Machine learning will not tell you whether Legionella is living in your pipes. It cannot see biofilm, count bacteria, or smell a stagnant dead leg. What it can do is read the data you already collect — temperatures, flow, flushing records — faster and more consistently than any person skimming a monthly logbook, and flag where conditions are drifting toward trouble before you would otherwise notice.
That distinction sits at the heart of the subject, and most vendor demos blur it. A model predicts conditions, not the organism. Get that straight and the real decision — whether predictive analytics is worth the money on your estate — becomes much easier to make.
What the model is actually predicting
Legionella multiplies when water sits warm and still long enough for the bacteria to grow in biofilm and sediment. Guidance generally puts the active growth range at roughly 20-45°C, which is why control turns on keeping hot water hot, cold water cold, and water moving [1]. A model cannot measure the bacteria, but it can measure good proxies for those conditions: how often an outlet’s temperature strays into the growth band, how long a cold tank stays warm on a hot afternoon, whether a low-use shower is genuinely being flushed.
So Legionella risk prediction really means earlier warning of conditions that raise risk. The model learns what normal looks like for your building and tells you when a pattern is heading the wrong way. It does not replace the framework that governs your duties — in UK practice, L8 and HSG274 still define competent control, and the risk assessment still sets your numbers [1][2].
How it works on a real UK site
Picture a multi-site NHS trust, a university with halls that empty over summer, or a corporate estate with hundreds of TMV-fed outlets on remote temperature sensors. Those sensors generate far more readings than anyone reviews. Most lapses hide in that flood of data — a sentinel outlet whose weekly flush keeps slipping by a day, a cold supply that creeps above 20°C every July, a calorifier return losing heat to the far wing.
This is the work machine learning genuinely does well. It scans every stream at once for anomalies, ranks outlets by modelled risk so limited flushing and inspection effort lands where it matters, and forecasts predictable drift — warning, for instance, that a particular cold tank will breach its limit in the next heatwave because it did in the last one. Done well, that shifts a reactive logbook review toward early intervention, which is the whole promise behind proactive rather than reactive control.
One hard limit travels with all of it: a model is only as good as its inputs. An uncalibrated sensor, or one fitted on the wrong side of a blending valve, feeds the algorithm confident nonsense. Sort out sensor placement and calibration before you ask software to find meaning in the readings.
Where the hype outruns the evidence
Predictive analytics attracts bold marketing, and Legionella is an emotive thing to sell against. A few claims worth testing before you sign anything:
| The claim | What holds up |
|---|---|
| ”Our AI predicts Legionella outbreaks” | It predicts proxy conditions, not the bacteria. Positive results in a controlled system are rare, so there is rarely enough data to train a true presence-detector |
| ”A green dashboard means we’re compliant” | A model that scores low risk because temperatures look fine is just restating its inputs in fancier language — not independent proof of control |
| ”The system flags everything, so we can cut manual checks” | A failed sensor reads a flat line, not an alarm. Without spot checks you may be trusting a stream that stopped reflecting reality weeks ago |
| ”A risk score can replace sampling” | A score is not a culture result. Sampling still verifies, when and where the risk assessment calls for it |
| ”You can buy prediction off the shelf” | With no clean history from your own system, the model has nothing site-specific to learn and falls back on generic assumptions |
The mistake that quietly undoes it
The trap is treating the model’s output as evidence of control rather than a prompt to act. A risk score is an input to a competent person’s judgement, not a substitute for it. And if the score is a black box you cannot interrogate, it actively weakens your position: you must be able to explain to an inspector why each control exists and what an acceptable result is, and “the algorithm said it was fine” is not that explanation [3].
Accountability is the line technology never crosses. You can outsource the analytics, the sensors and the dashboard, but the duty holder still owns the risk, and a competent person still has to interpret what the model surfaces and decide what to do about it [3]. Hand that judgement to a vendor’s algorithm and you have not reduced your risk — you have only hidden it behind a confident number.
Where to start
Do not start by buying a model. Start with the foundation a model needs to be worth anything: calibrated sensors at points that actually represent the system, records complete enough to show who did what and when, and thresholds with a written escalation path for readings that fall outside them. Most estates that think they have a machine learning problem really have a data-quality problem first.
When that base is solid, pilot on one building or a subset of outlets, and grade the model’s flags against what you find on the ground for a full season before you let it reprioritise real work. Treat anything it tells you as a reason to look, not a verdict. The figures that govern your system — control temperatures, flushing intervals, sampling frequency — come from a competent, site-specific risk assessment under L8 and HSG274, never from a dashboard’s defaults [2][4].
FAQ
Can machine learning predict a Legionella outbreak before it happens?
Not directly. It can warn you when conditions that favour growth are building — sustained warm temperatures, stagnation, missed flushes — which is genuinely useful early intervention. But it infers risk from proxy data; it does not detect the bacteria, and a confident-looking forecast is no substitute for the underlying controls.
Do we still need temperature monitoring and sampling if we use predictive analytics?
Yes. The analytics sit on top of monitoring rather than replacing it, and they certainly do not replace verification by sampling, which follows your system and risk assessment rather than the software [4]. If anything, the model makes your monitoring data more valuable by reading more of it than a human ever could.
Will an HSE inspector accept a machine learning risk score as proof of control?
A score on its own is weak evidence. What demonstrates control is the underlying record — temperatures in range, tasks done and signed off, exceptions chased to a conclusion — plus a competent person who can explain the decisions. The model can help you keep those records; it cannot stand in for them [1][3].
Sources
[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm