There is no Legionella Act. The duty comes from section 3 of the Health and Safety at Work etc. Act 1974, which makes an employer or person in control of premises responsible for people who are not their employees, and from the Control of Substances Hazardous to Health Regulations 2002, because legionella bacteria are a biological agent hazardous to health. HSE's Approved Code of Practice L8 says what discharging that duty looks like.
What the assessment has to establish
Whether the water system could create and spread breathable droplets, and whether anybody could be exposed. That means an accurate description of the system: the incoming supply, storage, the calorifier or heaters, distribution, the outlets, and anything that atomises water such as showers, spray taps, humidifiers, spa pools, fountains and cooling towers. Then temperatures, stagnation, materials that support growth, and the people at risk.
Dead legs, and why they matter more than anything else
A dead leg is a length of pipe with no flow through it, and a blind end is a capped stub left behind by a refurbishment. Water in them sits at room temperature, which is the range legionella grows in, and every time an outlet nearby is used the contents can be drawn into the system. Finding them is most of the value of a good assessment and it is the part a desk exercise cannot do.
Who can carry it out
A competent person. HSE says most landlords can assess the risk themselves and do not need to be professionally trained or accredited, and that they can arrange for somebody else to do it if they do not feel competent. Complex systems, healthcare and care settings, cooling towers and large or partly occupied buildings are where a specialist earns their fee.
How long it lasts
HSE states that the law does not prescribe that the risk assessment be reviewed on an annual or biennial basis. It should be reviewed periodically in case anything changes, and specifically where the system, its use or the people at risk have changed, where control measures have failed, or where a case of the disease is associated with the system. The two year interval widely quoted in the trade is a convention rather than a rule.
What comes after it
An assessment that identifies risk requires a written scheme of control: what will be monitored, by whom, how often, what the acceptable range is, and what happens when a reading is outside it. The assessment describes the problem; the written scheme is how the duty is actually discharged, and a business with the first and not the second has bought a document rather than a control.
Questions people ask about legionella risk assessment
Is a legionella risk assessment mandatory?
The assessment is required by health and safety law wherever a water system could create and spread breathable droplets and someone could be exposed. It is not required in the form of a certificate.
How long does a legionella risk assessment last?
HSE states the law does not prescribe an annual or biennial review. It is reviewed periodically and whenever the system, its use, the people at risk or the control measures change.
Do I need a legionella risk assessment for a small flat?
If you let it, you have a duty to assess and control the risk. For a simple system on a mains supply with no stored water, that assessment may be short and may conclude the risk is low and already controlled.
Who is responsible for the legionella risk assessment?
The employer, the person in control of the premises or the landlord. The duty can be discharged with help but it cannot be transferred to the contractor who carries out the work.