Is HSG274 legally binding for commercial premises?

The legal obligation for a commercial premises is to control reasonably foreseeable risks to people, including the risk of exposure to legionella bacteria. That obligation comes from health and safety legislation; HSG274 sets out recognised technical methods for assessing and controlling the water-system risks that support compliance.

The main legal framework usually includes:

• Health and Safety at Work etc. Act 1974: employers and those responsible for premises must protect employees and others who may be affected by their activities, so far as is reasonably practicable.
• The Management of Health and Safety at Work Regulations 1999: require suitable and sufficient risk assessments, appropriate preventive arrangements, competent assistance and co-operation between relevant dutyholders.
• The Control of Substances Hazardous to Health Regulations 2002: legionella is a biological agent, so employers may need to assess and control work-related exposure under COSHH.

HSE’s Approved Code of Practice L8 is particularly important because it explains the legal duties applying to the control of legionella in water systems. HSG274 provides the more detailed technical guidance supporting L8, including approaches for hot and cold water systems, evaporative cooling systems and other risk systems. Together, they help a dutyholder translate broad legal requirements into practical control measures.

A business does not automatically breach the law merely because its arrangements differ from a recommendation in HSG274. However, departing from the guidance requires a defensible reason. The dutyholder should be able to show that the alternative approach is based on a suitable risk assessment, is technically appropriate and controls the risk to an equivalent or better standard. An undocumented departure is much harder to justify during an inspection, investigation or legal proceeding.

The person with day-to-day responsibility is commonly referred to as the responsible person. Depending on the premises and contractual arrangements, this may be an employer, landlord, managing agent, facilities manager or another person who has control of the water system or workplace. Responsibility cannot be made effective simply by naming somebody in a policy. The appointed person needs sufficient authority, information, competence and resources to implement the control scheme.

Where several organisations share a building or water system, each party must understand its role. Contracts should clearly identify responsibilities for risk assessment, temperature monitoring, cleaning and disinfection, maintenance, records, incident response and communication of changes. Allocating a task to a contractor does not necessarily remove the client’s wider duty to select a competent provider and check that the agreed arrangements are being carried out.

A legally credible legionella management system will normally include:

• a current, site-specific legionella risk assessment;
• identification of the responsible person and other relevant dutyholders;
• an up-to-date description or schematic of the water systems and associated assets;
• control measures suited to the design, use and condition of each system;
• routine monitoring, inspection, servicing and maintenance;
• clear action limits and procedures for responding to failures or abnormal results;
• records showing what was checked, when it was checked, who completed the work and what action followed; and
• periodic review, particularly after changes to occupancy, use, equipment, management arrangements or system condition.

Testing alone does not establish legal compliance. A negative sample is only evidence about the sample and the point in time at which it was taken. It does not replace risk assessment, system management, temperature control, removal of dead legs, maintenance or other measures required by the risk profile. Similarly, holding a document labelled “HSG274 compliant” does not demonstrate that the arrangements are suitable if the assessment is generic, out of date or inconsistent with the installed system.

Enforcement officers may examine the risk assessment, monitoring records, remedial actions, training arrangements and evidence that identified defects were addressed. If conditions indicate a serious or uncontrolled risk, an enforcing authority may use its statutory powers, which can include requiring improvements or stopping an activity where the legal threshold is met. In the event of an investigation, L8 and HSG274 may also be used as evidence of accepted good practice when assessing whether reasonable precautions were taken.

Commercial premises should therefore treat HSG274 as an important benchmark rather than as a checklist that can be applied without professional judgement. The correct approach is to assess the actual system, implement proportionate controls, document the reasoning behind decisions and review the arrangements when circumstances change. Where the guidance cannot be followed exactly, the rationale and evidence for the alternative should be recorded by a person with appropriate legionella competence.

A competent risk assessment and compliance audit can help identify gaps between the written management system and what is happening on site. UKAS-accredited water testing may provide useful supporting evidence where sampling is appropriate, but results should be interpreted alongside the risk assessment and control records rather than considered in isolation.