Legionella: Landlord and Employer Responsibilities

If you're a UK landlord or employer, you have a legal duty to control the risk of Legionella in any water system under your control. The duty comes from the Health and Safety at Work etc. Act 1974, COSHH 2002 and Management of H&S at Work Regs 1999, with practical detail in ACOP L8 and HSG274. There is no legal "Legionella certificate" — what's required is a proportionate, documented risk assessment and a sensible scheme of control.

The legal duties, in order

What landlords actually have to do

The HSE's own landlord page is short and unambiguous. In practice, the duty has four parts:

1. 1

   Carry out a risk assessment

   Written, site-specific, proportionate. For simple combi-heated single lets it's short; for HMOs, cold-tank systems and complex properties it's longer. See our guide to the Legionella risk assessment.

2. 2

   Put controls in place

   Stored hot water at 60°C; cold water below 20°C; remove or chop back dead legs; keep tanks clean and lidded; flush little-used outlets.

3. 3

   Tell the tenant what they need to know

   Written information at the start of the tenancy: keep the cylinder thermostat as set; flush showers and taps after a holiday; report tepid hot water or dirty cold water at once.

4. 4

   Keep records and review

   The assessment, any test or temperature data, remedial work, and a review date. Review at least every two years for low-risk lets, annually for higher-risk systems, and any time something changes.

Employers (including small businesses)

The same backbone applies if you're an employer. If you have a workplace with any water system — even a small office with a calorifier, a shower for cyclists, or a kitchen mixer tap fed from a stored cold tank — you need a Legionella risk assessment. Plus:

• If you have a cooling tower or evaporative condenser, you must notify HSE (Notification of Cooling Towers & Evaporative Condensers Regulations 1992).
• Records must be kept for at least five years.
• You should appoint a competent "responsible person" with the authority and resources to manage the controls.

The certificate myth — once more, with feeling

What's reasonable, and what the HSE is looking for if they ever inspect, is a written risk assessment by a competent person, evidence that the controls in it are actually being done, and a sensible review cycle. That can absolutely come from a contractor — many landlords sensibly outsource it — but it should be presented honestly, as the risk-assessment service it is, not as a fictional certificate.

What tenants should be told (and what they shouldn't)

• Leave the cylinder thermostat alone — it's set at 60°C for safety.
• If hot water goes lukewarm or never gets fully hot, report it.
• After being away for more than a week, run hot and cold at each outlet for a couple of minutes — especially showers.
• If a shower hasn't been used for a while, remove and clean the head, then run on hot.
• Don't ask the tenant to do your job — temperature monitoring, tank inspections and any remedial work are the landlord's responsibility.

Penalties for getting it wrong

Failure to comply with HSWA and the related regulations is a criminal offence. In serious cases — for example, a confirmed case of Legionnaires' disease traced to a building where no risk assessment had been done — sentences can include unlimited fines and (rarely) imprisonment of individual duty holders. Civil claims and insurance consequences are additional. The point isn't to scare; it's that doing the assessment, acting on it and keeping the records is straightforward, and it's also the defence.

Frequently Asked Questions

Related guides