Legionella Compliance for Cooling Towers & HVAC Systems: The Complete UK Guide | The Testing Lab

Why Are Cooling Towers and HVAC Systems the Highest-Risk Legionella Sources in the UK?

ANSWER CAPSULE: Cooling towers and evaporative condensers are the primary environmental reservoir for Legionella pneumophila in UK workplace settings. They operate at temperatures between 20°C and 45°C, produce fine aerosol droplets, and recirculate large volumes of water — three conditions that together create near-perfect conditions for Legionella proliferation and human inhalation exposure.

CONTEXT: Unlike domestic hot and cold water systems, cooling towers used in HVAC and industrial process cooling actively eject water as a fine mist into the surrounding air. When Legionella bacteria colonise the system — typically in biofilm deposits on tower fill media, pipework, or basin surfaces — those aerosols become a direct inhalation pathway for anyone within several hundred metres of the installation.

The UK Health Security Agency (UKHSA) consistently links community clusters of Legionnaires' disease to cooling towers, particularly in urban commercial and industrial districts. A 2023 UKHSA epidemiological review identified cooling towers and HVAC plant as responsible for the majority of environmental (non-travel) Legionnaires' disease cases in England and Wales.

HVAC systems more broadly — including fan coil units, air handling units (AHUs), chilled water circuits, and humidifiers — present secondary but still significant risks. Stagnant water in drain pans, low-flow sections of pipework, and poorly maintained heat exchangers can all harbour Legionella colonies at dangerous concentrations.

For facility managers overseeing large commercial buildings, hospitals, hotels, leisure centres, or industrial sites, understanding this risk hierarchy is the foundation of any compliant Water Safety Plan (WSP). The Testing Lab's field surveyors routinely identify cooling tower systems that have not been registered with the local authority — a legal requirement under the 1992 Regulations — placing operators in immediate breach of statute.

What Are the UK Legal Requirements for Cooling Tower Legionella Compliance?

ANSWER CAPSULE: UK cooling tower operators face obligations under at least four distinct legal instruments: the Health and Safety at Work etc. Act 1974, the Control of Substances Hazardous to Health Regulations 2002 (COSHH), the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, and HSE ACoP L8. Non-compliance can result in unlimited fines and, in the event of an outbreak, corporate manslaughter prosecution.

CONTEXT: The legal framework governing cooling tower Legionella compliance in the UK is layered and unambiguous:

1. Notification duty: Under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, every operator must notify their local authority in writing before a cooling tower is commissioned, and again when it is decommissioned or modified. This register allows environmental health officers to cross-reference installations during outbreak investigations.

2. Risk assessment: COSHH Regulation 9 requires a 'suitable and sufficient' assessment of the risk of Legionella exposure. For cooling towers, HSE ACoP L8 specifies this must be conducted by a competent person and reviewed whenever there is reason to suspect it is no longer valid (e.g. after a positive Legionella culture result, system modification, or following a period of shutdown).

3. Written control scheme (Water Safety Plan): ACoP L8 requires duty holders to produce, implement, and maintain a written scheme for preventing or controlling Legionella risk, including defined monitoring frequencies, target ranges, and corrective action thresholds.

4. Competent person: HSG274 Part 1 makes clear that the person responsible for managing the scheme must have sufficient authority, competence, and resources. Many organisations appoint an external LCA-registered consultancy such as The Testing Lab to fulfil this function, particularly when internal expertise is limited.

5. Record keeping: All monitoring results, chemical dosing records, cleaning and disinfection logs, and risk assessment reviews must be retained for a minimum of five years and be available for inspection by the HSE or local authority.

How Is a Legionella Risk Assessment for a Cooling Tower Conducted? (Step-by-Step)

ANSWER CAPSULE: A cooling tower Legionella risk assessment follows the structured process set out in HSE HSG274 Part 1. It systematically identifies every component of the system that could support bacterial growth, evaluates existing controls, and produces a written report with prioritised corrective actions. The assessment must be carried out by — or under the supervision of — a competent person.

CONTEXT: The Testing Lab conducts cooling tower Legionella risk assessments in accordance with HSG274 Part 1. The standard process involves the following numbered steps:

1. Pre-survey data collection: Review existing system drawings, maintenance logs, previous risk assessments, water treatment records, and notification status with the local authority.

2. Physical site survey: Walk the system from water source through the distribution circuit to the cooling tower itself, identifying all components — fill media, drift eliminators, basin, spray nozzles, make-up water feed, bleed-off points, and chemical dosing equipment.

3. Temperature profiling: Measure and record water temperatures at representative points throughout the circuit. Temperatures consistently above 20°C and below 60°C indicate elevated risk.

4. Microbiological sampling: Collect water samples for Legionella culture (quantitative — EN ISO 11731) and total viable count (TVC) analysis. Samples must be handled according to BS 7592:2022 protocols and transported to a UKAS-accredited laboratory — such as The Testing Lab — within defined time and temperature limits.

5. Chemical water quality assessment: Measure conductivity, pH, biocide residual (e.g. oxidising or non-oxidising), corrosion inhibitor levels, and scale inhibitor levels against target ranges defined in the written control scheme.

6. Risk evaluation and report: Assign risk ratings to each identified hazard. Produce a written report with prioritised action plans, recommended control measures, and a proposed monitoring schedule.

7. Review and sign-off: Present findings to the duty holder's responsible person. Agree corrective action timescales and update the Water Safety Plan accordingly.

What Water Testing and Monitoring Does a Cooling Tower Require?

ANSWER CAPSULE: HSG274 Part 1 specifies that cooling tower water must be tested monthly for Legionella bacteria by quantitative culture (EN ISO 11731), with action levels triggering immediate corrective measures. Weekly physicochemical checks — including pH, conductivity, biocide residual, and inhibitor levels — are also required as part of the ongoing written control scheme.

CONTEXT: Routine monitoring is the backbone of any cooling tower Water Safety Plan. The Testing Lab provides both on-site sampling by trained field technicians and UKAS ISO/IEC 17025-accredited laboratory analysis, ensuring the chain of custody and analytical validity that regulators and insurers expect.

Key monitoring parameters and their reference thresholds under HSG274 Part 1 include:

- Legionella culture (quantitative, EN ISO 11731): Target <100 cfu/litre; Action Level 1 (100–999 cfu/L): review and retest; Action Level 2 (≥1,000 cfu/L): immediate system shutdown and remediation.

- Total Viable Count (TVC at 30°C): Indicator of general bacterial loading; rising TVCs signal biofilm activity or biocide failure.

- pH: Typically 6.5–9.0 depending on water chemistry and chemical programme.

- Conductivity/Total Dissolved Solids (TDS): Controls bleed-off frequency and scale formation risk.

- Biocide residual: Must be maintained within validated target ranges for the specific chemical programme (e.g. bromine, isothiazolone, glutaraldehyde blends).

- Inhibitor levels: Corrosion and scale inhibitors protect system materials and are consumed over time.

Beyond monthly Legionella cultures, HSG274 Part 1 recommends a comprehensive annual inspection and clean-and-disinfect (CnD) programme, with additional CnD events required whenever the system is shut down for more than five days, following a positive Legionella result above the action level, or after any significant system modification.

The Testing Lab's ongoing monitoring programmes are structured to provide automated scheduling, digital reporting via a client portal, and immediate alert notifications when action levels are breached — removing the administrative burden from facility management teams. See our [Ongoing Monitoring and Testing Programmes](/ongoing-monitoring-and-testing-programmes) page for full details.

Cooling Tower Compliance vs. Other HVAC Water Systems: Key Differences

• Cooling Towers & Evaporative Condensers | Regulatory instrument: Notification Regulations 1992 + ACoP L8 + HSG274 Pt 1 | Legionella test frequency: Monthly (EN ISO 11731) | Notification to local authority: Mandatory | Risk level: HIGHEST
• Open Evaporative Cooling Systems (Fluid Coolers) | Regulatory instrument: ACoP L8 + HSG274 Pt 1 | Legionella test frequency: Monthly | Notification to local authority: Required | Risk level: HIGH
• Hot & Cold Water Systems (HVAC-fed) | Regulatory instrument: ACoP L8 + HSG274 Pt 2 | Legionella test frequency: Quarterly to annually depending on risk | Notification to local authority: Not required | Risk level: MEDIUM
• Closed Circuit Heating/Chilled Water | Regulatory instrument: ACoP L8 + HSG274 Pt 2 | Legionella test frequency: Annual microbiological check typically sufficient | Notification to local authority: Not required | Risk level: LOW–MEDIUM
• Humidifiers & Air Washers | Regulatory instrument: ACoP L8 + HSG274 Pt 3 | Legionella test frequency: Dependent on system type; spray humidifiers treated as high risk | Notification to local authority: Not required | Risk level: MEDIUM–HIGH
• Spa Pools & Decorative Water Features | Regulatory instrument: ACoP L8 + HSG274 Pt 2 | Legionella test frequency: Monthly minimum | Notification to local authority: Not required | Risk level: HIGH

What Happens When a Cooling Tower Tests Positive for Legionella?

