Quick Answer
Let me be blunt. Your legionella compliance is only as good as the records you can produce on the day someone asks for them, and most social landlords cannot produce them. The risk assessments, the written schemes, the temperature logs, the remedial sign-offs, they sit in a contractor's filing system in fifteen different formats, half of them incomplete. Awaab's Law did not invent your legionella duty. That has been sitting in the Health and Safety at Work Act and ACoP L8 for years. What Awaab's Law changed is what happens when you cannot prove it. From October 2025 the repair timescales are implied terms in every social tenancy, so a tenant can take you to court for breach of contract. Phase 3 in 2027 pulls the remaining housing hazards, legionella included, into that same regime. If your evidence lives in someone else's filing cabinet, you have a problem, and you have roughly eighteen months to fix it. Start the audit now.
Table of Contents
- The gap nobody thought to audit
- What Awaab's Law actually changed
- Where legionella sits in the phases
- Why your records live in someone else's filing cabinet
- What a defensible legionella record set looks like
- The five failure modes I see again and again
- Your 90-day records audit
- What tradespeople are saying
- Recommended videos
- Frequently asked questions
- My verdict
The gap nobody thought to audit
Years ago I sat on my lounge floor with hundreds of periodic inspection reports spread out around me, checking each one by hand. It was one constant stream of deja vu. Same missing fields, same skipped observations, same certificates that looked fine on the front page and fell apart the moment you read the detail. That is the moment I stopped trusting the front page of a compliance document, and it is exactly the same problem I am watching play out with legionella records right now.
Here is the thing decision-makers keep getting wrong. They treat legionella as done because a spreadsheet somewhere has a green cell against every property. A green cell is not a record. A green cell is somebody's summary of a record they have never actually read, produced by a contractor they have never actually audited. When the Regulator asks you to evidence your water safety, or a tenant's solicitor does, you do not get to show them the spreadsheet. You have to produce the risk assessment, the written scheme, the monitoring logs and the remedial evidence. Most landlords go looking and discover the trail runs cold.
I have spent my career at this junction between the frontline and the boardroom, and I ran all the electrical and cyclical services for a local authority before I built a business out of reading compliance data for a living. So when I tell you the social housing sector has a legionella records problem, it is not a hunch. It is what the data looks like across the portfolios I see. And it matters now more than it ever has, because the ground under compliance has shifted.
Compliance is not assurance
This is the line I repeat until people are sick of hearing it. Compliance to something does not mean it is safe. I have seen a housing provider's legionella management look immaculate on paper, records showing weekly flushing carried out on the dot, and then the outlet temperatures on an independent test told a completely different story. The record said one thing. The water said another. Only one of them can hurt your tenant.
What Awaab's Law actually changed
Awaab's Law is named after Awaab Ishak, a two-year-old boy who died in December 2020 after prolonged exposure to mould in his family's social housing flat in Rochdale. The law that carries his name flows from the Social Housing (Regulation) Act 2023, and it does something the sector had never faced before. It writes fixed repair timescales into social tenancy agreements as implied terms. That single move is the whole story.
Before Awaab's Law, if you were slow to deal with a hazard, a tenant's route was a complaint, then the Housing Ombudsman, then maybe enforcement. Now the timescale is a term of the contract. Miss it and the tenant can take you to court for breach, and the court can order the works and award compensation. If you cannot make the home safe inside the deadline you have to offer suitable alternative accommodation at your own expense. The Regulator sits on top of all of it and can impose unlimited fines for a serious failure. This is not a nudge. It is a legal lever placed directly in the tenant's hand.
It arrives in phases, and the phasing is where a lot of people have switched off too early. They saw damp and mould, decided it did not touch water safety, and moved on. That is a mistake. Read the trajectory.
Phase 1 in force
Significant damp and mould, plus emergency hazards, now carry fixed statutory timescales. Emergencies must be made safe within 24 hours. The clock is a contractual term, not a target.
Phase 2 in force
Seven more hazard groups join: excess cold, excess heat, falls, structural collapse, fire and explosions, electrical hazards, and domestic and personal hygiene. The record-keeping culture tightens across the board.
Phase 3 in force
Awaab's Law extends to all remaining HHSRS hazards that present a significant risk, with overcrowding the only exclusion. Water safety and the biological hazards that legionella belongs to are inside that final sweep.
So the honest summary is this. Legionella is not in Phase 1 and it is not in the seven hazards landing in November 2026. It comes in with Phase 3 in 2027. But do not read that as a reason to relax, because your legionella duty already exists in full, today, whether Awaab's Law names it or not. What Phase 3 does is bolt legionella onto the same court-enforceable, deadline-driven, evidence-hungry machine that damp and mould are already inside. The records you cannot produce in 2027 are the records you should be building in 2026.
The clock you are not watching
Every phase of Awaab's Law raises the bar for what counts as an acceptable record and how fast you have to lay hands on it. If your legionella evidence is already thin, Phase 3 does not create the weakness. It exposes it, in front of a court, on a deadline. You have the run-up to 2027 to close the gap. That is not a long time in a portfolio of thousands of homes.
Where legionella sits in the phases
Let me clear up the regulation, because this is where people tie themselves in knots. Your legionella duty does not come from Awaab's Law and it never has. It comes from the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations. The practical detail sits in the HSE's Approved Code of Practice, ACoP L8, and the technical guidance in HSG274. If you own, manage or control premises with a water system, you are the dutyholder. Councils and housing associations are squarely caught. There is no domestic exemption that lets a social landlord off.
What the dutyholder has to do is not complicated to say. Carry out a suitable and sufficient risk assessment. Put the control measures into a written scheme. Implement it. Keep it under review, and review it whenever the water system, the management arrangements or the property itself changes. Keep the records. That is the whole shape of it. The difficulty is never the concept. The difficulty is proving, years later, that every one of those steps actually happened at every property.
Layer on the Regulator's own consumer standards and the picture sharpens. Since April 2024 the Safety and Quality Standard requires registered providers to hold an accurate, up to date and evidenced understanding of the condition of their homes. Read that phrase slowly. Evidenced. Not asserted, not assumed, not summarised in a green cell. Evidenced. The Regulator has written the records problem straight into the standard, and legionella is one of the safety areas it expects you to evidence.
Legionella is rare, and that is the trap
There were 472 legionellosis cases reported in England and Wales in 2024, down on the year before. Rare, yes. But it kills, and it kills the exact people social housing shelters most: the elderly, the immunocompromised, residents of sheltered schemes with stored and blended water. Rarity is why legionella gets treated as a tick-box. Rarity is also why, when a case does land, the investigation goes straight to your records. And that is the day the gap stops being a paperwork issue and becomes a coroner's question.
Why your records live in someone else's filing cabinet
Here is the structural problem, and it is the reason I built a company around it. You do not produce your own legionella records. Your contractor does. The water hygiene firm turns up, does the risk assessment, runs the monitoring, carries out the remedials, and hands you a document. You file the document. Multiply that across a portfolio and across a decade of different contractors, different templates, different competence levels, and you end up with an archive that is technically complete and practically unusable.
The risk assessment from 2019 is a scanned PDF. The 2022 one is a different contractor's proprietary format. The temperature logs are in a monitoring platform you no longer have a login for because that contractor lost the framework. The remedial from last spring is an email attachment in a shared inbox. None of it is wrong, exactly. It is just scattered, unversioned, and impossible to interrogate at portfolio scale. When I say the records live in someone else's filing cabinet, I mean it almost literally. The knowledge of what is actually going on with your water systems is distributed across contractors who have no obligation to make it legible to you.
I wrote about this exact pattern in the context of AI document extraction, because reading these documents at scale is the only way to find the gaps before someone else does. The lesson is always the same. The certificate says the job is done. The detail underneath it is where the risk hides. If you have never had a human, or a properly built system, actually read the body of every legionella document you hold, you do not know what you have. You know what your spreadsheet claims you have.
The question that exposes the gap in five minutes
Pick three properties at random. Ask for the current legionella risk assessment, the written scheme, the last two rounds of monitoring data and evidence that every remedial action from the last assessment was closed out. Time how long it takes and count how many of the four you actually receive. If it takes longer than a day, or you get three out of four, you have found your audit gap. Now imagine doing that for a solicitor, on a deadline, for a property where a tenant is unwell.
This is the same records discipline I hammered on when I wrote about the 30-year liability window in the Building Safety Act. Different regulation, identical failure mode. The work might have been done perfectly. If you cannot produce the evidence when it is demanded, the quality of the work stops mattering.
