ACOP L8 Risk Assessment Requirements: What the Law Requires

The Approved Code of Practice L8 (ACOP L8) is the cornerstone of legionella compliance in the UK. Published by the Health and Safety Executive, it sets out the legal framework that every duty holder must follow. If you are responsible for a water system in a building -- whether as a landlord, employer, or facilities manager -- ACOP L8 applies to you.

This guide breaks down the key requirements in practical terms, so you know exactly what the law expects.

What is ACOP L8?

ACOP L8, formally titled "Legionnaires' disease: The control of legionella bacteria in water systems," is an Approved Code of Practice published under the Health and Safety at Work etc. Act 1974. While it is not statutory law in itself, ACOP L8 has a special legal status: if you are prosecuted for a breach of health and safety law and it is shown that you did not follow the guidance in the ACOP, a court will find you at fault unless you can demonstrate that you complied with the law in some other equally effective way.

In practice, this means ACOP L8 sets the minimum standard. Deviate from it at your own legal risk.

Who needs a legionella risk assessment?

Every duty holder who is responsible for a water system must carry out -- or commission -- a legionella risk assessment. The duty holder is typically:

• Employers who have water systems in the workplace
• Landlords who provide residential accommodation
• Building owners or those who have responsibility for the building through a contract or tenancy obligation
• Facilities managers acting on behalf of the above

There is no exemption for small premises. If you have a water system that could create a risk of legionella exposure, you need a risk assessment -- even if the building only has a single hot water cylinder and a few taps.

What must the risk assessment cover?

ACOP L8 requires the risk assessment to identify and assess the risk of legionella exposure from the water system. At a minimum, it must:

1. Identify the water systems in the building, including all hot and cold water services, storage tanks, calorifiers, showers, cooling towers, and any other system that could create an aerosol
2. Assess the risk that legionella bacteria could grow and be transmitted to people
3. Identify who might be at risk, including employees, residents, visitors, and vulnerable groups (immunocompromised individuals, elderly persons)
4. Evaluate existing controls and determine whether they are adequate
5. Recommend remedial actions where risks are not adequately controlled

The assessment must be "suitable and sufficient" -- a phrase the HSE uses to mean it must be thorough enough to identify all significant risks, but it does not need to be excessive or academic.

Who can carry out the assessment?

ACOP L8 requires the risk assessment to be carried out by a "competent person." The ACOP does not mandate a specific qualification, but it states that the person must have:

• Sufficient training and experience
• Knowledge of the water system type being assessed
• An understanding of the risks associated with legionella
• The ability to identify failures in control measures

In practice, most duty holders appoint an assessor from an LCA-registered company (Legionella Control Association) or one who holds an equivalent industry qualification. This is not a legal requirement, but it is the standard that the HSE and courts expect.

If you are a duty holder carrying out your own assessment, you must be able to demonstrate that you have the competence to do so. In most cases, it is safer and more defensible to appoint a qualified external assessor.

How often must the assessment be reviewed?

ACOP L8 does not specify a fixed frequency for risk assessment reviews. However, it requires the assessment to be reviewed:

• Regularly, to ensure it remains valid
• Whenever there is reason to believe it is no longer valid -- for example, after a change to the water system, a change in building use, or a case of legionella disease associated with the premises
• After any significant change to the water system, such as installation of new pipework, changes to water storage, or modifications to the heating system

In practice, the widely accepted standard is to review the risk assessment at least every two years, or sooner if any of the above triggers apply. Some organisations review annually, particularly for higher-risk systems.

What are the duty holder's responsibilities?

Beyond commissioning the risk assessment, ACOP L8 requires the duty holder to:

• Appoint a responsible person to manage legionella risk on a day-to-day basis
• Implement the recommendations from the risk assessment
• Maintain a written scheme for controlling legionella risk
• Keep records of monitoring, inspections, and any remedial actions taken
• Provide training to anyone involved in managing the water system
• Review and update the risk assessment as required

The duty holder cannot simply commission a risk assessment and file it away. The HSE expects active management of legionella risk, with evidence of ongoing monitoring and compliance.

What happens if you do not comply?

Failure to comply with ACOP L8 can result in:

• Improvement notices requiring you to take action within a specified timeframe
• Prohibition notices preventing you from using a water system until risks are controlled
• Prosecution under the Health and Safety at Work etc. Act 1974, with unlimited fines and potential imprisonment for the most serious breaches
• Civil liability if someone contracts legionnaires' disease as a result of your failure to manage the risk

The HSE takes legionella compliance seriously. Outbreaks of legionnaires' disease regularly result in prosecutions and substantial fines, even when no deaths occur.

The relationship between ACOP L8 and HSG274

ACOP L8 sets out the legal framework and general duties. HSG274, the associated technical guidance, provides the detailed practical guidance on how to comply. HSG274 is published in three parts:

• Part 1: The control of legionella bacteria in evaporative cooling systems
• Part 2: The control of legionella bacteria in hot and cold water systems
• Part 3: The control of legionella bacteria in other risk systems

For most assessors working with domestic and commercial hot and cold water systems, HSG274 Part 2 is the primary technical reference. It contains the specific requirements for temperature monitoring, system design, maintenance, and the 67 risk conditions that L8Pro is built around.

Key takeaways

• ACOP L8 applies to every building with a water system -- there are no exemptions for small premises
• The risk assessment must be carried out by a competent person
• It must be suitable and sufficient, covering system identification, risk evaluation, and recommended actions
• Reviews should happen at least every two years, or sooner if the system or building use changes
• The duty holder must actively manage legionella risk, not just commission and file the assessment
• Non-compliance can result in prosecution, fines, and imprisonment