Short answer: there is no fixed legal interval. HSE says the law does not prescribe an annual or two-yearly review. L8 asks for the assessment to be reviewed "regularly and specifically whenever there is reason to suspect it is no longer valid", such as changes to the system or building, failing checks, new key staff or a case of disease (para 47). Record when it is next due.
What the law and the ACOP say
The dutyholder must make sure a suitable and sufficient assessment of the Legionella risk is carried out (L8, para 28). The ACOP then says: "You need to review the assessment regularly and specifically when there is reason to believe that the original risk assessment may no longer be valid" (L8, para 32).
It calls the record of the assessment "a living document that must be reviewed to ensure it remains up-to-date", and adds that "an indication of when to review the assessment and what to consider should be recorded" (L8, para 47). HSG274 Part 2 repeats the same wording in its introduction (para 14).
On fixed dates, HSE's page for landlords is direct: "The law does not prescribe that the risk assessment be reviewed on an annual or biennial basis. It is important to review the assessment periodically in case anything changes." If a contract or the assessment itself sets a review every one or two years, that is a planning choice by the client or the assessor, not a legal interval.
What triggers a review
| Trigger in L8, para 47 | What it can look like on site |
|---|---|
| (a) Changes to the water system or its use | New showers or a kitchen added, a calorifier replaced, a tank removed, a wing closed off, outlets capped |
| (b) Changes to the use of the building | An office converted to a care setting or flats, or a building left largely empty |
| (c) New information about risks or control measures | Updated HSE guidance, or a change of control method such as a biocide system |
| (d) Results of checks indicating controls are no longer effective | Return legs below 50 °C month after month, cold sentinels above 20 °C, positive legionella samples |
| (e) Changes to key personnel | A new responsible person or facilities manager, or a new water hygiene contractor |
| (f) A case of Legionnaires' disease or legionellosis associated with the system | Any suspected case linked to the building |
HSG274 Part 2 gives two more points where a review comes up:
- Sampling results. Table 2.2 sets action levels. Above 100 and up to 1000 cfu/l with a minority of samples positive, resample; if similar results come back, carry out "a review of the control measures and risk assessment". With most samples positive in that band, or above 1000 cfu/l, the review is immediate. Healthcare premises with vulnerable patients should consider the stricter Table 2.3 (para 2.125).
- Hot summers. Incoming mains water should be well below 20 °C for most of the year, but "in an exceptionally hot summer, it may be necessary to review the risk assessment" (para 2.56).
When a building's use pattern changes, HSG274 also asks for the cold water consumption over a typical day to be recorded again, to confirm water is not stagnating in the tank (para 2.58).
Worked example: a two-storey office with a new gym
The assessment was done in January and recorded a review date two years later. During the year:
- May: the tenant fits out a staff gym with four showers. That is a change to the water system and its use, trigger (a). The contractor who fitted the showers tells the responsible person in writing, and the assessor is asked to review the parts affected, including the shower descaling and flushing regime.
- September and October: the monthly log shows the return leg on one loop at 46 °C. The contractor reports it to the responsible person the same day, and remedial work is arranged straight away, as the written scheme requires (L8, para 69); a single failed reading is a reason to act, not to wait for a review. In October the loop is still at 47 °C after the work, so the controls are plainly not effective, trigger (d), and the review covers that loop and the remedial work.
- April the next year: the facilities manager who was the responsible person leaves, trigger (e). The new one is appointed in writing and the review confirms who does what.
Three reviews came before the recorded date. Each one updates the assessment, and the review date itself can be reset.
Who does what
- The dutyholder makes sure the assessment is done and reviewed, and that whoever does it is competent (L8, paras 28 and 29). Employing contractors or consultants "does not absolve the dutyholder of responsibility" (L8, para 57).
- The responsible person manages day-to-day control (L8, para 51) and is usually the one who spots a trigger and asks for the review.
- The risk assessor carries out the review. HSE lists consultancies, water treatment companies or "a person experienced in carrying out risk assessments" as possible sources of competent help (L8, para 35).
- The maintenance contractor reports what they find: failed readings, changes they make or see, and outlets that have fallen out of use. A contractor who changes the system should say so in writing, because that change is itself a trigger.
What to record, and for how long
- The significant findings, where there are five or more employees (L8, para 43).
- The date of each review, what prompted it, what changed, and the next review date with what to consider (L8, para 47).
- Who the responsible person is (L8, para 71).
L8 says these records are kept "throughout the period they are current and for at least two years afterwards". Monitoring results and their dates are kept "for at least five years" (L8, para 72).
Keeping track of reviews in Field Suite
- Found on the visit: an engineer records what they found, such as a run of failed readings or new outlets, marked by how urgent it is. Urgent items alert the office straight away and print on the job sheet PDF, so the trigger reaches the client in writing when the office sends it.
- Contracts: if your firm carries out assessments, a visit line that repeats every 12 or 24 months creates the review job to book a set number of days before it is due. Visits are set in whole months.
- Forms: build your own review form in the form builder, with yes/no questions for each trigger in para 47. A form's renewal months propose its next due date, and the forms page lists what is coming due in the next 60 days.
See planned maintenance software or book a demo. For the checks behind trigger (d), read Legionella checks for hot and cold water systems and use the monthly temperature log template.
Questions
Does a Legionella risk assessment expire after two years?
No. HSE says the law does not prescribe an annual or biennial review. It must be reviewed regularly and whenever there is reason to think it is no longer valid. A two-year date in a contract or in the assessment itself is a planning choice.
Who can review the assessment?
Someone competent to do it, chosen by the dutyholder (L8, para 29). That can be inside the organisation or an outside assessor.
Do landlords of rented homes need the same reviews?
The duty to assess applies, but for landlords of domestic rental properties HSE says it "does not require an in-depth, detailed assessment", and that it is important to review it periodically in case anything changes.
Does a new water hygiene contractor trigger a review?
It can. "Changes to key personnel" is one of the triggers in L8, para 47. Whether a change of contractor counts is for the dutyholder and assessor to decide.
Field Suite is job management software, not a water hygiene consultancy. The building's own risk assessment, and the competent person who reviews it, decide when it is reviewed and what changes.
Sources
- HSE, L8 Approved Code of Practice and guidance (fourth edition, 2013), paras 28, 29, 32, 35, 43, 47, 51, 57, 69, 71 and 72. https://www.hse.gov.uk/pubns/priced/l8.pdf
- HSE, Legionnaires' disease: Technical guidance, HSG274 Part 2 (second edition, 2024), Introduction para 14, paras 2.56, 2.58 and 2.125, and Tables 2.2 and 2.3. https://www.hse.gov.uk/pubns/priced/hsg274part2.pdf
- HSE, Legionella and landlords' responsibilities. https://www.hse.gov.uk/legionnaires/legionella-landlords-responsibilities.htm
Last checked: 5 November 2026 against the sources above.
Field Suite is job management software for UK building services firms, not a consultancy. Your own risk assessments, contracts and advisers decide what applies to your work. Spotted a mistake? Email info@fieldsuiteapp.com and we correct it.