What does the law actually require?
Legionella control is not a maintenance task you can choose to do, it is a legal duty. Under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002, anyone who controls premises with a water system that could create a risk must prevent or control that risk. The Approved Code of Practice L8 sets out how, and because it is an Approved Code, a court can treat a failure to follow it as evidence of breaching the law.
In practice that means four things: assess the risk in writing, appoint a competent Responsible Person to own it, put a written control scheme in place, and keep records that would stand up to inspection. The technical detail of how to do each sits in HSG274, and for spa pools specifically in HSG282.
Who is the Responsible Person, and what do they carry?
The duty-holder must appoint a named, competent Responsible Person to manage the control scheme. This is a personal accountability, not a box on an org chart. They must understand the water systems, ensure the risk assessment is current, and make sure the control measures are actually being carried out and recorded.
It is a duty that does not pause. Legionnaires' disease is now caught in the community more often than abroad: in England and Wales in 2024 there were 472 confirmed cases and 13 deaths, a case fatality rate of around one in thirty-five. A controllable water risk that is not controlled is a personal, often seven-figure liability.
Which systems are covered?
More than people expect. Any system that stores or moves water at temperatures and conditions where Legionella can grow, and that can create breathable droplets, is in scope. That includes hot and cold water services, calorifiers and stored water, showers and spray taps, cooling towers and evaporative condensers, spa and hydrotherapy pools, and humidifiers and air washers.
Wet cooling towers and evaporative condensers carry an extra duty: they must be notified to the local authority under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, and managed to the specific guidance in HSG274 Part 1.
What happens if you get it wrong?
Enforcement is real and the fines are unlimited. Prosecutions are brought under the Health and Safety at Work Act, and the duty of care it creates is non-delegable, so it extends to guests, patients and the public, not just employees.
The benchmark case remains a display spa pool whose mismanagement caused three deaths and led to a GBP 1,000,000 fine. More recently, water-system mismanagement led to a GBP 900,000 fine. Beyond the fine, an outbreak is a regulatory event, a reputational event, and in regulated settings a threat to registration or accreditation.
How do you evidence control?
A claim is not evidence. What an inspector, an insurer or an accreditation assessor needs is proof: a current written risk assessment, complete monitoring and temperature records, and a clear trail of remedial actions. The strongest position adds independent verification that the system itself is clear.
That bar is achievable. At one major UK site, a recurring waterborne pathogen problem was brought from 600 to 0 cfu/g in four days, confirmed by a UKAS-accredited laboratory, and then held on routine maintenance dosing. Results like that, independently confirmed, are what turn a Legionella duty into a defensible compliance file.