Property Management Legionella Liability: Where Responsibility Really Sits

If your firm manages property on behalf of owners, you are almost certainly carrying a share of the legal duty for Legionella control, whether the management agreement spells it out or not. Property management Legionella liability is rarely a clean handover from owner to agent. It tends to attach to whoever is actually in control of the water systems day to day, and that is usually the managing agent.

That matters because the duty to manage Legionella risk sits under health and safety law, not just the terms of your contract. The Health and Safety Executive looks at who controls the premises and the systems, who appoints the contractors, and who could reasonably have prevented harm. If that points to you, the contract wording with the owner will not get you off the hook with the regulator.

This is where many agents get caught out. They assume the freeholder holds the risk, or that a annual sample result is enough evidence, or that a contractor visiting twice a year means the building is compliant. None of those assumptions hold up well when something goes wrong.

Who Carries the Duty When a Managing Agent Runs the Building

The starting point under the Control of Substances Hazardous to Health Regulations is the concept of the dutyholder. The dutyholder is the person or organisation in control of the premises and the work activity, including the operation of the water systems. In a managed building, that control has usually been delegated to the agent.

Owners often think they have passed the entire duty across by appointing an agent. They have not. Health and safety duties cannot be contracted away. What the management agreement does is allocate responsibility between the parties, but both can still hold a duty depending on the degree of control each one has in reality.

The practical test is control. Ask yourself who decides when the water risk assessment is carried out, who instructs the water treatment contractor, who holds the keys to the plant room, and who would be expected to act on a recommendation in a risk assessment. If the answer is the managing agent across most of those points, the agent is functioning as the dutyholder for Legionella purposes.

This is the heart of managing agent Legionella responsibility. It is not about who owns the building. It is about who runs the water systems and who is in a position to control the risk. A freeholder who has handed over full operational control to an agent has reduced their own exposure and increased the agent’s.

How Property Management Legionella Liability Is Decided in Practice

When the HSE or a claimant’s solicitor looks at a Legionella case, they do not start with the management contract. They start with the building and work backwards to find who was in control.

The questions that decide liability tend to be practical:

• who appointed and managed the water hygiene contractor
• who received and reviewed the Legionella risk assessment
• who was responsible for acting on its recommendations
• who held the records and signed off the monitoring regime
• who controlled access to tanks, calorifiers, plant rooms and outlets
• who decided the budget for remedial works and whether they went ahead

Where most of those answers point to the managing agent, the agent is treated as the dutyholder regardless of what the agreement says. Where responsibility is genuinely split, liability can be shared, but the regulator will not let a vague contract clause obscure who was actually controlling the risk.

A common pattern shows up in dispute. The owner says the agent was appointed to handle compliance. The agent says the owner refused to fund the remedial works the risk assessment identified. Both can end up exposed: the agent for failing to manage the risk it was controlling, the owner for blocking the action needed to control it. Clear records of who recommended what, and who declined to act, are what separate the two positions when it matters.

The other deciding factor is evidence. A dutyholder is expected to be able to demonstrate that the risk has been assessed and is being managed. If you can produce a current risk assessment, a written scheme of control, monitoring records and a clear management plan, you are in a defensible position. If you cannot, the absence of records is often treated as evidence that the risk was not being managed at all.

The Legal Framework That Puts Agents on the Hook

Legionella duties do not sit in one tidy piece of legislation. They are built from several overlapping requirements, and understanding how they fit together explains why agents carry real exposure.

The Health and Safety at Work etc. Act 1974 sets the broad duty. It requires those in control of premises to ensure, so far as is reasonably practicable, the health and safety of anyone who could be affected by the work, including tenants, visitors and members of the public. A managing agent operating water systems falls squarely within this.

The Control of Substances Hazardous to Health Regulations 2002 treat Legionella bacteria as a hazardous substance and require a suitable and sufficient assessment of the risk, followed by control measures to prevent or minimise exposure. This is the legal source of the requirement to carry out a Legionella risk assessment and act on it.

The Approved Code of Practice known as L8 sits alongside these regulations. ACOP L8 has special legal status. It is not law in itself, but if you fail to follow it and something goes wrong, you need to show you managed the risk to an equivalent standard. In practice, courts and the HSE treat ACOP L8 compliance as the benchmark. Departing from it without good reason is hard to defend.

Beneath L8 sits the HSG274 technical guidance, which sets out in detail how to control risk in hot and cold water systems, cooling towers and other systems. HSG274 is where the practical expectations live: temperature regimes, monitoring frequencies, tank inspections, sampling and the written scheme of control. When a contractor or assessor refers to legionella control HSG274, this is the document driving the methods.

For residential lettings, there is a further layer. Landlord Legionella duties under the same health and safety framework apply to rented housing, and where a managing agent runs a residential portfolio, the agent typically inherits the assessment and control obligations the landlord would otherwise hold. The risk in most domestic settings is low, but the duty to assess it and keep it under review still exists.

Where Managing Agents Most Often Get Caught Out

The failures that create real liability are rarely dramatic. They are usually quiet gaps that build up over time until an inspection or an illness brings them to light.

The most common is treating a risk assessment as a one-off document. A Legionella risk assessment is a living thing. It needs reviewing when the building changes, when systems are altered, when occupancy patterns shift, or at sensible intervals even when nothing has changed. Agents who commissioned an assessment five years ago and filed it are often relying on a document that no longer describes the building.

Close behind is the gap between assessment and action. An assessment identifies remedial works and control measures, but the recommendations are never implemented. This is one of the most exposed positions an agent can be in. The risk has been formally identified in writing, and the failure to act on it is documented in your own files. If the owner declined to fund the works, that needs to be recorded and chased, not quietly dropped.

Other recurring problems include:

• monitoring records that exist but are incomplete, with missing temperature readings or gaps where a contractor failed to attend
• no clear written scheme of control naming who does what and when
• dead legs and redundant pipework left in place after a refurbishment, creating stagnant water nobody is flushing
• cold water storage tanks with poor turnover or missing lids that were never picked up
• hot water return temperatures that do not reach control targets but are never investigated
• infrequently used outlets in void flats or seasonal areas that are not being flushed
• relying on annual sampling as proof of compliance when sampling is only ever a snapshot

Access is another quiet failure. An assessor cannot inspect what they cannot reach. Locked plant rooms, ceiling voids that were not opened, risers nobody had keys to, and tenanted areas that could not be accessed all leave gaps in the assessment. If those limitations are noted but never resolved, the agent is sitting on an assessment that admits parts of the system were never checked.

The final trap is poor handover. When a building changes managing agent, the records often arrive incomplete. The incoming agent inherits the duty along with the building but has no reliable history of what has been done. Picking up a portfolio without confirming the Legionella position is a way of inheriting other people’s gaps.

What an Outbreak or Enforcement Action Actually Looks Like for an Agent

Most agents understand the duty in the abstract but underestimate what happens when it crystallises into an actual problem.

Enforcement does not usually start with an outbreak. It often starts with a routine inspection, a complaint, or a case of illness reported to environmental health that gets traced back to a building. The HSE or local authority then asks the dutyholder to produce evidence that the risk was being managed. This is the moment when missing records, expired assessments and unactioned recommendations become very visible.

Where the regulator finds the risk was not being adequately controlled, the response escalates depending on severity. An improvement notice requires you to put things right within a set period. A prohibition notice can stop the use of a system or part of a building immediately where there is a risk of serious personal injury. Beyond notices, there is the prospect of prosecution.

Legionella enforcement by the HSE has produced significant fines, and sentencing guidelines for health and safety offences mean penalties are linked to turnover. For a managing agent with a substantial portfolio, the financial exposure from a single serious failing can be considerable. Individual managers and directors can also face personal liability where there has been consent, connivance or neglect on their part.

An actual outbreak changes the scale entirely. Legionnaires’ disease is a serious form of pneumonia, and a cluster of cases linked to a building triggers a full investigation. The agent faces the regulator, potential prosecution, civil claims from those affected, and the reputational damage of being named as the organisation that was supposed to be managing the risk. For a property management business, a high-profile failure of this kind can cost client relationships and instructions well beyond the case itself.

Even where no one becomes ill, the cost of a poorly managed system can be high. Discovering serious contamination triggers emergency remediation, system disinfection, temporary closures and disruption to tenants, often at short notice and well above the cost of routine maintenance that would have prevented it.

Splitting Responsibility Between Owner, Agent and Contractor

One of the most useful things an agent can do is get clear, in writing, about who is responsible for what. Confusion between owner, agent and contractor is where duties fall through the cracks.

The owner generally retains responsibility for funding works to the fabric and systems of the building, and for major capital items. They cannot escape all duty by appointing an agent, but they can reasonably expect the agent to manage day-to-day compliance within the budget and authority they have been given. Where the owner refuses to fund essential remedial works identified in a risk assessment, the agent should record that refusal clearly. It does not transfer the whole risk back, but it changes the picture significantly if a problem later arises.

The managing agent typically holds the operational duty: commissioning and reviewing risk assessments, appointing competent contractors, holding records, ensuring monitoring happens and acting on recommendations within their authority. This is where most of the water hygiene liability concentrates in a managed building, because this is where the day-to-day control sits.

The water treatment contractor carries responsibility for the competent delivery of the services they are instructed to provide. But here is the trap many agents fall into: appointing a contractor does not transfer your duty to them. The contractor is responsible for doing the work properly. You remain responsible for making sure the right work is being done, that the contractor is competent, and that the recommendations coming back are acted on. A contractor turning up twice a year is not a compliance system on its own.

The cleanest position is a documented split that reflects reality. The management agreement should state who holds the dutyholder role, who appoints the responsible person, what the agent is authorised to spend without further approval, and what happens when the owner declines recommended works. Where this is vague, both owner and agent end up exposed because neither can demonstrate clear control.

Practical Steps to Limit Your Exposure

The good news is that limiting your exposure is mostly about doing the obvious things properly and being able to prove you did them. Demonstrable control is the defence.

Start with the assessment. Make sure every building in your portfolio has a current, suitable and sufficient Legionella risk assessment carried out by someone competent. Check the scope: confirm it actually covered the whole system, and resolve any access limitations the assessor noted rather than leaving them as permanent blind spots.

Then close the loop on action:

• maintain a written scheme of control for each building that names who does what and at what frequency
• track every recommendation from the assessment through to completion, with dates and evidence
• where the owner declines to fund recommended works, record the recommendation, the refusal and your advice in writing
• keep monitoring records complete and review them, rather than just filing them when the contractor sends them in
• review each risk assessment at sensible intervals and whenever the building, systems or occupancy change
• confirm the competence of the contractors you appoint and check their work against HSG274 expectations

Get the documentation right and keep it accessible. If you cannot lay your hands on a current assessment, the scheme of control, the monitoring records and a clear management plan for any building in your portfolio, you have a gap you need to fix before someone else finds it.

When you take on a new building, treat the Legionella position as part of due diligence. Ask for the existing assessment, the records and the history of works before you inherit responsibility blind. If the handover information is thin, commission a fresh assessment rather than relying on documents you cannot verify.

Finally, be honest about competence. If your firm does not have someone who genuinely understands what a written scheme of control should contain, or whether a contractor’s monitoring regime meets the standard, that is a gap worth filling with specialist support. The cost of expert review is trivial against the cost of an enforcement notice or a claim. You can find background on how the bacteria behaves and why control matters in the explanation of Legionella bacteria, and reviewing relevant case studies is a useful way to see how these failures play out in practice.

Common Questions From Managing Agents and Landlords

Can we transfer Legionella liability to the property owner in our management agreement?

Not fully. The management agreement allocates responsibility between you and the owner, but it cannot remove your duty under health and safety law if you are the one controlling the water systems. The regulator looks at who is actually in control, not just at the contract. A well-drafted agreement helps clarify roles and protects you in a dispute, but it does not hand the dutyholder role back to the owner if you are running the building.

Does appointing a water treatment contractor mean we have discharged our duty?

No. Appointing a competent contractor is part of managing the risk, but it does not transfer your responsibility. You remain responsible for selecting a competent contractor, defining the right scope of work, reviewing what comes back and acting on recommendations. A contractor who attends regularly but whose reports are never reviewed leaves you just as exposed as having no contractor at all.

How often does a Legionella risk assessment need reviewing?

There is no fixed legal interval, but the assessment must be kept up to date. In practice this means reviewing it whenever the building, water systems, use or occupancy changes, and at sensible regular intervals even when nothing has changed, often around every two years for many buildings. The key point is that the assessment should always reflect the building as it is now, not as it was when first assessed.

What happens if the owner refuses to pay for recommended remedial works?

Record it clearly. Put the recommendation, your advice and the owner’s refusal in writing. This does not eliminate your duty to manage the risk you control, but it shifts a meaningful share of responsibility to the owner who blocked the action. Where the risk is serious, you may need to consider whether you can continue to manage the building safely without the works being done.

Do residential properties carry the same Legionella duties as commercial ones?

The same legal framework applies, but the risk in most domestic settings is lower, so the level of control expected is usually proportionate to that lower risk. Landlords and the agents acting for them still need to assess the risk and keep it under review, but a typical residential property rarely needs the intensive monitoring regime of a large commercial system with tanks and calorifiers. The duty to assess does not disappear because the risk is low.

If your firm manages property on behalf of owners and you are not certain your Legionella records would stand up to an HSE inspection or a claim, Acorn Safety Services can review your portfolio, identify where assessments, schemes of control or monitoring fall short, and put a defensible compliance position in place before a gap becomes a problem. Contact us to talk through your buildings with the team, or get a quote for the work you need.