The two main pieces of legislation are the Health and Safety at Work Act (1974) and the Control of Substances Hazardous to Health Regulation (1994).
Organisations that fail to comply with HSE ACoP L8 The Control of Legionella Bacteria in Water Systems may be prosecuted under either of these regulations.
Employers have a duty of care under the health and safety at work act to protect their employees and any one visiting their site or work place. They then have responsibility to make sure that their water systems are controlled from legionella.