A certificate of disinfection is the written record a contractor hands over after a water system, storage tank or component has been cleaned and disinfected. It sets out what was treated, by what method, to what concentration, and for how long — so you can prove the work happened and, more usefully, judge whether it was done properly.

That second part is the bit most people skip. A certificate is only worth keeping if it actually records the disinfection. A signed sheet that says “system disinfected” and nothing else proves a visit, not a result.

It is also not the thing many buildings think they are chasing. There is no single statutory “Legionella certificate” that makes premises compliant — Do you need a Legionella certificate? explains why that document does not exist. A certificate of disinfection is narrower and more honest: it is evidence of one specific job, on one specific date.

When you actually get one

Disinfection is not a routine monthly task. It is triggered by particular events, and a certificate is generated each time one of them happens.

The common triggers are commissioning a new system or a new section of pipework before it goes into use; restoring a system to service after it has stood empty or had significant work done on it; cleaning out a cold water storage tank or calorifier; and responding to a confirmed problem, such as a high Legionella count from a sample or a case linked to the building. HSE’s technical guidance treats disinfection as the expected step in these situations rather than an optional extra [1]. The two routes available — chemical dosing or raising the system to a disinfection temperature — are set out in Cleaning and disinfection after remedial work.

So if your contractor has just cleaned a tank, finished a refurbishment, or chased down a positive result, a certificate of disinfection is the document that should land afterwards. If it does not arrive, ask for it.

Who issues it

The certificate is issued by whoever carried out the disinfection — the contractor, water treatment company or competent person who did the work. It is their statement of what they did, with their name against it.

That signature matters more than it looks. Disinfection done badly is worse than none, because it can leave you believing a system is safe when it is not. The person doing it should be competent and, in practice, working to a recognised standard — the Legionella Control Association’s code of conduct is the usual benchmark for service providers in the UK [2]. A certificate from a named, accountable competent person is part of how you show the work was done by someone who knew what they were doing.

What a credible certificate should show

This is the part to actually check. Use it as a field checklist when a certificate arrives. If items are missing, the document is incomplete — and incomplete is the same as unproven.

The job and the system

  • The site, building and the specific system, tank or component disinfected — not just “the water system”.
  • The parts of the system covered, including which outlets were included, so you also know what was not done.

The method

  • The method used: chemical (chlorination) or thermal disinfection. For the step-by-step of the chemical route, see How to shock chlorinate a water system.
  • For chlorination: the disinfectant used and the target free chlorine concentration.
  • The contact (dwell) time the disinfectant was held in the system, confirmed at the outlets and not only at the dosing point.

Verification and making safe

  • Neutralisation and flushing-through afterwards, so any disinfectant residual is brought back to normal supply levels before the water is used.
  • Any post-disinfection checks — for example confirming the residual has dropped back, and where relevant, clearance sampling taken once the system is back in service.

Provenance

  • The date the work was carried out.
  • The name, company and signature of the competent person, with enough detail to contact them.

A certificate that records all of this lets a third party — an auditor, an enforcing officer, the next contractor — reconstruct what happened without taking it on trust. That is the test it has to pass.

The mistake to avoid

The big misunderstanding is treating the certificate as the goal. It is not. Disinfection knocks the system back to a known clean state at a single point in time; it does nothing about next week.

Legionella recolonises from biofilm and sediment whenever water sits in the growth temperature band again. A tank disinfected today starts to drift the moment temperature control slips or an outlet stops being used. So the certificate is evidence for your logbook, not a substitute for the ongoing control — temperature monitoring, flushing, inspection — that keeps the system safe between events. After a tank clean in particular, the certificate pairs naturally with a routine inspection regime; Water tank inspections covers what that looks like.

The second mistake is filing the certificate and never reading it. The value is in checking it against the list above while the contractor is still on site and can answer for any gaps.

A note on scope: this is general guidance on what a disinfection certificate is and should contain. What disinfection your particular system needs, when, and to what standard are decisions for a competent person working from a current, site-specific Legionella risk assessment under ACoP L8 [3]. We are not giving legal, medical or design advice for your building.

What to do next

Pull the most recent disinfection certificate you hold — for a tank clean, a commissioning, or remedial work — and run it against the checklist above. If you cannot tell which system was treated, what concentration was used, or how long it was held, you have found a record that will not stand up when someone asks.

Then make sure the next one is filed where it belongs: alongside the asset it relates to, in the same place as your temperature and flushing records, so the disinfection history of each tank and system reads as one timeline rather than scattered email attachments. That single chain of evidence — what was done, when, and by whom — is what turns a stack of certificates into a defensible record.

FAQ

No law names this specific certificate, but the duty to control Legionella risk and to keep records of the control measures you take is real [3]. When disinfection is part of those measures — on commissioning, after remedial work, or after a positive result — the certificate is how you evidence that it was carried out and to what standard. It supports compliance; it is not a standalone compliance document.

How long should I keep a disinfection certificate?

Keep it with your other Legionella records. Guidance commonly expects records of this kind to be retained for at least five years, so the certificate should stay on file for at least that long [3]. In practice it is most useful kept for the life of the asset, so each tank or calorifier carries its full disinfection history.

Does a disinfection certificate mean my water is safe?

It means the system was disinfected to the stated standard on that date. It does not mean the water will stay safe — recolonisation begins as soon as conditions allow. The certificate is one point on a timeline that only ongoing temperature control, flushing and monitoring can hold.

Sources

[1] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [2] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/ [3] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm