The cheapest Legionella control you will ever fit costs nothing and goes in before a single pipe is laid: a sensible call about where the cold water tank sits, how short the runs are, and which outlets actually need to exist. Get those right on the drawing and the building spends the next thirty years easier to flush, easier to keep hot where it should be hot and cold where it should be cold, and easier to prove under control. Get them wrong and operational diligence never fully buys it back.

That is the case for assessing Legionella risk while a building is still a set of drawings, and it runs straight into a wall of comfortable assumptions. A design-stage assessment looks at the proposed water system, asks where the bacteria would find warmth and stillness once it is built, and feeds those answers back before anything is fixed in concrete. It does not replace the operational risk assessment the duty holder will run once water is flowing and people are in the building [1]. It makes that later job winnable.

Most of the resistance comes from a handful of myths. They are worth naming, because each one quietly pushes risk downstream to the point where it is most expensive to fix.

Myth: Legionella is an operational problem, deal with it after handover

By handover, the decisions that matter most are already cast. The route of the pipework, the location and volume of cold storage, the way hot water is generated and circulated, the materials in contact with water, the sheer number of outlets — all settled, most of them physically. Operational control then spends years compensating for whatever the design baked in.

The whole logic of UK guidance is to control temperature and stagnation: keep hot water hot, cold water cold, and water moving [2]. Every one of those is shaped first by layout. A far outlet at the end of a long, poorly insulated run will struggle to deliver hot water hot, no matter how diligently someone logs the temperatures. Design stage is the one window where you can simply not build the problem.

Myth: A brand-new system is clean, so it starts low-risk

New is not the same as flushed-and-in-use. The window between pressure-testing a system and the building filling up with people is one of the higher-risk periods a water system ever sees. Pipework gets charged with water for commissioning, then sits static for weeks or months while the fit-out finishes. Floors come into use one at a time. Show flats and marketing suites draw water; the rest of the block does not.

Stagnant water warming gently toward room temperature is exactly the condition Legionella likes, and a system that has never been properly used does not self-flush the way an occupied one does [3]. A design-stage assessment should treat the construction-to-occupation gap as a foreseeable hazard and plan for it — who keeps the system moving, how, and from when — rather than assume a shiny new install looks after itself (see Commissioning new water systems: preventing Legionella from day one on commissioning, which picks up exactly where this leaves off).

Myth: If every component meets the standard, the system is safe

Compliant parts, badly arranged, still produce dead legs and tepid zones. An approved tap on the end of a six-metre spur to a cleaner’s sink used twice a year is a dead leg, whatever the tap’s pedigree. A cold run that shares a long, warm route with the hot flow warms up regardless of each pipe’s individual approval.

A design-stage assessment looks at the system as a whole — turnover, balance, the relationship between hot and cold runs, how each outlet will actually be used — not at a parts list. That whole-system view is the entire point of doing it on the drawing, where rerouting a branch is a redline rather than a chase cut into a finished wall.

Myth: Bigger storage is safer storage

It feels prudent to oversize the cold water tank and the calorifier so the building never runs short. For Legionella it usually works the other way. Oversized storage means water sits longer before it is drawn off, drifting up in temperature and stratifying while it waits. Storage matched to genuine demand and turnover keeps water fresher and colder than a generous safety margin does. As a general design principle, size to realistic demand rather than to a comfort buffer — and confirm the actual figures for the specific building through the project’s competent designers and the risk assessment.

Myth: The risk assessment is the operator’s job once they move in

The operational risk assessment does belong to the duty holder, after occupation. But a design-stage assessment is what hands that duty holder a building they can actually control, and it forces the question of who that duty holder is early enough to matter. Designing safety in, rather than inspecting it in afterwards, is the principle behind treating water as a managed system from the first drawings [4]. The two assessments are a relay, not a duplication: the design-stage work shapes the system and records why; the operational work then runs it.

Why these myths are so sticky

Mostly because design and operation are different people, with different budgets and different timelines. The engineer sizing the pipework rarely flushes it later; the facilities manager flushing it never chose the route. Legionella also reads as a water-treatment problem rather than an engineering one, so it slides off the design agenda. And before anyone has moved in, the risk is invisible — there is no warm, still water yet, so it is easy to believe there is no hazard. The cost of that belief simply lands later, on someone else.

Designing the risk out before the drawings freeze

Treat the design-stage assessment as a set of pointed questions about the proposed system, each one answered in writing:

  • Storage — is cold storage sited away from heat sources and sized to real turnover, not a comfort margin? Is hot water generation and storage arranged to reach and hold the temperatures control depends on?
  • Distribution — are runs as short as the layout allows, branches minimised, and no dead legs “left capped for a future phase”?
  • Outlets — does every specified outlet earn its place? The cheapest low-use shower to manage is the one that was never installed.
  • Materials and access — are wetted materials suitable, and can tanks, valves and sentinel points actually be reached for inspection, cleaning and sampling once the ceilings are in?
  • The dormant period — is there a written plan for keeping the system safe between commissioning and full occupation?

Record the reasoning, not just the decision. “Cold storage relocated from the south-facing plant room to the cooler core to limit warming” is the kind of note that survives a design change and tells the future duty holder why the building is shaped the way it is. A schematic and an early asset register make that handover real rather than notional.

One caveat worth keeping in view: a design-stage assessment is informed judgement about a building that does not yet exist. It is not engineering sign-off, and it does not replace the operational risk assessment once the system is filled and in use. Pipe sizing, material selection and the temperatures a real system can actually hold must be settled by the project’s competent designers and confirmed on the commissioned building, not assumed from a drawing.

Your next move

If you are anywhere near a live project, ask for the current water services schematic and walk it before the design is frozen — pen in hand, tracing every run to every outlet and asking, at each one, “how does this stay moving, and how does it stay at the right temperature?” The branches with no good answer are your design-stage actions. Capture them while changing them is still a line on a drawing, not a wall to open up.

FAQ

When in a project should a design-stage Legionella risk assessment happen?

As soon as the design is detailed enough to show cold storage, hot water generation, distribution routes and outlets, then revisited whenever the design changes materially, with a final check before it is frozen for construction. The earlier the input, the cheaper the change.

Does it replace the operational risk assessment once the building opens?

No. They do different jobs. The design-stage assessment shapes the system and records the why; the operational risk assessment, owned by the duty holder, manages the filled and occupied building through monitoring, records and review [1]. A good design-stage assessment should make the operational one easier, not redundant.

Who is responsible, the designer or the client?

Both, in different ways. The client commissioning the building is the prospective duty holder and should require Legionella to be considered in the design; the designers act on that brief. Commissioning the work out to a consultant or contractor does not transfer the duty itself [5].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems — Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [4] BSI, “BS 8680:2020 — Water quality. Water safety plans. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-water-safety-plans-code-of-practice [5] HSE, “Legionnaires’ disease — what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm