---
title: "How long is a Legionella risk assessment valid for? Review triggers and the 'two-year' myth"
source_url: https://legionella.io/articles/how-long-is-a-legionella-risk-assessment-valid-for-review-triggers-and-the-two-year-myth/
canonical_url: https://legionella.io/articles/how-long-is-a-legionella-risk-assessment-valid-for-review-triggers-and-the-two-year-myth/
pillar: "Legionella Risk Assessment"
summary: "No fixed expiry date exists for a Legionella risk assessment. Learn the real review triggers that force a re-assessment and why the 'every two years' rule is a myth."
primary_keyword: "how long is a Legionella risk assessment valid"
date_published: 2026-02-03
date_reviewed: 2026-06-26
author: "Legionella.io editorial team (REMOTE TECH LTD)"
reviewed_against: "HSE L8 and HSG274 guidance"
region: "United Kingdom"
license: "(c) REMOTE TECH LTD. Quote freely with attribution and a link to source_url."
---

# How long is a Legionella risk assessment valid for? Review triggers and the 'two-year' myth

A Legionella risk assessment has no statutory expiry date. It does not "run out" on a fixed anniversary. It stays valid until something about your water system, its use, or the people exposed to it changes enough that the assessment no longer reflects reality. At that point it must be reviewed, regardless of how recently it was done.

So the honest answer to "how long is it valid for" is: as long as it remains an accurate picture of the risk. That could be three years. It could be three weeks if you refit a plant room. The clock is driven by change, not by the calendar.

The "every two years" rule that gets quoted on quotes and reminder emails is a scheduling convention, not a legal limit. Useful as a backstop. Wrong if you treat it as the only trigger.

## The short answer, before the detail

UK guidance under the ACoP L8 expects the responsible person to review the assessment regularly and whenever there is reason to suspect it is no longer valid [1]. "Regularly" is deliberately not pinned to a single number, because a low-risk office and a healthcare site carry very different review needs. Your assessment should state its own review interval, and that interval is a judgement made by a competent person about your specific system.

The pragmatic call: set a periodic review date so nothing drifts, and treat that date as a floor, not a finish line. The triggers below override it.

## Myth versus reality

The two-year figure has stuck because it is a tidy round number that fits a service contract. Here is where it holds and where it misleads.

| The myth | The reality |
| --- | --- |
| "It expires after two years." | There is no fixed expiry. It is valid until change or doubt makes it inaccurate [1]. |
| "Two years is the legal maximum." | No interval is set in law. The assessment sets its own review frequency via competent judgement [1]. |
| "If nothing changed, I can ignore it." | A periodic review still confirms nothing changed and that controls still work [2]. |
| "A new assessment every two years ticks the box." | Reviewing on a fixed cycle while missing a refurbishment or occupancy change leaves you exposed [2]. |
| "Two years applies to every building the same way." | A care home, gym or vacant unit each warrant their own interval based on risk [1]. |

The myth persists because it is easy to administer and easy to sell. A diary reminder is simpler than asking, every quarter, whether the system has actually changed. The fix is to keep both: a scheduled review and a live list of triggers.

## The review triggers that actually matter

These are the events that should force a re-assessment well inside any review cycle. HSG274 frames review around changes to the system, its use, or its occupancy [2].

### Does changing the water system itself trigger a review?

Yes. New calorifiers, a replaced cold water storage tank, added or capped pipework, a different TMV arrangement, or a switch from mains-fed to stored water all change the risk picture. Any physical alteration that creates a dead leg, changes flow, or adds a new outlet should prompt a review [2].

### What about a change of building use or occupancy?

A change in use or occupancy is one of the clearest triggers. Converting offices to a gym with showers, taking on vulnerable occupants, a building left empty for a period, or a sharp rise or fall in how much water is drawn all alter exposure and stagnation risk [2]. Reduced occupancy matters as much as increased occupancy, because low use means low turnover.

### Do failed temperatures or monitoring results trigger a review?

They should. If your monitoring shows hot water persistently below the expected delivery temperature, cold water creeping up, or repeated failures at the same outlets, that is reason to suspect the assessment and its control scheme no longer hold [3]. As a general expectation the temperatures your scheme targets are set by your risk assessment and the relevant guidance; persistent deviation is a prompt to reassess, not just to re-flush.

### Does a case of Legionnaires' disease force a re-assessment?

A suspected or confirmed case linked to the premises is an immediate trigger. So is any incident that casts doubt on control, such as a positive Legionella sample above your action level. In those situations you review without waiting for the next scheduled date [1].

### What if the responsible person or contractor changes?

A change of duty holder, responsible person, or water hygiene contractor is a sensible point to review. New people inherit assumptions they did not make. A review confirms the asset register, the schematic and the control measures still match the building as it stands today [1].

## How often should the periodic review be, then?

Set the interval in the assessment itself. For many lower-risk premises a review every couple of years is a reasonable backstop, but higher-risk or more complex systems are commonly reviewed more often, and your competent person decides based on the system [1]. BS 8580-1 gives a structured basis for choosing that frequency and for deciding when a full re-assessment, rather than a lighter review, is warranted [4].

The distinction is worth holding onto. A review checks whether the existing assessment is still valid. A re-assessment rebuilds it. A trigger event often pushes you from one to the other.

### Is a review the same as a full new risk assessment?

No. A review can conclude that nothing material has changed and the assessment stands, with that conclusion recorded and dated. A re-assessment is a fresh survey of the whole system. You escalate from review to re-assessment when a trigger shows the original premises no longer hold [4].

### What should I keep as evidence between assessments?

Keep the dated review record, your temperature and monitoring logs, remedial actions and their close-out, and an up-to-date schematic and asset register. This is the running evidence that the assessment is still live and acted upon, not a document filed and forgotten [2]. An auditor reads the gap between assessments through these records.

## A note on applying this

This is general guidance, not a determination for your site. The valid review interval, the triggers that matter most, and whether an event needs a review or a full re-assessment are all decisions for a competent person who knows your building and its water system. Use this to ask better questions, not to set your own legal threshold.

## What to do today

Open your current assessment and find two things: its stated review date, and whether it lists the triggers that would override that date. If it has a date but no triggers, that is the gap to close.

Then build a living trigger list against your actual building, owned by the responsible person, sitting next to the scheduled review. Paper diaries and a single spreadsheet cell make this fragile, because the reminder fires but the context does not. Holding the review date, the trigger events, the monitoring results and the dated review record together in a digital logbook such as L8log means the next change to your system prompts the reassessment instead of slipping past a fixed two-year tickbox.

## Related reading

- [When to conduct a Legionella risk assessment: frequency and triggers](https://legionella.io/articles/when-to-conduct-a-legionella-risk-assessment-frequency-and-triggers/)
- [Reviewing and updating your Legionella risk assessment regularly](https://legionella.io/articles/reviewing-and-updating-your-legionella-risk-assessment-regularly/)
- [When to review your Legionella risk assessment under UK guidance](https://legionella.io/articles/when-to-review-your-legionella-risk-assessment-under-uk-guidance/)

## Sources

[1] HSE, "Legionnaires' disease. The control of legionella bacteria in water systems - ACoP and guidance (L8)". https://www.hse.gov.uk/pubns/books/l8.htm
[2] HSE, "Legionnaires' disease: Technical guidance (HSG274)". https://www.hse.gov.uk/pubns/books/hsg274.htm
[3] HSE, "Hot and cold water systems". https://www.hse.gov.uk/legionnaires/hot-and-cold.htm
[4] BSI, "BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice". https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1