Publisher: Health and Safety Executive (HSE)
Full title: Legionnaires' disease: Technical guidance
Series code: HSG274
Number of parts: Three
Current edition: Second edition, published March 2024 (Part 1 revised only)
Legal status: HSE guidance supporting the Approved Code of Practice L8
Jump to:
1. What is HSG274?
2. The three parts of HSG274 at a glance
3. HSG274 Part 1: Evaporative cooling systems
4. HSG274 Part 2: Hot and cold water systems
5. HSG274 Part 3: Other risk systems
6. What HSG274 compliance looks like in practice
7. Where HSG274 compliance most often fails
8. How L8 Protection delivers HSG274 compliance
9. HSG274 FAQs
HSG274 is HSE's technical guidance on how to control legionella in real water systems. It sits alongside the Approved Code of Practice L8 and turns its broad legal expectations into specific, measurable control measures: the temperatures to achieve, the checks to carry out, how often to carry them out, and what to do when something goes wrong.
It is written for dutyholders, which includes employers, landlords, managing agents and anyone in control of premises. It is also written for the people doing the hands-on work, such as facilities teams, responsible persons and water hygiene specialists like ours.
The simplest way to think about it is that ACOP L8 tells you what you must achieve, while HSG274 tells you how to achieve it.
ACOP L8, titled Legionnaires' disease: The control of legionella bacteria in water systems, sets out the core duties. You must identify and assess the risk, prepare a written scheme to prevent or control it, put that scheme into practice, keep records and appoint someone to manage it all.
HSG274 then provides the technical detail for each type of water system. Without it, a written scheme would have no clear content. With it, your scheme becomes specific, measurable and auditable. In practice, you need both documents working together, and any competent legionella risk assessment should be carried out against ACOP L8 and HSG274 as a pair.
HSG274 is guidance rather than law, so it is not compulsory to follow it word for word. However, it is the standard that inspectors, insurers and courts recognise as good practice for meeting your legal duties.
If you choose a different approach, you need to be able to show it is at least as effective, and that reasoning should be documented clearly in your risk assessment and written scheme. A different method chosen to save money, without technical justification, is unlikely to stand up to scrutiny if something goes wrong.
ACOP L8 carries more weight still. As an Approved Code of Practice, it has special legal status: if you are prosecuted and did not follow it, a court can treat that as evidence of a breach unless you prove you complied in another equally effective way.
HSG274 supports the legal duties set out in four key pieces of UK legislation:
The Health and Safety at Work etc Act 1974, which places a general duty on employers and those in control of premises to protect employees and others from harm
The Control of Substances Hazardous to Health Regulations 2002 (COSHH), which covers biological agents, including Legionella bacteria
The Management of Health and Safety at Work Regulations 1999, which require suitable and sufficient risk assessments and competent assistance
The Notification of Cooling Towers and Evaporative Condensers Regulations 1992, which require wet cooling systems to be notified to the local authority
HSG274 is divided into three parts, each covering a different type of water system. Most organisations only need Part 2, but many sites have systems that fall under more than one part.
HSG274 Part 1: The control of Legionella bacteria in evaporative cooling systems. Cooling towers and evaporative condensers.
HSG274 Part 2: The control of Legionella bacteria in hot and cold water systems. The water services found in almost every building
HSG274 Part 3: The control of Legionella bacteria in other risk systems. Spa pools, humidifiers, water features and other systems that can create aerosols.
A Legionella risk assessment will identify every water system on your premises and the guidance that covers it.
No. HSG274 is published in three parts only. If you have seen a reference to a fourth part, it is likely a mix-up with other HSE guidance, such as HSG282 for spa pools. Whatever your system, it will be covered by Part 1, Part 2 or Part 3.
HSG274 Part 1 covers cooling towers and evaporative condensers, the highest-risk systems for Legionella. They operate at temperatures bacteria thrive in and are designed to release fine water droplets into the air, which can travel well beyond the site boundary. Some of the UK's largest outbreaks of Legionnaires' disease have been linked to cooling towers, which is why the controls in Part 1 are the most demanding of all three parts.
