The HSE (Health And Safety Executive) has produced a document HSE274 Legionnaires' Disease Part 2 : The Control of Legionella Bacteria in hot and cold water systems (Previously ACOP L8).
This requires, employers or persons in control of a building, must ensure that where there is a risk of exposure to the legionella bacteria that may affect staff or members of the public, a sufficient assessment of that risk should be carried out, and suitable precautions taken.
HSE274 Legionnaires' Disease Part 2 : The Control of Legionella Bacteria in hot and cold water systems is enforceable under the Health and Safety at Work Act 1974 and the COSHH (Control of Substances Hazardous to Health) regulations.
The penalties for non-compliance include heavy fines and even imprisonment.