Inspections by installation
Legionella in business premises: Royal Decree 487/2022 covers the water supply, not just cooling towers and hotels
If your premises have hot water, showers, a spa, a cooling tower or misting units on the terrace, Real Decreto 487/2022 (the Spanish Legionella prevention regulation) requires you to control Legionella. The text sets no size threshold: the only exclusion is buildings used solely as housing. The holder chooses between a prevention plan (PPCL) and a health plan (PSL), and remains responsible even when a contractor does the work.
The short answer
The Legionella regulation in force is Real Decreto 487/2022 (Royal Decree 487/2022), in force since 2 January 2023 and amended by Real Decreto 614/2024. It replaced Royal Decree 865/2003, which has been repealed. It applies to the holder of any installation that uses water and can spread it as aerosols: the hot and cold water of a restaurant, the showers of a gym, the spa of a hotel, the cooling tower of an industrial unit, the fountain in the lobby or the garden sprinklers.
In practice it comes down to four things: a written plan adapted to your installation; temperature and disinfectant checks at the frequency set in annex IV; cleaning and disinfection at least once a year (twice for cooling towers); and Legionella tests in a laboratory with an accredited method. Everything is recorded and kept for five years.
What the rule says
La persona titular de una instalación de las previstas en el apartado 1 del artículo 3 estará obligada a controlar y prevenir la aparición y proliferación de Legionella. Para ello, podrá optar entre elaborar un PPCL o un PSL. ("The holder of an installation under Article 3(1) shall control and prevent the appearance and growth of Legionella. To that end, they may choose between drawing up a PPCL or a PSL.")
The PPCL (Plan de Prevención y Control de Legionella, the Legionella prevention and control plan) brings together an initial assessment with a drawing of the installation, the maintenance, treatment, sampling and training programmes, and the records (Art. 8(2)). The PSL (Plan Sanitario frente a Legionella, the Legionella health plan) starts from a risk assessment and allows the sampling frequencies to be adjusted (Arts. 9(2) and 13(1)); until it has been validated, the PPCL is kept (Art. 9(3)).
The holder is responsible, and the rule defines the holder as the owner or operator of the installation (Art. 2(18)). If the business is run by someone other than the owner of the premises, the operator is responsible "salvo que pueda acreditarse fehacientemente que dicha responsabilidad la tiene la persona propietaria" (unless it can be reliably proved that the owner bears that responsibility) (Art. 5(2)). Outsourcing the service does not exempt the holder: they remain responsible for ensuring the installation is not a risk to public health (Art. 5(10)).
Who it binds and from what threshold
The scope is set in Art. 3(1) and in annex I, which is a "relación no exhaustiva" (non-exhaustive list) of fifteen types of installation. The ones found in business premises are these:
- Domestic water supply, hot and cold: the taps and showers of any premises, the kitchen included.
- Cooling towers and evaporative condensers, common in industrial units and in the air conditioning of large office buildings.
- Spas, hot tubs and pools with jets or water features at 24 ºC or more, including swimming pools fitted with those devices.
- Terrace misting units (evaporative spray cooling devices), humidifiers, ornamental fountains, sprinkler irrigation and fire-fighting water systems.
- Vehicle washing, at petrol stations, car dealerships and units with their own fleet.
The text contains no threshold of floor area, power, capacity or number of taps that exempts business premises. The only exclusion is installations in buildings used solely as housing that do not affect the outside environment (Art. 3(2)). "Priority installations", which are asked to base their plan "preferiblemente" (preferably) on a PSL (Art. 9(4)), are healthcare, social care and prison facilities and any others the health authority designates (Art. 2(11)): a hotel, a gym or a school is not one by definition.
What is checked, how often and by whom
The frequencies are minimums: the plan can set more, never fewer (annex IV, part A(1)). On top of what the table says, any installation is cleaned and disinfected when it is first started up, after a shutdown of more than a month and after a repair or structural change (annex IV, part A(5)). The beach bar that closes for the winter has to do it before reopening.
