ACOP L8 and HSG274: What Dutyholders Actually Need to Know

Most dutyholders come across ACOP L8 and HSG274 in the same breath, often during an audit, after a positive legionella sample, or when reviewing a risk assessment for the first time. The two documents are routinely treated as interchangeable, yet they do very different jobs. One sets out the legal expectations on those who own, manage or control premises with water systems. The other explains, in technical detail, how to actually deliver that control on site.

Understanding the difference between ACOP L8 and HSG274 is not an academic exercise. It changes how you write a risk assessment, how you scope a written scheme of control, what your contractor should be doing on each visit, and how confidently you can defend your arrangements if something goes wrong. For dutyholders managing offices, care homes, schools, residential blocks, industrial sites or healthcare facilities, getting this right is the foundation of a defensible legionella programme.

This piece sets out, in plain English, what each document covers, where they overlap, and how to apply acop l8 hsg274 guidance day-to-day across hot and cold water systems and higher-risk plant. The aim is to give you a practical map of your duties, not a regulatory recital.

Where ACOP L8 and HSG274 Sit in UK Legionella Law

The legal foundation for legionella control in the UK is not ACOP L8 or HSG274 itself. It is the Health and Safety at Work etc. Act 1974, the Control of Substances Hazardous to Health Regulations 2002, and the Management of Health and Safety at Work Regulations 1999. Together, these place general duties on employers and those in control of premises to assess risks from biological agents, including Legionella pneumophila, and to put in place suitable controls.

ACOP L8, formally titled Legionnaires’ disease: The control of legionella bacteria in water systems, is an Approved Code of Practice published by the Health and Safety Executive. Approved Codes of Practice have a special legal status. They are not law in themselves, but if you are prosecuted for a breach of health and safety law and you have not followed the relevant ACOP, a court can take that as evidence of failure unless you can demonstrate that you complied with the law in some equally effective way. In practice, that places ACOP L8 a half step away from being legally binding for any dutyholder with a water system that could foreseeably create and disseminate aerosols.

HSG274 sits at a different level. It is HSE technical guidance, published in three parts covering evaporative cooling systems, hot and cold water systems, and other risk systems such as spa pools. HSG274 has no formal legal status of its own, but it is the document HSE inspectors, water hygiene specialists and the courts treat as the recognised industry standard for delivering the control measures that ACOP L8 expects. If ACOP L8 tells you what good looks like, HSG274 tells you how to build it.

The relationship is hierarchical rather than competitive. The law sets the duty. ACOP L8 sets the framework for compliance. HSG274 provides the detailed technical methodology. A dutyholder who understands all three layers, and how they fit together, is in a far stronger position than one who treats compliance as a checklist exercise.

What ACOP L8 Actually Says and Why It Carries Legal Weight

ACOP L8 is a relatively short document, but it is dense with duties. It identifies who must act, what they must do, and the standard of care expected. Its core requirements fall into a small number of clear themes.

Further guidance can be found in the legionella ACOP L8 requirements.

The first is the appointment of a dutyholder. Where a workplace or premises has a water system, someone must be formally identified as the person responsible for managing legionella risk. For a limited company, this is typically a director or senior manager. For a landlord or managing agent, it is the person with control of the premises. The dutyholder cannot delegate the legal duty itself, although they can and usually must delegate the operational tasks to a competent person.

The second theme is risk assessment. ACOP L8 requires a suitable and sufficient assessment of the risk of exposure to legionella bacteria, considering the source of supply, the system itself, the likelihood of bacterial proliferation, and the potential for aerosol generation and exposure. The assessment must be reviewed regularly and whenever there is reason to suspect it is no longer valid, such as after system changes, a positive sample, or a change in occupancy.

The third theme is the written scheme of control. Where a risk is identified that cannot simply be designed out, ACOP L8 requires a written document that describes the system, identifies the controls, sets out the monitoring regime, and defines what to do when control limits are breached. This is the operational backbone of legionella compliance.

The fourth theme is record keeping. ACOP L8 requires records of the risk assessment, the written scheme, monitoring results, remedial actions, and any incidents. These records must be retained for at least five years and must be available for inspection.

The reason ACOP L8 carries practical legal weight is the reverse burden of proof embedded in its status. If a court is satisfied that a dutyholder departed from the ACOP, the burden shifts onto the dutyholder to show that what they did was at least as effective. That is a high bar, particularly where someone has fallen ill or died. In enforcement terms, ACOP L8 is treated as the floor of acceptable practice.

What HSG274 Adds and How It Differs From ACOP L8

If ACOP L8 is the framework, HSG274 is the working manual. It is published in three parts, each addressing a distinct category of water system, and each reflecting how the risks and controls actually behave on real plant.

• Part 1 covers evaporative cooling systems, including cooling towers and evaporative condensers
• Part 2 covers hot and cold water systems, the most common category for the majority of dutyholders
• Part 3 covers other risk systems, such as spa pools, humidifiers, vehicle wash systems and certain industrial processes

HSG274 is more detailed than ACOP L8 in several practical respects. It gives temperature targets, sampling frequencies, inspection intervals, and clear descriptions of what control measures should look like in service. It explains, for example, that hot water should be stored at 60°C and distributed so that it reaches 50°C at the outlet within one minute, and that cold water should be below 20°C at the outlet within two minutes. It sets out how often calorifiers should be inspected, how thermostatic mixing valves should be serviced, how often shower heads should be cleaned and descaled, and what to do when monitoring identifies a control failure.

The other significant difference is intent. ACOP L8 is written for the dutyholder. HSG274 is written for the people doing the work, including water hygiene contractors, facilities teams, responsible persons, and competent advisers. That difference in audience changes the language and the level of detail. It also explains why HSG274 is so important to the dutyholder, even though it is not addressed to them. Without HSG274, the written scheme of control has no clear technical content. With it, the scheme can be specific, measurable and auditable.

It is also worth recognising that HSG274 is updated more readily than ACOP L8. Part 2 in particular has been revised to reflect lessons learned from outbreaks and from changes in plumbing practice. A scheme written against an outdated version of HSG274 Part 2 will look obviously thin to any competent assessor. Keeping the technical reference current is part of the dutyholder’s obligation to ensure the scheme remains suitable.

How Dutyholder Responsibilities Are Defined Across Both Documents

The word “dutyholder” appears in both documents, but the responsibilities are most clearly framed in ACOP L8. The dutyholder is the person with overall control and accountability for managing the risk. Where a building is leased, this can sit with the landlord, the tenant, the managing agent, or be split between them depending on the lease and the systems involved. In a multi-let commercial property, for example, the landlord is typically responsible for the central plant and risers, while individual tenants may be responsible for the systems within their demise.

Three roles are typically identified in a well-organised legionella programme.

• The dutyholder, who carries the legal accountability and signs off the strategic decisions
• The responsible person, who is appointed by the dutyholder to take day-to-day operational responsibility, usually a facilities manager, building manager or estates lead
• The competent person or persons, who carry out the technical work, including risk assessment, monitoring, sampling and remediation

The competent person can be internal or external. In most commercial and public-sector settings, this role is held by an external water hygiene contractor or specialist consultant, supported by trained on-site staff for routine tasks such as flushing infrequently used outlets and recording temperatures. Whoever holds the role, ACOP L8 is clear that they must have sufficient training, knowledge, skills and experience to carry out the task in question. The dutyholder is responsible for satisfying themselves that this is the case, and for keeping evidence of competence on file.

HSG274 builds on this by describing what a competent person actually does in practice. It sets out the technical content of monitoring visits, the way temperatures should be recorded, the sampling protocols for legionella testing, and the actions expected when control parameters are not met. A competent person who follows HSG274 properly will produce records that align directly with the written scheme and that demonstrate ongoing compliance with ACOP L8.

Where dutyholder responsibilities most often go wrong is at the boundary between roles. The dutyholder assumes the contractor is managing everything. The contractor assumes site staff are flushing infrequently used outlets. Site staff assume the contractor will pick up anything that matters during their next visit. Clear written allocation of responsibilities, signed off by the dutyholder and reviewed regularly, is the only way to close those gaps.

Applying ACOP L8 and HSG274 to Hot and Cold Water Systems

For most dutyholders, hot and cold water systems are the dominant risk. They are present in almost every premises, they are the most common source of legionella exposure incidents, and they are where HSG274 Part 2 gives the most directly applicable guidance. Applying acop l8 hsg274 principles to these systems is the everyday work of legionella compliance.

The control philosophy for hot and cold water systems rests on three pillars. Temperature is used to suppress bacterial growth, with cold water kept below 20°C and hot water generated and distributed above the temperatures at which legionella proliferates. Movement is used to prevent stagnation, which means designing out dead legs, managing infrequently used outlets, and ensuring that storage capacity matches actual demand. Cleanliness is used to prevent the accumulation of biofilm, scale and sediment, which provide both nutrients and shelter for bacteria.

HSG274 Part 2 translates these principles into measurable parameters. Calorifiers should be inspected and cleaned where appropriate at intervals informed by the risk assessment. Hot water flow and return temperatures should be monitored monthly at sentinel points. Cold water sentinel temperatures should be taken monthly at the inlet to the storage and at the furthest outlet. A representative selection of other outlets should be checked on a rolling basis. Thermostatic mixing valves require annual inspection, descaling and disinfection where the risk assessment supports it. Showerheads and flexible hoses should be cleaned and descaled at least quarterly, more frequently if scale or use patterns demand it.

Where Hot and Cold Water Systems Most Commonly Fail

The technical parameters look simple in writing, but they fail in service for predictable reasons. Cold water tanks installed in roof spaces drift above 20°C during summer because they are uninsulated, undersized or poorly ventilated. Hot water returns fail to reach 50°C because pumps are undersized, balancing valves are misadjusted, or the system has been extended without recommissioning. Outlets used by only one occupant, or used seasonally, sit stagnant for weeks. Showers in voids, guest rooms, or rarely occupied wings become reservoirs.

A competent legionella risk assessment identifies these issues by walking the system, not by reading the asset register. It takes temperatures at outlets, opens inspection hatches on tanks, traces dead legs, and checks that the asset list matches reality. The written scheme then defines what should happen on each system on each visit, and what control limits trigger remedial action. Without that level of specificity, the scheme will not stand up to scrutiny if something goes wrong.

Cooling Towers, Evaporative Condensers and Other Higher-Risk Systems

Where a site operates a cooling tower or evaporative condenser, the legionella regime steps up sharply. These systems generate aerosols by design, can disperse droplets over considerable distances, and have been responsible for some of the largest community outbreaks of Legionnaires’ disease in the UK. They sit firmly in the highest risk category, and HSG274 Part 1 reflects that with detailed expectations on chemical treatment, monitoring frequency, drift eliminator integrity and operator training.

There is also an additional legal layer. Under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, all wet cooling systems must be notified to the local authority. That notification is a one-off duty unless the system is decommissioned or relocated, but in practice many sites discover during an audit that the notification was never made, or that it was made under a previous occupier and never updated. Confirming that notification is current is one of the first checks any new dutyholder should make.

HSG274 Part 1 expects weekly chemical and biocide checks, monthly sampling for general bacteria, and quarterly legionella sampling at minimum, with more frequent testing where conditions warrant it. Drift eliminators must be inspected, packs cleaned, and the entire system disinfected and cleaned at least twice a year, typically aligned with seasonal use patterns. The written scheme for a cooling tower is necessarily more detailed than for a hot and cold water system because the consequences of failure are more severe and the controls are more demanding.

Other higher-risk systems covered by HSG274 Part 3 include spa pools, humidifiers used in industrial processes or large public buildings, vehicle wash systems, decorative fountains, and certain misting and dust-suppression systems. Each has its own control regime, but the principles are consistent. Identify the source of aerosol, control the temperature and chemistry of the water, prevent stagnation and biofilm, monitor regularly, and respond promptly when control is lost.

Risk Assessment, Written Schemes and Record Keeping in Practice

The legionella risk assessment is the single most important document a dutyholder commissions. Done well, it defines the system accurately, identifies real risks, and sets the scope of every other compliance activity. Done badly, it gives false assurance and exposes the dutyholder to enforcement and civil liability.

A suitable and sufficient risk assessment under ACOP L8 should cover the responsibilities and management arrangements, a description of the water system supported by an up-to-date schematic, an asset list with location and condition data, an evaluation of the risk of legionella proliferation and exposure, and clear recommendations prioritised by risk. HSG274 informs the technical content. A good risk assessor walks the system, takes temperatures, photographs significant findings, and produces a document that an internal team can act on without further interpretation.

The written scheme of control sits alongside the risk assessment but does a different job. The risk assessment identifies what needs to be controlled. The scheme defines how it will be controlled, by whom, how often, and with what response when control is lost. The scheme should reference the risk assessment, list the assets, set out the control parameters drawn from HSG274, define monitoring frequencies and methods, and specify the action levels and corrective actions for each parameter. It should be a working document, not a generic template.

Record keeping is the evidence layer that ties everything together. ACOP L8 requires records to be kept for at least five years. In practice, the records that matter include monitoring sheets, sampling results, remedial action records, training records for site staff, contractor visit reports, and minutes of any water safety group or compliance review meetings. A robust record-keeping system, whether paper or electronic, allows the dutyholder to demonstrate continuous control rather than a series of disconnected activities.

What a Defensible Compliance Pack Looks Like

If an HSE inspector arrived tomorrow, what would they expect to see? At minimum, a current risk assessment with all significant findings tracked through to closure or active management. A written scheme of control specific to the site. Monitoring records for the last twelve months at least, showing temperatures, sampling results and any remedial actions. Evidence that the dutyholder and responsible person are clearly identified and have appropriate training. Evidence that contractors have been assessed for competence. A record of any incidents, including positive samples and the actions taken in response. An up-to-date schematic and asset list.

What inspectors find most often is partial: a risk assessment from three years ago, a generic scheme that does not match the site, monitoring records with gaps, and no clear evidence of who is doing what. That is the gap between paper compliance and real compliance, and it is where most enforcement action begins.

Common Compliance Failures Dutyholders Get Wrong

Patterns repeat across the sites we assess. Most failures are not exotic. They are the predictable consequences of treating compliance as a series of contractor visits rather than a managed system.

• Risk assessments that have not been reviewed despite obvious changes to occupancy, system layout, or use patterns
• Written schemes that are generic templates rather than site-specific documents, with no clear control parameters or response actions
• Monitoring carried out diligently but never reviewed by the dutyholder, so out-of-specification results sit unaddressed
• Sentinel temperatures taken at the same outlets every month rather than rotating through a representative sample
• Cold water storage tanks that have not been inspected internally for years, often hidden behind locked roof access
• Shower heads and flexible hoses listed as cleaned in records without any visual check that the work was actually done
• Thermostatic mixing valves serviced on a rolling programme that no longer matches the asset register
• Outlets in vacant rooms, void plant rooms or seasonal areas not flushed, with no formal record of the omission or its rationale
• Positive legionella samples managed by the contractor without the dutyholder being formally notified or involved in the response
• Contractor competence assumed rather than evidenced, with no documented assessment on file

The common thread is a lack of management oversight. The dutyholder needs to be visibly engaged with the system, reviewing records, asking questions, and ensuring that the written scheme is actually being delivered. Where that oversight is absent, problems accumulate quietly until something forces them into the open, often a positive sample, an audit finding, or in the worst cases a confirmed case of Legionnaires’ disease linked to the premises.

