Legionella compliance in the UK is governed by the same piece of guidance whether you manage a city centre office block or a sixty-bed care home: the HSE's Approved Code of Practice L8. Yet walk into ten commercial buildings and ten care homes, and you'll find two very different risk pictures, two very different sets of consequences for getting it wrong, and, more often than not, two very different reasons why compliance quietly falls apart.
At L8 Protection, we carry out legionella risk assessments across both sectors, and the failures we come across are rarely obscure or unpredictable. They follow patterns. Understanding those patterns, and recognising where your own building might already be exposed to one, is the first step towards genuine compliance rather than a box-ticking exercise that looks fine on paper and falls apart under scrutiny.
This guide sets out where commercial and care home legionella compliance most commonly fails, why the two sectors need fundamentally different approaches, and what a properly sector-aware commercial legionella risk assessment actually looks like when it's done right.
ACOP L8 and its supporting guidance, HSG274, apply to any duty holder with control over a water system that could expose people to Legionella bacteria. That covers offices, retail units, warehouses, leisure centres, hotels, care homes and everything in between. The legal foundation is identical. What differs enormously is the risk itself.
Commercial buildings tend to have intermittent occupancy, mixed tenant populations, and water systems that get more complicated the more times a building has been let, refurbished or subdivided. Many of the biggest risks in commercial premises come from parts of the system nobody is actively using, rather than parts being used incorrectly.
Care homes sit at the opposite end of the spectrum. Occupancy is constant, the population using the water system is clinically vulnerable by definition, and the water systems themselves are often extensive, serving assisted bathrooms, wet rooms, catering and laundry facilities around the clock. The risk isn't hidden in unused corners of the building. It's active, every day, in rooms that are in constant use by the people least able to fight off an infection.
Treating both sectors with the same generic risk assessment template is where a lot of compliance failures begin.
Every duty holder, regardless of sector, operates under the same underlying legislation. The Health and Safety at Work etc. Act 1974 places a general duty on employers and those in control of premises to protect the health and safety of employees, visitors and anyone else who might be affected. The Control of Substances Hazardous to Health Regulations 2002 go further, classifying Legionella bacteria as a biological agent and requiring duty holders to assess the risk, prevent or control exposure, and keep appropriate records.
ACOP L8 translates those legal duties into a practical standard. It sets out the requirement for a suitable and sufficient risk assessment, the appointment of a competent person to manage legionella risk, a written scheme of control, and a monitoring and record-keeping regime. HSG274 then provides the detailed technical guidance behind that standard, covering hot and cold water systems, cooling towers and other higher risk systems. Courts and the HSE treat compliance with ACOP L8 as evidence that you've met your legal obligations, which is why it forms the backbone of almost every Legionella risk assessment carried out in the UK.
This is where commercial and care sectors part company. Commercial duty holders answer to the HSE, and enforcement typically follows an incident, a complaint or a routine inspection. Care providers face an additional and much more active layer of scrutiny. CQC Regulation 12, Safe Care and Treatment, explicitly requires registered providers to assess, prevent and control the risk of infection, and this includes Legionella. CQC inspectors will ask to see the risk assessment, the water safety plan and monitoring records as a matter of routine, not as an exception. A gap here doesn't just carry HSE risk. It can trigger a CQC requirement notice, a warning notice, or in serious cases, action against the provider's registration itself.
That difference in oversight is one of the clearest reasons why a generic, one-size-fits-all approach to legionella compliance leaves both sectors exposed in different ways.
If you're unsure which framework applies to your building or how it should shape your approach, our team can talk you through exactly what a commercial legionella risk assessment needs to cover for your specific circumstances.
Commercial legionella compliance rarely fails because nobody has heard of ACOP L8. It fails because of a handful of recurring, entirely avoidable gaps.
