Legionella and landlords: risk assessments, certificate myth | August

Legionella and landlords: risk assessments, certificates and control measures

Legionella is one of the most misunderstood parts of landlord compliance, and that confusion is profitable for some. You have a genuine legal duty to assess and control the risk of legionella in your rental property, but for an ordinary house or flat you do not need to pay for water testing or a "legionella certificate", whatever a cold-calling consultant tells you. What you need is a proportionate risk assessment, a few sensible control measures, and a record that you have done it. This guide explains what legionella is, what the law actually requires, how to carry out your own assessment, and when professional help is genuinely worth it. For the formal definition, see our dictionary entry on the legionella risk assessment.

What legionella is, and why it matters

Legionella is a bacterium that occurs naturally in water but can multiply to dangerous levels in man-made water systems. If someone inhales small contaminated droplets, for example from a shower, they can develop Legionnaires' disease, a serious form of pneumonia. It is treatable with antibiotics if caught early, but it is fatal in around one in ten cases, and more often among older people, smokers, and those with lung conditions or weakened immune systems. The bacteria multiply fastest in still water between 20°C and 45°C, and in systems where rust, scale or sediment give them something to feed on, which is why temperature and flow are the two things that matter most.

What the law actually requires

Your duty comes from health and safety law, not from a dedicated "legionella regulation". Under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002, you must assess and control the risk that legionella poses to your tenants. The HSE's Approved Code of Practice L8 sets out, in proportionate terms, what that means in practice.

Here is the part that is widely misrepresented. You have a duty to assess and control the risk, but you are not required to obtain a "legionella test certificate", and water sampling is generally not needed for domestic hot and cold water systems except in exceptional circumstances. The HSE is explicit on this. Any company telling you that a standard rental needs laboratory testing and certification is either misinformed or selling you something you do not need. What the law requires is a risk assessment by a competent person, which for a typical property can be you. This duty is part of the same family of obligations as your gas safety certificates and your EICR, and legionella is also one of the hazards a council can assess under the HHSRS and the duty to keep a home fit for human habitation.

Can you do the assessment yourself?

For most standard houses and flats, yes. The HSE describes a competent person as someone with enough training, experience or knowledge to do the job properly, and a typical domestic water system does not require formal qualifications to assess. What it does require is that you understand how legionella grows, can recognise the risk factors, know the control measures, and record what you find. The HSE publishes free guidance, and a simple risk assessment template will structure the job.

A professional assessment makes sense in specific cases: complex systems, multiple storage tanks, commercial-grade equipment, a history of water problems, or a property that has stood empty for a long time. A professional typically charges £75 to £200 for a standard domestic property and takes temperature readings at each outlet, inspects taps, showers and tanks, and identifies redundant pipework. For an ordinary, occupied flat, that is usually money you do not need to spend.

What an assessment covers

A sound assessment works through the property's water systems in order. Identify everything first: the hot and cold supply, any cold-water tank and hot-water cylinder, all taps and outlets, showers and hoses. Then look at temperature, since it is the main control: hot water should be stored at around 60°C and reach the taps at no less than 50°C, and cold water should stay below 20°C, which usually means insulating tanks and pipes and keeping them somewhere cool. Check for stagnation, the other main risk, which is highest in properties left empty, seasonally occupied student lets or rarely used outlets. Inspect the physical condition for rust, scale, biofilm, missing tank lids and dead-leg pipework where water sits unused. Consider who lives there, since vulnerable occupiers raise the stakes, and consider how aerosols are created, with showers the main concern. Then put the control measures in place and write down what you found, what you did, and when you will review it.

The control measures that matter

Most of the risk is removed by a handful of habits. Keep hot water hot and cold water cold, as above, since temperature is the single most effective control. Before a new tenancy or after any void, flush the whole system by running every tap and shower for a couple of minutes to clear standing water. Keep water moving during void periods, arranging weekly flushing if a property will sit empty between tenancies. Keep tanks lidded and systems free of rust, scale and redundant pipework. Clean and descale shower heads at least quarterly, since they generate the aerosols that carry the highest risk. And when you refurbish, remember that combination boilers and electric showers store little or no water, which cuts the risk substantially.

