Home / Guides / Legionella regulations
Legionella · South African law · HBA Regulations 2022
Key facts
- Main law OHS Act 85 of 1993, sections 8, 9, 14 and 16
- Regulations HBA Regulations, 2022 (GN R. 1887, 16 March 2022)
- Classification Legionella spp., Risk Group 2
- Risk assessment by a competent person, reviewed at least every 24 months
- Training before possible exposure, refresher every year or as the health and safety committee or representative recommends
- Records risk assessments and monitoring kept at least 40 years
- SANS 893 voluntary national standard, Parts 1 and 2 (2018)
- Notification legionellosis is Category 2: within 7 days, by the doctor or laboratory
Turn the regulations into a working plan for your site
Legionella Responsible Person Training takes you through every duty in the HBA Regulations as it applies to a water system, then has you build a full risk assessment and water management plan for a 140-room hotel. Ten hours, online, R2 950, HPCSA CPD accredited.
What does South African law require for Legionella?
Start with the Act, because everything else hangs off it. Section 8 of the OHS Act requires every employer to provide and maintain, as far as reasonably practicable, a working environment that is safe and without risk to the health of employees. Section 8(2) spells out what that means in practice: identify the hazards, decide on the precautions, and give people the information, instruction, training and supervision to work safely.
Section 9 is the one hotels, care centres and property owners forget. It requires employers and the self-employed to run their undertakings so that people who are not their employees are not exposed to hazards to their health or safety. A guest in a shower, a resident in an assisted bath, a diner on a terrace downwind of a cooling tower and a member of the public walking past a building’s drift are all section 9 people.
Section 14 puts a duty on every employee to take reasonable care and to co-operate. Section 16 makes the chief executive officer responsible for seeing that the employer’s duties are properly discharged. The CEO may assign duties to someone else under section 16(2), and that is how most sites appoint a Legionella responsible person, but the assignment does not take the responsibility away from the employer. Who carries which duty, from the CEO to the contractor, is set out in who is responsible for Legionella.
Is Legionella a hazardous biological agent under South African law?
Yes. The Regulations for Hazardous Biological Agents, 2022, published as Government Notice R. 1887 in Government Gazette 46051 on 16 March 2022, list Legionella spp. in Annexure A, Table 3, as a Risk Group 2 agent. A Group 2 agent may cause human disease and be a hazard to exposed people, is unlikely to spread to the community, and usually has effective prophylaxis or treatment.
Two things trip people up here. First, these 2022 regulations replaced the Regulations for Hazardous Biological Substances of 2001 (GN R. 1390). If a risk assessment, a contractor’s report or a policy still cites the 2001 regulations, it is out of date. Second, you will see websites claim that Legionella moves to Group 3 when immunocompromised people are present. The 2022 regulations do not say that. They keep it at Group 2 and require the risk assessment itself to deal with pregnant, immunocompromised and vulnerable employees.
The regulations never use the words water, aerosol or cooling tower. They apply wherever a hazardous biological agent is produced, processed, used, handled, stored or transported, or where exposure to one may occur. That last phrase, “where exposure may occur”, is how most competent persons read them as applying to building and process water systems, from a hotel’s showers to a dairy’s evaporative condensers. It is a reading of the scope wording, so say so when you put it in a policy.
What do the HBA Regulations require of a site with water systems?
This is the table I give general managers who ask what they actually have to show an inspector. The right-hand column is the record that proves you did it.
| Regulation | What it requires | What it means for your water systems | The record that proves it |
|---|---|---|---|
| 4(1) | Tell the health and safety representative or committee beforehand, and share the results | Your H&S reps know the assessment, sampling and training are happening | Committee minutes, a signed circulation list |
| 4(2) to 4(4) | Train exposed employees in theory and practice, before possible exposure (4(3)), with a refresher every year or at intervals the health and safety committee or representative recommends (4(4)) | Maintenance, housekeeping, spa, kitchen and plant staff trained before they flush, clean or work near spray | Training records, kept as long as the person is employed |
| 6 | A documented risk assessment by a competent person, then a documented action plan, reviewed at least every 24 months and on any trigger | Every system that can grow Legionella or release spray is assessed, including vulnerable people. See what the assessment must contain | The signed assessment and action plan, kept at least 40 years |
| 7 | A monitoring programme by a competent person at intervals set in the assessment, never more than 24 months | For water systems: temperature checks, disinfectant checks and sampling where it is needed | Monitoring reports, kept at least 40 years |
| 8 | Medical surveillance where the assessment shows a hazardous exposure or an occupational health practitioner recommends it | Risk based, not universal: there is no routine screening test for Legionella exposure | Surveillance records under the practitioner’s control |
| 10 | Reduce exposure, control it as low as possible, documented work procedures including maintenance of installations | Hot water stored hot, cold water kept cold, outlets flushed, towers treated, spray kept away from people | Written procedures and the water management plan |
| 11 | PPE and RPE where engineering controls cannot prevent exposure | Respiratory protection for cooling tower cleaning and similar work | PPE issue and fit records |
| 12 | Documented risk-based protocols for every control, a thorough examination and test at least every 24 months | The clearest legal hook for a written maintenance and verification scheme, laid out in our water management plan template | Protocols, examination and test records, repairs kept at least 5 years |
Where the regulations say 24 months, read it as a ceiling. A water system that is under control is checked weekly and monthly. Nobody keeps a hot water loop safe by looking at it every second year.
Is SANS 893 compulsory?
No regulation was found that incorporates SANS 893, and the HBA Regulations reference no SANS standard at all. SANS 893 is a voluntary South African National Standard in two parts, both in their second edition of 2018:
- SANS 893-1, Legionella, Part 1: Risk management. Guidance on managing the risk from Legionella in any work activity, and in trade or business premises, where water is used or stored and droplets that could be inhaled may be produced.
- SANS 893-2, Legionella, Part 2: The control of Legionella in water systems. Requirements for the design and management of cooling towers, evaporative condensers, hot and cold water systems and other systems that can create and spread inhalable droplets.
Voluntary does not mean optional in practice. When an inspector, an environmental health practitioner or a court asks whether your controls were “reasonably practicable”, the recognised national standard is the obvious yardstick, and a competent person will measure your site against it. The appointed responsible person should hold a licensed copy of both parts.
Your frontline staff must be trained before they are exposed
Regulations 4(3) and 4(4) are clear: training comes before possible exposure, with a refresher every year or at intervals the health and safety committee or representative recommends. Legionella Awareness Training gives maintenance, housekeeping, spa and plant staff the numbers, the checks and what to report, in four hours on a phone. R799 a person.
Who has to notify a case of Legionnaires’ disease?
Legionellosis is a Category 2 notifiable medical condition under the Regulations relating to the Surveillance and the Control of Notifiable Medical Conditions (GN R. 1434 of 15 December 2017, with Table 2 substituted in March 2025). Category 2 means written or electronic notification within 7 days of clinical or laboratory diagnosis.
The notifier is the health care provider or the laboratory that makes the diagnosis, not the hotel, the employer or the building owner. What the site must do is co-operate with the investigation that follows. Under the NICD’s guidance, two or more cases with an epidemiological link to one place, such as a hotel or health facility, within 12 months is a cluster. A cluster triggers a full environmental assessment, ideally starting within 24 hours, carried out by municipal environmental health practitioners.
That is when a site finds out whether its records are any good. The investigating EHP will ask for the risk assessment, the temperature logs, the flushing records and the contractor’s reports, for the weeks before the person fell ill. What the disease looks like, and who is most at risk, is in our guide to Legionnaires’ disease in South Africa.
What about hotels, pools and food premises?
Two other instruments touch water. The first is the National Environmental Health Norms and Standards for Premises and Acceptable Monitoring Standards for Environmental Health Practitioners (GN 7779, Government Gazette 55152, 7 August 2026), issued under the National Health Act. GN 7779 replaced the October 2025 norms (GN 6740), which had repealed the 2015 norms (GN 1229). It lists Legionella spp. in pool and hot bath monitoring at accommodation establishments. It sets Legionella monitoring monthly for hot tubs and three-monthly for public pools, a limit below 1 per 100 mL where Legionella is tested, and weekly draining and cleaning of hot tubs. For health establishments it requires hot water kept above 50 °C and cold water below 20 °C (8.2.9). It sets no cooling tower rules. Environmental health practitioners monitor premises against it. What that means for a hotel hot tub is in our hotel guide, and for a clinic or care centre in Legionella in hospitals, clinics and frail care.
R638, the food premises hygiene regulations of 2018, requires potable water that complies with SANS 241, hot and cold water at wash-up facilities, and hot water at hand-washing facilities where possible. R638 does not mention Legionella and sets no water temperatures. A food plant’s Legionella duties come from the OHS Act and the HBA Regulations, not from R638. Our guide to Legionella in the food industry shows what that means for cooling plant, washdown and reused water.
Who enforces the Legionella rules?
- Department of Employment and Labour inspectors enforce the OHS Act and the HBA Regulations. They can enter and inspect, and issue prohibitions and directions to take corrective steps.
- Municipal environmental health practitioners monitor premises against the National Health Act norms and investigate legionellosis cases.