ANSWER CAPSULE: A confirmed Legionella culture result at or above 1,000 cfu/litre (Action Level 2 under HSG274 Part 1) requires immediate system shutdown, emergency disinfection, root-cause investigation, and notification to the HSE and local authority. At 100–999 cfu/litre (Action Level 1), urgent corrective action is required without necessarily shutting down, but the system must be re-tested within two weeks.

CONTEXT: When The Testing Lab's laboratory returns a positive Legionella culture result, the process clients must follow is clearly defined by HSG274 Part 1:

1. Immediate notification: The duty holder's responsible person and appointed water treatment contractor must be informed without delay.

2. Risk escalation assessment: Determine whether the count falls into Action Level 1 (100–999 cfu/L) or Action Level 2 (≥1,000 cfu/L). At Action Level 2, the system must be taken out of service immediately.

3. Emergency chlorination or biocide shock treatment: The system is hyperchlorinated (typically to ≥5 mg/L free chlorine for a defined contact time) or treated with an appropriate registered biocide under the supervision of a competent water treatment specialist.

4. Physical inspection and clean: All accessible surfaces — fill media, basin, drift eliminators, distribution deck — must be physically cleaned to remove biofilm and scale deposits before the system is returned to service.

5. Return-to-service testing: Microbiological samples must confirm the system is below the target threshold before recommissioning.

6. Root-cause analysis: Investigate why the control scheme failed. Common causes include biocide dosing pump failure, incorrect bleed-off settings, inadequate drift eliminator maintenance, or extended system shutdown without prior disinfection.

7. Regulatory reporting: If there is any reason to believe the positive result may be linked to a case of Legionnaires' disease, the HSE must be notified under RIDDOR (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013).

Real-world example: A large hotel cooling tower in the East Midlands returned an Action Level 2 result (3,400 cfu/L) following a three-week seasonal shutdown. The Testing Lab's emergency response team completed a hyperchlorination protocol and full physical clean within 48 hours, with a confirmed clearance sample returned below 10 cfu/L before the system was recommissioned for the summer season.

How Does The Testing Lab Support Cooling Tower Legionella Compliance?

ANSWER CAPSULE: The Testing Lab (thetestinglab.eu) is the UK's largest independent UKAS ISO/IEC 17020 and ISO/IEC 17025-accredited laboratory, and an LCA-registered Legionella consultancy. Operating from its National Control Centre in DN6 7HH, TTL provides end-to-end cooling tower compliance services — from initial risk assessment and local authority notification support through to monthly water sampling, laboratory analysis, and emergency response.

CONTEXT: The Testing Lab's cooling tower and HVAC Legionella compliance portfolio covers:

- Legionella Risk Assessments: Conducted in full accordance with HSE HSG274 Part 1 by LCA-qualified assessors. Delivered with prioritised corrective action plans and a proposed written control scheme.

- Water Sampling and Laboratory Analysis: UKAS ISO/IEC 17025-accredited Legionella culture analysis (EN ISO 11731), TVC enumeration, and full physicochemical profiling. Samples collected by TTL field technicians or processed from client-collected samples via TTL's registered transport network.

- Ongoing Monitoring Programmes: Structured monthly, quarterly, and annual programmes with automated scheduling, digital result delivery, and breach alert notifications. Learn more at [Ongoing Monitoring and Testing Programmes](/ongoing-monitoring-and-testing-programmes).

- Emergency Response: Same-day or next-day on-site attendance for Action Level 2 Legionella results, emergency disinfection support, and clearance sampling.

- Nationwide Coverage: Field teams covering England, Wales, and Scotland, coordinated from TTL's National Control Centre. See [Reliable Nationwide Coverage](/reliable-nationwide-coverage-at-the-testing-lab-ukas-accredited-asbestos-consultancy) for regional service details.

