5 Quick Checks Dutyholders Must Do on UK Disinfection Certificates
Yes, a disinfection certificate is required documentary evidence whenever a water system is chlorinated, thermally treated, or otherwise remediated under UK legionella compliance rules. It records what was done, when, and by whom, and it must sit inside your written scheme of control for at least five years under HSE ACoP L8. One certificate proves one intervention, though. It is not proof that your system stays under control afterwards.
TL;DR:
A disinfection certificate must include site details, method parameters, measurement evidence, and a signed competency statement to be accepted by inspectors.
Certificates are only necessary for specific situations such as commissioning, positive legionella test results, returning systems, and scheduled high-risk cleaning.
Proper disinfection methods require documented evidence of process specifics and follow-up sampling, usually tested at a UKAS-accredited laboratory.
The certificate should be issued by a qualified and competent person, with proof of training, method of works, insurance, and sampling chain of custody provided upfront.
Record retention must last at least five years, stored within the written scheme of control, and linked to system schematics and ongoing monitoring documents.
Table of Contents
Which disinfection methods are acceptable, and what evidence should they produce?
Who should issue the certificate, and how do you check competence?
Where does the certificate sit in your written scheme, and how long do you keep it?
How Bespoke Compliance Solutions documents disinfection works
How Bespoke Compliance Solutions can help with disinfection and certification
What a valid disinfection certificate must contain
A certificate that would actually survive scrutiny during an HSE inspection or an insurance audit needs specific, checkable detail, not a generic sign-off. Contractors working to HSG274 standards typically build certificates around four blocks of information.
Site and administrative details. The building name and address, the system identifier (which tank, which riser, which cooling tower), the date the work started and finished, and the names of the operatives who carried it out.
Method parameters. Whether the job was thermal or chemical, the target temperature or chlorine dose, the contact time held, and a list of every outlet or point treated. A certificate that says “system disinfected” without these figures tells you almost nothing.
Measurement evidence. Chlorine residual readings before and after dosing, sample reference numbers, a documented chain of custody, and confirmation the samples went to a UKAS-accredited laboratory.
Competency sign-off. The signatory’s name, role, a statement of their competence, and a reference to the method of works used. Without this, HSG274’s emphasis on named, competent persons goes unmet, and the certificate becomes weak evidence in front of an inspector.
When do you need a disinfection certificate?
Four situations trigger the need for formal disinfection evidence on a UK site, and missing any of them tends to be where compliance gaps first appear.
Commissioning. New pipework, altered mains, or systems returning from a build phase all need disinfection before handover, often referencing BS EN 806-5 or BS 8558 for procedure detail.
A positive legionella result. Any confirmed contamination demands remedial treatment and a certificate proving it happened.
Return to service. Systems left stagnant during closures, refurbishments, or major works need disinfecting before anyone uses them again.
Routine high-risk plant cleaning. Cooling towers and similar equipment need scheduled clean-and-disinfect cycles as part of ongoing control, not just reactive treatment.
Recognising these triggers early means you commission the right contractor before a minor issue becomes a notifiable one.
Which disinfection methods are acceptable, and what evidence should they produce?
UK sites generally use one of three approaches, and each one leaves a different evidence trail on the certificate.
Thermal disinfection. Calorifiers raised to 70°C or above, with outlets run at 60°C or higher for at least five minutes each. In healthcare settings, HTM 04-01 expects logged temperature readings per outlet, so a generic thermal certificate without that detail is a red flag on hospital or care sites.
Chlorination. Industry guidance commonly cites dosing to roughly 50 parts per million, held for around one hour, followed by flushing to safe residual levels. New mains work often needs trade effluent consent before flushing to drain, and the certificate should record the post-flush residual at the connection point.
Cooling towers. These need a mechanical clean to remove biofilm and scale before high-level disinfection, with the whole regime documented rather than treated as a single event.
Post-treatment sampling is where a lot of certificates fall short. HSE guidance recommends testing the same sample points that returned the original positive, culturing to ISO 11731 at a UKAS lab, with repeat sampling at two and six weeks where the risk assessment calls for it. A certificate dated the day of treatment with no follow-up sampling attached is only telling you half the story.
Who should issue the certificate, and how do you check competence?
The certificate needs a name attached to it, not just a company logo. It should be signed or formally authorised by the contractor or the responsible person who actually carried out or supervised the work, with a clear statement that they were competent to do so.
Before accepting any certificate, ask for:
Evidence of relevant training and qualifications for the operative named on the document.
A written method of works covering the specific system type being treated.
Current insurance covering the work carried out.
Confirmation that microbiological testing went to a UKAS-accredited laboratory, with sampling chain of custody recorded from swab to result.
Pro Tip: Request the method of works before the job starts, not after. A contractor who can’t produce one on request usually can’t produce a defensible certificate either.
Where does the certificate sit in your written scheme, and how long do you keep it?
File the certificate directly against the relevant entry in your written scheme of control, alongside the system schematic and any follow-up lab results. A certificate floating in a filing cabinet, disconnected from the scheme it relates to, is functionally useless during an audit.
Keep the certificate, the lab report, and any resampling results together as one evidence bundle.
Retain everything for at least five years, in line with the record-keeping duty under ACoP L8.
Log corrective actions and resampling dates in your Legionella logbook so the certificate reads as part of an ongoing control narrative rather than a one-off event.
Auditors and inspectors read continuity. A well-filed certificate that connects to a schematic, a sampling result, and a logbook entry says far more than the certificate alone ever could.
How do you quickly check if a certificate is sound?
Run through this before signing off any handover or closing out a remedial job.
Confirm the site, system, and dates are specific, not vague (“various outlets” is not an outlet list).
Check the method section states actual figures: temperature, chlorine dose, contact time.
Look for sample reference numbers and confirmation of a UKAS-accredited lab result.
Verify the certificate cross-references your written scheme entry.
Check for a named, signed competent person, not just a company stamp.
Missing lab evidence, vague method statements, no signature, or no follow-up sampling are the four red flags that should stop you accepting a certificate as complete.
How Bespoke Compliance Solutions documents disinfection works
Certificates issued on our jobs carry the same fields inspectors expect to see: system identifiers, method parameters, dosing and contact time, sample references, and a signed competence statement tied to our method of works. That consistency matters because a certificate is one data point in a longer story, not the end of it.
We treat every disinfection job as feeding back into the client’s written scheme and monitoring cycle, never as a standalone tick-box exercise. A certificate that isn’t linked to resampling and ongoing control is only half-finished work.
How Bespoke Compliance Solutions can help with disinfection and certification
Beyond writing certificates, Bespoke Compliance Solutions runs the actual work behind them, which is the real advantage over piecing compliance together from separate suppliers. We handle system disinfection and flushing, coordinate UKAS laboratory sampling, and issue the method of works and certificate as one connected package rather than three disjointed documents.
[
When requesting a quote, ask what evidence you’ll receive: dosing figures, contact times, sample chain of custody, and a named competent signatory should all be standard, not an upsell. We also help clients link new certificates back to their existing written scheme and logbook, so nothing sits disconnected from the wider control record.
If you’ve got a positive result, a commissioning deadline, or a system that’s been stagnant too long, get in touch to arrange a site quote for disinfection and testing, or speak to us about a rolling compliance programme across multiple sites.
Where to check the rules yourself
For the legal framework and record-keeping duties, go directly to HSE’s ACoP L8. For sampling and testing detail, HSE’s guidance on testing and monitoring water systems sets out repeat sampling timescales and laboratory accreditation expectations. HSG274’s published parts cover method-specific technical guidance for hot and cold systems, cooling towers, and other plant types referenced throughout this article.
Sources
FAQ
Is a disinfection certificate a legal requirement in the UK?
There’s no standalone law demanding a certificate by that name, but ACoP L8 requires dutyholders to keep records of cleaning and disinfection activities, and a certificate is the standard way contractors provide that record.
How long must disinfection certificates be kept?
At least five years, filed alongside the written scheme of control and any related sampling reports.
What’s the difference between a disinfection certificate and a risk assessment?
A disinfection certificate evidences a single remedial or commissioning intervention, while a legionella risk assessment sets out the ongoing hazards, controls, and monitoring schedule for the whole system.
Who can legally issue a disinfection certificate?
Anyone competent to carry out the work can issue one, provided they can demonstrate training, a suitable method of works, and (where microbiological confirmation is involved) use of a UKAS-accredited laboratory.
What should I do if a certificate is missing key details?
Reject it and request the missing evidence, particularly lab sample references and dosing figures. A provider like Bespoke Compliance Solutions can also review historic certificates against HSG274 expectations if you’re unsure whether existing paperwork is adequate.
Recommended
Comments