Legionella Hotel Risk: A Manager's Guide to Water Safety Compliance

Legionella hotel outbreaks are rare. When they happen, they make national news. They also expose a quiet truth about hospitality compliance. Most Legionella records sit in a folder no one has opened since the last check.

Hotel general managers know Legionella is a legal duty. Most are less sure what "good" Legionella hotel management looks like day-to-day. This guide sets out what UK law asks. It explains what the HSE wants to see. It shows how teams can manage Legionella risk in your hotel without drowning in paperwork.

In our experience working with multi-site hotel groups, the gap is rarely awareness. It's evidence. Managers know the rules. They struggle to prove they followed them.

Why Every Legionella Hotel Risk Profile Looks Different

A hotel is a small town for water. There are guest rooms, kitchens, laundries, spas, pools, ice machines, fountains and plant rooms. Each carries water through pipework that bends, branches and dead-ends in ways the architect never quite drew on paper.

Three features push the hotel's Legionella exposure into the high-risk band. The first is the sheer scale of the plumbing. The second is variable occupancy. The third is aerosol risk.

Floors close in low season. Rooms sit empty for weeks. Refurbishments leave behind dead legs. Showers, taps, spa jets and misters can all spread bacteria in fine droplets.

Legionella in hotels thrives in still water between 20°C and 45°C. A closed-off corridor on a Tuesday is exactly that. The bacteria grow. A guest checks in on Friday, runs the shower, breathes in the mist, and the clock starts.

We've seen properties where a single seasonal closure created weeks of stagnation across a wing. The risk assessment had been signed off two years earlier. The flushing schedule existed on paper. Nobody had updated either document when the occupancy pattern changed.

The Legal Framework Behind Every Legionella Hotel Duty

Legionella control in the UK hotel safety space sits under several laws. Knowing which applies to you matters when an HSE inspector turns up.

The Health and Safety at Work Act 1974 places a general duty on employers. COSHH (the Control of Substances Hazardous to Health Regulations 2002) treats Legionella as a biological agent. ACoP L8, fourth edition, sets out how to comply. Technical guidance for any hotel scheme sits in HSG274 Parts 1, 2 and 3.

ACoP L8 names the "duty holder" as the person in control of the premises. In most UK hotel groups, that is the owner or the management company. The duty holder must appoint a "responsible person" for day-to-day work. They can be in-house or external. Their role must be in writing.

The legal duties for any Legionella hotel programme are clear. You must identify and assess sources of risk. You must prepare a written scheme of control. You must put that scheme into action. Records must be kept and reviewed when things change.

Failing to do this is not a technical breach. The HSE has prosecuted hotels where guests died. The HSE has prosecuted hotels where poor water safety contributed to guest illness. Fines in recent Legionella prosecutions have exceeded £1 million, and directors can face personal liability.

Legionella Temperature Thresholds Every Hotel Must Know

Temperature is the single most useful control measure for the Legionella risk in your hotel. Get it right, and the bacteria can't grow. Get it wrong, and you've built a culture flask.

Featured answer: Legionella bacteria are killed at temperatures above 60°C. Hot water should be stored at 60°C or above. It should reach outlets at 50°C or higher within one minute. Cold water should sit below 20°C. The danger zone is 20°C to 45°C, where the bacteria grow fast.

In practice, this means three sentinel checks every Legionella hotel routine should run. Hot water flow temperature at the calorifier outlet, taken monthly. Hot water return temperature at the calorifier, taken monthly. Cold water at the storage tank and at sentinel outlets, also monthly.

‍

Many hotels fit thermostatic mixing valves (TMVs) for guest scald safety. The pre-mix supply must still hit 50°C. The mixed tap temperature is lower. That is fine. The supply behind the valve must stay hot enough to kill Legionella.

The Legionella Hotel Risks Most Managers Miss

In 38 years of supporting hotel safety compliance, Legionella work is the area where paperwork falls shortest. Not because operators don't care. Hotel water systems are just too complex for textbook examples to fit.

Empty rooms are the classic blind spot. A floor closed for off-season. A wing held for refurbishment. A single room out of service for plumbing repairs. Each one holds still water at room temperature. The shower head, the basin tap, the toilet, the bath spout, all dead until someone runs them.

Dead legs are the second hidden risk. A "dead leg" is a length of pipe that no longer feeds an active outlet but still holds water. They appear after a refurbishment when a basin is moved but the supply pipe is capped, not removed. Every dead leg is a small Legionella nursery.

Spa pools, hot tubs and swimming pools need separate care in any hotel Legionella plan. They are warm, aerated, and shared by many guests. HSE guidance HSG282 covers spa pools. ACoP L8 still applies.

Indoor fountains and misters in conservatories or restaurants can also throw aerosols. They belong on the risk register too.

Ice machines are the surprise on most asset lists. They take cold water, store it, and dispense it. Where the cold supply runs through warm voids, or sits too long, the risk is real.

The same goes for garden irrigation, an unused sprinkler test point, and the showers in the staff changing room nobody has run in weeks.

Day-to-Day Water Safety Management in a Legionella Hotel Routine

Hotel water safety stands or falls on routine. Risk assessments matter. They don't prevent Legionella growth on their own. What does is the boring weekly task that operations teams either do or skip.

A practical Legionella hotel routine looks like this.

Weekly: flush low-use outlets for at least two minutes. That covers guest rooms empty for seven days or more, staff areas with patchy use, and any outlet flagged by the risk assessment. Run hot and cold apart. Log the date, time, outlet and the person who did it.

Monthly: take temperature readings at sentinel outlets. Hot water flow at calorifier. Hot water return at calorifier. Cold water at storage and at the furthest outlet from the tank. Log the reading and the action taken if it falls outside target.