Part 1 applies to anyone who owns, operates or controls wet cooling plant. That typically includes manufacturing and industrial sites, data centres, hospitals, large office buildings and process plants using cooling towers, evaporative condensers or other evaporative cooling systems.
Because temperature alone cannot keep a cooling tower safe, Part 1 relies on a combination of water treatment, monitoring and good engineering. Your regime should include:
Notification of the system to your local authority, kept up to date if the plant changes, moves or is decommissioned
A continuous water treatment programme, typically using biocides to kill bacteria and dispersants to control biofilm, scale and corrosion
Routine chemical monitoring to confirm treatment levels stay within set limits
Microbiological monitoring, including regular general bacteria counts and routine legionella sampling, analysed by a UKAS-accredited laboratory
Inspection, cleaning and disinfection of the system, including the pack, basin and drift eliminators, at intervals set by your risk assessment
Clear action levels, so everyone knows exactly what to do if results fall outside safe limits
It is worth checking your notification early. We regularly find sites where the cooling tower was registered by a previous occupier and never updated, or never registered at all.
In March 2024, HSE published a second edition of HSG274. Only Part 1 was revised; Parts 2 and 3 are unchanged.
The update adds further detail on DPD No. 1 testing, the method many sites use to measure free chlorine and bromine in cooling water. It also explains how cooling water pH affects the efficacy of halogen-based biocides. As pH rises, chlorine and bromine become less effective, so an unadjusted test result can suggest your system is better protected than it really is.
HSE's advice is simple: check your most recent results and make sure they are pH-corrected. If your monitoring records do not show pH-corrected free halogen readings, your control regime may need updating to reflect current guidance.
HSG274 Part 2 is the part that applies to almost every building in the UK. It covers the hot and cold water services we all rely on (taps, showers, storage tanks, calorifiers and the pipework connecting them) and explains how to keep them free from conditions that allow Legionella to multiply.
The principle is straightforward: legionella grows most readily between 20°C and 45°C, especially where water sits still and where scale, sludge and biofilm give it food and shelter. Part 2 controls that risk through three things: temperature, water movement and cleanliness.
If your premises have running water, Part 2 almost certainly applies to you. That includes offices, retail units, factories, warehouses, schools, care homes, hotels, gyms, residential blocks, HMOs and rental properties. Part 2 also includes specific guidance for healthcare and care settings, where occupants are more vulnerable, and for residential accommodation managed by landlords.
Temperature control is the main line of defence in most hot and cold water systems. HSG274 Part 2 sets clear targets:
Hot water storage: stored at 60°C or above in calorifiers and cylinders
Hot water at outlets: reaching at least 50°C within one minute of running (55°C in healthcare premises)
Cold water at outlets: below 20°C within two minutes of running
Where hot water is delivered at these temperatures, scalding becomes a real risk, particularly for children, older people and anyone with reduced mobility or sensation. That is why thermostatic mixing valves are often fitted close to outlets in care homes, schools and healthcare premises.
Sentinel outlets are the taps nearest to and furthest from the hot water source or cold water tank on each part of the system. If water reaches the right temperature at these points, it is a good indication the rest of the system is in control. Monthly checks at sentinel outlets are the backbone of most Part 2 monitoring programmes.
HSG274 Part 2 sets out a programme of routine checks. The exact frequencies for your site should come from your risk assessment, but a typical regime includes:
Weekly: flush little-used outlets, including showers and taps in vacant rooms
Monthly: check hot and cold water temperatures at sentinel outlets, and calorifier flow and return temperatures
Quarterly: clean and descale showerheads and hoses
Annually: inspect cold water storage tanks and calorifiers, and check a representative sample of other outlets
As recommended: service thermostatic mixing valves in line with the risk assessment and manufacturer's guidance
Every check should be recorded. A temperature you took but did not write down offers no protection when an inspector asks for evidence.