This is the single most common failure we encounter, particularly in smaller commercial units, multi-let buildings and premises that have changed hands or changed use without anyone reviewing water safety along the way. An assessment carried out five or six years ago, before a refurbishment, a change of tenant or a shift in how the building is used, provides no legal protection whatsoever. It's also worth being clear that there's no such thing as a one-off "Legionella certificate" that covers you indefinitely. A legionella risk assessment commercial property owners rely on needs to reflect the building as it stands today, not as it stood when the assessment was last commissioned.
In multi-let commercial buildings, and particularly where a managing agent sits between the landlord and the tenants, responsibility for legionella control can become genuinely unclear. Landlords assume the managing agent has it covered. Managing agents assume it falls to whichever tenant occupies the space. Tenants assume it's a landlord obligation tied to the building's core services. In practice, the legal duty always sits with whoever has control over the water system, and if that isn't written down clearly in the management contract, it's only a matter of time before it becomes a genuine gap rather than a theoretical one.
Commercial buildings change shape constantly. Units get subdivided, refurbished, partially let or left vacant while new tenants are found. Every one of those changes has the potential to leave behind a dead leg, a section of pipework that no longer serves an active outlet but still holds water. These sections are classic Legionella growth points precisely because nobody is using them, and they're frequently missed unless the assessment specifically accounts for the building's history, not just its current floor plan.
A risk assessment on file is not the same as compliance. We regularly see buildings where a legionella risk assessment was commissioned, filed away, and never translated into an actual working scheme covering who monitors what, how often, and what happens if a reading falls outside the safe range. Without that written scheme of control, the assessment is little more than a document, and it won't hold up if the HSE ever asks to see how its recommendations were actually implemented.
Care homes generally take legionella compliance seriously given the vulnerability of their residents and the scrutiny they face from CQC. Even so, the same handful of failure patterns turn up again and again.
This is the care sector's version of the commercial "document without action" problem, and it's arguably more serious given who's exposed. A thorough risk assessment and a detailed written scheme of control mean very little if temperature checks are inconsistent, if showerheads aren't cleaned on schedule, or if staff simply aren't following the routine the scheme sets out. CQC inspectors are specifically trained to look past the paperwork and ask for evidence that controls are actually happening day to day.
Thermostatic mixing valves are fitted throughout care homes to prevent scalding, but the pipework immediately downstream of a TMV can sit at temperatures that support Legionella growth if the valve isn't serviced and flow tested regularly. It's an easy area to lose track of, particularly across a large home with dozens of valves, and gaps in TMV servicing records are one of the first things a thorough inspection will flag.
When a resident's room becomes vacant, whether through hospitalisation, a move, or bereavement, the outlets in that room stop being used, sometimes for weeks. Water sitting still in pipework is exactly the condition Legionella bacteria need to establish themselves. Weekly flushing of vacant rooms is a simple, low-cost control measure, but it's also one of the easiest to let slip during a period that's already difficult for staff to manage.
Many care homes formally name a Responsible Person for legionella management, but don't always give that person the time, authority or training needed to actually fulfil the role. If the Responsible Person can't instruct remedial work, can't restrict the use of an outlet when needed, or hasn't received proper training, the appointment exists on paper only. CQC and the HSE both expect to see a Responsible Person who can demonstrate real oversight, not just a name on an organisational chart.
The consequences of poor legionella compliance differ by sector, but they're serious in both directions.
For commercial duty holders, non-compliance is a COSHH breach that can lead to HSE improvement or prohibition notices, prosecution, and unlimited fines. Beyond the direct penalty, there's the cost of business interruption if a system needs to be taken out of use for remedial work, and the civil liability exposure if anyone is harmed as a result.
For care providers, the stakes are arguably higher still. A CQC finding around water safety can result in a requirement notice, a warning notice, or in the most serious cases, action against the home's registration itself, alongside the reputational damage that follows any safeguarding-adjacent finding in a care setting.
Set against either of those outcomes, the cost of a proportionate, properly scoped Legionella assessment is genuinely modest. It's one of the clearest examples in health and safety compliance where prevention is dramatically cheaper than the alternative.
