Guide
Legionella testing or a risk assessment: which does the law require?
Many businesses are told that regular legionella testing is a legal requirement. For most hot and cold water systems it is not. The law asks for something else.
By the Germ3 Water team. Updated 20 October 2026.
What the law requires
If you control premises with a water system you must assess the risk from legionella. You must then control it. The duty comes from three places:
- The Health and Safety at Work etc. Act 1974.
- The Management of Health and Safety at Work Regulations 1999.
- The Control of Substances Hazardous to Health Regulations 2002.
HSE sets out how to meet the duty in its Approved Code of Practice L8. The technical detail for hot and cold water is in HSG274 Part 2.
In practice you need a risk assessment and a written scheme of control. You need a named responsible person. You need records that show the checks are being done.
Assessment and testing do different jobs
A risk assessment looks at the whole system. It finds where water is stored and where it sits still. It shows who could be harmed and sets out how to control the risk.
A water sample tells you what was in the water at one outlet on one day. It is useful when you need to check something. It does not replace an assessment.
“For most small premises, sampling is a cost with no legal basis.”
When sampling is worth paying for
HSG274 Part 2 says routine sampling of hot and cold water systems is not usually needed. It is appropriate in these situations:
- Temperatures cannot be kept in the safe range.
- The system is controlled by a biocide instead of temperature.
- Vulnerable people use the water.
- There is a suspected or confirmed case of Legionnaires' disease.
- After disinfection or major work on the system.
Cooling towers and spa pools are different. They have their own regimes and routine sampling is expected.
Be wary of these sales lines
Quarterly testing is a legal requirement. You need a legionella certificate. Your building needs monthly sampling. For an ordinary office or shop on mains water none of these is true.
What you should have on file
- A current legionella risk assessment.
- A written scheme of control.
- The name of your responsible person.
- A logbook of temperature checks and flushing.
- Records of any engineer work and any sample results.
If those are in place and your checks are in range you are meeting the duty. Sampling is a tool to use when the checks give you a reason.
Questions
Common questions
Is legionella testing a legal requirement?
Not for most hot and cold water systems. The legal duty is to assess the risk and control it. Cooling towers and spa pools are the main exceptions.
How often do I need a legionella test?
Only when your risk assessment or your checks give a reason. Many buildings never need routine sampling.
Can I do my own legionella risk assessment?
For a small simple system a competent person on site can often do it. Larger systems or sites with vulnerable people need a professional.
Find out what your building actually needs
Book a survey and we will give you a fixed quote. You will also get an honest view of what you can safely do in house.
Request a survey