Who is responsible for legionella control in commercial premises?

In commercial premises, legionella control is the responsibility of the person or organisation with control over the building, its water systems, or the work carried out there. This may be an employer, building owner, landlord, facilities manager, managing agent, or another duty holder. Where responsibilities are shared, each party must understand its specific duties and coordinate with the others.

The legal framework is based mainly on the Health and Safety at Work etc. Act 1974, the Control of Substances Hazardous to Health Regulations (COSHH), and the principles set out in the HSE’s Approved Code of Practice L8 and technical guidance HSG274. These requirements apply where people could be exposed to legionella bacteria through water systems, including showers, cooling systems, spa pools, evaporative equipment and other sources of aerosol.

The duty holder’s responsibilities include:

• Identifying water systems and equipment that could create a legionella risk.
• Arranging a suitable and sufficient legionella risk assessment.
• Putting proportionate control measures in place and keeping them effective.
• Appointing people with suitable competence to carry out assessments, monitoring and maintenance.
• Ensuring staff and contractors understand the procedures relevant to their work.
• Maintaining accurate records, reviewing findings and acting on defects or abnormal results.
• Reviewing the arrangements when the building, occupancy, water system or use of equipment changes.

Overall accountability cannot be transferred simply by appointing a contractor. A specialist can provide technical advice, sampling, assessment or remedial work, but the organisation in control must make sure the work is appropriate, completed as required and followed up. It must also provide the assessor or contractor with accurate information about the premises, system design, usage patterns and previous maintenance.

Employers are responsible for protecting employees and other people who may be affected by their activities. This includes considering water systems within workplaces and making sure control procedures are implemented. An employer occupying leased premises may therefore have duties even when the building owner retains responsibility for fixed water services.

Building owners and landlords are commonly responsible for systems serving the building or multiple occupants, particularly where they arrange maintenance or control shared plant. A commercial lease may allocate particular tasks to a tenant, but contractual wording does not remove the need for clear health and safety arrangements. The owner and occupier should establish who controls each part of the system, who arranges servicing and who receives monitoring records.

Tenants and occupiers may be duty holders for systems within their control. This can include outlets, storage tanks, water heaters, secondary circulation systems and equipment installed for their own operations. They should not assume that the landlord’s assessment covers every risk created by their use of the premises, especially where they have altered the plumbing, left areas unused or introduced equipment that generates an aerosol.

Facilities managers and managing agents often organise practical controls on behalf of an owner or occupier. Their role may involve coordinating contractors, maintaining asset information, arranging temperature checks, managing flushing programmes and escalating issues. They need clearly documented authority and reporting arrangements so that significant risks are passed promptly to the person who can approve corrective action.

Where several employers, tenants or contractors share a building, cooperation is essential. The parties should agree who owns the principal risk assessment, which systems are included, how control measures are divided, how information is exchanged and who responds to failed controls. A written responsibility matrix can help prevent gaps, duplicated work and assumptions that another party is dealing with the risk.

A competent person does not necessarily have to be an employee. Competence means having sufficient knowledge, training, experience and understanding of the particular water system and the work being undertaken. The level required depends on the complexity and risk of the premises. For example, a straightforward assessment of a small system requires a different level of technical input from an assessment involving complex hot and cold water services, cooling towers or healthcare facilities.

Responsibility also extends beyond the initial assessment. Effective control normally requires a management plan supported by routine monitoring and maintenance. Depending on the system and assessment findings, this may include:

• Monitoring hot and cold water temperatures at relevant outlets and storage points.
• Checking that tanks, calorifiers, showers and other components remain in suitable condition.
• Flushing outlets that are infrequently used or have remained stagnant.
• Cleaning, disinfection or other remedial work where control has been lost.
• Investigating conditions that could encourage bacterial growth, such as stagnation, low temperatures, scale or corrosion.
• Using water testing where it is justified by the risk assessment, an incident, investigation or control failure.

Records should show what was checked, when it was checked, the result, who completed the task and what action followed. Records are particularly important where a result is outside the expected range or where a task could not be completed. Recording an unresolved issue without assigning corrective action does not demonstrate effective control.

The responsible organisation should review the risk assessment when there is a significant change to the water system, building use, occupancy, maintenance arrangements or control measures. It should also review the arrangements after an incident, a serious control failure, relevant test results or evidence that the existing procedures are not being followed.

In practice, the most reliable arrangement is one in which ownership is explicit: a named duty holder retains overall oversight, competent people carry out defined tasks, contractors provide suitable evidence of their work, and management checks that recommendations have been closed out. Legionella control is therefore not the sole responsibility of the person who takes a water sample or writes a report; it is an ongoing management duty shared according to who controls each risk.

Where internal expertise is limited, specialist support can help with the risk assessment, water testing, compliance audit, monitoring arrangements, training and remedial works. The duty holder remains responsible for selecting competent support, providing relevant information and ensuring that the resulting recommendations are implemented.