An HSE inspector arrives at a client’s site after a water sample comes back positive. They want to see the evidence that the water systems have been controlled: the risk assessment, the written scheme, the temperature logs, the remedial actions, all of it, going back years. Your client is the one legally on the hook. But the records that will save them, or sink them, are the ones your engineers have been producing on every visit. If those records are patchy, late, or sitting in a pile of paper nobody can quickly pull together, the problem lands on you too, because you were the contractor delivering the control.
Legionella control is one of the most documentation-heavy areas of field service work, and for good reason: the bacteria can kill, and the law treats the evidence trail as seriously as the physical control itself. This guide explains what the rules actually require, where the line sits between your client’s legal duty and your job on the ground, and why the quality of your records is the whole game.
Table of Contents:
- The legal framework, and why it differs by jurisdiction
- Who holds the duty, and where you come in
- What the records actually have to show
- Why paper is the weak point
- The commercial upside
- The bottom line
- FAQs
The legal framework, and why it differs by jurisdiction
Legionella control is a legal duty across the UK and Ireland, but the exact framework depends on where you work, and it helps to be precise, because the rules are not identical in the three jurisdictions.
In Great Britain (England, Wales, and Scotland), the framework is ACOP L8 and HSG274. ACOP L8, formally “Legionnaires’ disease: The control of legionella bacteria in water systems,” is the Health and Safety Executive’s Approved Code of Practice. An Approved Code of Practice has a special legal status. It is not law in itself, but if a dutyholder is prosecuted for a health and safety breach and has not followed L8, they have to prove they achieved compliance some other equally effective way, or a court can find them at fault. HSG274 is the technical guidance beneath it, published in three parts: cooling towers and evaporative condensers, hot and cold water systems, and other risk systems such as spa pools. Both sit on the underlying duties in the Health and Safety at Work etc. Act 1974 and the COSHH Regulations 2002.
In Northern Ireland, the same guidance applies, ACOP L8 and HSG274 are used just as they are in Great Britain, but the underpinning law differs: the Health and Safety at Work (Northern Ireland) Order 1978 and the Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003, enforced by the Health and Safety Executive for Northern Ireland (HSENI) rather than the HSE.
In the Republic of Ireland, the framework is separate. The legal duty comes from the Safety, Health and Welfare at Work Act 2005, along with the Biological Agents Regulations, enforced by the Health and Safety Authority (HSA). The recognised technical guidance is the Health Protection Surveillance Centre’s National Guidelines for the Control of Legionellosis in Ireland. ACOP L8 has no legal standing in the Republic, though many Irish water hygiene specialists reference it, and the British Standard BS 8580, as best practice alongside the HPSC guidelines. The practical duties, a competent responsible person, a written risk assessment, control measures, and record-keeping, closely mirror the UK approach, but the governing law and guidance are Irish, not British.
The point that matters for a contractor working across these regions is that the technical substance is essentially the same everywhere, the temperatures, the monitoring, the record-keeping, while the legal citations differ. Get the control right and the records right, and you are meeting the duty in all three; just be aware which framework and which enforcing authority applies to each client’s site.
One thing to be aware of on the guidance itself: HSG274 Part 1, covering evaporative cooling systems, was updated in 2024 with more prescriptive inspection tasks and frequencies, and new guidance on photographic records before and after cleaning. Parts 2 and 3 were not changed. If you service evaporative cooling systems in Great Britain or Northern Ireland, your regime and records need to reflect the updated Part 1.
Who holds the duty, and where you come in
For a water hygiene contractor this distinction matters most of all, and getting it right keeps you on the correct side of a lot of confusion.
The legal duty sits with the dutyholder, the employer, building owner, landlord, or whoever controls the premises and its water systems. They are the ones who must ensure a suitable and sufficient risk assessment is done, appoint a competent responsible person, put a written scheme of control in place, and keep it under review. That legal responsibility is theirs, not usually yours.