What a defensible legionella record set looks like
Enough diagnosis. Let me tell you what you should actually be holding for every water system you are responsible for. This is the structure I would build a portfolio around, and the retention periods reflect both the legionella guidance and the reality that a tenant claim under Awaab's Law can come at you long after the work.
| Record | What it must actually show | Keep it for |
|---|---|---|
| Legionella risk assessment | Named competent assessor, date, the specific water system surveyed, hazards identified, and clear control recommendations. Not a template with the address changed. | Life of the assessment plus the next two, minimum |
| Written scheme of control | How each identified risk is controlled, by whom, at what frequency. Written against the current HSG274, not a decade-old version. | Life of the water system |
| Monitoring and inspection logs | Temperature readings at sentinel outlets, tank checks, flushing of infrequently used outlets, all dated and attributable to a person. | At least 5 years |
| Remedial actions and close-out | Every action the assessment raised, who did it, when, and evidence it is actually finished. An open action with no close-out is a live liability. | At least 5 years |
| Review trigger log | Record of system changes, void turnovers, complaints or works that should have prompted a reassessment, and whether one happened. | Life of the water system |
| Contractor competence evidence | Proof the firm and the individual doing your assessments are actually competent. If you cannot evidence competence, you cannot rely on the assessment. | Duration of engagement plus 6 years |
Notice what runs through every row. A date. A named person. A closed loop. That is the difference between a record and a piece of paper. A record tells a story that a competent stranger can follow and verify years later. A piece of paper asserts that something happened and asks you to take it on trust. The Regulator does not take things on trust anymore, and neither does a tenant's solicitor.
The cost of getting this right is trivial next to getting it wrong
Structuring your legionella records properly is mostly organisation, not spend. Set the standard, hold contractors to it, and digitise what you already own. Against that, put a court-ordered repair, compensation, alternative accommodation at your expense, and an unlimited Regulator fine, before you even count the reputational damage. There is no version of this maths where the records discipline is the expensive option.
The five failure modes I see again and again
Across the portfolios I look at, the same handful of failures come up over and over. None of them are exotic. That is what makes them dangerous, because familiarity breeds the assumption that they are fine.
One. The assessment that never got reviewed. A risk assessment done in 2018, never revisited, on a building that has had a new boiler, a void refurb and two changes of managing agent since. ACoP L8 is explicit that a material change triggers a review. No review means the assessment is describing a building that no longer exists.
Two. The open remedial. The assessment flagged a redundant dead leg, or a tank in poor condition, and recommended action. Nobody can evidence the action was ever done. An open action sitting in a file for years is not a paperwork problem. It is documented proof you knew about a risk and did nothing.
Three. The scheme written against yesterday's guidance. A written scheme built on a superseded version of HSG274 Part 2 looks thin to any competent assessor the moment they open it. Keeping the technical reference current is part of the duty, not an optional refinement.
Four. The green cell with nothing behind it. The compliance dashboard says complete. The underlying document is missing, corrupt, or belongs to a contractor who is long gone. The organisation believes it is compliant because nobody has ever tested the claim against the actual file.
Five. The competence you assumed. You never checked whether the person doing your assessments was actually competent to do them. If you cannot evidence their competence, you cannot lean on their assessment when it matters, and the duty bounces straight back to you. This is exactly why the wider push for higher qualification standards across inspection work matters here too. Competence you cannot prove is competence you do not have.
Your 90-day records audit
You cannot fix a portfolio overnight, and I am not going to pretend you can. But you can run a structured audit that tells you the size of your problem and starts closing it. Here is how I would spend the next 90 days if the legionella records were my responsibility.
Days 1 to 15. Establish the true baseline. Pull your compliance dashboard and treat every green cell as unproven until you have seen the document behind it. Sample properties across your different building types and different historic contractors. You are not auditing the water systems yet. You are auditing whether the evidence exists and whether you can lay hands on it. Read the guidance on the HSE legionella pages so your team is measuring against the actual duty, not a memory of it.
Days 16 to 45. Map the contractor sprawl. List every firm that has produced legionella documents for you in the last six years. Track down the monitoring platforms, the logins, the shared inboxes. Get the raw data back into your possession, in a format you own, not one a contractor controls. Where a contractor is gone, this is where the real gaps surface. Better you find them now than a solicitor finds them for you.
