Is HSG274 legally binding?

HSG274 is not a law or regulation in its own right. Its legal significance is that it explains the control measures normally expected when managing legionella risks in water systems. The underlying duties come from health and safety legislation, particularly the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002, where legionella is treated as a biological agent.

HSG274 is published in three parts covering evaporative cooling and other industrial systems, hot and cold water systems, and other risk systems. It provides technical detail on matters such as risk assessment, temperature control, cleaning and disinfection, monitoring, sampling, inspection and remedial action. The guidance is intended to help duty holders put the broader legal requirements into practice.

HSG274 should also be distinguished from the Approved Code of Practice L8. L8 has a special status because it is an Approved Code of Practice for the control of legionella bacteria in water systems. It is not legislation either, but it can be used in legal proceedings as evidence that an applicable legal duty has, or has not, been met. HSG274 supports the technical application of L8 by setting out more detailed and system-specific recommendations.

A failure to follow HSG274 does not automatically create a criminal offence. However, it may raise questions about whether the duty holder identified the risks properly and took reasonably practicable precautions. Where a business departs from the approach described in the guidance, it should be able to explain why the alternative is suitable, proportionate to the risk and capable of achieving an equivalent level of control.

In practice, enforcement action would normally relate to a breach of the relevant legislation rather than to a standalone breach of HSG274. Inspectors may examine the risk assessment, written control scheme, monitoring results, maintenance records, training arrangements and evidence of corrective action. They may also consider whether the organisation used recognised technical guidance when deciding how to manage the system.

The legal duties generally fall on the person or organisation with control of the premises, water system or work activity. Depending on the circumstances, this may be an employer, landlord, facilities manager, managing agent, building owner, care provider or contractor. More than one party can have responsibilities, particularly where control is shared. Contracts can allocate tasks, but they do not necessarily remove the underlying duty to ensure that risks are properly managed.

A defensible legionella control arrangement will usually include:

• a suitable and sufficient legionella risk assessment;
• clear identification of responsible people and their authority to act;
• a written scheme describing control measures and responsibilities;
• appropriate temperature monitoring, inspection, sampling or other verification;
• planned maintenance, cleaning, disinfection and remedial work where required;
• competent people carrying out risk assessment and technical tasks; and
• records showing what was done, what was found and how deficiencies were addressed.

The controls required will depend on the system and the level of risk. Factors can include water temperatures, storage and distribution arrangements, stagnation, low-use outlets, aerosol generation, system complexity, the condition of equipment and whether susceptible people may be exposed. HSG274 is therefore not a universal checklist that can be applied without professional judgement. Applying a recommendation without considering the actual system can be just as unhelpful as ignoring a relevant control altogether.

Where a risk assessment identifies a problem, the duty holder should not rely on the fact that the system has historically operated without an incident. Action may include removing redundant pipework, improving circulation, correcting temperature problems, reviewing blending valves, increasing monitoring or arranging cleaning and disinfection. The chosen response should be recorded, with responsibility and completion requirements clearly assigned.

Documentation is important because it demonstrates how decisions were reached, not simply that a document exists. Records should be accurate, current and consistent with the physical system. Significant changes to plant, occupancy, use or operating conditions should trigger a review of the assessment and control scheme rather than being left to the next routine inspection.

For organisations seeking to demonstrate compliance, the sensible approach is to treat HSG274 as an important benchmark within a wider legal framework. A risk assessment should identify which recommendations apply, explain any justified departures and show how the selected controls manage the identified risks. Independent water testing, compliance audits, system monitoring and competent remedial work can help verify that the documented arrangements reflect actual conditions, but they do not replace the duty holder's responsibility for managing the risk.