But dutyholders rarely do the physical work themselves. You do. Your engineers carry out the monitoring, take the temperatures, inspect the tanks, flush the outlets, and record the results. You are, in practice, the one delivering the control the law requires, even though the legal accountability sits with your client. That is why the quality of what you produce matters so much: your records are the evidence your client relies on to show they have met their duty. When an inspector asks for proof of continuous control, they are asking to see your work.
So the obligation reaches you commercially, even where it does not reach you legally. A dutyholder who has to demonstrate continuous, defensible control cannot do it with a contractor who hands back scattered paper, delayed reports, or logs with gaps in them. Increasingly, they will not try. It is the same shift that has already reshaped fire and security compliance work, where digital, provable records have moved from a nice-to-have to a tender requirement, and the logic applies just as directly to water hygiene.
What the records actually have to show
Legionella compliance is a continuous programme rather than a single task, and the records have to prove the programme never lapsed. A few things sit at the heart of it.
Temperature control is the primary defence, and the primary thing you evidence. HSG274 sets clear parameters: hot water stored at 60°C or above and reaching 50°C at outlets within one minute, cold water stored and distributed below 20°C, and the 20 to 45°C range treated as the danger zone where the bacteria thrive. Every sentinel-point temperature reading is a data point proving the system stayed out of that zone, and a single out-of-range reading demands a documented corrective action, not just a note in the margin.
Beyond temperatures, the record set includes the monitoring of tanks, calorifiers, and outlets; the flushing of little-used outlets to prevent stagnation; inspections and cleaning with their results; and, most important of all, the corrective actions taken whenever something falls out of parameter. Records must be kept for at least five years, under ACOP L8 in Great Britain and Northern Ireland and under the HSA and HPSC guidance in the Republic. That five-year evidence trail is what turns a series of individual visits into demonstrable continuous control, which is exactly what an inspector or an insurer wants to see.
The failure the HSE sees most often is not ignorance of the rules. It is the gap between what the written scheme says should happen and what the records show actually happened on site: sentinel points skipped, a closed building’s showers never flushed, an out-of-range reading logged with no corrective action recorded against it. Enforcement is real, improvement and prohibition notices, prosecution, and substantial fines, and it can follow a failed inspection even when no outbreak has occurred.
Why paper is the weak point
Most of these failures are not failures of effort. They are failures of the recording system, and paper is usually the culprit.
A paper log does not travel back to the office in real time, so results are written on site and entered later, if at all, which is where gaps and transcription errors creep in. It does not flag a missed reading or an overdue flush; it just sits in a folder until someone thinks to check. When the inspector arrives, assembling a coherent five-year evidence trail from paper sheets across multiple sites is slow, painful, and full of holes. The scheme can look immaculate on paper while the actual record of what happened on site tells a different, weaker story.
The fix is to capture the work digitally at the point it happens. When an engineer records temperatures, inspections, and remedials on a mobile device on site, the reading is timestamped, tied to the specific asset and site, and synced to the office immediately. An out-of-range reading can prompt a corrective action there and then, rather than being lost. The five-year record builds itself as a by-product of doing the work, and when a client needs to prove control, the evidence is already assembled. Here is where good mobile forms and proper asset management stop being conveniences and become the thing that protects both you and your client. Our case study on Industrial Water Management, a water hygiene and Legionella specialist, shows what that shift looks like in practice.
The commercial upside
It would be easy to read all this as pure burden, but there is a real advantage in it for the contractors who get their record-keeping right.
Dutyholders are under growing pressure to prove continuous control, and they are increasingly choosing contractors who make that easy. Being able to show a client that your monitoring is captured digitally, timestamped, linked to each asset, retained for the required five years, and producible on demand is a genuine differentiator in a market where many contractors still work off paper. It also lets you offer clients direct visibility of their compliance position, through a customer portal, which is exactly what a dutyholder juggling audits and insurers wants. The regime that looks like a compliance headache is, handled well, a reason clients pick you and stay with you. It ties naturally to the planned maintenance schedules that keep the whole programme running on time.
The bottom line
Legionella control is governed by ACOP L8 and HSG274, sitting on the Health and Safety at Work Act and COSHH, and the legal duty rests with the dutyholder rather than with most of the contractors who carry out the work. That is the precise position. But the records your engineers create are the evidence that duty was met, and a dutyholder cannot demonstrate continuous control if your monitoring is patchy, late, or trapped on paper.
The practical response is not to take on a legal duty that is not yours. It is to make sure the monitoring you already do produces clean, timestamped, asset-linked records that assemble into a defensible five-year trail, and that you can hand over the moment a client, insurer, or inspector asks. In work where the evidence trail is as important as the control itself, that is what separates the contractors who keep this work from the ones who lose it.
This article is general guidance, not legal or health and safety advice, and it summarises a complex area that differs across the UK and Ireland. For the precise requirements that apply to a specific system or business, refer to the current guidance for the relevant jurisdiction, ACOP L8 and HSG274 via the HSE (Great Britain) or HSENI (Northern Ireland), and the HSA and HPSC National Guidelines in the Republic of Ireland, or consult a competent water hygiene professional.
FAQs
Do the Legionella rules differ between the UK and Ireland?
Yes. In Great Britain, ACOP L8 and HSG274 apply under the Health and Safety at Work etc. Act 1974 and COSHH 2002, enforced by the HSE. Northern Ireland uses the same L8 and HSG274 guidance but under the Health and Safety at Work (NI) Order 1978 and COSHH (NI) 2003, enforced by HSENI. The Republic of Ireland has a separate framework: the Safety, Health and Welfare at Work Act 2005, enforced by the Health and Safety Authority, with technical guidance from the HPSC’s National Guidelines for the Control of Legionellosis in Ireland rather than HSG274. The practical control measures and record-keeping are very similar across all three, but the governing law and enforcing authority differ.
What is ACOP L8 and is it a legal requirement?
ACOP L8 is the Health and Safety Executive’s Approved Code of Practice, “Legionnaires’ disease: The control of legionella bacteria in water systems,” and it applies in Great Britain and Northern Ireland. It has special legal status: it is not law in itself, but if a dutyholder is prosecuted for a health and safety breach and has not followed L8, they must prove they achieved compliance in some equally effective way, or a court can find them at fault. In the Republic of Ireland, ACOP L8 has no legal standing; the equivalent duties come from the Safety, Health and Welfare at Work Act 2005 and the HPSC National Guidelines instead.
What is the difference between ACOP L8 and HSG274?
ACOP L8 sets out the legal framework, what dutyholders must do to control Legionella. HSG274 is the HSE’s technical guidance explaining how to deliver that control in practice, published in three parts covering cooling towers, hot and cold water systems, and other risk systems such as spa pools. L8 tells you what good looks like; HSG274 tells you how to build it. HSG274 is guidance rather than law, but inspectors and courts treat it as the recognised standard.
What temperatures are required for Legionella control?
Under HSG274, hot water should be stored at 60°C or above and reach 50°C at outlets within one minute of running. Cold water should be stored and distributed below 20°C. The range between 20°C and 45°C is the danger zone where Legionella bacteria multiply, so the aim of temperature control is to keep water out of that range. Sentinel-point temperature monitoring is the main early-warning system, and any out-of-range reading requires a documented corrective action.
How long do Legionella records need to be kept?
Legionella control records must be kept for at least five years. In Great Britain and Northern Ireland this requirement comes from ACOP L8; in the Republic of Ireland it follows from the HSA framework and the HPSC National Guidelines. The records include monitoring and temperature logs, inspection and cleaning results, sampling results, remedial and corrective actions, and training records. This five-year trail is what allows a dutyholder to demonstrate continuous control rather than a series of disconnected activities, and it is what inspectors, insurers, and auditors expect to see.
Does a water hygiene contractor hold the Legionella legal duty?
Usually not. The legal duty sits with the dutyholder, the employer, building owner, landlord, or whoever controls the premises and water systems. However, the contractor typically carries out the monitoring and control on the dutyholder’s behalf, and the records the contractor produces are the evidence the dutyholder relies on to prove compliance. So while the legal accountability is the client’s, the quality of the contractor’s records directly determines whether that compliance can be demonstrated.
