What Is ACOP L8? The Legionella Code of Practice Explained

TL;DR: The short answer to what is ACOP L8 is this: it is the HSE Approved Code of Practice on controlling Legionella bacteria in water systems, currently in its fourth edition. It is not law in itself, but it carries a special legal status. If you are prosecuted and it is proved you did not follow a relevant provision, that matter is taken as proved unless you satisfy the court you complied some other way. The Code tells a duty holder to assess the risk, appoint a competent responsible person, write a scheme of control, monitor it, and keep records proving it happened.

Last updated: 20 July 2026

Key takeaways

• The short answer to what is ACOP L8: the HSE Approved Code of Practice on the control of Legionella bacteria in water systems, fourth edition, 2013.
• An Approved Code of Practice is not law, but section 17 of the Health and Safety at Work etc. Act 1974 gives it special status in criminal proceedings.
• The duty holder is the employer, the self-employed person, or the person in control of the premises, and cannot delegate that duty to a contractor.
• The Code sets five duties: assess, appoint, write a scheme of control, monitor, and record.
• Monitoring records must be kept at least five years; other records for the current period plus two years.

What is ACOP L8?

ACOP L8 is the HSE Approved Code of Practice and guidance titled Legionnaires’ disease: The control of legionella bacteria in water systems. The current version is the fourth edition, published in 2013. It gives duty holders practical advice on complying with the Health and Safety at Work etc. Act 1974 and the COSHH Regulations where Legionella is concerned, and downloads free from the HSE publication page.

One detail catches most people out when they first ask what is ACOP L8: the document holds two kinds of text carrying different legal weights. The bold passages are the ACOP text proper. The normal-type passages are guidance, and following guidance is not compulsory. Only the bold text carries the special status below.

The fourth edition also raised several topics to full ACOP status: risk assessment, the appointed competent person known as the responsible person, the control scheme, and review of control measures.

Why what is ACOP L8 is a legal question, not just a technical one

An Approved Code of Practice is approved by the HSE Board with the consent of the Secretary of State, and sits in a legal category of its own. It is not law, so you cannot be prosecuted for breaching the Code as such. What it changes is what a court assumes when examining whether you complied with the law you can be prosecuted under.

Follow the advice and you are doing enough to comply on the matters the Code covers, and you may use alternative methods. But if you are prosecuted and it is proved you did not follow the relevant provisions, you must show you complied some other way or the court will find you at fault. That is statute, not marketing language.

Section 17 of the Health and Safety at Work etc. Act 1974 provides that where a failure to observe a relevant provision of an approved code is proved, that matter shall be taken as proved unless the court is satisfied the requirement was complied with otherwise than by observing the code.

For an estates team the consequence is a shift in who proves what. Follow the Code and the evidential work is done for you. Depart from it, even for a sound engineering reason, and you must argue your alternative achieved equivalent control. That argument is only as good as the records behind it.

Duty holder and responsible person

The duty holder is the employer whose undertaking creates a risk to employees or others, the self-employed person in the same position, or the person in control of premises or systems in connection with work. A landlord retaining responsibility for a let building is a duty holder, as is a trust running a hospital estate.

The responsible person is different, and confusing the two is the commonest mistake in Legionella management. The Code says the duty holder should appoint a competent person to take day-to-day responsibility for controlling the risk, with sufficient authority, competence and knowledge of the installation to make sure procedures happen on time.

Appointing a contractor does not move the duty. The duty holder stays legally responsible and must make reasonable enquiries that everyone working under the written scheme is competent, trained and equipped. Our page on Legionella compliance monitoring covers how that split works across a multi-site estate.

What does ACOP L8 require you to do?

Asked operationally rather than legally, what is ACOP L8 requiring day to day? It sets five duties that run in sequence and then loop. Assess the risk from every water system on the premises. Appoint a competent responsible person. Prepare a written scheme for preventing or controlling the risk. Implement, manage and monitor its precautions. Keep records demonstrating the cycle happened.

The HSE summarises the same duties on its what you must do page. Assessment starts by checking whether conditions encourage the bacteria to multiply, which for most buildings means whether water sits between 20°C and 45°C, whether there is a means of creating breathable droplets, and whether susceptible people could be exposed.

The risk assessment and the written scheme

The Code requires a suitable and sufficient assessment identifying potential sources of risk and setting out the means of preventing exposure or, where prevention is not reasonably practicable, of controlling it. It must consider the system as a whole, not one asset in isolation. Where it shows no reasonably foreseeable risk, no further measures are needed, but the assessment is a living document, reviewed whenever there is reason to suspect it is no longer valid.

The written scheme is the operating manual for controlling that risk. The Code is specific about its contents: an up-to-date plan of the layout including parts temporarily out of use, a description of correct and safe operation, the precautions, the checks and their frequency, and the remedial action if it proves ineffective. It should also cover the treatment programme and the control parameters with their allowable tolerances, measurement methods, sampling locations and test frequencies.

Note that phrase, allowable tolerances. A scheme stating that hot water shall be stored at 60°C without defining what counts as a deviation, how you would know, and what you would do about it is not complete. Teams working out what is ACOP L8 asking of them usually find the gap sits here rather than in the engineering. Our Legionella monitoring requirements page covers the same duties from the monitoring side.