| Installation | What is done | How often | Where |
|---|---|---|---|
| Domestic hot water | Temperature in the final storage tanks (60 ºC or more) and in the return circuit (50 ºC or more) | Daily | Annex IV, B.2 |
| Domestic hot water | Temperature in a rotating sample of taps and showers (50 ºC or more, reached within one minute) | Monthly; all of them over the year | Annex IV, B.2 |
| Domestic hot water | Draining the bottom of the storage tanks / sediment through the drain valves / condition of the tanks | Weekly / monthly / quarterly | Annex IV, B.2 |
| Water supply | Running the taps and showers in little-used areas for a few minutes | Weekly | Annex IV, B.1.3 |
| Water supply | Inspection, cleaning and disinfection of the whole installation | Yearly, never more than 12 months apart | Annex IV, B.1.1 |
| Water supply | Legionella and aerobic bacteria tests | Quarterly, and 15 to 30 days after each disinfection | Annex V, table 3 |
| Cooling tower | Cleaning and disinfection of the whole system / Legionella test / biocide, pH and temperature | Twice a year, preferably in spring and autumn / monthly / daily | Annex IV, C.1; annex V |
| Spa or hot tub | Recirculation before opening / Legionella test / full dismantling, cleaning and disinfection | Daily, 10 minutes before / monthly / every six months | Annex IV, D.1; annex V |
| Terrace misting units | Nozzle check / Legionella test | Monthly / every six months | Annex IV, E.4; annex V |
| Fountains, sprinklers, fire-fighting water | General inspection, cleaning and disinfection | Yearly | Annex IV, E.1 |
Minimum frequencies under a PPCL. Under a PSL, sampling frequencies may change according to the risk assessment (Art. 13(1)), and the health authority may ask for more (Art. 13(3)). Source: RD 487/2022, annexes IV and V, as worded by RD 614/2024.
Who does it. Your own staff can measure temperature, biocide or pH if they are in the training plan (Art. 18(3)). Cleaning and disinfection treatments require the SEA492_2 vocational qualification or the equivalent professional certificate (Art. 18(5)); certificates from the old courses were extended for five years (third transitional provision). A firm doing them must be registered in the Registro Oficial de Establecimientos y Servicios Biocidas, the ROESB (the official register of biocide services) (Art. 16(3)), and Legionella culture tests are done in a laboratory with an accredited method (Art. 12(1)).
Cooling towers and evaporative condensers must also be notified to the health authority of the autonomous community, electronically and using the form in annex II, within one month of being put into operation or of a change affecting the system, and within one month of being decommissioned (Art. 5(3)).
What paperwork is kept
The plan's documents and records are kept at the installation itself, available to maintenance staff, contracted firms and the health authority (Art. 8(4)), preferably in electronic form, and are retained "durante, al menos cinco años desde su generación" (for at least five years from when they were produced) (Art. 8(5)). They must show every check and its result, any incidents, the measures taken and also the dates the installation was shut down and restarted, with the reason (Art. 8(2)(c)). Each cleaning and disinfection leaves a record or certificate following the template in annex X, whether your staff or a firm does it (annex IV).
If a test comes back bad, the rule says what to do (annex VIII). In the water supply, with 1,000 CFU/L of Legionella or more: immediate review of the plan, cleaning and disinfection of the system, new sampling after 15–30 days and, if necessary, shutting the installation down and informing users. In a cooling tower, at 10,000 CFU/L or more, it is stopped, drained and disinfected before being restarted. In a spa or hot tub, at 1,000 CFU/L or more, it is also stopped.
What the rule does not say
Worth knowing
There are no longer "higher risk" and "lower risk" installations. That classification came from Art. 2(2) of Royal Decree 865/2003, now repealed. Annex I of RD 487/2022 is an open list, and the only special category is the priority installations of Art. 2(11). Nor does the rule require you to hire a firm: the holder can use qualified in-house staff. And sampling by an accredited body (Art. 11(5)) is not required until 1 January 2030 (sixth transitional provision).
A residents' association with central hot water is excluded if the building is used solely as housing and the installation does not affect the outside environment (Art. 3(2)), although the health authority can require measures if it suspects a risk. The rule does not say what happens in a building with both flats and commercial premises, or with the sprinklers of a communal garden: in those cases, ask the health authority of your autonomous community.
What depends on the autonomous community
RD 487/2022 is a basic national rule (first final provision). The health authority of each autonomous community, or the local authority, inspects, receives the cooling tower notifications and can ask for more samples or more frequent sampling (Arts. 2(3), 10 and 13(3)), and it can also require other installations to be notified (Art. 5(6)). Before you sign off your plan, check whether your region has its own rules or guidance: they may ask for more than the national text.
What this means for each type of business is on the pages for hotels, gyms, restaurants and industrial units. The cooling tower shares a plant room with the RITE, and a pool with jets shares rules with swimming pools.
Frequently asked questions
Which Legionella regulation applies today in Spain?
