A handful of myths cost duty holders real money on Legionella. They all come from the same place: grabbing a familiar word without knowing what the law actually asks. Here are the three that do the most damage — and the truth behind each.
In 2013 the HSE republished its rulebook for Legionella — the Approved Code of Practice, ACOP L8 — in a new fourth edition. It simply tidied the guidance up. It did not change a single one of a landlord's ACTUAL duties, which had been the same for years.
But a revised document is easy to misrepresent as a revised law — if you have a reason to. And some consultants and letting agents did exactly that: telling landlords the law had been overhauled, that they now needed testing and a certificate to prove it. It wasn't true. For those few, it was a sales opportunity dressed as a legal one.
So many landlords were contacting the HSE that it had to step in directly. It published a formal myth-buster — Case 357 — with a bluntly worded verdict:
“Health and Safety law does not require landlords to produce a ‘Legionnaires testing certificate’. Legionella testing is required only in exceptional circumstances and generally not in domestic hot and cold water systems.”1
The HSE went further, describing what those agents and consultants were doing as “scaremongering landlords, for financial gain, by misinterpreting and exaggerating the legal requirements”.1 Plenty of consultants and agents are honest and do valuable work — the problem was never the profession, it was the misinformation. But the myths outlived the correction, and they're still doing the rounds today.
There is no such thing as a ‘Legionella certificate’. The HSE does not recognise one. What the law actually requires is that you assess the risk and control it — and, in most cases, keep a record. The real shape of all this is set out below. If a letting agent, insurer or client asks for a ‘certificate’, give them your risk assessment and your monitoring records: the evidence that you've assessed the risk and are keeping it controlled.
The word ‘certificate’ appears once in ACOP L8 — and not about your premises. It's in a list of records, referring to “cleaning and disinfection procedures and associated reports and certificates”: the paperwork a contractor leaves after doing a disinfection job. The word ‘accreditation’ does not appear at all. There is no premises certificate in there, because there is no such thing.
Why does ‘certificate’ feel so plausible? Because every other box a landlord ticks really is one: Gas Safety, EICR, EPC. ‘Legionella certificate’ slots neatly onto the end of that list and sounds exactly as official as the rest. That's why it sells — and why it's worth knowing it doesn't exist.
What to say when someone asks for one: ‘There's no official ‘Legionella certificate’ — the HSE doesn't recognise one. Here's my Legionella risk assessment and my monitoring records, which show the risk is assessed and controlled.’ That answer marks you out as someone who knows the subject.
Many times, as an engineer, I was asked, ‘Are you here to do the Legionella testing?’ — not because the person knew what testing was, but because it's the phrase that had lodged. And underneath it sits a genuine, understandable assumption: that Legionella compliance means sampling the water in a lab to find out whether it's contaminated, and then acting on the result.
It's a reactionary picture — test first, react to what you find — and it quietly assumes an expense that usually isn't needed. Lab sampling can be costly, and believing you must do it means believing you must carry that cost — when, for an ordinary water system, routine sampling usually isn't what the guidance asks for.
For most ordinary systems, control is TM: temperature and management. You keep hot water hot, cold water cold, and everything moving — and you check it with a thermometer. That's what keeps Legionella from taking hold. Sampling has its place, but it's directed by the risk assessment, not the default first step.
This is the HSE's own position, not ours. HSG274 Part 2 is explicit:
“Microbiological monitoring of domestic hot and cold water supplied from the mains is not usually required, unless the risk assessment or monitoring indicates there is a problem.”2
So the risk assessment comes first, and it's the risk assessment that decides whether sampling is warranted at all. Sometimes it is — Part 2 directs sampling where the assessment calls for it, or where the controls aren't being met, for example where disinfectant is low or temperatures have drifted out of the safe range.3 For many ordinary hot and/or cold water systems, keeping the temperatures right is what the guidance leans on rather than routine sampling. The point isn't that sampling never matters — it's that it follows the assessment, rather than being the thing compliance starts with.
This is the opposite mistake, and it's just as common. Here the risk assessment is treated as the whole job: get the document, file it, tick the box, finished. But the assessment is the start, not the end — and, on its own, it doesn't actually tell you what to do.
This surprises some, so it's worth being clear about what a risk assessment is. It identifies your water system, records what's in it, and gives it a risk profile — here's your building, here's where the risk sits, here's how serious it is. What it does not do is set out the day-to-day job of keeping the water safe. That's a separate document: the Written Scheme of Control.
The Written Scheme of Control is the one most duty holders have never heard of — yet where your assessment finds a risk to control, ACOP L8 says one should be prepared.4 It takes the assessment and turns it into a clear plan for controlling the risk, and who is responsible for it. It's the bridge between ‘here's your risk’ and ‘here's what's being done about it.’
And then there's the part that actually protects people — the regular monitoring the scheme sets out. Not one job on one date, but ongoing checks carried out over time, each logged as it's done. A thick report in a drawer protects no one; it just proves you knew the risk and did nothing. The living record of that monitoring is what keeps you compliant and what stands up if anyone ever asks.
The pattern behind all three myths is the same: a familiar word — ‘certificate’, ‘testing’, ‘assessment’ — gets grabbed and mistaken for the whole of compliance. The real shape isn't one thing at all: assess the risk, set out a scheme of control that says what to do, carry out the monitoring — and have the know-how to do it safely, keeping the record that proves it throughout.
Cutting through all three myths, real compliance comes down to a few connected parts:
No certificate. No lab bill you didn't need. Not a thick report in a drawer — but a running scheme that keeps the water safe and keeps you covered. That's the real job, and it's exactly the job EASYlegionella is built to do for you.
Your Risk Assessment, your Written Scheme of Control and your Training — all FREE. You pay only for the monitoring that keeps you covered. The professional documents, without the professional bill.
Join the launch listThis guide is general information, not legal advice, and does not certify compliance. Your legal duty as the responsible person cannot be transferred. Always refer to HSG274 Part 2 and ACOP L8 for the authoritative guidance.