Stagnant water is one of the most common causes of Legionella growth we find on site. Little-used outlets include guest bathrooms, vacant offices, accessible toilets, outside taps and seasonal facilities. Each one should be flushed at least weekly, with the flushing recorded.
Dead legs are lengths of pipe that no longer serve an outlet, often left behind after refurbishments. Water sits in them indefinitely. HSG274 advises removing them wherever possible, and a good risk assessment will identify every one.
Thermostatic mixing valves (TMVs) blend hot and cold water to a safe temperature at the outlet. They protect people from scalding, but the pipework after the valve sits at a temperature where Legionella can grow. TMVs therefore need regular inspection, cleaning and failsafe testing, and should be positioned as close to the outlet as possible.
Part 2 recognises that some settings carry higher risk. Care home residents and hospital patients are often more susceptible to Legionnaires' disease, so controls must be tighter and records more rigorous. Healthcare premises should also follow HTM 04-01, the Department of Health's guidance on safe water in healthcare settings.
For landlords, the duty to assess and control legionella risk applies to residential lettings too, with void periods and tenant changeovers being the moments to watch most closely.
HSG274 Part 3 covers water systems that are not cooling towers or standard hot and cold services, but can still create the warm, stagnant or aerosol-producing conditions Legionella needs. These systems are often overlooked because they are not part of the main plumbing, which is exactly why they deserve attention.
Part 3 applies to a wide range of equipment, including:
Spa pools and hot tubs
Humidifiers and air washers
Emergency showers and eye wash stations
Sprinkler and hose reel systems
Misting, fogging and spray systems, including horticultural and retail misting
Indoor and outdoor water features and fountains
Vehicle wash systems
Dental chair water lines
Industrial process water and effluent treatment systems
If any of these are present on your site, they should appear in your risk assessment and written scheme in their own right, not as a footnote.
Spa pools combine warm water with powerful air jets, a combination that has caused outbreaks at hotels, leisure centres and even trade show displays. Alongside Part 3, HSE publishes separate, more detailed guidance for spa pools: HSG282, Control of legionella and other infectious agents in spa-pool systems. If you operate a spa pool or hot tub in a commercial setting, both documents apply.
Every Part 3 system is different, but the same principles run through all of them:
Understand how and where the system creates aerosols
Keep water treated and disinfected where that is part of the design
Prevent stagnation by running, flushing or draining systems that sit idle
Clean and disinfect regularly to remove biofilm and deposits
Monitor, record and act quickly when results fall outside limits
Emergency showers are a good example. They are rarely used, so water can stagnate for months. When someone finally needs one, they receive a direct spray of aerosol at the worst possible moment. A simple weekly flush, recorded, removes most of that risk.
HSG274 compliance is not a certificate or a single visit. It is an ongoing, documented system of control that you can evidence at any time. In our experience, the sites that handle an inspection with confidence share the same six foundations.
Everything starts with the risk assessment. It should describe your water systems, identify where Legionella could grow and how people could be exposed, consider who might be more vulnerable, and set out prioritised recommendations. It should also include an up-to-date schematic and asset register.
A good assessment is carried out by walking the system, not reading old paperwork. It should follow ACOP L8 and HSG274, and many assessors also work to BS 8580-1, the British Standard for Legionella risk assessments.
Where the risk assessment identifies a risk, you need a written scheme of control. This sets out what will be done, by whom, how often, and what happens when a check fails. It should reflect your actual site and draw its control limits directly from HSG274. A generic template copied between buildings will not meet the standard.
Records are your evidence. They should cover temperature checks, flushing, cleaning, inspections, sampling results, remedial work and training. ACOP L8 requires them to be kept for at least five years, and they must be available for inspection.
