Sensors did not improve this organisation’s Legionella compliance. People did — but only after the sensors made it impossible to keep ignoring the same handful of gaps. That distinction is the whole point, and it is worth walking through how it played out before you decide whether the capital is worth it on your own estate.

What follows is a composite, built from how these rollouts usually go across UK property portfolios rather than any single named site. The figures are illustrative. The pattern behind them is not.

The site, and why monthly paper checks kept slipping

Picture a facilities team responsible for a dozen mixed buildings — a couple of offices, a depot, two leisure centres and a training centre. The Legionella risk assessment was sound: monthly sentinel temperature checks, calorifier flow and return readings, weekly flushing of low-use outlets, all logged. On paper, a clear written scheme of the kind L8 expects a duty holder to keep records against [1].

In practice the scheme leaked at the edges. One mobile engineer covered every site, so readings were often taken late, batched, or written up from memory at the end of a long day. A thermostatic mixing valve failing high, or a calorifier quietly running below its stored target, could sit unnoticed for the best part of a month — until the next scheduled visit. Holiday cover left whole weeks blank. None of this was negligence. It was the ordinary friction of doing periodic manual checks across a spread-out estate.

What finally forced a change

The push came from an audit. A routine review found the records could not actually demonstrate that control had been maintained between visits — present some months, thin or missing in others. That is precisely the position the duty holder duties are written to prevent: you remain accountable for showing control, not merely for intending it [3]. If that scenario sounds familiar, HSE improvement notices for Legionella explained covers what happens when an inspector reaches the same conclusion formally.

The team’s first instinct was to add another reminder and a second engineer. The better question was why the existing scheme kept producing patchy evidence in the first place.

How the rollout went

Treat this remote monitoring case study as illustrative rather than a verified incident. The team fitted fixed temperature sensors at representative sentinel outlets and on calorifier flow and return, logging continuously instead of once a month. They added digital task scheduling for flushing, with a named owner per site, and routed alerts to a responsible person whenever a logged reading sat outside the range the risk assessment had set — escalating to the contractor if an alert went unactioned for a defined period.

Three things surfaced within the first quarter that monthly spot checks had been missing:

  • A cold water tank in a roof plant room was drifting above its target through the summer, warming toward the band where Legionella multiplies — roughly 20 to 45 degrees C [5]. A monthly check on a cool morning had never caught it.
  • The hot return at the far wing of one leisure centre was arriving below target, a recirculation fault masked by spot readings that happened to be taken near the calorifier.
  • The holiday-week blanks disappeared. Continuous loggers do not take annual leave.

The biology of the system had not changed overnight. What changed was visibility and the speed of response. Compliance improved because the evidence improved — complete timestamps, exceptions flagged the same day, actions recorded and closed — which is exactly the monitoring and record-keeping that HSG274 and L8 are built around [2][1].

Where it nearly came undone

The first month was noisy. Poorly set thresholds, plus one sensor mounted where it read plant-room air rather than pipe-surface temperature, generated a flood of nuisance alerts. People started tuning out the dashboard — which would have left them worse off than the paper system, because now the false comfort came with a screen and a reassuring green tick.

Two corrections saved it. First, thresholds were reset to the figures in the risk assessment, the stray sensor was repositioned, and a calibration schedule was put in place so readings stayed trustworthy. Second, alerts were routed to one named person with the authority and the time to act, not broadcast to an inbox nobody owned. A dashboard without an owner is wallpaper.

What transfers to your site

Strip out the kit and the lessons are about management, not hardware.

  • Monitoring proves control only if every exception has an owner and a written escalation path. The sensor is the cheap part; the response process is the control.
  • Place and calibrate sensors where the risk assessment cares — sentinel outlets, calorifier flow and return — not where the cabling is easiest. Schedule calibration; drifting sensors quietly erode the trust the whole system depends on.
  • Continuous data does not retire physical inspection, cleaning, or sampling where the assessment calls for it. Sampling frequency in particular follows the system and the risk assessment, not the presence of a dashboard [4].
  • Record the reasoning, not just the reading. “This outlet is flushed weekly because use is intermittent; a missed flush escalates within 48 hours” is worth more at audit than a bare column of numbers.

If you already run a building management system, the integration question is a decision of its own — Integrating Legionella control with Building Management Systems goes into where that helps and where it adds complexity.

Before you sign anything

Start small and prove the response loop, not the technology. Pick one building with a known weak spot — a low-use wing, a calorifier you do not fully trust — and instrument that first. Define who receives an alert, what they must do, and within what window, before a single sensor goes up. If you cannot describe that chain on one page, more sensors will only generate more unowned data.

A word on limits. A green dashboard is a record of temperatures at the points you chose to sense, and nothing more. It does not vouch for every outlet, tank or dead leg, and it is not a substitute for a competent, site-specific risk assessment. Treat sensor thresholds, monitoring frequency and remedial triggers as outputs of that assessment and a named responsible person, not as whatever the vendor shipped as default. Nothing here is legal or engineering advice for your particular building.

FAQ

Will remote monitoring let us cut down on site visits?

Sometimes — but that is the wrong reason to buy it. Continuous logging can reduce routine reading visits, yet the physical tasks (flushing, cleaning, descaling, inspecting tanks) still need someone on site. Treat any saved visits as a bonus, not the business case.

Can continuous sensor data replace Legionella sampling?

No. Temperature logging and sampling answer different questions, and sampling frequency follows the system and the risk assessment rather than the presence of a monitoring platform [4]. A run of in-range temperatures is supporting evidence, not a clean bill of health for the whole system.

Who is accountable if a sensor misses a problem?

The duty holder and responsible person, as before. Automating the measurement does not transfer the duty; you stay responsible for the control scheme, for the competence behind it, and for acting on what the data shows [3].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems — Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease — what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [5] HSE, “Hot and cold water systems”. https://www.hse.gov.uk/legionnaires/hot-and-cold.htm