Compliance · Published 8 May 2026 · 6 min read
The regime is well documented and still routinely missed — usually in the buildings that sit empty for weeks.
Legionella control in a commercial building is governed by the Health and Safety at Work etc. Act, the Control of Substances Hazardous to Health Regulations, and the Approved Code of Practice known as ACOP L8, together with the HSG274 technical guidance that sits under it.
The obligation falls on the duty holder — usually the employer, building owner or the person in control of the premises. It cannot be contracted away. What a supplier like us does is deliver and evidence the regime that lets you discharge it.
What the regime requires
- A written legionella risk assessment, reviewed regularly and whenever the system or its use changes
- A named responsible person with the authority and competence to act
- A written scheme of control setting out what is monitored, how often, and by whom
- Temperature monitoring on hot and cold services at sentinel outlets
- Flushing of infrequently used outlets, recorded
- Tank and calorifier inspections at defined intervals
- Records kept and available
Where we see it fail
Rarely through ignorance of the requirement. Almost always through one of these:
- A risk assessment that was thorough on the day and has not been reviewed since a refurbishment changed the pipework
- Flushing regimes that stop during holiday periods — precisely when they matter most
- Records held by a contractor rather than the duty holder, and unavailable at short notice
- A named responsible person who has left the organisation
The last is worth checking today. If your written scheme names someone who no longer works there, the scheme is not current, regardless of how well the monitoring is being done.