Three roles sit at the heart of every compliant programme:
The dutyholder carries the legal responsibility. This is usually the employer, landlord or person in control of the premises, and the duty itself cannot be delegated
The responsible person is appointed by the dutyholder to manage day-to-day control, often a facilities or estates manager
Competent persons carry out the technical work, such as risk assessments, monitoring and remedial works. They can be in-house or, as is common, a specialist provider like L8 Protection
Many compliance problems start in the gaps between these roles, where each party assumes someone else is handling a task. Writing down who does what, and reviewing it regularly, closes those gaps.
Your risk assessment should be reviewed regularly and whenever there is reason to believe it is no longer valid. Common triggers include:
Changes to the water system, such as refurbishments, extensions or new equipment
Changes in how the building is used or who occupies it
Monitoring results showing control has been lost, or a positive Legionella sample
Completion of significant remedial work
A change of responsible person or contractor
A suspected or confirmed case of Legionnaires' disease linked to the site
Many organisations also set a fixed review date, often every two years, so the assessment never quietly drifts out of date.
If an HSE or local authority inspector visited tomorrow, you should be able to produce:
A current risk assessment, with every recommendation either completed or actively managed
A written scheme of control specific to your site
At least the last twelve months of monitoring records, with any failures followed through
An up-to-date schematic and asset register
Named dutyholder and responsible person, with evidence of their training
Evidence that your contractors are competent
Records of any positive samples and the actions taken
Most compliance failures are not dramatic. They are small, predictable gaps that build up quietly until a positive sample, an audit or an inspection brings them to light. These are the patterns our specialists see most often, sector by sector, and how to put them right.
Care homes and healthcare settings
En suite showers in rooms that are temporarily empty are the classic weak spot. When a resident moves out or spends time in hospital, flushing often stops, and the outlet becomes a stagnation point beside the most vulnerable people in the building. TMV servicing is the second gap, with valves left untested for longer than the risk assessment allows. A room-by-room flushing log, linked to occupancy, and a TMV schedule tied to the asset register solve both.
Offices and multi-let commercial buildings
In shared buildings, responsibility often falls between landlord and tenant. The landlord manages the central plant, the tenant fits out a kitchen or shower block, and nobody adds the new outlets to the risk assessment. A clear written split of responsibilities, confirmed in the lease and the written scheme, prevents systems from falling through the cracks.
Schools, colleges and universities
Holiday shutdowns leave whole buildings stagnant for weeks at a time. Without a planned recommissioning flush before staff and pupils return, the first person to use a shower or tap after the break can be exposed to water that has sat in the danger zone all summer. A shutdown and reopening procedure in the written scheme is essential.
Hotels, gyms and leisure facilities
Variable occupancy and heavy shower use make these sites high-risk. Unoccupied guest rooms, spa pools and changing room showers all need attention. The most common gap we find is spa pool testing that is carried out but not acted on when results fall outside limits.
Landlords, HMOs and residential blocks
Void periods between tenancies are the key risk. Water left standing in an empty flat can reach unsafe conditions before the next tenant moves in. A simple void property procedure, including flushing before handover, keeps residential portfolios compliant.
Industrial and manufacturing sites
Industrial sites often have systems covered by all three parts of HSG274: cooling plant, domestic water services and process water. The risk is that each is managed by a different team or contractor with no overall picture. One risk assessment covering every system, with one written scheme, gives dutyholders the oversight the law expects.
.webp)
At L8 Protection, we do more than tell you what HSG274 says. We put it into practice on your site, document it properly and keep it working, so you can show complete, defensible compliance whenever you are asked.Every L8 Protection Legionella risk assessment is carried out against ACOP L8 and HSG274 Parts 1, 2 and 3.
1. Survey and risk assessment
Our specialists walk your entire water system, take temperatures, inspect tanks and plant, and produce a clear, prioritised risk assessment with an accurate schematic.
2. Written scheme of control
We turn the findings into a site-specific scheme with clear responsibilities, frequencies and action levels drawn from HSG274.
3. Monitoring programme
We carry out, or support your team to carry out, the routine checks your scheme requires, with every result recorded.
4. Sampling and remedial works
Where needed, we take water samples for analysis at UKAS-accredited laboratories and complete remedial works to restore control.
