An airport is not a building. It is a small town that happens to share one water supply, split across a dozen organisations who each hold a slice of the same connected system. The terminal operator owns the incoming main and the storage tanks. An airline owns the lounge with the showers. A coffee franchise owns the unit with its own water heater and a mop sink nobody has filled in months. A hotel trades on the same site under separate management. Legionella does not read the lease plan.

If you run estates or water safety at a hub, the controls themselves are familiar: keep hot water hot, cold water cold, water moving, fittings clean, and prove it on paper. What changes is the scale, the fragmentation of who is responsible, and a handful of assets most buildings never have to think about — rooftop cooling towers, crew showers that run hard for one shift then sit cold for a week, a pier mothballed in a downturn and quietly brought back without anyone flushing it first.

Where the single-building model breaks

On a normal site you can point to one duty holder and one responsible person. At an airport that chain fragments the moment a tenant fits out a unit. The concession connects to the landlord’s supply, then installs its own pipework, water heater, drinks machine and back-of-house taps — branches the landlord’s risk assessment may never have seen. Demised space and retained space meet at a stop valve, and the water hygiene responsibility is supposed to meet there too. Often it doesn’t.

So the first piece of real work, before any thermometer comes out, is a written map of who is the duty holder and who is the responsible person for each part of the system. Handing the flushing or the sampling to a contractor does not move that accountability; it stays with whoever holds the duty for each demise [1]. Where two organisations each assume the other is handling an outlet, that outlet is handled by no one.

The assets that lift a hub above the average office

A terminal gathers almost every recognised higher-risk feature into one footprint. The ones worth naming individually:

Cooling towers and evaporative condensers. Large terminals reject heat from their air conditioning through wet cooling plant, and that plant sits among the highest-risk systems for Legionella because it produces drift — a fine aerosol that can carry well beyond the roofline [2]. These devices also bring a separate legal duty: wet cooling towers and evaporative condensers must be notified to the local authority, and they run under their own control and cleaning expectations rather than the general hot-and-cold regime [3].

Showers, in more places than you would expect. Premium lounges, spa concessions, crew rest areas and staff changing rooms all run showers that aerosol straight into someone’s breathing zone — and many are used heavily for a few hours, then not at all.

Water features and platform cooling. A decorative fountain in the concourse, or a misting system cooling a crowded rail platform in summer, is an aerosol generator that rarely reaches the water-system schematic, because nobody files it as “the water system”.

Drinking fountains and bottle-refill points. Low aerosol, but the quiet ones in far corners past security stagnate like any other lightly used outlet.

Map the system before you manage it

Before the controls, draw the picture. Put three layers on one sheet and you will see the problem before you touch it.

The supply spine first: incoming main, into the cold water storage tanks, through boosted distribution, out to the hot water plant — the calorifiers or water heaters — with the cooling-tower circuit drawn as its own branch off to one side, because it behaves nothing like the rest.

The zones next, each a box hanging off the spine: landside concourse washrooms, airside piers and gate areas, lounges and crew facilities, back-of-house offices and plant rooms, and every tenant concession.

Then two overlays in two colours. One marks every aerosol-generating or high-risk asset — cooling towers, showers, water features, spray taps. The other marks every ownership boundary, the points where the system passes from the operator to an airline, a retailer or the hotel.

Now run the test. Pick any high-risk asset and trace it back along the spine, naming out loud the responsible person for each length of pipe it touches. If you hit a stretch you cannot name, that asset is uncontrolled, whatever the logbook says. And wherever a coloured asset sits right beside an ownership boundary, you have found the exact place control tends to fall through the gap. A blank or a clash on this map is a management risk long before it is a microbiological one.

Failure modes you won’t meet in an office block

A hub fails in ways a single tenanted office never does.

Perpetual construction. Airports are always building something. New pipework gets charged with water at commissioning, then waits months for the gate or the unit to open — warm, still, and connected to the live system. The joint between old infrastructure and new is a classic spot for a dead leg nobody designed on purpose.

The pier that came back. A wing closed during a downturn or a seasonal lull gets recommissioned to chase capacity. Switched back on without a planned flush, clean and — where the assessment calls for it — disinfection, the first passengers through are washing in water that has stood still for a long time.

The dispersed cluster. A hub’s population is transient. Someone exposed on a Tuesday may fall ill days later and hundreds of miles away, so a cluster linked to the site is far more likely to surface through public-health investigation than through anything you notice on the concourse [4]. That is an argument for evidence you can hand over cleanly under pressure — and a reason manual records scattered across multiple operators are a liability, since they are painful to assemble after the fact (see Automation in record keeping).

How often you check the long runs and the cooling plant is not a figure to copy from another site. Monitoring and flushing frequency follow your risk assessment and the way the system is actually used, not a fixed calendar lifted from guidance [5]. A terminal’s long horizontal runs raise the same monitoring discipline as the vertical risers in high-rise buildings, just spread sideways. The same caution applies to sampling: it verifies or investigates, it does not replace control, and how often you sample should follow the system and the assessment [6].

What this guidance is, and what it isn’t

The risk features and routines described here are orientation, not a control scheme. An airport’s real risk profile is set by its own layout, its cooling plant, its tenant mix and its passenger flows, so the temperatures, flushing intervals and sampling points that prove control on one concourse can be wrong on the next pier. Use this to brief a competent, site-specific risk assessment and the written scheme that follows from it [7] — not as a substitute for either, and not as legal or clinical advice.

FAQ

Who is the duty holder when a lounge or concession runs its own showers and water heaters?

Responsibility follows control of the system, and it splits at the demise. The terminal operator typically holds the duty for the supply, storage and retained distribution; the tenant usually holds it for the pipework and assets they install and operate behind their stop valve. The thing to settle in writing is the boundary itself — which valve, and who flushes, monitors and records on each side of it. Bringing in a contractor does not move the duty from whoever holds it [1].

Do we have to tell anyone about the cooling towers on the roof?

Wet cooling towers and evaporative condensers carry a notification duty to the local authority, on top of being among the higher-risk systems to control [2][3]. Treat them as a distinct, named part of the water safety arrangements with their own cleaning and monitoring regime, not as a footnote to the domestic hot and cold water. Confirm the current notification requirements before you rely on this.

How do we safely bring a closed pier or gate back into service?

Plan it as a recommissioning, not a switch-on. A length of system that has stood idle should be flushed through, cleaned and — where the risk assessment calls for it — disinfected before passengers and staff use the outlets, with results recorded so you can show the wing returned to service under control [5]. The riskiest moment is the first use after a long stagnation, so the work belongs before reopening, not after.

Sources

[1] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [2] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [3] HSE, “Other duties: RIDDOR and notification of cooling towers or evaporative condensers”. https://www.hse.gov.uk/legionnaires/what-you-must-do/duties.htm [4] UKHSA, “Investigation of Legionnaires’ disease: cases, clusters and outbreaks”. https://www.gov.uk/government/publications/investigation-of-legionnaires-disease-cases-clusters-and-outbreaks [5] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [6] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [7] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm