Can AI Write a Legionella Risk Assessment? Competent-Person Limits

AI can help draft the layout of a legionella risk assessment and turn findings into plain-English actions, but it cannot assess your water system. A competent assessor must inspect the system, own the findings and sign the report. You, as duty holder, review it, accept the actions and make sure they happen. AI is a tidy-up tool, not the assessor.

The temptation is understandable. A report can run to twenty pages of tables, and a model will produce something that looks like one in half a minute. Looking like one is the danger. A legionella risk assessment is a judgement about a real system, made from a real inspection, and the person who made it is accountable for it. AI has a useful place in the paperwork around that judgement and none in the judgement itself, and none of this is compliance advice.

Follow me on Instagram@sagnikteaches

What the duty holder is responsible for

If you are an employer or someone in control of premises, including a landlord, the regulator's guidance says you must identify and assess sources of risk, manage the risks, prevent or control them, keep the correct records and carry out any other duties you have. The guidance also says that all systems need a risk assessment, but not all need elaborate control measures: a simple assessment may show that risks are low and properly managed. Read the regulator's own page, "Legionnaires' disease: what you must do", and check the current text before you rely on anything here.

Connect on LinkedInSagnik Bhattacharya

That list is the duty holder's view, and it frames every use of AI. The assistant can help you with the paperwork parts of "keep the correct records". It cannot do the "identify and assess" part, because that needs eyes on pipes, tanks and outlets, and it cannot take over your accountability for the rest.

Subscribe on YouTube@sagnikteaches

What makes a system a risk: the facts the assessor looks for

The regulator describes a reasonably foreseeable legionella risk where a water system has a water temperature between 20 and 45°C, creates or spreads breathable droplets (aerosols, for example from showers or cooling towers), stores or recirculates water, or is likely to contain nutrients such as rust, sludge, scale and biofilm. The most common sources are cooling towers, hot and cold water systems and spa pools, with other sources including humidifiers, emergency showers and decorative fountains.

The same guidance sets out temperature control for hot and cold water. Cold water should be kept, where possible, below 20°C. Hot water should be stored at least at 60°C and distributed so it reaches 50°C within one minute at the outlets, or 55°C in healthcare premises; if you run a clinic, ask your assessor which figure applies to you. It also warns about scalding risk where taps deliver above 44°C to vulnerable people. These are the sort of figures an assessor reads against measured readings on site. They are also the sort of figures an AI will quote confidently from memory and sometimes get wrong, so check any number the assistant gives against the current regulator page.

Nine legionella tasks and who owns each

A good test is whether the task depends on something that exists only on site. If it does, the assistant cannot do it. If it is turning information you already hold into a clearer form, it can.

Doing the assessment yourself or appointing an assessor

The regulator's guidance says duty holders may carry out the assessment themselves if they are competent to do so, and otherwise should appoint someone who is. Competence here means enough training, experience and knowledge of the system to assess it properly. It is not a status a software tool can have, and a vendor's claim that its product produces a "compliant" assessment does not change that. A duty holder who relies on a generated report with no site assessment behind it holds a document, not an assessment.

When you appoint an assessor, ask for evidence of training and experience, relevant industry membership or accreditation where the sector has it, professional insurance, and a sample report. Ask what they will inspect, how long they expect to spend on site, and whether they will leave you an action list with priorities. Ask also how they use AI themselves, if at all: an assessor may use it for report layout, which is fine, so long as they own the findings.

A sensible division of work for a small duty holder

1. Appoint the assessor and agree scope: which buildings, which systems, what is delivered, by when.
2. Prepare what you know: a plain description of the building, a list of outlets, tanks and any past reports, with no names or personal details.
3. The assessor inspects and writes the findings. That is the assessment.
4. Use AI for the tidy-up, working from the assessor's findings: a summary in plain English, an action register, a monitoring log layout.
5. The assessor checks the tidy-up against their findings and confirms nothing has changed in meaning.
6. The duty holder reviews, accepts and assigns owners with dates, and signs the acceptance.
7. The responsible person runs the routine checks and records real readings.

The AI step is the fourth. It is a convenience on top of a human assessment, never a replacement for one.

A physiotherapy clinic's findings turned into actions

Take an illustrative six-room physiotherapy clinic in a rented unit, with two staff showers, four hand basins, a small hot water cylinder and one rarely used outlet in a storeroom. The owner is the duty holder. She appoints an assessor, who visits for half a day, measures temperatures at outlets and notes findings. Here is an illustrative extract of the assessor's notes, and what AI is asked to do with it.

Notice how the assistant never decides anything. Where the assessor states a target or a recommendation, the assistant reports it. Where a figure matters, such as the 52°C cylinder, it appears in the register as the assessor wrote it. The clinic owner ends up with an action register of five lines, each with an owner and a due date, instead of reading a dense report.

Prompt: turn findings into an action register

Below are an assessor's findings from a legionella risk assessment of a small clinic.
Turn them into an action register with columns: reference, finding (use the assessor's own
wording), action in plain English, priority (use the assessor's priority; if none is
given write [ASSESSOR TO STATE]), suggested owner role, due date [DUTY HOLDER TO SET].
Do not add findings, temperatures, targets or regulations that are not in the notes.
Do not say whether anything is compliant. List any finding you could not turn into an
action as "Needs assessor clarification".

FINDINGS:
[paste the assessor's notes, with no names or addresses]

The two flags, [ASSESSOR TO STATE] and [DUTY HOLDER TO SET], make the assistant leave visible gaps instead of filling them. Notice also the ban on adding targets: the model may know a typical temperature, but the one that applies to your system is the assessor's call.

Translating the assessor's jargon, with their approval

Reports often use words that a busy owner skips. An illustrative before and after:

Assessor's wording: "Distal outlet on the first-floor spur shows insufficient temperature recovery; recommend investigation of circulation and balancing."

Plain version (for the assessor to confirm): "The tap furthest from the boiler does not get hot enough. Have a plumber check the hot water circulation and balance it, then re-test."

The second helps the owner brief a plumber and recognise when the job is done. It is only safe if the assessor reads it and agrees it says the same thing. Send both versions to the assessor and ask for a yes.

Monitoring logs: where AI saves real time

Routine checks are the long, dull part of legionella control, and where a drafting tool earns its place. Ask the assistant for a monthly log: date, outlet reference, hot temperature after one minute, cold temperature after the run time the assessor specifies, who measured, the instrument used and a remarks column. Add a column for "outside the assessor's range: action taken". Use the assessor's actual ranges and frequencies, not ones from the chat.

The assistant can also draft reminders: an email to the responsible person on the first of each month, a calendar entry for the annual review, a renewal date for the assessor's contract. The contract renewals tutorial shows how to track those dates. The readings themselves come from a thermometer on site, entered by a person, never from the model. An illustrative failure: a pre-filled log, "to save time", with temperatures that look right and were never measured. That is a false record, and it is worse than a blank one.

Where AI goes wrong with legionella

Confident wrong figures. Models recall temperatures, frequencies and clause references from general text, and they mix up systems, buildings and guidance editions. Do not let any figure in the report come from the assistant. Compare each with the regulator's current page, or leave it to the assessor.

Invented findings. A prompt that says "write a legionella risk assessment for a clinic" produces generic findings about generic pipes. If someone pastes that into a report as if it were observed, it is a fabrication. See the tutorial on AI hallucinations for why this happens and how to catch it.

"Compliant" language. Models like to end with "this assessment is compliant with current regulations". Strip the sentence. Only a competent assessor can make a judgement like that, and only about what they inspected.

Missing the unusual. Systems with a spa pool, a humidifier or a rarely used shower have particular risks. A generic draft ignores them. The assessor must name each system on site and the duty holder must tell the assessor about every one.

A landlord with eight flats

An illustrative second case: a landlord owns a converted house with eight flats, a shared cold water tank in the loft and individual combination boilers. The regulator's guidance on landlords' responsibilities says most landlords can assess the risk themselves and do not need to be professionally trained or accredited, but can arrange for someone else to do it if they do not feel competent. With a shared tank feeding eight flats, this landlord appoints an assessor. The assessor surveys the shared tank, the pipework and a sample of flats. The landlord then asks the assistant for a tenant letter explaining a planned flushing programme and access visit. The assistant drafts a short, polite letter with the date and time left as placeholders. The landlord checks the facts with the assessor, fills the dates and sends it. The tenants get a clear message; the assessor's findings stay unchanged.

Use AI to prepare for the assessor's visit

A prepared duty holder gets a better assessment in less time. Ask the assistant to build a pre-visit pack from facts you already know, and give it to the assessor in advance. An illustrative prompt for an IT support firm that rents a small office floor with a kitchenette, a shower used by cyclists and a long-unused cleaner's sink:

I am the duty holder for a small office floor. Make a pre-visit checklist for a water
hygiene assessor. Include: a table of every water outlet I know about (location, type,
how often used, hot and cold), questions I should ask the landlord about shared tanks
and pipework, documents I should gather (previous reports, plumbing drawings, servicing
records), and a list of things the assessor may want access to. Do not say what the
risks are or what temperatures are required; the assessor will decide.

The output is a one-page pack. The owner fills the outlet table by walking the floor, which usually turns up one forgotten outlet, here the cleaner's sink that nobody has run for months. Telling the assessor about it in advance saves a return visit, and it is the kind of detail that shapes the findings.

Questions to put to a prospective assessor

AI can also help you compare quotes by turning a messy pile of replies into a table, provided you have asked every assessor the same questions. Useful ones: what training and experience do you hold; which systems have you assessed that resemble mine; what will you inspect and measure on site; how will the report separate findings from recommendations; will you give priorities and a suggested review interval; who signs the report; what is not included in the fee; and do you offer follow-up if I act on the actions. Paste the replies into the assistant and ask for a side-by-side summary with gaps flagged. Choose on competence and clarity, not on the cheapest fee or the longest report.

Records you should keep, and where

The regulator's records page says that if you have five or more employees you must record the significant findings, including the people identified as particularly at risk and the steps taken to prevent or control the risks. Keep the signed assessment, the assessor's evidence of competence, the action register with dates closed, the monitoring logs with real readings, and a list of changes to the system. Name files with dates, for example legionella_assessment_clinic_2026-11-05_signed.pdf. If AI helped with the tidy-up, keep the assessor's original report separate and unaltered; the tidy version is a convenience. An inspector or insurer will ask for the original, the actions and the monitoring, in that order.

Keep personal data out of chats: no residents' names, no medical details, no addresses. Use a business plan where you can: the vendors say ChatGPT Business and Gemini in Workspace do not train on business content by default, and a personal plan's training switch should be off before you paste anything. Re-check the terms whenever the plan changes. For the wider compliance picture, the AI compliance checklist for small businesses sets out what applies to you.

Three hours of clerical work cut to forty-five minutes

An illustrative duty holder spends about three hours turning a long assessor's report into an action register and a monitoring log layout by hand. With the prompt above, it takes about 15 minutes to draft and 30 minutes to check against the report, roughly 45 minutes in total, and most of that is the check. The saving is about two hours per report. It is small, and sensible: the assessor's fee covers the expert work, and the AI covers the clerical part.

Seven duty-holder steps for this month

1. Confirm who the duty holder is for each building, and write it down.
2. Check the date of your last assessment and what it said about the review interval.
3. If there is none, or it is out of date, appoint a competent assessor and agree scope.
4. After the visit, give the findings to the assistant with the register prompt; remove any wording it added.
5. Send the tidy-up to the assessor for a yes; fix anything they flag.
6. Assign owners and dates, sign the acceptance and start the monthly log with real readings.
7. Set a reminder for the review date.

The pattern is the same one used for other safety paperwork. The backflow testing tutorial applies it to reminders and reports for another water test, and the tutorial on legal tasks to keep away from AI explains why judgement and sign-off stay with a qualified person. The less the assistant is asked to decide, the more use it is.

Duty-holder questions about legionella and AI

Can I do my own legionella risk assessment with AI?

The regulator's guidance says a duty holder may carry out the assessment themselves only if they have the competence to do it, otherwise they should appoint someone who does. A chat assistant cannot supply that competence, because it cannot inspect your system. Read the current guidance and, if you are unsure, appoint a competent assessor.

What can AI safely help with in a legionella report?

Structure, plain-English wording of actions, a tidy action register, reminder schedules and drafts of routine monitoring logs. It should work from the assessor's findings or your own recorded readings, never from guesses about the system. Everything it produces is checked by the assessor or the person responsible for the system.

Who signs a legionella risk assessment?

The competent assessor signs and dates the assessment as the author of the findings. The duty holder, the person with responsibility for the premises, should review it, accept the actions and record who is responsible for each one. Your own documents should say who those people are.

Should I give the AI my water temperatures and site layout?

Temperatures and system descriptions can be useful, but leave out names, addresses and any residents' details. Describe the building by type and the outlets by number. Keep the original readings in your own log, because the assessor and any inspector will want the source records, not a chat transcript.

How often does a legionella risk assessment need reviewing?

Review it when something significant changes in the building, the water system or who uses it, and on a schedule the assessor recommends for your system. Ask your assessor to state the review interval in the report rather than assuming a standard period.

Further reads

• A Simple AI Risk Register for Small Businesses (With Template) — Keep actions and owners in one simple register.
• Landlord Compliance Checklist: Track Gas Safety and EICRs With AI — Track landlord safety checks and renewal dates in one place.
• How to Draft Risk Assessments With AI and What a Human Must Check — Draft general risk assessments with AI, then check them.
• EICR Report Cover Note Template: Plain English With AI — Turn a technical report into a plain-English cover note.
• How to Write a Health and Safety Policy With AI and What to Check — Write the health and safety policy that names who does what.
• Can AI Write a Beauty Salon Risk Assessment? What It Must Not Skip — How to draft a salon risk assessment with AI by treatment, and the on-site checks, records and sign-off that a competent person has to do themselves.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: the health and safety regulator's published legionella guidance pages (what you must do; legionella risk in water systems; hot and cold water systems), read in November 2026; vendor help pages for ChatGPT and Gemini data controls. This tutorial is not compliance advice.