It is also worth noting that the regulatory picture continues to develop. Reviewing current legionella regulations and guidance annually, and confirming that the risk assessment and written scheme reflect the latest expectations, is part of a properly managed programme.

When to Bring in a Competent Legionella Consultant

ACOP L8 expects competence to be demonstrable. For most dutyholders, that means engaging an external specialist for at least the risk assessment and any complex remedial decisions, even where routine monitoring is handled in-house or by a separate contractor. The question is not whether to use a consultant, but when and how to use one effectively.

There are several points at which independent consultancy adds clear value. The first is the initial or periodic risk assessment, particularly for sites with multiple buildings, complex systems, or healthcare and care home occupancy where service users may be more vulnerable. The second is when a positive legionella sample is identified, where the response needs to be technically correct, proportionate and properly documented. The third is when reviewing or rewriting the written scheme of control, especially after significant changes to the building or its use. The fourth is during contract tendering or transition, when a competent adviser can scope the work properly and assess potential contractors against meaningful criteria.

A good consultant does more than write a report. They translate ACOP L8 and HSG274 into a programme that fits your site, your team and your operational reality. They train your responsible person to ask the right questions, review your monitoring records with a critical eye, and challenge contractor activity where it falls short. They give the dutyholder confidence that the system is genuinely under control, not merely papered over.

When selecting a consultant, look for evidence of training and qualifications, professional membership of recognised bodies, accreditation against relevant standards, demonstrable experience with similar premises, and a willingness to be specific rather than generic. Generic reports written off a template are easy to spot and offer little protection. Specific reports written by people who have walked your site, opened your tanks and read your records are the ones that hold up when scrutiny arrives.

Frequently Asked Questions on ACOP L8 and HSG274

Is ACOP L8 a legal requirement?

ACOP L8 is not a statute, but it has special legal status as an Approved Code of Practice. If you are prosecuted for a breach of health and safety law and have not followed ACOP L8, a court can treat that as evidence of failure unless you can prove you complied with the law in some equally effective way. For practical purposes, dutyholders should treat it as binding.

Do I need to follow HSG274 if my risk assessment recommends a different approach?

HSG274 is guidance, not law, but it is the recognised industry standard. Departing from it is possible, but only if the alternative approach delivers at least equivalent control and the rationale is documented in the risk assessment and written scheme. The burden falls on the dutyholder to justify the departure, and that justification needs to be technical, not commercial.

How often should the legionella risk assessment be reviewed?

ACOP L8 requires the risk assessment to be reviewed regularly and whenever there is reason to believe it is no longer valid. Most competent advisers recommend a formal review at least every two years, with interim reviews triggered by changes such as building works, occupancy changes, a positive sample, or significant remedial actions. A static assessment that has not been touched for five years is a red flag.

Who counts as a competent person for legionella control?

A competent person has the training, knowledge, skills and experience to carry out the specific task safely and effectively. For risk assessment and complex remedial work, this usually means an external specialist with recognised qualifications and accreditation. For routine flushing and temperature monitoring, trained on-site staff can be competent provided they have appropriate instruction, written procedures, and access to expert support when issues arise.

What records do I need to keep and for how long?

ACOP L8 requires records of the risk assessment, written scheme, monitoring results, remedial actions and incidents to be kept for at least five years. In practice, keeping records longer is sensible, especially for risk assessments and major remedial works, because they often inform the next assessment cycle and provide a documented history of the system that future dutyholders will rely on.

If you are reviewing your legionella arrangements and want an independent view of how your risk assessment, written scheme and monitoring records measure up against ACOP L8 and HSG274, our consultants work with dutyholders, landlords, managing agents and facilities teams across the UK to make compliance practical, defensible and tailored to the site. Contact us today for a free, no-obligation quote.