Tenants matter here too. At the start of a tenancy, explain the basics in your welcome pack and note it on the check-in report. Use the taps and showers regularly, do not turn the cylinder thermostat down, clean shower heads, and report any hot-water fault promptly. A property in daily use is inherently lower risk than one with outlets left unused for weeks.

How often to review

The law does not set a fixed interval, but the HSE suggests reviewing a domestic assessment at least every two years, and sooner if something changes: a new boiler, added or removed tanks, reconfigured pipework, a change of use such as converting to an HMO, or a new vulnerable occupier. The efficient approach is to fold the review into your existing compliance calendar, checking it alongside the annual gas safety inspection so it never becomes a separate chore.

Record keeping

Landlords with fewer than five employees are not legally required to keep written records, but you should anyway. If a tenant ever contracted Legionnaires' disease, your records would be the evidence that you met your duty. Keep the assessment itself (date, who did it, systems examined, risks found, controls applied, review date), any temperature checks and flushing dates, and a note of what you told tenants and when. August's document storage keeps that alongside your other certificates with the review date on a reminder.

Common myths

The biggest myth is the certificate. There is no "legionella certificate" requirement for a domestic rental, and water testing is not routinely required. A professional assessment is not mandatory for a simple property if you are competent to do your own. The law has not recently changed; the L8 code dates from 2001 and the 2013 revision clarified rather than expanded the duty. Not every property is high risk; most ordinary homes are low risk once basic controls are in place. And annual reassessment is not required; the two-year review is guidance, not law.

Where it sits in the 2026 picture

The Renters' Rights Act does not change the legionella duty, but it raises the stakes around property condition generally. The extension of the Decent Homes Standard to the private rented sector, stronger council enforcement, and the new PRS ombudsman all mean a documented, sensible approach to water safety is worth more as evidence than it used to be. None of it requires anything beyond the proportionate assessment described above.

What happens if you ignore it

Councils and the HSE do not routinely inspect domestic properties for legionella, but the consequences arrive if a tenant falls ill. A breach of the Health and Safety at Work Act can be prosecuted even where no one became ill, simply on exposure to risk, and fines are unlimited. If someone contracts Legionnaires' disease traceable to your property, you face potential criminal liability, unlimited fines and a civil claim. Your insurer may also decline a claim if you cannot show you met your health and safety duties. Set against an assessment you can do yourself in an afternoon, the asymmetry is stark.

Frequently asked questions

Do landlords legally need a legionella certificate? 

No. There is no legal requirement for a domestic rental to have a legionella certificate or routine water testing. The duty is to assess and control the risk, usually through a simple risk assessment.

Is a legionella risk assessment a legal requirement? 

Yes, in effect. You must assess and control the risk under health and safety law, and a risk assessment is how you do that. It does not have to be done by a professional for a standard property.

Can I do my own legionella risk assessment? 

For a typical house or flat, yes, provided you understand the risks and controls. Use a template and keep the record. Bring in a professional for complex systems or a history of problems.

How often should it be reviewed? 

At least every two years for a domestic property, per HSE guidance, and sooner if the water system or the occupancy changes.

What temperature kills legionella? 

Legionella multiplies between 20°C and 45°C and is killed at higher temperatures, which is why hot water is stored at around 60°C and cold water kept below 20°C.

The bottom line

Legionella rarely makes headlines, but the duty is real and the fix is simple. For most rentals the risk is low, the assessment is something you can do yourself, and the controls are good water-system maintenance you would want to do anyway. Understand the risk, keep water hot or cold rather than lukewarm and moving rather than stagnant, write down what you have done, and review it when things change. You do not need to buy a certificate to keep your tenants safe.

Want the assessment, temperature logs and review dates in one place? Store them with August's compliance checklist and start for free. No credit card required, free for up to two properties.

Disclaimer: This article is a guide and not intended to be relied upon as legal or professional advice, or as a substitute for it. August does not accept any liability for any errors, omissions or misstatements contained in this article. Always speak to a suitably qualified professional if you require specific advice.