at outlets or above 20°C in cold water storage) or a positive Legionella test result.
- A confirmed or suspected case of Legionnaires' disease associated with the building.
- New legislation or guidance — such as an update to ACOP L8 or HSG274 by the Health and Safety Executive.
How does review frequency differ by sector?
Sector determines review frequency because the Health and Safety Executive expects higher-risk sectors such as healthcare and care homes to review more often than lower-risk sectors such as small offices. This risk-based approach means a shopping centre in Manchester with cooling towers faces a different review cycle to a five-person office in Reading with a simple domestic-style hot water system.
Care homes and hospitals typically operate on annual full reviews because of the higher proportion of vulnerable occupants — UKHSA figures show 63.9% of legionellosis cases in 2026 were reported in people aged 60 and over, with 68.0% of cases affecting men (UKHSA, 2026). Hotels and leisure facilities with spa pools or cooling towers also warrant more frequent scrutiny, while low-risk small commercial premises with simple systems may reasonably operate on a two-year cycle supported by annual desktop checks.
| Premises type | Typical review frequency | Key risk factors |
|---|---|---|
| Hospitals and care homes | Annual full review, continuous monitoring | Vulnerable occupants, complex pipework, immunocompromised patients |
| Hotels, leisure centres, spas | Annual review | Spa pools, cooling towers, transient occupancy, showers |
| Shopping centres and large FM estates | Annual to 2-yearly, risk-tiered by building | Cooling towers, multiple risk zones, high footfall |
| Offices and light commercial | Up to 2-yearly with annual desktop check | Simple systems, lower occupant vulnerability |
| Residential and sheltered housing | Annual to 2-yearly depending on system complexity | Vulnerable residents, communal water systems |
| Construction sites and temporary accommodation | Reviewed at each site change or system alteration | Temporary pipework, stagnant water, dead legs |
What happens if you don't review your risk assessment on time?
Prosecution under the Health and Safety at Work etc. Act 1974 is the primary consequence of an out-of-date legionella risk assessment, with unlimited fines and, in the most serious cases, custodial sentences for individuals found grossly negligent. The Health and Safety Executive has repeatedly demonstrated that it will prosecute organisations that let a risk assessment become out of date and fail to act on its findings, even where no fatality occurs — but the penalties escalate sharply when someone dies.
HSE fined Amey Community Limited £600,000 and ordered it to pay £15,186.85 in costs after the company failed to act on a 2016 legionella risk assessment, a failure that contributed to a prisoner's death from Legionnaires' disease (HSE Press Release, 2026). Stacey Gamwell, HSE Inspector, stated: "There is a legal duty to keep workers and inmates safe in prisons."
HSE fined Sanctuary Housing £900,000 plus £11,480.60 in costs following a legionella outbreak at a sheltered housing accommodation (PropertyWire, 2026). Rose Leese-Weller, HSE Inspector, said the housing association "failed to protect vulnerable residents living at Vincent Naughton Court through its mismanagement of the site's water system."
These two cases together illustrate a pattern that FM compliance teams should note carefully: HSE issued these fines not for a single missed reading, but for a systemic failure to review, act upon, and update risk assessments once circumstances had changed.
The human cost behind the fines
UKHSA's national surveillance data shows why timely reviews matter, beyond the enforcement figures alone. The estimated incidence of Legionnaires' disease in England and Wales was 0.7 per 100,000 population in 2026, down from 1.0 in 2023 (UKHSA, 2026). UKHSA estimated the case fatality rate for 2026 at 2.8% (confidence interval 1.6% to 4.9%) (UKHSA, 2026). Community exposure accounted for 51.6% of cases (239 cases), travel-associated exposure for 43.8% (203 cases), and healthcare-associated exposure for 4.5% (21 cases) in 2026 (UKHSA, 2026). A separate UKHSA report recorded 604 confirmed cases of legionellosis reported to the National Enhanced Legionnaires' Disease Surveillance Scheme (NELSS) in England and Wales in 2023, with an estimated incidence of 1.0 per 100,000 in England and 1.4 per 100,000 in Wales (UKHSA, Legionellosis in residents of England and Wales: 2017 to 2023 report, 2023).
Who is legally responsible for legionella risk assessment reviews?
The "responsible person" or "duty holder" under COSHH 2002 holds legal accountability for ensuring legionella risk assessments are carried out, kept current, and reviewed on schedule — typically the employer, building owner, or landlord, though the practical task is often delegated to a "competent person" with suitable training. Whoever holds this role must be named in the written scheme and must sign off on both the assessment and any subsequent reviews.
For multi-site organisations — shopping centres, construction firms, and FM providers managing dozens of buildings — the duty holder is usually a single named director or estates manager, even though day-to-day monitoring is delegated to site teams or specialist contractors. The Health and Safety Executive holds the named duty holder accountable regardless of how many layers of subcontracting sit beneath them, which is exactly the pattern seen in the Amey Community Limited prosecution.
In-house competent person vs outsourced specialist
Organisations generally choose between training an in-house competent person or outsourcing the entire risk assessment and monitoring cycle to a specialist legionella consultancy. Each route carries trade-offs that FM and estates teams should weigh against their portfolio size and risk profile.
| Approach | Best suited to | Trade-offs |
|---|---|---|
| In-house competent person | Single-site organisations with straightforward systems | Lower ongoing cost; requires training, time, and clear evidence trail to satisfy HSE inspectors |
| Outsourced specialist consultancy | Complex, high-risk, or multi-site estates | Higher cost per assessment; independent expertise; easier to demonstrate due diligence if scrutinised |
| Hybrid model with compliance software | Multi-site FM providers and security companies managing several buildings | Combines specialist assessments with digital scheduling, audit trails, and automated review triggers across a portfolio |
Many facilities and security operations now adopt the hybrid model, using compliance software to schedule specialist reviews, log trigger events, and produce audit-ready evidence the moment an HSE inspector asks for it — the same logic that underpins a security patrol app used to prove checkpoint completion rather than relying on paper logs.
Your legionella risk assessment frequency checklist
- Confirm who holds the "duty holder" or "responsible person" role for every site in your portfolio.
- Record the date of the last full legionella risk assessment for each building and calendar the next review at a maximum two-year interval.
- Schedule an annual desktop review between full assessments to check whether any trigger events have occurred.
- Log every refurbishment, extended shutdown, water supply change, and personnel change that could reset the review clock.
- Verify hot water reaches 50°C or above at outlets and cold water storage stays below 20°C, recording results for audit purposes.
- Escalate immediately if any monitoring result falls outside the safe range or a Legionnaires' disease case is suspected.
- Retain risk assessments, monitoring logs, and review records for the retention period recommended by your competent person, typically at least five years.
- Audit multi-site estates quarterly to confirm no building has slipped past its scheduled review date.
FAQ
How often should a legionella risk assessment be carried out?
The Health and Safety Executive does not set a fixed legal interval, requiring reviews "regularly" and whenever the assessment might no longer be valid. Most UK organisations treat two years as the practical maximum gap for lower-risk premises, with annual reviews for hospitals, care homes, and high-risk facilities.
Is there a legal requirement to review a legionella risk assessment every two years?
No, two years is not a statutory deadline written into legislation — it is an industry-accepted maximum interval derived from ACOP L8 guidance. The actual legal requirement is to review "regularly" and immediately after any trigger event, meaning some buildings need reviews far more often than every two years.
What triggers the need for a new legionella risk assessment?
Trigger events such as building refurbishment, extended low occupancy, water supply changes, a change of competent person, monitoring failures, or a confirmed Legionnaires' disease case all necessitate a new or updated review. Any one of these events should prompt an immediate reassessment rather than waiting for the next scheduled date.
Do legionella risk assessments expire?
Legionella risk assessments do not have a fixed legal expiry date, but they become invalid in practice once circumstances change or once too much time has passed without review. The Health and Safety Executive expects duty holders to treat an assessment as outdated the moment it no longer reflects the current water system and occupancy.
How often should legionella risk assessments be done in care homes and hospitals?
Care homes and hospitals typically require annual full reviews because of the concentration of vulnerable occupants. UKHSA data shows 63.9% of legionellosis cases in 2026 occurred in people aged 60 and over, reinforcing why healthcare and elderly care settings warrant more frequent scrutiny (UKHSA, 2026).
What is the difference between a legionella risk assessment and legionella testing?
A legionella risk assessment is a comprehensive evaluation of the whole water system, its design, and its control measures, while legionella testing is the ongoing sampling and temperature monitoring that checks whether those controls are working day to day. Testing results feed into the decision about whether a full risk assessment review is needed sooner than planned.
Who is legally responsible for conducting a legionella risk assessment?
The duty holder or responsible person, usually the employer, landlord, or building owner, is legally responsible under the Health and Safety at Work etc. Act 1974 and COSHH 2002. This person may delegate the practical assessment to a trained competent person or an outsourced specialist, but legal accountability remains with the named duty holder.
Keeping legionella compliance on schedule with Pulse Operations
Legionella risk assessment frequency is only useful if someone actually tracks it across every building, cooling tower, and water system a facilities or security operation is responsible for — and that's exactly the gap Pulse Operations closes for FM providers, in-house estates teams, and security companies managing statutory compliance across multiple sites. Missed review dates, undocumented trigger events, and scattered paper records are precisely what turned the Amey Community Limited and Sanctuary Housing cases into six and seven-figure fines.
Pulse Operations' compliance runway sits alongside its SIA licensing, BS 7858 vetting, and DBS tracking modules, giving estates and FM teams one place to log statutory building compliance items — including legionella review dates, monitoring logs, and trigger events — with a full audit trail rather than a filing cabinet of certificates. The same platform covers full FM functions including work orders, PPM scheduling, and permits, so a legionella trigger event logged on one site can sit alongside the rest of an estate's compliance record — as described in more detail in this guide to integrated security and FM software.
If your organisation manages legionella risk assessments across multiple sites and needs an auditable, single system to prove every review happened on time, get in touch with Pulse Operations to see the compliance runway in action.
Related Reading
- Guardhouse Alternative 2026: Best UK Options Compared
- SmartTask Alternative 2026: Best Options Compared
- TrackTik Pricing 2026: UK Cost Guide & Alternatives