5. Review and ongoing support
We review your arrangements as your building and its use change, so your compliance never falls out of date.
Legionella risk assessments for every type of premises
Written schemes of control tailored to your site
Legionella sampling and testing through UKAS-accredited laboratories
Water tank cleaning and disinfection
TMV servicing and failsafe testing
Remedial works, including dead leg removal and system improvements
Legionella control is too important to leave to a tick-box visit. Organisations across the UK trust L8 Protection because we combine technical expertise with clear, practical advice that makes compliance easier to manage.
Specialists, not generalists: Legionella and water hygiene are our focus, so our team works with ACOP L8 and HSG274 every day
Sector experience: across care homes, healthcare, education, commercial property, hospitality, residential and industrial sites
Clear, honest reporting: Our reports explain what we found, why it matters and exactly what to do next, in plain English
UK-wide coverage: Our specialists support sites across England, Scotland, Wales and Northern Ireland, so multi-site organisations get one consistent standard of Legionella control wherever their buildings are
.webp)
Interested?
Get in touch.
Can't see your question? Get in touch with our friendly team, we'd be happy to help.
Where can I download HSG274?
All three parts of HSG274 are free to download from the HSE website. Always use the HSE source, so you have the current edition.
How long must legionella records be kept?
Records of your risk assessment, written scheme, monitoring results and remedial work must be kept for at least five years and be available for inspection.
Who is responsible for HSG274 compliance?
The dutyholder is legally responsible. This is usually the employer, landlord or person in control of the premises. They appoint a responsible person to manage day-to-day control and use competent specialists for technical work such as risk assessments.
How often should legionella testing be carried out?
Cooling towers need routine Legionella sampling as part of HSG274 Part 1. For most hot and cold water systems, testing is not routine and is driven by your risk assessment, for example after remedial work, when temperatures cannot be maintained, or in higher-risk healthcare settings.
How often should a legionella risk assessment be reviewed?
A legionella risk assessment should be reviewed regularly and whenever it may no longer be valid, such as after system changes, a change in occupancy, a positive sample or remedial works. Many organisations also set a fixed review, often every two years.
What changed in the 2024 edition of HSG274?
The second edition, published in March 2024, updated Part 1 only. It adds detail on DPD No. 1 testing and explains how cooling water pH affects chlorine and bromine biocides, meaning free halogen results should be pH-corrected.
What temperatures does HSG274 Part 2 require?
Hot water should be stored at 60°C or above and reach at least 50°C at outlets within one minute (55°C in healthcare premises). Cold water should be below 20°C at outlets within two minutes of running.
What is the difference between ACOP L8 and HSG274?
ACOP L8 sets out the legal duties for controlling Legionella and has special legal status. HSG274 provides the technical detail on how to meet those duties for each type of water system. Compliant organisations follow both together.
Is HSG274 a legal requirement?
HSG274 is guidance, not law, but it is the recognised standard inspectors and courts use to judge legionella control. You can use an alternative approach only if it is at least as effective and the reasoning is documented in your risk assessment.
Is there an HSG274 Part 4?
No. HSG274 is published in three parts only. Every water system is covered by Part 1, Part 2 or Part 3. Spa pools also have their own separate HSE guidance, HSG282, which is sometimes mistaken for an additional part.
What are the three parts of HSG274?
Part 1 covers evaporative cooling systems such as cooling towers. Part 2 covers hot and cold water systems found in most buildings. Part 3 covers other risk systems, including spa pools, humidifiers, water features and emergency showers.
What is HSG274?
HSG274 is the Health and Safety Executive's technical guidance on controlling Legionella bacteria in water systems. Titled Legionnaires' disease: Technical guidance, it is published in three parts and explains the practical control measures dutyholders need to meet their legal duties under ACOP L8.
Whether you manage one building or a full portfolio, L8 Protection's legionella specialists can review your current arrangements, identify any gaps and help you put a clear, compliant control regime in place.
Where water safety meets peace of mind.