Legionella and Workplace Water Hygiene: The 2026 UK Compliance Guide

Legionella is a bacterial infection that causes Legionnaires' disease, a form of pneumonia with a fatality rate of around 10% among diagnosed cases. It thrives in stagnant water between 20°C and 45°C, and is transmitted when contaminated water is inhaled as aerosol. Office water coolers, hot and cold taps, air conditioning cooling towers, spa pools, shower heads and evaporative condensers all present some level of risk. Most of these risks are manageable, but they are not zero, and UK employers have legal obligations to manage them.

This piece walks through the practical version of what UK employers actually need to do for their workplace water hygiene in 2026, focused on office water coolers and drinking water systems. For the broader workplace drinking water regulatory picture (temperature, quality, accessibility), see our UK workplace drinking water regulations guide.

Three pieces of law and guidance underpin UK workplace Legionella obligations. You do not need to memorise them, but you should know they exist and roughly what each does.

The practical takeaway: every UK workplace with a water system needs to identify a duty holder, produce a written Legionella risk assessment, put a written scheme of control in place, and keep records of implementation. The proportionality of the response scales with the actual risk level of the system — an office with two water coolers has a much lower burden than a hospital with cooling towers, but the underlying framework is the same.

HSE guidance treats water coolers as low-risk in the workplace water system hierarchy. Bottled water coolers using sealed, single-source bottles present the lowest risk of the range because the water is not held stagnant in a large system. Mains-fed coolers present slightly more risk because they contain small internal reservoirs and are connected to the building water supply. Both are still low-risk compared to systems like showers, cooling towers, spa pools or complex multi-outlet hot water systems.

Low-risk does not mean no-risk. The specific Legionella-relevant features of a water cooler are:

• Water held between 20°C and 45°C — the risk temperature range. Chilled water dispensed at 5-10°C is below the growth range, but ambient water sitting in an internal reservoir can drift into it.
• Aerosol generation — dispensing water creates a small amount of aerosol, particularly on button-operated coolers. This is the transmission mechanism.
• Stagnation risk — if a cooler is not used for a period (a holiday shutdown, an office that has moved), the water sits and can support bacterial growth.
• Biofilm buildup — over time, the internal surfaces of any water system develop biofilm, which harbours bacteria. This is why sanitisation matters.

The corresponding controls are: scheduled sanitisation (six-monthly), regular filter changes (six-monthly), keeping the cooler in use rather than dormant, running through a stagnation flush after any extended shutdown, and keeping the dispensing area clean.

For most UK offices, the practical route to Legionella compliance on drinking water dispensers is to have a supplier contract that includes the scheduled sanitisation, filter changes and record-keeping as standard. A well-run contract provides:

• Six-monthly scheduled sanitisation of the cooler internal reservoir and dispensing surfaces, using an appropriate sanitising agent.
• Six-monthly filter change on mains-fed units, including scale-reduction cartridge where fitted.
• Sanitisation certificate issued for every service visit, dated and signed by the engineer.
• Filter change log with cartridge specification and date.
• Written breakdown history for the year, kept as part of the customer's compliance record.
• Advice on stagnation flush after any office shutdown of two weeks or more (Easter, summer, Christmas closedowns).

All of the above should be on the supplier contract without a per-callout charge. If a supplier is quoting sanitisation as an extra cost on top of monthly rental, they are effectively asking you to pay separately for something that should be bundled. Ask upfront and get it in writing.

The written Legionella risk assessment required by ACOP L8 does not have to be an enormous document for a low-risk office environment. For a typical UK office with mains water, hot and cold taps, water coolers and no complex water systems, a proportionate assessment covers:

1. Identification of the duty holder — the employer, or a named individual within the business who owns the risk (typically facilities lead or office manager).
2. Inventory of water systems on the premises — taps, showers, water coolers, dishwashers, boiling water taps, boilers, ice machines. For most offices this is a short list.
3. Assessment of the risk of each system — for typical office plumbing and water coolers, low-risk with standard controls in place.
4. Scheme of control — the specific actions taken to control each risk, and the frequency (e.g. "six-monthly sanitisation and filter change on all water coolers, per supplier contract").
5. Named responsibility — who owns each action, who provides it (supplier or internal), and who verifies it has been done.
6. Review interval — usually every two years for a low-risk site, or sooner if the water system materially changes (new fit-out, added kit, building extension).

Larger sites, sites with more complex water systems (hot water tanks, cooling towers, showers), and higher-risk environments (care homes, hospitals, sports centres) need a more comprehensive assessment, typically produced by a specialist Legionella risk assessor. For a straightforward office environment, a competent facilities lead can produce it with reference to HSG274 Part 2.

The specifics scale with the office. A five-person office does not need a monthly cleaning contractor for their dispensing area. A 200-person office might sanitise every four months rather than six. The point is that there is a written scheme, with named owners and defined frequencies.

Compliance in an HSE inspection or an insurance claim is proven with documentation. The physical work matters, but the records are what get looked at. For a typical office with water coolers, the file should contain:

• Legionella risk assessment — signed and dated, with review date recorded.
• Written scheme of control — the table above or equivalent.
• Sanitisation certificates for each water cooler, from every scheduled service visit, going back at least two years.
• Filter change log with dates and cartridge specifications.
• Breakdown history — every callout, what was found, what was done.
• Supplier contract with service scope clearly identified.
• Post-shutdown flush records where any 2-week-plus shutdown has occurred.

A well-run supplier maintains most of this on their side and can provide it on request. Some suppliers now offer a customer portal where all documentation is accessible in one place — this is worth asking about, particularly for multi-site portfolios (see our multi-site guide).

Routine HSE inspections of ordinary office premises are uncommon. HSE prioritises higher-risk environments and reactive investigation of incidents. But an inspection can happen, and inspections do happen more frequently after any water-borne illness incident, at building change of use, and at some insurance renewals.

An inspector for a low-risk office environment will typically want to see: the risk assessment, the scheme of control, and two years' worth of sanitisation certificates and service records for water systems. If these exist, are current and are consistent with each other, the inspection is usually short and no enforcement action follows. If they do not exist or are materially inadequate, enforcement escalates from advice to an improvement notice, then to a prohibition notice, and in the worst case to prosecution — the last of which is rare for low-risk premises but real for repeat breach or incident.

Every Aquathirst customer contract includes six-monthly sanitisation, six-monthly filter changes, sanitisation certificates and filter change logs as standard, with no per-callout charge. For multi-site customers we maintain the consolidated documentation pack across all sites. We can also support customers with the Legionella risk assessment itself for straightforward office environments, or refer to a specialist assessor for higher-risk sites.

If you are reviewing your current arrangements or you have inherited a water cooler contract and are not sure whether it covers what it should, book a compliance review. Fifteen minutes on site, and we will tell you honestly what is in place, what is missing, and what a compliant setup for your office actually looks like. No obligation to switch suppliers if what you have is working.