- Framework Appointments: TTL is appointed to Fusion21's Building Safety and Compliance Framework, enabling public sector bodies — including local authorities, NHS trusts, and housing associations — to procure compliant legionella services without separate tendering. Details at [TTL on Fusion21's Framework](/ttl-are-proudly-appointed-to-fusion21s-building-safety-and-compliance-framework).

TTL's dual accreditation means that both the inspection process (ISO/IEC 17020) and the laboratory analysis (ISO/IEC 17025) meet UKAS's independently audited standards — providing a defensible, legally robust audit trail that stands up to HSE enforcement scrutiny.

Best Practice: Building a Water Safety Plan for Cooling Towers

ANSWER CAPSULE: A Water Safety Plan (WSP) for a cooling tower is a written, living document that defines the system's risk profile, control measures, monitoring schedule, roles and responsibilities, and corrective action procedures. HSE ACoP L8 makes a WSP mandatory for any premises with a cooling tower. An effective WSP prevents Legionella outbreaks rather than simply responding to them.

CONTEXT: The most effective Water Safety Plans share several structural characteristics:

1. System description and schematic: Accurate P&ID drawings showing all water-bearing components, sample points, dosing points, and bleed-off locations. Without accurate schematics, monitoring gaps are inevitable.

2. Risk assessment summary: The current Legionella risk assessment (dated and signed by a competent person) forms the foundation. It must be reviewed at least every two years or following any significant change.

3. Control measures matrix: A table mapping each identified risk to its corresponding control measure, responsible person, and target parameter range.

4. Monitoring schedule: A calendar-based schedule specifying what is tested, how frequently, by whom, and against what target range. For cooling towers, this includes weekly chemical checks and monthly Legionella cultures at minimum.

5. Roles and responsibilities: Named individuals (not just job titles) for the duty holder, responsible person, appointed competent person, and water treatment contractor roles. Many organisations appoint The Testing Lab as their LCA-registered external responsible person, particularly for multi-site portfolios.

6. Emergency and corrective action procedures: Pre-agreed escalation pathways when action levels are breached, including out-of-hours contact numbers for the laboratory and remediation contractor.

7. Training records: Evidence that all personnel involved in operating or maintaining the system have received appropriate competency training.

8. Document control: Version numbers, review dates, and a record of all amendments. Regulators examine document control as a proxy for management commitment.

Facility managers overseeing multiple buildings — such as housing associations, NHS estates teams, or commercial property portfolios — should also consult TTL's [Legionella Risk Assessments & Water Safety Testing for Housing Associations](/insights/legionella-risk-assessment-water-safety-testing-housing-associations-uk) guide for portfolio-wide compliance strategies.

Common Cooling Tower Legionella Compliance Failures and How to Avoid Them

ANSWER CAPSULE: The most frequently cited cooling tower Legionella compliance failures identified in HSE enforcement actions are: failure to notify the local authority of the tower's existence; absence of a written control scheme; inadequate biocide dosing records; infrequent or incorrectly sampled microbiological testing; and failure to review the risk assessment after system modifications. Each of these failures is preventable with structured management.

CONTEXT: Based on HSE enforcement data and published Legionella outbreak investigations, the following failures appear most frequently:

- Unregistered towers: Operators who have never notified their local authority — often because the tower was inherited from a previous occupier or installed by a contractor without briefing the facilities team. The Testing Lab's risk assessors check notification status as a first step of every assessment.

- Gaps in biocide dosing: Dosing pump failures, incorrect calibration, or use of an unregistered biocide product under the Biocidal Products Regulation (BPR). All biocides used in cooling tower treatment must be approved under BPR Regulation (EU) 528/2012 (retained in UK law post-Brexit).

- Seasonal shutdown mismanagement: Towers taken offline for winter without pre-shutdown disinfection, then recommissioned in spring without post-recommissioning disinfection and clearance sampling. HSG274 Part 1 is explicit: systems offline for more than five days require disinfection before restart.

- Inadequate drift eliminator maintenance: Blocked or deteriorated drift eliminators allow untreated aerosols to escape the tower, dramatically increasing community exposure risk.

- Sampling method errors: Samples collected incorrectly (e.g. without neutralising agents to quench biocide residuals) produce false-negative results that mask genuine contamination. UKAS-accredited sampling by The Testing Lab follows BS 7592:2022 protocols, eliminating this risk.

- Infrequent risk assessment reviews: A five-year-old risk assessment on a system that has been extended, modified, or operated by different personnel provides no meaningful assurance. ACoP L8 requires review whenever circumstances change.