Who Is the "Responsible Person" Under ACOP L8 — and What Are They Liable For?

Dupal UK — Compliance Team
2 days ago
4 min read

A surprising number of facilities and estates managers find out they're the “Responsible Person” for Legionella control the same way they find out about most compliance gaps — after an audit, an incident, or an inspector's question they weren't expecting. If that title is somewhere in your job description, or somewhere it should be, it's worth knowing exactly what it means before you're asked.

Duty Holder, Responsible Person, Deputy, Competent Person — who's who

ACOP L8 and HSG274 use several role titles, and organisations often blur them. In outline:

• Duty Holder — the organisation (or the person who represents it, such as an employer, landlord or managing agent) that has overall legal responsibility for the premises and the health and safety of people affected by it. This is usually the legal entity, not a named individual.

• Responsible Person — the individual given day-to-day responsibility, by the duty holder, for managing the risk from Legionella. ACOP L8 expects this to be someone with the authority, competence and resources to actually do the job — not a title added to someone's role without the means to carry it out.

• Deputy — often appointed to cover absence, particularly in larger or multi-site organisations.

• Competent Person — may be internal or external (a specialist contractor or consultant) and provides the technical expertise the Responsible Person draws on, such as carrying out the risk assessment itself.

On a larger site — a hospital, a multi-block student campus, a care group with several homes — these roles are often split across more than one person, coordinated through a Water Safety Group. On a smaller site, one person may hold several of these hats at once. Either way, ACOP L8 expects the lines of responsibility to be written down, not assumed.

What the Responsible Person actually does, day to day

Stripped of the legal phrasing, the role generally covers:

• Making sure the written scheme for controlling Legionella risk is actually being followed, not just filed

• Keeping (and being able to produce) records — risk assessments, monitoring results, cleaning and replacement logs, contractor reports

• Managing competence: making sure anyone carrying out monitoring, cleaning or maintenance is trained and, where relevant, that contractors are properly vetted

• Escalating problems — a missed flush, a temperature out of range, a system change — rather than letting them sit

• Reviewing the scheme when something changes: a refurbishment, an extended void period, a change in how a building is used

For showers specifically, that usually means the Responsible Person needs to be able to answer, for any outlet in the building: when was it last cleaned or replaced, by whom, and is it overdue? If the honest answer is “we'd have to check the spreadsheet,” that's a gap worth closing before an inspector finds it.

What they're actually liable for

It's worth being precise here rather than alarmist. Legal responsibility under health and safety law generally sits with the duty holder — the organisation. But the Health and Safety at Work etc. Act 1974 also creates duties that can fall on individuals, and HSE's enforcement powers aren't limited to fining organisations. Depending on the circumstances of a failure, HSE can:

• Improvement notices requiring specific action within a set time

• Prohibition notices stopping an unsafe activity or system from continuing

• Prosecution against the organisation and, in cases of individual negligence or an offence committed with the consent, connivance or neglect of a specific person, against that individual as well

None of this means every Responsible Person is one missed flush away from prosecution. Enforcement action follows a pattern of clear, often longstanding failure — not an isolated administrative slip. But it does mean the role carries real weight, and it's not one to take on without the resources, training and authority ACOP L8 says should come with it. If your job title includes “Responsible Person” but you've never actually been given the time, budget or training to do the job properly, that's worth raising with your duty holder directly — ACOP L8 expects that conversation to happen.

Making the role easier to actually do

Most of what makes this role stressful isn't the regulation itself — it's the gap between what a scheme says on paper and what's actually happening on 40, 200 or 2,000 outlets across a site. That gap closes fastest when compliance status is visible without having to go looking for it: colour-coded, dated shower heads and hoses that show at a glance whether an outlet is within its replacement window, rather than relying on a log that's only as good as its last update. It won't do the risk assessment for you, but it removes one of the most common reasons schemes quietly drift out of compliance between audits.

Key takeaways

• The duty holder is the organisation; the Responsible Person is the named individual with day-to-day responsibility — they're not automatically the same thing.

• ACOP L8 expects the Responsible Person to have real authority, competence and resources — not just the title.

• Individual liability is possible under HSWA 1974, but enforcement typically follows sustained, demonstrable failure rather than a single mistake.

• The most practical protection for a Responsible Person is a scheme where compliance status is genuinely visible, not just recorded somewhere.

FAQ

Can I be the Responsible Person for more than one site?

Yes, but ACOP L8 expects you to have the time and resources to manage each site properly. Spreading one person too thin across multiple sites without support is itself a compliance risk worth flagging to the duty holder.

Does appointing a contractor to do the cleaning make them the Responsible Person?

No. A contractor can be the competent person carrying out technical tasks, but day-to-day responsibility for managing the risk stays with the Responsible Person appointed by the duty holder.

What's the first thing to check if I've just been made Responsible Person?

Ask to see the current written scheme and the last 12 months of monitoring records. If either is missing, out of date, or you can't tell at a glance which outlets are compliant, that's your starting point.