Search “is a Water Safety Plan legally required?” and you get two confident, contradictory answers. The honest one sits in between. For most UK buildings, no law names a “Water Safety Plan” as a document you must hold. What the law does require is that you find your water risks, control them, and prove it. A Water Safety Plan is one way to do that well — broader and more formal than the legal minimum, and in some sectors effectively expected.
So the decision is not really “plan or no plan”. It is how far above the legal floor your particular building needs to go, and whether a full plan is proportionate or just paperwork you will not maintain.
What the law actually requires
Strip it back and the duty is narrow. Under health and safety law, a duty holder must identify and assess the risk from Legionella, manage it, prevent or control it, keep the right records, and carry out related duties such as notifying certain systems [1]. The Approved Code of Practice, ACoP L8, sets out how to do that competently: a suitable risk assessment, a written scheme of control, a named responsible person, implementation, monitoring, records and review [2].
ACoP L8 carries weight that ordinary guidance does not. Follow it and you can normally show you have complied; depart from it and you have to demonstrate you achieved the same standard another way, and a failure to follow it can count against you if something goes wrong [2]. HSG274 then fills in the technical detail for hot and cold water, cooling systems and the rest [3].
None of those documents demands a “Water Safety Plan” by that title. They demand control and evidence. You can satisfy the entire legal requirement in a small, stable building with a good risk assessment, a written scheme, and a logbook that shows the temperatures, flushing and checks are genuinely happening.
What a Water Safety Plan adds
A Water Safety Plan is a best-practice framework, drawn from the World Health Organization’s water-safety-in-buildings approach [5] and set out for the UK in BS 8680 [4]. It is wider than Legionella alone. A plan looks at the whole water system across its life — design, commissioning, operation, maintenance, alteration and refurbishment — and at other waterborne hazards such as Pseudomonas and scalding, not just one organism.
The other thing a plan adds is governance. BS 8680 frames water safety as something a group owns, not a folder a single contractor updates [4]. In practice that means a Water Safety Group: named people who review the risks, authorise the controls, sign off changes to the system, and decide what happens when a control limit is missed. It makes the chain of accountability visible, which is exactly where thin compliance tends to fall apart.
In healthcare the picture changes again. NHS England’s HTM 04-01 sets the expectation that healthcare premises operate a documented Water Safety Plan and a Water Safety Group [6]. For a hospital, hospice or many care settings, a plan is not “going the extra mile” — it is the operating standard for the sector.
Legal minimum vs full plan, side by side
The two approaches are not rivals; the plan contains the legal duty and wraps more around it. Comparing them on the axes that actually matter helps you place your own site.
| Decision axis | Legal minimum (risk assessment + scheme) | Full Water Safety Plan |
|---|---|---|
| Legal status | What HSWA, COSHH and ACoP L8 require of every duty holder [1][2] | Best practice under BS 8680/WHO; effectively required in healthcare via HTM 04-01 [4][5][6] |
| Scope | Legionella control across your water systems | Whole water system and other hazards (e.g. Pseudomonas, scalding) across its life cycle [4] |
| Ownership | A competent responsible person [2] | A Water Safety Group with defined roles and escalation [4] |
| Effort to maintain | Lower; suits small, stable sites | Higher; needs the governance to be live, not just written |
| Best fit | Offices, small lettings, simple low-risk buildings | Hospitals, care homes, complex estates, multi-building portfolios, vulnerable users |
Which one does your building need?
Match the response to the risk, not to what sounds thorough.
A single small office, a low-risk let, or a simple building with healthy users and few outlets is usually well served by the legal minimum done properly. A current, competent risk assessment and a written scheme that someone actually follows will beat a 40-page Water Safety Plan that nobody reviews. Doing the basics well is not cutting a corner; it is proportionate control.
A hospital, care home, or any premises with clinically vulnerable people sits at the other end. Here a Water Safety Plan and a Water Safety Group are the expected standard, with HTM 04-01 the reference point in healthcare [6]. The breadth matters because the consequences do.
Most large but non-clinical estates fall in the middle — a university, a hotel group, a council’s building stock. The pragmatic call is a “light” plan: keep the legally required risk assessment and scheme as the spine, then borrow the governance from BS 8680. Name a small group, give it a standing review of the evidence, and define what triggers escalation. You get the accountability of a plan without pretending a low-risk store cupboard needs the same treatment as a renal unit.
If you appoint contractors to fill competence gaps — common at the middle and upper end — scope and oversight are where plans earn their keep. The Legionella Control Association Code of Conduct is a useful yardstick for what a competent provider should sign up to, but the duty holder still has to brief, challenge and review them.
Before you treat a plan as proof
A Water Safety Plan is not a shield. Whether you have discharged your legal duty turns on whether the risk is actually controlled and evidenced for your specific systems and users — judged by a competent person, not by the weight of the document. BS 8680 and HTM 04-01 are guidance and a sector standard respectively; they inform that judgement, they do not replace it. Any numeric control limits, monitoring frequencies and review intervals come from your own risk assessment for your own site, and HSE is clear that sampling supports verification rather than setting the schedule [3]. None of this is legal advice — if a control limit is being missed or your situation is genuinely uncertain, get competent help rather than reaching for a template.
A sensible next step
Pull your current risk assessment and ask one question of it: if a control limit was breached tomorrow, does the paperwork name who decides what happens next? If the answer is yes and the building is low-risk, you are likely compliant and a full plan would be overkill. If the answer is no, or your site carries vulnerable users or real complexity, that missing line of accountability is your case for moving from the legal minimum toward a Water Safety Plan — start by naming the group, not by writing the document. When you next review the assessment, fold the decision in; Reviewing and updating your Legionella risk assessment regularly covers how to keep that review honest.
FAQ
Is a Water Safety Plan a legal requirement in the UK?
Not by that name for most buildings. The law requires you to assess and control the risk and keep records, and ACoP L8 sets out how [1][2]. A Water Safety Plan is a best-practice framework on top of that — though in healthcare, HTM 04-01 makes one effectively expected [6].
What is the difference between a Water Safety Plan and a Legionella risk assessment?
The risk assessment is focused: it identifies and rates Legionella risk in your systems and underpins the written control scheme. A Water Safety Plan is wider — it covers the whole water system over its life and other waterborne hazards, and adds the governance (typically a Water Safety Group) for owning and reviewing it all [4].
Does a small office need a Water Safety Plan?
Usually not. A small, low-risk building is normally well covered by a current Legionella risk assessment and a written scheme that is genuinely followed. A formal plan adds value where systems are complex, occupants are vulnerable, or an estate spans many buildings.
Sources
[1] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [2] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [3] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [4] BSI, “BS 8680:2020 - Water quality. Water safety plans. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-water-safety-plans-code-of-practice [5] WHO, “Water safety in buildings”. https://iris.who.int/server/api/core/bitstreams/2c302ce4-bca9-42bc-97b4-ddbe95f0c7f2/content [6] NHS England, “Health Technical Memorandum 04-01: Safe water in healthcare premises”. https://www.england.nhs.uk/publication/safe-water-in-healthcare-premises-htm-04-01/