Days 46 to 75. Test the substance, not the cover page. For your sampled properties, read the body of the documents. Are the assessments current. Are the remedials closed. Is the written scheme built on current guidance. Are the monitoring logs actually populated or full of gaps. This is the step people skip, and it is the only one that tells you the truth. The approach I set out for reading compliance documents at scale exists precisely because a human cannot read a portfolio's worth of PDFs by hand, and a green cell will lie to you all day.
Days 76 to 90. Set the standard and hold the line. Write down the record structure every contractor must deliver from now on, the one in the table above. Make it a condition of the next contract, not a polite request. Fix the highest-risk gaps first, sheltered schemes and communal systems ahead of low-risk single dwellings. And build the discipline of closing every remedial and logging every review trigger, so you never rebuild the same backlog. If you want the wider records mindset, the same logic runs through everything from CDM duties to fire safety obligations. The hazard changes. The need to prove what you did does not.
Do the audit before the deadline does it for you
The whole point of running this now, in the run-up to Phase 3, is that you get to find your gaps on your own terms, quietly, without a tenant, a solicitor or the Regulator standing over you. That is the difference between a managed programme and a crisis. Stick your head above the parapet and look properly at what you hold. It is far less painful than being shown it.
What tradespeople are saying
The confusion in the trade is real, and it tells you why the records culture is so patchy. Half the conversation online is people arguing about whether legionella assessments even matter for domestic property. That argument is exactly how you end up with a portfolio of thin records.
Recommended videos
If you want to level up your team's understanding of both the water safety duty and the Awaab's Law regime bearing down on it, these are worth an hour of anyone's time.
Legionella risk assessments
IOSH
Legionella: The Risks and Responsibilities
RSK Group
Legionella Duty Holder Training Course
Commodious
Awaab's Law: Major Changes for Social Landlords
Anthony Gold Solicitors
Awaab's Law: What It Means for Landlords and Tenants
Harrison Clarke Chartered Surveyors
Awaab's Law: What to Expect
Trinity Barristers Chambers
Frequently asked questions
No. Your legionella duty already exists under the Health and Safety at Work Act, COSHH and ACoP L8. What Awaab's Law does is change the consequences of failing it, by making repair timescales contractual terms a tenant can enforce in court, and by pulling the remaining hazards including water safety into that regime at Phase 3 in 2027.
Phase 3, from 2027, which extends the law to all remaining HHSRS hazards presenting a significant risk, with overcrowding the only exclusion. Legionella sits in that final sweep. That gives you the run-up through 2026 to get your records in order before the deadline machine is pointed at your water safety.
For most domestic systems, routine sampling is not required. The duty is to assess the risk, control it through a written scheme, and monitor. Testing comes into play in specific higher-risk situations. But do not let the no-testing point become an excuse for no records. The assessment, the scheme and the monitoring evidence are exactly what you have to be able to produce.
Monitoring and inspection records should be kept for at least five years, and I would hold risk assessments and written schemes for the life of the water system. Given a tenant can bring an Awaab's Law claim well after the event, err towards keeping more for longer. The cost of storage is nothing next to the cost of not being able to defend yourself.
No, and this is the dangerous assumption. You are the dutyholder. The duty to hold accurate, evidenced records sits with you, and the Regulator's Safety and Quality Standard says so plainly. If your contractor disappears with the data, the gap is yours. Get the raw records into a format you own, and never rely on a platform you do not control.
The open remedial. An assessment flags a risk, recommends an action, and nobody can prove the action was ever closed out. It sits in a file for years as documented evidence that you knew about a hazard and did not deal with it. Close every action, log the close-out, and never let one drift.
Risk-rank. Sheltered schemes, care settings and communal water systems first, because that is where the vulnerable residents and the complex systems are. Sample across your historic contractors to size the problem, read the substance of the documents rather than the cover pages, and set a mandatory record standard for every future contract. You will not fix it all at once, but you can stop it getting worse this quarter.
My verdict
Build the record you would want to defend yourself with
People can doubt what you say. It is much harder to doubt what you can prove. Legionella has been treated as the quiet compliance area for years, rare enough to tick and move on, and Awaab's Law is about to make that complacency very expensive. You do not need a panic and you do not need a huge budget. You need to stop trusting the green cell, read what your contractors have actually handed you, close the gaps on your own timeline, and set a records standard you enforce. Do that before 2027 and Phase 3 is a formality. Leave it, and you will be doing the same audit under a solicitor's deadline, for a tenant who is already unwell. I know which one I would choose.