Royal Decree 487/2022 of 21 June, in force since 2 January 2023 and amended by Royal Decree 614/2024. It repealed Royal Decree 865/2003. It requires the holder of any installation that uses water and can form aerosols to have a prevention plan (PPCL) or a health plan (PSL), to carry out the checks in annex IV and to test for Legionella at the frequency set in annex V.
Do a restaurant or a shop have to comply with RD 487/2022?
If they have a water supply, yes: taps and showers are "sistemas de agua sanitaria" (domestic water systems) under annex I, and the text sets no size threshold that exempts business premises. The only exclusion is buildings used solely as housing (Art. 3(2)). A restaurant with misting units on its terrace adds another installation: a monthly nozzle check and a Legionella test every six months.
What temperature must the hot water be?
60 ºC or more in the final storage tanks and 50 ºC or more in the return circuit, checked every day; and 50 ºC or more at taps and showers, checked every month in a rotating sample that covers all of them over the year. The temperature must stabilise within one minute (annex IV, part B.2, of RD 487/2022).
How often must you test for Legionella?
Under a PPCL, the water supply every three months; cooling towers and spas every month; misting units every six months; and fountains, sprinklers or fire-fighting water systems once a year (annex V, table 3). Also between 15 and 30 days after each cleaning and disinfection. Under a PSL, the frequencies may change according to the risk assessment, and the health authority may ask for more.
Does a residents' association with a central boiler need a Legionella plan?
Under the national rule, no, if the building is used solely as housing and the installation does not affect the outside environment: Art. 3(2) of RD 487/2022 excludes it. Even so, if a risk is suspected, the health authority can require control measures. The rule does not say what happens in a building with shops or offices: it is worth asking the health authority of your autonomous community.
How long must Legionella records be kept?
For at least five years from when they are produced, under Art. 8(5) of RD 487/2022. They must be kept at the installation itself, available to maintenance staff, contracted firms and the health authority, preferably in electronic form, and record the checks, their results, any incidents, the measures taken and each shutdown and restart with its reason.
Where it usually applies
- Restaurants and barsThe obligations of a restaurant or a bar in Spain: what is specific to the kitchen and the checks on the premises, each with the condition that triggers it, how often it applies and its article.
- GymsA gym: no national law; qualifications, insurance and notices under each region's sports professions act, plus low voltage, Legionella, pool, RIPCI and defibrillator as premises.
- HotelsA hotel: guest register and reporting within 24 hours, regional classification, low voltage and lift as a public-assembly venue, RIPCI, Legionella, pool, kitchen and defibrillator.
- OfficesThe obligations of an office in Spain: temperature and upkeep of the premises, screen work, health and safety, coordination with contractors, internal reporting channel, right to disconnect and building checks.
- SchoolsA school: minimum facilities, protocols against violence and a wellbeing coordinator, canteen and menus from April 2026, self-protection and the building inspections.
- Industrial unitsAn industrial unit: fire inspection every five years under the 2025 regulation, chemical storage (APQ), air receivers, work equipment, low voltage, cooling towers and self-protection.
Other mandatory inspections
- Fire protection (RIPCI)RIPCI checks: quarterly by the owner, yearly and five-yearly by the maintenance company, records kept for five years and an inspection every ten years, with its exemptions.
- Self-protection planWho needs a self-protection plan under the Basic Directive in force since 11 October 2026, what it contains, how often it is reviewed and what the regions add.
- Low-voltage inspectionInspection by an accredited body every 5 years for the premises in ITC-BT-05 (bars, restaurants and hotels always) and every 10 years for residential common areas over 100 kW.
- Thermal installations (RITE)Maintenance company from 5 kW; contract, annual certificate and efficiency inspection every 4 years above 70 kW, with the minimum intervals of table 3.1.
- Lift inspectionWhat ITC AEM 1 (Royal Decree 355/2024) requires of a lift's holder: a contract with a lift maintenance company, monthly servicing, a periodic inspection every 2, 4 or 6 years and deadlines for defects.
- Swimming poolsWhat Royal Decree 742/2013 requires by type of pool: self-monitoring, daily and monthly checks, information for users and incidents, and what it leaves to the autonomous communities.
- HACCP (APPCC)What Article 5 of Regulation 852/2004 requires of a bar, a restaurant or an institutional kitchen in Spain: the seven principles, the records, the flexibility and what is no longer in force.
- Defibrillator (AED)What the Spanish national rule on defibrillators requires, and who must have one in Madrid, Catalonia, Andalusia and the Basque Country, with each threshold and article.