- The NICD runs national surveillance and supports outbreak response.
On penalties, the HBA Regulations make a breach of regulations 3 to 15 an offence, with a fine or up to 12 months’ imprisonment, plus up to R200 a day for a continuing offence, capped at 90 days. Section 38 of the OHS Act provides for fines of up to R50 000 or a year’s imprisonment for listed offences, and up to R100 000 or two years’ imprisonment, or both, where an employer negligently causes an injury (conduct that would have been culpable homicide had the person died). The fine is rarely the real cost. The cost is a closed hotel wing, a lost contract and a family’s questions.
Five mistakes I find in South African Legionella files
- Citing the 2001 regulations. They were withdrawn in 2022. Update the policy, the risk assessment and the contractor’s scope.
- The “Group 3” claim. The 2022 regulations list Legionella spp. as Group 2 and deal with vulnerable people through the risk assessment.
- Calling SANS 893 law. It is the benchmark, not the regulation. Say what it is and use it properly.
- Treating 24 months as the schedule. It is the longest allowed gap for a review, not the frequency of your checks.
- Outsourcing the duty with the work. A water treatment company can do the dosing and sampling. Section 37 presumes the employer liable for the acts and omissions of its employees and mandataries, such as contractors, unless it proves all three of these: it did not connive at or permit the act, the act was outside the person’s authority, and it took all reasonable steps to prevent it. A written instruction is not enough proof on its own. A written agreement with a mandatary under section 37(2) removes that presumption for the mandatary’s acts, but not the employer’s own duties under sections 8 and 9.
Enrol your team in Awareness Training (R799) →Start the Responsible Person course (R2 950) →
Related guides: who is responsible for Legionella, Legionella risk assessment in South Africa, the water management plan template, Legionella testing in South Africa and Legionnaires’ disease in South Africa. Try the free Risk Assessment and Water Management Plan Builder, then learn the method behind every rating in the Responsible Person course.
Frequently asked questions
Is there a specific Legionella law in South Africa?
No single law. The duty comes from the OHS Act 85 of 1993 and the Regulations for Hazardous Biological Agents, 2022, which list Legionella spp. as a Risk Group 2 agent. SANS 893 Parts 1 and 2 are the voluntary national standard used as the benchmark.
Which HBA regulations apply to a building’s water systems?
Regulation 4 (training before exposure, with a refresher every year or at intervals the health and safety committee or representative recommends), regulation 6 (a documented risk assessment by a competent person, reviewed at least every 24 months), regulation 7 (monitoring), regulation 9 (records), regulation 10 (prevention and control) and regulation 12 (documented protocols and a thorough examination and test at least every 24 months). What the assessment must contain is set out in Legionella risk assessment in South Africa.
Is SANS 893 compulsory?
No regulation was found that makes it compulsory. It is a voluntary national standard, but it is the recognised benchmark a competent person, an inspector or a court will use to judge whether your controls were reasonably practicable.
Do staff need Legionella training?
Yes. Regulation 4 requires training in theory and practice for employees who may be exposed, before possible exposure, with a refresher every year or at intervals the health and safety committee or representative recommends.
Who notifies a case of Legionnaires’ disease?
The doctor or laboratory that diagnoses it, within 7 days, because legionellosis is a Category 2 notifiable medical condition. The site’s job is to co-operate with the environmental health investigation that follows.
How long must Legionella records be kept?
Under regulation 9, risk assessments and monitoring reports are kept for at least 40 years, records of examinations, tests and repairs of control measures for at least 5 years, and training records for as long as the person is employed.
Is Legionella Group 3 when vulnerable people are present?
No. The 2022 regulations list Legionella spp. as Group 2 and require the risk assessment to deal with pregnant, immunocompromised and vulnerable employees. There is no Group 3 rule in the regulations.
Get the duty, the plan and the records right in one course
Ten hours, online, built on the OHS Act and the HBA Regulations, 2022, with SANS 893 explained and a full hotel workshop that produces a risk assessment and water management plan you can adapt for your own site.
Start the Responsible Person course (R2 950) →Awareness Training for your team (R799)Self-paced, works on a phone. HPCSA CPD accredited. Certificate on passing.
Sources and further reading
- Regulations for Hazardous Biological Agents, 2022 (GN R. 1887)
- Occupational Health and Safety Act 85 of 1993
- Standards matters notice announcing SANS 893-1 and 893-2:2018
- Notifiable Medical Conditions, Category 2
- NICD recommendations for Legionnaires’ disease
- National Environmental Health Norms and Standards for Premises and Acceptable Monitoring Standards for EHPs (GN 7779, 2026)