Monitoring and record-keeping duties

For precautions to remain effective the system must be monitored, overseen by the appointed responsible person. The Code names three strands: checking the performance and operation of the system and its components, inspecting accessible parts for damage and contamination, and monitoring to confirm the regime still controls to the required standard. Frequency depends on the system, so the Code sets the obligation and leaves the schedule to your assessment.

Records are where the Code becomes unforgiving. They should cover the appointed responsible person, the significant findings of the assessment, the written scheme and its implementation, whether the system is in use, and the results of any monitoring inspection, test or check with the dates. Two retention clocks then run. Records should be retained throughout the period they are current and for at least two years afterwards, and records of any monitoring inspection, test or check should be kept for at least five years.

This is where the paper regime and the physical regime diverge. A monthly manual round produces twelve readings per point per year and says nothing about the roughly 43,000 minutes between each pair. If a calorifier drifts or a rarely used wing sits stagnant for three weeks, a fully compliant logbook can be silent about it.

How ACOP L8 relates to HSG274

ACOP L8 tells you what to achieve. HSG274 tells you how. When the fourth edition removed the Code’s technical Part 2, that material became standalone HSE guidance in three parts: evaporative cooling systems, hot and cold water systems, and other risk systems. The second edition was published in March 2024, with Part 1 reviewed and updated.

The distinction matters legally, because the answer to what is ACOP L8 versus what is HSG274 turns on status: HSG274 is guidance rather than ACOP text and does not carry the section 17 evidential effect. It matters practically because Part 2 holds the temperatures, sentinel outlet logic and inspection frequencies. Most buildings are governed day to day by Part 2, with ACOP L8 as the legal spine holding it up. For the operational detail, start at our ACOP L8 monitoring page.

What does enforcement look like?

Health and safety law covering Legionella is enforced by the HSE and, in premises such as offices and hospitality, by local authority environmental health teams. In general terms an inspector finding a shortfall can require improvements within a set period, can stop an activity immediately where there is a risk of serious personal injury, and in the most serious cases the matter can be prosecuted.

What an inspector reads first is the paperwork: the risk assessment, the written scheme, the appointment of the responsible person, and the monitoring record. A control measure you cannot evidence is, in practice, a control measure you did not have. Knowing what is ACOP L8 requires is half the job. Showing it happened is the half that decides how an investigation ends.

The full AQUAIOT ACOP L8 monitoring capability stack

Sensing at the points your scheme already names

AQUAIOT Legionella monitoring places wireless temperature sensors at cold water storage tanks, calorifier flow and return, circulating loops, TMVs and sentinel outlets. They are retrofit-friendly and need no pipe cutting, so an occupied building keeps running.

Telemetry and threshold logic

Readings travel over encrypted cellular or LoRaWAN telemetry to the AQUAIOT Cloud, where each point is checked against the control parameters and allowable tolerances in your own scheme. When a reading drifts into the risk window, or a flush is missed, alerts go out by SMS, email and app with role-based routing and escalation.

Audit-ready records and integration

The record becomes timestamped, tamper-evident and exportable on demand, which is the shape the retention rules expect. Data feeds BMS, CAFM and AIMS platforms over RS485/Modbus or an API. More on our automated Legionella monitoring hub.

Wider water quality where the scheme calls for it

Where a scheme relies on chemical treatment rather than temperature alone, the same telemetry layer carries the iSPA-T multi-parameter water quality monitoring system, putting chlorine, pH, conductivity and turbidity on the same dashboard as the temperature trace.

Frequently asked questions

What is ACOP L8 in simple terms?

ACOP L8 is the HSE Approved Code of Practice on controlling Legionella bacteria in water systems, currently the fourth edition published in 2013. It explains how duty holders comply with the Health and Safety at Work etc. Act 1974 and COSHH: assess the risk, appoint a competent responsible person, write a scheme of control, monitor it and keep records.

Is ACOP L8 a legal requirement?

Not directly. ACOP L8 is not law and you cannot be prosecuted for breaching the Code itself. It carries special legal status under section 17 of the Health and Safety at Work etc. Act 1974: if it is proved you did not follow a relevant provision, that matter is taken as proved unless you satisfy the court you complied another way. The underlying duties under the Act and COSHH are law.

What is the difference between ACOP L8 and HSG274?

ACOP L8 sets out what a duty holder must achieve. HSG274 is separate HSE technical guidance, in three parts, covering cooling systems, hot and cold water systems and other risk systems. It is guidance rather than ACOP text, so it does not carry the same evidential status, but it holds most of the practical detail.

Does continuous monitoring make us ACOP L8 compliant?

No, and any supplier claiming otherwise is overselling. Continuous monitoring evidences the control measures in your written scheme and alerts you when they drift, which strengthens two of the five duties. Compliance still requires a valid risk assessment, a written scheme, a competent responsible person, and acting on the data. The duty holder retains legal responsibility.

Talk to an engineer about your scheme

Once you have settled what is ACOP L8 requiring of your estate, the useful conversation is specific: which assets your scheme names, where the record has gaps between manual rounds, and what continuous monitoring would cover. Speak to an expert and we will scope it against the scheme you already have.