Quarterly: inspect cold water storage tanks, calorifiers, expansion vessels, shower heads (descale or replace as needed), and any point-of-use water filters. Inspect spa and pool plant rooms in line with the bespoke schedule for those systems.

Annually: review the written scheme of control. Every two years, or sooner if anything material changes, review the full risk assessment software record and update the Legionella risk assessment.

Here's the thing about these schedules. They are simple. The complication is doing them across forty guest floors, three restaurants, a spa, a pool, two laundries and a staff block, and then evidencing it when an inspector asks.

The Legionella Hotel Risk Assessment: What It Involves

A Legionella risk assessment hotel teams commission must be done by a competent person. ACoP L8 does not force you to use an external firm. Most hotels still do. The reason is simple. A hotel water system needs technical training, schematic skills and a working grip of HSG274. Few in-house teams hold all three.

A proper hotel Legionella assessment covers the full system, hot and cold. It lists every asset: tanks, calorifiers, pumps, expansion vessels, TMVs, outlets, dead legs and aerosol points. It draws a schematic of how water flows through the building. It logs temperatures, materials, the age of parts and the use pattern of every outlet.

From this, the assessor flags risk points and proposes controls. The output is a written report with a clear action plan, what is high risk, what is medium, what to do, by when, and who owns it.

Reviews should happen every two years at the latest. They should also happen sooner after a change to the water system, after refurbishment work, after a change in building use, when new risk data arrives, or after any case of Legionnaires' linked to the premises.

In our experience, the cheapest risk assessment is rarely the most useful. A two-day visit at a 200-bedroom hotel that yields a 12-page report has likely missed something. A five-day visit with a schematic, an asset register and a costed action plan is what good looks like.

Record-Keeping and Hotel Water System Compliance

ACoP L8 requires that records are kept for at least five years. This is the part of hotel water system compliance that decides whether you pass an HSE inspection or face enforcement.

The records that matter are flushing logs, temperature readings, risk assessment files and review dates. You also need remedial action records, training files for the responsible person, and water sampling results where they apply. Each record needs a date, an outlet or asset, and a sign-off.

Paper systems can work for a single small hotel. For a group of five sites or more, paper is where compliance evidence goes to die. We've seen properties with strong operational practice fail audits. The records lived in a file in the chief engineer's office. The engineer was on leave when the inspector arrived.

Digital record-keeping changes the picture. A weekly flushing job that prompts the team on a tablet, captures the reading and stamps it with the date is open to audit in seconds. The same goes for monthly temperature checks and quarterly inspections. When the HSE inspector asks for six months of flushing data for floor four, you find it in two clicks.

This is where the duties for ACoP L8 hotels connect to the wider compliance picture. Groups that run a digital compliance platform for food, fire and health and safety find their Legionella records sit beside them. The idea is the same: one source of truth, one audit trail you can hand over on the spot.

Modern compliance software brings these threads together rather than leaving them in folders. For hotel groups managing multiple properties, water safety records belong in the same picture as every other compliance discipline. An integrated safety platform makes that picture visible across the portfolio. If you can't evidence it, you didn't do it.

Frequently Asked Questions

Is a Legionella risk assessment a legal requirement for hotels?

Yes. Under COSHH Regulations 2002 and the Health and Safety at Work Act 1974, every hotel must assess the risk of Legionella. ACoP L8 sets out how. The hotel Legionella assessment must be in writing and reviewed when the water system or its use changes. Missing or outdated paperwork is a common HSE enforcement trigger.

How often should hotel water systems be tested for Legionella?

Routine sampling is not required for every system. It is needed where the control scheme calls for it. Hot and cold systems running between 20°C and 50°C should be sampled at least quarterly. Spa pools should be sampled monthly. If samples come back positive, sampling frequency rises and the control scheme must be reviewed.

What temperature kills Legionella in water?

Legionella bacteria are killed at temperatures above 60°C. At 70°C, they die within seconds. Hot water systems should store water at 60°C or above and deliver it to outlets at 50°C or higher. Below 20°C, Legionella does not grow. The bacteria grow fastest between 35°C and 45°C.

Who is responsible for Legionella compliance in a hotel?

The duty holder is legally responsible. In most properties this is the owner or the management company. The duty holder must appoint a competent responsible person. That role often falls to the general manager, facilities manager or chief engineer. Their role and skills must be on paper. Group operations directors hold the wider accountability.

Do hotel spas and pools need separate Legionella assessments?

Yes. Spa pools, hot tubs, swimming pools, hydrotherapy pools and water features each present specific risks that the main Legionella hotel risk assessment may not cover in enough depth. HSG282 sets out extra control measures for spa pools. A bespoke check on the spa or pool system, its plant room, balance tanks, dosing kit and aerosol points is good practice. In most cases, it is a legal expectation.

Next Steps

Legionella hotel risk is a compliance area where the cost of getting it wrong sits far above the cost of getting it right. The day-to-day work is dull: flushing taps, logging temperatures, updating schematics. The cost of skipping it is a guest in hospital and a director in court.

If you run a hotel group and your records still live in paper folders or scattered sheets, ask one question. Could you show the last six months of evidence right now, across every site? If the answer is "probably, eventually," there is room to improve.

Navitas Safety helps hotel operators manage compliance across every property in the group. From food safety to fire safety, water safety records and risk assessments, the platform brings it into one system. Book a free Navitas demo to see how multi-site hotel teams are evidencing compliance in real time. Group operators can also explore the audit software that keeps records inspector-ready.

For the regulatory detail, the HSE guidance on Legionnaires' disease is the primary reference. The HSE Approved Code of Practice L8 sets out the legal duties in full.