How to do a legionella risk assessment for hospitality premises, what the law requires, and when you need a specialist
Step-by-step legionella risk assessment for hotels, pubs and restaurants: the legal duty under COSHH and ACOP L8, surveying the water system, the risk factors, the control scheme, the monitoring log and when to bring in a specialist. Free template.
Legionnaires' disease is a form of pneumonia caught by breathing in water droplets carrying legionella bacteria. The bacteria live in most water systems at low levels and multiply where water sits between 20°C and 45°C, especially with scale, sediment or biofilm to feed on. That describes a hotel wing closed for the winter, a shower nobody has run for a month, a hot tub, or the cold tank in a loft that gets warm in August.
The duty is clear. Under the Health and Safety at Work Act, COSHH and the HSE Approved Code of Practice L8, anyone in control of premises must identify and assess the risk from legionella, put a written scheme in place to control it, appoint a responsible person, keep records and review the assessment. It applies to a two-room B&B as much as a 200-room hotel; the difference is how much work the assessment takes.
This guide walks through the assessment for a hospitality building using the free legionella risk assessment template on this site, and is honest about where a simple system can be assessed in-house and where a specialist is the right call.
7 steps to complete
Appoint the responsible person
Name the person who owns legionella control on the premises. In a small venue that is the owner or general manager; in a hotel it is often the maintenance manager with a contractor doing the technical work. The responsible person does not have to be an expert but must be competent enough to understand the risk, know what the controls are and check they are being done.
Survey the water system
Walk the system from the incoming main to the furthest outlet and write it down: cold water storage tanks and their location and temperature, how hot water is made and stored (calorifier, combi boiler, point-of-use heaters), the pipe runs, every outlet, every shower, hoses and spray taps, and anything that stores or sprays water such as hot tubs, spa pools, ice machines with tanks, decorative fountains and vehicle wash lances. Mark the dead legs (capped pipes that still hold water) and the outlets used less than once a week. Photograph the plant.
Identify where the risk factors meet
Legionella needs three things: water in the growth range, time to multiply, and a way to become spray that people breathe. Score each part of the system on those. A shower in a seasonal room ticks all three. A cold tap in the busy kitchen ticks none. Hot tubs and spa pools are the highest-risk item in any hospitality building and have their own HSE guidance (HSG282) with daily checks.
Assess and rate each component
For each component, record the growth risk, the exposure risk, the controls already in place and a rating of high, medium or low. Write the further action for anything medium or high with an owner and a date. For a simple system (mains-fed cold, a combi boiler, no tanks, no showers) this is a short document and a competent manager can complete it. For stored water, calorifiers, showers or a spa, use the template to structure the work and bring in a Legionella Control Association member to do the technical assessment.
Write the control scheme
The scheme says what is checked, how often, what counts as a pass and who does it. The core controls are temperature (hot water stored at 60°C and reaching 50°C at the tap within a minute; cold water below 20°C within two minutes), flushing rarely used outlets weekly, descaling and disinfecting shower heads quarterly, inspecting cold tanks annually and keeping them clean and lidded, and removing dead legs where possible. Where temperature control is not possible, chemical treatment or point-of-use filters come in, and that is specialist territory.
Run the monitoring log
A control scheme with no records is an assessment with no evidence. Each month record the sentinel outlet temperatures (nearest and furthest hot and cold), the calorifier flow and return, the outlets flushed and the shower heads descaled. Record failures and what was done about them. Keep the records for at least five years. Digital routines that prompt the check and store the reading are the easiest way to keep this going across a rota.
Review the assessment
Review at least every two years and immediately after any change to the water system, a change in how the building is used (a wing closed for winter, a new spa), a failed monitoring result, or any case or suspected case of Legionnaires' disease linked to the premises. Record the review even when nothing changes.
Tips for success
Common mistakes to avoid
Frequently asked questions
Is a legionella risk assessment a legal requirement for a pub or restaurant?
Yes. Under COSHH and the HSE Approved Code of Practice L8, anyone who employs people or controls premises must assess and control the risk from legionella in the water system. Smaller and simpler systems need a proportionate assessment, not none.
Can I do a legionella risk assessment myself?
For a simple system, mains-fed cold water, a combi boiler and no showers or stored water, a competent manager can complete the assessment using a structured template. Stored hot water, tanks, showers, spa pools or hot tubs justify a specialist, ideally a Legionella Control Association member.
How often should a legionella risk assessment be reviewed?
At least every two years, and straight away after any change to the water system or how the building is used, after a failed monitoring result, or after any suspected case linked to the premises.
What temperatures should hot and cold water be to control legionella?
Hot water stored at 60°C and reaching at least 50°C at the outlet within a minute; cold water below 20°C within two minutes of running. Check the nearest and furthest outlets monthly and record the readings.
Need hands-on help with this?
Our hospitality consultants work alongside your team to implement food safety systems, prepare for inspections, and improve compliance.
Ready to simplify compliance?
Paddl automates the processes described in this guide. Digital records, automatic alerts, and complete audit trails for your hospitality business.
Full access to all features · Dedicated onboarding support · Cancel anytime