A generic template completed in an afternoon rarely reflects the reality of how a building is used, which is exactly why so many of the failures above happen in buildings that technically have "an assessment" on file. At L8 Protection, our approach is built around getting underneath the paperwork and understanding the building itself.
Every assessment starts with a proper survey of the actual water system as it exists today, not as it was designed or as a previous assessment described it. That means identifying every tank, outlet, dead leg and piece of specialist equipment, and mapping how water actually moves through the building.
A small, simply plumbed commercial unit and a sixty-bed care home should never end up with the same monitoring schedule. Our assessments set a risk rating and a monitoring frequency that's genuinely proportionate to the occupancy pattern and the vulnerability of the people using the building, rather than defaulting to a generic interval.
The written scheme we produce sets out exactly who is responsible for what, how often each control measure needs to happen, and what to do if a reading falls outside the safe range. It's designed to be a working document your team can actually follow, not a file that gets opened once and never looked at again.
We build in clear guidance on when the assessment needs revisiting, whether that's a routine review interval or an event that should trigger an earlier reassessment, such as a refurbishment, a change of use, or a control measure that's stopped working as expected.
If any of the failure patterns above sound familiar, it's worth getting a proper commercial legionella risk assessment in place before they become a finding rather than a fix.
No. There's no legal document called a legionella certificate, in the way there is, for example, a gas safety certificate. What the law actually requires is a written Legionella risk assessment and a written scheme of control. Some providers issue a summary or cover sheet alongside the full report, and this is sometimes referred to informally as a certificate, but it's the underlying risk assessment itself that carries legal weight. If you're asked to provide evidence of legionella compliance, it's the full assessment and scheme of control you'll need to produce, not a standalone certificate.
For most commercial premises, the HSE's recommended minimum is a review every two years, provided nothing significant has changed in the meantime. For care homes and other high-vulnerability settings, an annual review is generally considered appropriate given the continuous occupancy and the additional layer of CQC scrutiny.
In both sectors, certain events should trigger an earlier review regardless of where you are in the standard cycle. These include any change to the water system itself, a refurbishment or extension, a change of building use or occupancy pattern, a period of extended closure, or any indication that existing control measures aren't working as intended.
If there's one lesson that runs through every failure pattern above, it's this: legionella compliance goes wrong when the assessment doesn't reflect the building as it actually is, or when it isn't translated into controls that actually happen. A sector-aware assessment, carried out by someone who understands the specific risk profile of your building type, is the difference between a document that protects you and one that simply exists.
As a specialist UK legionella and water hygiene compliance provider, L8 Protection works across commercial and care sectors precisely because we understand they need different approaches, not the same template applied twice. If you'd like an honest assessment of where your building currently stands, our team is ready to help.
Yes. Any landlord, employer or business owner with control over a water system has a legal duty under COSHH to assess and manage the risk of Legionella exposure, regardless of the size of the property or the number of tenants.
Both sectors are governed by the same core legislation, ACOP L8 and HSG274, but care homes face additional scrutiny under CQC Regulation 12, continuous occupancy, and a clinically vulnerable population, all of which typically call for more frequent monitoring and tighter implementation of control measures.
No. There's no standalone legal certificate for Legionella compliance. What's legally required is a written risk assessment and a written scheme of control, sometimes accompanied by a summary document that's informally referred to as a certificate.
As a general guide, commercial premises should be reviewed at least every two years, while care homes and other high-vulnerability settings are typically reviewed annually. Either should be reviewed sooner if the water system, building use or occupancy changes.
Responsibility depends on what the management contract specifies. If it isn't clearly stated, the legal duty falls to whoever has actual control over the water system, which makes it essential to clarify this in writing at the outset of any management or letting agreement.
Whether you manage a single commercial unit or a full portfolio of care settings, getting your legionella risk assessment right shouldn't be left to chance or a generic template. Get in touch with L8 Protection to book a legionella risk assessment tailored to your building, your sector and the people who use it every day.
.webp)
Interested?
Get in touch.
Where water safety meets peace of mind.
