Training is the part of Legionella compliance that looks like a box and behaves like a liability. A duty holder books a half-day course, files the certificate, and treats the duty as discharged. It rarely is. What the law actually expects is competence — the people who run your water system understanding it well enough to keep the bacteria in check and to spot when something has slipped. A certificate records attendance. Competence is the thing being tested.
So the question worth asking is not “have we done the training?” but “can each person who touches our water system explain why their task matters and what an acceptable result looks like?” Get that right and the paperwork takes care of itself.
What the rules actually expect
There is no national Legionella qualification you are obliged to hold, and no fixed syllabus laid down in law. What HSE sets out is a duty: identify and assess the risk, manage it through a competent person, and keep records that show you did [1]. The Approved Code of Practice, L8, builds on that with a management structure — a named responsible person, a written scheme of control, monitoring and review — and expects everyone with a part in it to be competent and suitably trained for that part [2].
“Competent” is doing a lot of work in that sentence, and it is deliberately not defined by a course title. It means the right mix of knowledge, training, experience and, crucially, familiarity with this building’s water system. Two people can hold the same certificate and have very different competence, because one of them knows where the dead legs and low-use showers actually are.
Who needs training, and how much
The mistake is to train one person and assume the duty is covered. Different roles need different depth, and most buildings have more than one role in play.
- The duty holder. You do not need to be able to take a temperature reading, but you need enough understanding to appoint the right people, brief them, read their reports critically and challenge a contractor when something looks thin. You cannot oversee what you cannot interrogate.
- The responsible person (and a deputy). This is the named individual with day-to-day control. They need a proper grounding in how Legionella behaves, what your written scheme requires, and how to act on a reading that falls outside its limits. Appoint a deputy and train them too — risk does not pause when the responsible person is on leave.
- Operatives doing the tasks. Whoever takes temperatures, flushes low-use outlets, cleans shower heads or descales fittings needs training proportionate to that specific task: how to do it, why it matters, what “good” looks like, and what to do when it isn’t good. A caretaker flushing rooms needs less than the responsible person, but they need the right slice.
- Contractors and service providers. If you outsource monitoring or remedial work, their competence is their concern to demonstrate — membership of the Legionella Control Association is one recognised signal that a provider’s staff are trained and audited against a code of conduct [3]. But hiring competence does not import it. You still need enough of your own to set the brief and judge the output.
The myths that leave gaps
Most training failures trace back to a handful of comfortable assumptions. These are the ones that catch duty holders out.
| What gets assumed | What actually holds |
|---|---|
| A generic online certificate means we’re covered | A certificate proves someone sat a course. Competence is being able to do the real task on this system and know what a result means |
| Only the responsible person needs training | Anyone who takes readings, flushes outlets or cleans fittings needs training matched to their task — and the duty holder needs enough to oversee it all |
| Using a contractor removes the training duty | Outsourcing the work does not outsource your competence; you still have to appoint, brief and challenge them [3] |
| Train once and you’re done | Knowledge fades, staff turn over and systems change; training has to be refreshed and updated when roles or plant change |
| Training is a classroom thing | The part that actually controls risk is site-specific — knowing this building’s tanks, dead legs, calorifiers and intermittently-used outlets |
The thing people get wrong most often
A good external course teaches Legionella in the abstract: growth temperatures, biofilm, aerosols, the legal frame. Useful, and necessary. But the gap that bites is almost never the theory — it is the join between the theory and the building. Someone can pass the course and still not know which showers in their block sit idle for weeks, or why the cold tank in a warm roof void is the thing to watch.
So the highest-value training you can run is the cheapest: walk the responsible person and the operatives around the actual system with the risk assessment and asset register in hand. Show them the outlets the scheme says to flush and why. Point at the dead leg. Explain what the temperature limit means at that tap, and what to do the day it reads wrong. That site-specific layer is what turns a certificate into control, and it is the layer most generic training never reaches.
How often to refresh it
There is no single legally-fixed interval, which frustrates people who want a date in the calendar. L8 expects training to be kept current and refreshed at suitable intervals rather than treated as a one-off [2] — so the trigger is change, not the anniversary. Refresh sooner when the system is altered, when the risk assessment is reviewed, when a new control is introduced, or when a trained person leaves and someone new picks up the task. Run a light periodic refresher too, simply because skills fade between rare events, and set that rhythm through your risk assessment rather than a number borrowed from a blog.
Whatever you decide, record it. Training records should show who was trained, on what, by whom, when, and how their competence for their tasks was confirmed — not just an attendance list. That is also what an inspector will look at; for how that conversation tends to go, see HSE audits and inspections.
A word of caution
None of this is legal advice, and no course can stand in for judgement on the day. What counts as adequate competence is set by your own risk assessment and the systems you run: a site with a cooling tower, a spa or vulnerable occupants needs deeper competence and tighter cover than a small low-risk office. Treat the points above as a prompt to test your own arrangements, then confirm the specifics against L8, HSG274 and a competent adviser before you change anything.
Your next step this week
Pull your training records and lay them next to your written scheme of control and your list of who actually does each task. Three columns: the task, the person, the proof they are competent to do it. Any row with a gap — a task with no named, trained person, or a person with a certificate but no site walk-round — is your priority. Close the most exposed one first, usually the low-use outlets that depend on someone remembering to flush them.
If your scheme itself is vague about who does what, fix that before the training, because training to an unclear scheme just spreads the confusion — Documenting a written scheme of control covers how to make those responsibilities concrete.
FAQ
Is there a legally required Legionella training certificate in the UK?
No. UK law and L8 require competence proportionate to the role and the system, not a specific named qualification [1][2]. A reputable course is a sensible way to build and evidence that competence, but a certificate on its own does not prove someone can run your particular water system.
Do all our staff need Legionella training, or just the responsible person?
Only those whose work bears on the risk, but that is usually more than one person. The responsible person and a deputy need a thorough grounding; anyone taking temperatures, flushing or cleaning needs training matched to that task; and the duty holder needs enough to oversee and challenge. People with no role in the water system do not need formal training.
If we use a contractor, do we still have to train our own people?
Yes, to the extent that you appoint, brief and oversee them. A contractor’s competence — for example through a Legionella Control Association provider — covers the work they do [3], but you retain the duty to set the scope, read their reports critically and act on what they find. That requires competence on your side.
Sources
[1] HSE, “Legionnaires’ disease — what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [2] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems — Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [3] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/