Is Legionella Testing Mandatory or Just the Risk Assessment?

Few questions cause more confusion among dutyholders than this one: do I legally have to take water samples for legionella, or is a risk assessment on its own enough? The short answer is that a suitable and sufficient risk assessment is the legal starting point under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002. Sampling, by contrast, is not a blanket legal requirement. It becomes necessary when the risk assessment, the written scheme, or the realities of the system point to it as a sensible control measure.

That distinction matters because it shapes how dutyholders spend their compliance budget, how often they bring in specialist support, and how defensible their position looks if something goes wrong. Treating sampling as optional when it is clearly needed is just as risky as treating it as compulsory when it adds no value. Most regulatory failings sit at one of those two extremes.

This article works through what the law actually says, where guidance such as ACOP L8 and HSG274 tightens expectations, and how a competent assessor decides whether water sampling for legionella is justified for a specific site. It is written for the person who has to make the decision and sign off on it, not for the textbook.

The Common Confusion Between Legionella Testing and Risk Assessment

The phrase “legionella testing” is used loosely across the industry, and that is part of the problem. Some people use it to mean the full risk assessment process. Others use it to mean temperature monitoring of hot and cold water outlets. Others use it strictly to mean laboratory analysis of water samples for the presence of Legionella bacteria. These are three different activities with three different legal positions, and confusing them leads to poor decisions.

A legionella risk assessment is the structured review of a water system and its use. It identifies where conditions might allow Legionella to grow, who might be exposed, and what controls are needed. This is legally required for any premises with a water system that could create a foreseeable risk of exposure. Temperature monitoring is part of the routine control regime that flows from the assessment and the written scheme. Water sampling for legionella is the microbiological analysis that confirms whether the bacteria are actually present in the system at the time the sample was taken.

When a dutyholder asks whether legionella testing is mandatory, they usually mean the third activity. The answer is more nuanced than a simple yes or no. The risk assessment is mandatory in practical terms wherever a foreseeable risk exists. Sampling is conditional. It depends on the system, the population exposed, the type of control regime in place, and what the competent assessor concludes is reasonably practicable.

The confusion is not helped by service providers who bundle sampling into every quote as if it were a legal default. It is also not helped by dutyholders who assume that a clean sample result somehow replaces the need for proper temperature control, flushing, or remedial work. Sampling is a verification tool. It is not a substitute for managing the system properly.

What the Law Actually Requires Under ACOP L8

The legal framework for controlling legionella risk in the UK sits across several pieces of legislation rather than a single dedicated act. The Health and Safety at Work etc. Act 1974 places a general duty on employers and those in control of premises to ensure, so far as is reasonably practicable, the health and safety of employees and anyone else who may be affected by their work. The Control of Substances Hazardous to Health Regulations 2002, known as COSHH, applies to biological agents including Legionella bacteria. The Management of Health and Safety at Work Regulations 1999 require a suitable and sufficient assessment of risk.

ACOP L8, the Approved Code of Practice published by the HSE, sits on top of those regulations. It does not create new law in itself, but it has special legal status. If a dutyholder is prosecuted and has not followed the code, they have to show that they complied with the law in some other equally effective way. In practice, most enforcement action and most insurer expectations track ACOP L8 closely.

ACOP L8 sets out the duties of the dutyholder, the appointment of a competent person, the need for a written scheme of control, the requirement to identify and assess sources of risk, and the duty to manage and review controls. HSG274, the supporting technical guidance, gives the detail. It is split into three parts covering evaporative cooling systems, hot and cold water systems, and other risk systems such as spa pools.

Nowhere in ACOP L8 does the law say “you must take water samples every X months.” What it says is that the dutyholder must identify and assess the risk, implement a written scheme to control that risk, and monitor the effectiveness of the controls. Sampling is mentioned as one of the tools used to verify that the control regime is working. It is presented as a measure to be used where appropriate, not as a universal duty.

This is the critical legal point. The risk assessment is the legally anchored starting position. Sampling sits inside the toolkit of control measures and is justified, scheduled, or omitted on the basis of what that assessment concludes.

Is Legionella Testing Mandatory or Discretionary?

Strictly speaking, legionella testing is not mandatory as a standalone legal duty. There is no regulation that says every dutyholder must sample their water system at a set frequency. What is mandatory is the duty to manage the risk of exposure to Legionella, and that duty is discharged through a competent risk assessment, a written scheme of control, ongoing monitoring, and a documented review cycle.

However, treating the answer as a simple “no, sampling is not required” is misleading. In several situations, sampling becomes effectively mandatory because it is the only practical way to demonstrate that controls are working or to verify that a known problem has been resolved. HSG274 specifically identifies categories of system and circumstances where sampling is expected as part of reasonable practice. If a dutyholder ignores those expectations and an outbreak or near-miss occurs, the HSE and the courts will not be sympathetic to the argument that sampling was technically discretionary.

So the more accurate framing is this. The risk assessment is the legal floor. Sampling is a discretionary control measure that becomes a reasonable, expected, and sometimes essential step depending on the system type, the population exposed, the control regime, and the risk profile identified in the assessment.

Asking whether legionella testing is mandatory in isolation is the wrong question. The right question is whether sampling is justified for this particular system, at this particular time, in this particular context. A competent assessor answers that question, and the answer should be recorded with reasoning.

When Sampling Becomes a Reasonable Control Measure Under HSG274

HSG274 is where the practical expectations around sampling are set out in detail. The guidance gives specific situations where water sampling for legionella is recommended or expected as part of a competent control regime. These are the situations dutyholders need to recognise, because they are where the discretionary framing of sampling falls away in practice.

HSG274 Part 1, covering evaporative cooling systems, sets a clear expectation that routine sampling is part of the control regime. Cooling towers and evaporative condensers create aerosols that can disperse over distance, and the population at risk is potentially large. For these systems, sampling at defined frequencies is treated as a baseline expectation rather than a discretionary add-on.

HSG274 Part 2, covering hot and cold water systems in buildings, takes a more conditional position. Sampling is recommended where:

• the system is treated with biocides such as in some healthcare or industrial settings
• control parameters are not being consistently achieved, for example hot water return temperatures persistently below 50°C or cold water above 20°C
• the system supplies water to people at higher risk, such as patients in healthcare, elderly residents, or those who are immunosuppressed
• the written scheme identifies sampling as a verification measure
• there has been a suspected or confirmed case of Legionnaires’ disease linked to the building
• significant remedial work has been carried out and the system needs to be revalidated

HSG274 Part 3 deals with other risk systems including spa pools, humidifiers, vehicle wash systems, fountains, and similar. For spa pools, microbiological sampling is essentially treated as routine, with sampling for Legionella and other organisms expected on a defined schedule.

The pattern across HSG274 is consistent. Where aerosol generation is significant, where the exposed population is vulnerable, where the control regime relies on chemical treatment, or where temperature control cannot be relied on, sampling moves from optional to expected. Where a building runs a well-controlled hot and cold water system at the correct temperatures, with good turnover and no susceptible population, routine sampling may add little and can reasonably be omitted.

Situations Where Testing Is Effectively Expected in Practice

Beyond the categories set out in HSG274, there are operational situations where sampling becomes the only sensible course of action. These are the moments where the question of whether legionella testing is mandatory becomes academic, because not testing is indefensible.

After a confirmed or suspected case of Legionnaires’ disease that may be linked to the building, sampling is essential. Public health investigations will expect it, and the dutyholder needs to know whether the system was the source. Refusing or delaying sampling in this scenario is not a defensible position.

After significant remedial work, such as chlorination, system disinfection, replacement of contaminated assets, or major pipework changes, sampling provides the evidence that the work has achieved its purpose. Sign-off without verification leaves the dutyholder exposed.

Where a building has been vacant or partially occupied for an extended period, particularly relevant in the context of post-pandemic reoccupation, sampling is commonly used to confirm that the system is safe to bring back into normal service. Temperature monitoring and flushing alone may not be enough to provide assurance.

Where control parameters are repeatedly out of specification, sampling tells the dutyholder whether the failure has translated into actual bacterial growth. A persistently warm cold water tank or a hot water system that cannot reach 60°C at the calorifier are not theoretical problems. They are conditions that favour growth, and sampling clarifies the actual position.

Where the population at risk includes vulnerable people, the threshold for sampling drops. Care homes, hospitals, dialysis units, and similar premises cannot rely on temperature data alone in many circumstances. Verification through sampling is part of how a competent dutyholder demonstrates control.

Where the written scheme of control specifies sampling, it becomes a self-imposed duty. The scheme is the document the dutyholder will be measured against. If it says quarterly sampling and the dutyholder does not do it, that is a failure against their own control regime, regardless of what the law strictly requires.

How a Competent Risk Assessment Determines Whether Sampling Is Needed

The decision on whether to sample sits squarely within the risk assessment. A competent legionella risk assessment does more than tick boxes against a checklist. It evaluates the system, the use, the population, and the control regime, and it draws conclusions about what is reasonably practicable to manage the risk.

The assessor will look at the system type and complexity. A small office with a mains-fed direct cold supply and a single point-of-use water heater has a very different risk profile from a multi-storey building with cold water storage tanks, a recirculating hot water loop, calorifiers, and dead legs from historical alterations. The first may need no routine sampling. The second may need a structured sampling programme.

They will assess the exposed population. Healthy adults in a commercial office tolerate Legionella exposure differently from elderly residents in a care home or immunosuppressed patients in a hospital. The susceptibility of the population shifts the risk calculation significantly.

They will review the existing control regime. If temperature monitoring is consistent, turnover is good, dead legs have been removed, and the system is properly designed, sampling adds limited value as a routine activity. If controls are weak, inconsistent, or new, sampling provides the verification needed to bridge the gap.

They will consider history. A system that has previously produced positive results, a building that has had a confirmed case, or a site that has undergone significant work all carry context that justifies sampling. So does a system with a long period of partial use or unusual occupancy patterns.

Finally, the assessor will record the reasoning. This is critical. A risk assessment that concludes no routine sampling is needed must explain why. A risk assessment that requires sampling must set out the scope, the points to be sampled, the frequency, the analytical method, and the action levels. Without that record, the dutyholder has no defensible position if the decision is later challenged.

Common Myths Dutyholders Get Wrong About Legionella Testing

A handful of misconceptions keep resurfacing in dutyholder conversations, and they cause expensive mistakes. It is worth working through them directly.

Myth one: every building must be sampled. This is not true. Many buildings, particularly those with simple mains-fed systems, low complexity, and no vulnerable population, do not require routine sampling. The risk assessment determines whether sampling is appropriate. A blanket sampling programme imposed without that reasoning is wasted spend.

Myth two: a clean sample means the system is safe. A negative result tells you that Legionella was not detected at that sample point at that moment, within the limits of the analytical method. It does not tell you the system is well controlled, that the temperatures are right, or that biofilm is under control. Sampling is a snapshot. Control is an ongoing regime.

Myth three: sampling replaces the need for temperature monitoring. It does not. Temperature control is the primary engineering control in hot and cold water systems. Sampling verifies, it does not substitute. A dutyholder who has reduced their temperature monitoring because they sample quarterly has weakened their control regime, not strengthened it.

Myth four: if the law does not require it, it is not worth doing. Legal minimums are not the same as defensible practice. The HSE, insurers, and the courts all measure dutyholders against ACOP L8 and HSG274. A dutyholder who insists on the strict letter of the law and ignores reasonable guidance is in a weaker position, not a stronger one.

Myth five: the water company tests the water, so we do not need to. The water company is responsible for water quality up to the property boundary. Once water enters the building, the risks of stagnation, temperature drift, contamination, and biofilm formation are the responsibility of the dutyholder. What happens inside the building is not covered by the supplier.

Myth six: only large or complex sites need to worry about this. Smaller premises, including residential lettings with communal water systems, small care settings, gyms, hairdressers using showers, and dental practices, all sit within the scope of legionella duties. Size does not determine duty. Risk does.

For dutyholders who want a fuller grounding in the legal framework, the supporting legionella regulations and guidance explain how the various pieces of legislation and ACOP L8 fit together in practice.

Sampling Methods, Frequencies and What Good Practice Looks Like

Where sampling is justified, it must be done properly. Poor sampling produces unreliable results, and unreliable results lead to either complacency or unnecessary remedial action. Both are costly.

Samples for Legionella analysis are normally collected in sterile bottles containing a neutralising agent such as sodium thiosulphate, which inactivates any residual disinfectant in the sample at the point of collection. This prevents the disinfectant continuing to act in the bottle and producing a falsely negative result. The standard volume is one litre, which gives sufficient material for the laboratory to concentrate and culture.

The analytical method is normally culture-based, following BS 7592 or equivalent. The laboratory will quantify any Legionella detected as colony-forming units per litre (cfu/L) and will identify the species where possible. UKAS-accredited laboratories provide the defensibility that dutyholders need. Non-accredited results carry weight only as informal screening, not as evidence of compliance.

Sampling points are selected to reflect the system. For a hot and cold water system, typical points include the incoming mains, the base of the cold water storage tank, sentinel outlets furthest from and nearest to the calorifier on the hot side, the calorifier drain where accessible, and any specific risk points identified in the assessment such as little-used outlets or showers. Sampling every outlet in a large building is rarely useful. Sampling a representative selection that reflects the system architecture is.

Frequencies depend on the system and the regime. For evaporative cooling systems, quarterly sampling is typical as a baseline. For hot and cold water systems where sampling is justified, annual or six-monthly sampling is common, with additional sampling after specific events. For spa pools, weekly or fortnightly sampling for general microbiology is standard, with Legionella sampling on a defined schedule. For healthcare premises, HTM 04-01 sets tighter expectations.

Action levels matter as much as the result itself. HSG274 sets out the bands. For hot and cold water systems, results of 100 cfu/L or less generally indicate the system is under control. Results between 100 and 1,000 cfu/L call for review of the control regime and a resample. Results above 1,000 cfu/L require immediate corrective action. For cooling systems, the bands are different and tighter at the lower end. The dutyholder’s written scheme should make clear what happens at each band, who is informed, and within what timescale.

Good practice also means trending the results over time. A single sample is a moment. A pattern of results across sampling rounds shows whether the system is stable, drifting, or improving. Dutyholders who only look at individual results and not the trend miss the early warning signs.

What Happens If You Skip Testing When It Was Justified

The consequences of omitting sampling when it was clearly justified fall into several categories, and they compound. The first is the direct health risk. Legionnaires’ disease is a serious, sometimes fatal pneumonia. The people most at risk are often those least able to recover. Every avoidable case is a serious incident.

The second is enforcement exposure. The HSE has the power to issue improvement notices, prohibition notices, and to bring prosecutions under the Health and Safety at Work etc. Act and COSHH. Penalties for serious failings include unlimited fines and, in some cases, custodial sentences for individuals. Sentencing guidelines for health and safety offences have tightened significantly in recent years, and fines for organisations have moved into the seven-figure range for the worst cases.

The third is civil liability. If someone contracts Legionnaires’ disease and the source is traced to a building where controls were inadequate, the civil claim can be substantial. Insurers will examine the risk assessment, the written scheme, the monitoring records, and the sampling history. A dutyholder who chose not to sample when guidance pointed clearly to sampling will struggle to demonstrate that they took reasonably practicable steps.

The fourth is reputational. Confirmed cases of Legionnaires’ disease attract media attention, particularly where vulnerable people are involved. Care homes, hospitals, hotels, and large employers can find their organisation named publicly and the reputational damage is durable.

The fifth is operational. A confirmed outbreak typically requires immediate closure or partial closure of the affected system, emergency disinfection, public health liaison, and intensive follow-up sampling. The cost of dealing with an outbreak is many times the cost of a proper sampling regime. Reading through documented legionella case studies makes that point clearly.

The defence of “the law does not strictly require sampling” tends to collapse under examination once a case is on the table. Investigators look at what a competent dutyholder would have done in the circumstances. If HSG274 pointed to sampling, if the risk assessment identified vulnerable users, if temperature control was inconsistent, and if sampling was nonetheless omitted, the dutyholder is in a poor position. The reasonableness test is not a sympathetic one when harm has occurred.

The defensible approach is straightforward. Have a competent risk assessment. Follow its recommendations. Where sampling is indicated, do it properly. Where it is not, record the reasoning. Review the position when anything material changes. That is the standard the law and the guidance actually expect.

Frequently Asked Questions About Legionella Testing and Risk Assessments

Does a Domestic Landlord Need to Sample Water in a Rental Property?

For most single-occupancy domestic lets with simple mains-fed systems, routine sampling is not expected. The landlord still has a duty to assess the risk under the Health and Safety at Work etc. Act and to make sure tenants are aware of any control measures, such as running outlets after periods of vacancy. Sampling becomes relevant where the property has communal water tanks, complex pipework, or features such as shared showers in HMOs, and where the risk assessment indicates it.

How Often Should Hot and Cold Water Systems Be Sampled?

There is no fixed legal frequency. Where sampling is indicated by the risk assessment, annual or six-monthly sampling is common for general hot and cold water systems. Healthcare premises typically work to tighter intervals under HTM 04-01. Sampling is also triggered by specific events such as remedial work, system disinfection, or unexplained control failures. The frequency should be set in the written scheme of control.

What Is the Difference Between Temperature Monitoring and Legionella Sampling?

Temperature monitoring measures whether the hot and cold water in the system is at the target ranges that suppress Legionella growth, typically below 20°C for cold and above 50°C for hot at sentinel outlets. It is the primary engineering control. Sampling tests the water itself for the presence of the bacteria. Temperature monitoring is ongoing and routine. Sampling is periodic and used to verify that the control regime is working.

Can a Negative Sample Result Be Used to Avoid Remedial Work?

No. A negative result confirms that Legionella was not detected at that point at that time. It does not address the underlying conditions that create risk, such as poor turnover, inadequate temperatures, or dead legs. Remedial work identified by a risk assessment should be carried out on its own merits. Using a clean sample to justify postponing improvements is a misuse of the result and leaves the dutyholder exposed.

Who Is Qualified to Take Legionella Samples?

Sampling should be carried out by someone trained and competent in the procedure, using sterile equipment, neutralising sample bottles, and a documented sampling protocol. The samples should be delivered to a UKAS-accredited laboratory within the timescales the laboratory specifies. Untrained sampling produces unreliable results, and unreliable results are worse than no results because they create false confidence or unnecessary remedial action.

What Should the Written Scheme of Control Say About Sampling?

The written scheme should specify whether sampling is part of the control regime, the points to be sampled, the frequency, the analytical method, the action levels, and the response at each level. It should also describe the trigger events that require additional sampling, such as remedial work or extended vacancy. If sampling is not part of the routine regime, the scheme and the risk assessment should explain why.

If you are unsure whether your current risk assessment, written scheme, or sampling programme reflects what ACOP L8 and HSG274 actually expect for your premises, Acorn Safety Services (Legionella) will review your position and set out a practical, defensible approach. Contact us today for a free, no-obligation quote.