Most people meet ACoP L8 as a document they are told to follow, file, and produce when an auditor asks. That misses what the “ACoP” part actually means. L8 is an Approved Code of Practice, and that single phrase decides how it bites in law, how much freedom you have to do things your own way, and what a court would make of your records if a case ever turned serious.

If you already know the day-to-day basics — keep hot water hot, cold water cold, water moving — the useful next step is understanding where L8 sits between the law above it and the technical guidance below it. Get that placement wrong and you can run a tidy monitoring regime that still leaves you exposed.

What “Approved Code of Practice” actually buys you

An ACoP is not the law itself, and it is not ordinary advice either. It sits in a specific middle position. Following the relevant provisions of L8 is normally accepted as doing enough to comply with the underlying health and safety law. You are not strictly compelled to follow it — but if you don’t, and you are later prosecuted, the burden shifts to you to show you controlled the risk in some other, equally effective way. Absent that, a court can find you at fault on the Code alone [1].

That is the part worth sitting with. The flexibility is real: L8 allows alternative approaches that achieve the same control. But the flexibility is conditional. “We did it differently” is only a defence if you can evidence that the different way worked as well. In practice, most duty holders are better off following the Code and documenting any justified deviation than improvising and hoping to defend it afterwards. Confirm the exact wording of this legal status against the current published Code before you rely on it [1].

L8 and HSG274 do different jobs

A frequent confusion is treating L8 and HSG274 as one body of rules. They are not. L8 is the Approved Code of Practice: the management framework and the duties, with the legal standing described above. HSG274 is technical guidance — the detailed “how”, covering different system types across its parts, from cooling towers and evaporative condensers through hot and cold water systems to other risk systems [2].

The practical consequence is sharp. HSG274 is where you find the temperatures, the inspection intervals, the cleaning methods. L8 is where you find what you must put in place around them. Lifting a temperature figure out of HSG274 and calling that “compliance” skips the management chain the Code actually requires. The number without the scheme proves nothing.

The management chain L8 expects

Strip L8 to its load-bearing parts and you get a chain that should run end to end on every site:

  • identify and assess the sources of risk;
  • appoint a competent person to take day-to-day responsibility;
  • prepare a written scheme of control;
  • implement, manage and monitor that scheme;
  • keep records, and retain them for a defined period;
  • review at the right intervals [1][3].

Two roles sit on that chain and are routinely muddled. The duty holder is the employer or person in control of the premises who carries the legal duty — that does not move. The responsible person is the competent individual appointed to manage the controls in practice. On a small site they may be the same person; on a large estate they are usually not. Either way, the duty holder stays accountable even when a responsible person, or an outside contractor, does the hands-on work [3].

Map the chain from law to outlet

Before you manage L8, draw it. Sketch a single vertical chain of boxes, top to bottom, and you can see at a glance whether your compliance is real or only described.

Top box: the law — the general duty to control risk to health. Below it: ACoP L8, the approved code that interprets that duty for Legionella. Below that: HSG274, the technical guidance feeding in methods and figures. Next: your site-specific risk assessment, ideally carried out to the BS 8580-1 code of practice [4]. Below that: your written scheme of control, naming the assets, the control limits, the tasks and who owns each. Below that: the monitoring and records the scheme generates. At the bottom: the review that loops back to the top whenever the system, its use, or the people exposed change.

Now overlay two labels. Draw “duty holder” as a band running down the whole chain — accountable at every level. Put “responsible person” against the scheme, monitoring and records boxes — the operating layer. Then add one side-branch off the L8 box marked “equally effective alternative”: the lawful deviation route, which only exists if it links back to evidence that control was genuinely achieved.

Any box you cannot fill in is a gap. A site with a strong risk assessment but a vague written scheme, or detailed readings but no review loop, has a broken chain. A broken chain is exactly what an investigation follows.

Where L8 compliance quietly fails

The failures are rarely dramatic. They are usually a missing link in that chain.

“We have an L8 risk assessment.” You don’t assess L8 — you assess the water system, against the expectations L8 sets out. The standard to reach for is BS 8580-1 [4]. A document titled after the Code but thin on the actual pipework, tanks and outlets is a common finding.

Outsourcing the work and assuming you outsourced the duty. Appointing a competent contractor is sensible and often necessary. It does not transfer the legal duty. You still have to be competent enough to specify, brief, question and check the work — and to recognise when an answer is wrong. The Legionella Control Association’s code of conduct is a reasonable benchmark for the providers you appoint [5].

The stale assessment. L8’s review trigger is not only the calendar. A change of use, a refurbishment, a new group of vulnerable occupants, a contractor switch — each is a prompt to revisit, and each is routinely missed.

Records that log tasks but not decisions. A temperature in a logbook proves a reading was taken. It does not prove anyone judged it acceptable or acted when it wasn’t. The scheme should capture the decision and the escalation, not just the figure. (L8 also expects these records to be retained for a defined period — commonly cited as at least two years for monitoring records, but confirm the current expectation before you set a retention rule [1].)

Treating a clean sample as a clean bill of health. Sampling supports verification or investigation; it does not replace control of temperature, stagnation and cleanliness, and HSE is clear that sampling frequency follows the system and the risk assessment rather than a fixed schedule [6].

What this Code can and can’t settle for you

L8 is written to be read alongside a competent, site-specific risk assessment, not in place of one. Nothing here interprets the Code for your particular premises: the published document, a competent assessor, and where it matters the HSE itself are the authorities on what your duties require. The legal status, the retention figure and the review triggers above are described cautiously on purpose — check each against the current Code before you act on it.

Common questions

Both, in a precise sense. You are not legally forced to follow L8 line by line, but it carries special legal status: in a prosecution, failing to follow its relevant provisions puts the onus on you to prove you achieved equivalent control another way, and a court can otherwise find against you [1]. Treat it as the default you deviate from only with evidence.

What is the difference between ACoP L8 and HSG274?

L8 is the Approved Code of Practice — the duties and management framework, with legal standing. HSG274 is the supporting technical guidance, holding the detailed methods and figures for different system types across its parts [2]. L8 tells you what to have in place; HSG274 helps you do it well.

If we use a water treatment contractor, are we still responsible under L8?

Yes. The duty holder keeps the legal duty regardless of who does the hands-on work. You can delegate tasks to a competent responsible person or an external provider, but you remain accountable for appointing, briefing and checking them — which means keeping enough in-house competence to tell good work from bad [3][5].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [5] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/ [6] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm