Ley 1209: what it really requires of a community with a pool

Ley 1209 de 2008 (the Colombian statute on pool safety) has been in force for more than fifteen years and is still the worst-cited rule in the sector. Requirements it does not contain are attributed to it, others it does contain are ignored, and a decree repealed in 2015 is quoted as its implementing regulation.

This is what it says, read article by article. It takes in six things almost everybody repeats and that are false, and one thing almost nobody says and that is the gravest of them all.

First: what kind of pool do you have

Everything depends on this, and it is almost always classified wrongly. The law defines three different things:

• —Private pool: the single-family pool and nothing else. A house.
• —Public use: intended for the general public, with no restriction.
• —Restricted use: for a defined group who must meet conditions in order to enter. The law expressly names condominiums, alongside clubs, hotels, schools and holiday resorts.

The pool of a residential development is of restricted use, not of public use. That distinction, bureaucratic as it sounds, decides which of the duties apply to it and which do not, and it is the source of half the errors in circulation.

What it requires exactly, by type of pool

The six false claims in circulation

1. "The enclosure must be 1.20 metres high"

False, and not by a small margin. No Colombian rule sets a single dimension for the enclosure: not a height, not a spacing between bars, not a type of ironmongery, not a self-closing gate. I checked the law, Decreto 554, Decreto 780, Resolución 1510 and Resolución 929 de 2026 which superseded it: it is in none of the five.

What article 5 says is purely functional: enclosures are "the barriers that prevent direct access to the place where the pools are situated", with access control. The figures in circulation come from United States standards and are quoted in Colombia as though they were law.

2. "A residential development needs a permanent lifeguard"

False, and this error costs money every month. Paragraph 1 of article 14 confines the duty of a residential development to four situations:

• —Weekends.
• —School holiday periods.
• —Social events at the pool or around it involving children under fourteen.
• —Whenever more than ten children are there at once, whatever the day.

The regulation confirms it and makes the distinction explicit: private clubs need one lifeguard per pool throughout their opening hours; condominiums and residential developments, only in those cases.

What is permanent for a residential development, with no exception for day or for season, is the enclosure and the immersion alarm outside opening hours. Many communities pay for a lifeguard from Monday to Friday and have no alarm. They are overspending on what the law does not ask for and breaching what it does.

3. "Decreto 2171 de 2009 is the implementing regulation"

False since 2015. Article 20 of Decreto 554 de 2015 expressly repealed it. And Decreto 554 was itself consolidated in full into Decreto 780 de 2016, the single consolidated decree of the health sector.

The correct citation today is Decreto 780 de 2016, articles 2.8.7.1.1.1 onwards. Citing 554 is not wrong: it is the source rule. Citing 2171 is, and it turns up constantly in suppliers’ quotations and on maintenance blogs.

4. "Every pool must have two drains"

Imprecise, and there is a real conflict of rules behind it. Article 12 of the law requires two drains only of "the pools built from the entry into force onwards", that is, from January 2009. Resolución 929 de 2026, by contrast, requires them of "the tanks of pools and similar structures", drawing no distinction by date, just as Resolución 1510 did before it.

A ministerial resolution cannot widen the scope of a statute, but neither has this one been challenged in court. In practice: a 1980s development pool with a single drain is exempt under the law and is not exempt under the resolution. It is a grey area to understand before you sit down to argue over a works budget.

5. "The devices have to be certified"

Misleading, and here lies the gravest point in the whole article.

The regulation makes type-approval of the devices conditional on a technical regulation that the health ministry was to issue. That technical regulation defines the only things that matter technically: maximum velocity at the face of the grating, certified flow rate per cover, service life, a pull-off resistance test, and the specification of the vacuum release system.

In the meantime the decree itself provided a transitional way out: the devices "shall be deemed type-approved on the first-party declaration of conformity of the supplier".

I searched for that technical regulation in the complete normative repository of the health ministry (more than seven thousand documents) and found no trace that it was ever issued. The 2016 decree, eight years after the law, still writes it in the future tense: the regulation "to be issued".

And the new rule did not close the gap: it restated it. Numeral 7 of Resolución 929 de 2026, eighteen years after the law, requires drains, anti-entrapment covers, a vacuum release system and a stop button that are "duly type-approved, in accordance with the rule the health ministry is to issue for that purpose", and for older pools it points once again to the first-party declaration of conformity of the supplier. The future is still the future.

Colombia legislated the requirement and never legislated the performance criterion. A flat grating bolted over a four-inch drain formally complies with the law if the supplier signs the declaration.

6. "The law does not apply to private houses"

False. It applies, with two duties (an immersion alarm and a vacuum release system), and it applies to pools already built. That has not changed, because it sits in a statute. What did change in 2026 is the water side: the scope of Resolución 234 reaches premises "of collective use open to the general public and of restricted use not open to the general public", and the single-family private pool is named in neither category. The water quality parameters are no longer enforceable against it by that route. The two safety duties of Ley 1209 are.

Entrapment: why a single drain kills

This is the part that justifies everything else, and the part least understood.

When a body seals a suction outlet, the working pressure of the pump turns into holding force. With a four-inch drain and a pump moving the flow rate the rule itself allows for that diameter, the force holding a child against the floor of the pool runs to hundreds of kilograms. No adult pulls a child off it, and the attempt at rescue usually makes matters worse.

The solutions, from the safest to the least safe:

1. 1Hydraulically balanced twin suction outlets, with the drains at least 0.90 m apart. It is a passive solution: if a body seals one, the other goes on admitting flow and the vacuum never forms at all. It does not depend on electronics, it cannot lose its settings, it has no battery. It is the best of them, and it is the one the rule requires.
2. 2An anti-entrapment cover sized for the pump’s actual flow rate. It is the first barrier, but it breaks, it gets stolen, and it degrades with chlorine and sun. A missing grating is not a cosmetic defect: it reopens exactly the original risk.
3. 3A vacuum release system, which detects the vacuum spike and stops the pump. It is active, and it is the one that fails most: it depends on calibration, on nobody having bypassed it, and on its being tested. The Colombian rule requires no periodic test of this system at all. That is, to my mind, the gravest blind spot in the regime.
4. 4A manual pump stop. It does not prevent, it mitigates. And only if it is where the law says ("a visible place, signposted as such and freely accessible"), rather than inside the padlocked plant room, which is where it usually is.

There are two further duties, from the rules of use, that hardly any community has in writing and that are compulsory: to prohibit entry "with chains, necklaces, shirts or similar items that allow mechanical entrapment", and to require a swimming cap and a costume in a material and style that avoid entrapment. These are not recommendations.

The water: what has to be measured, and how often

Resolución 234 de 2026 sets the parameters and the frequencies, which is the part most often breached. The real control is not the state’s: its column, against every single parameter, reads "linked to risk factors". It is the control exercised by whoever is responsible for the pool, and much of it is daily.

And here something this article used to assert has to be put right. Until 2026 this same section said the analyses had to be carried out by a laboratory accredited before ONAC, the national accreditation body, and that the chemical products had to hold an INVIMA health registration. I searched for both requirements, word by word, in Resolución 234 and in Resolución 929: neither resolution names ONAC or INVIMA, not once. What Resolución 234 does require is that the laboratory demonstrate validation or verification of the methods it uses (article 6, paragraph 3) and that every chemical product carry a technical data sheet and a safety data sheet, labelled to the globally harmonised system (article 13). I put it with the caution it deserves: their absence from these two resolutions does not prove the duty has gone from the statute book; it may live in another rule I have not read. What I can state is what the new framework requires, and this is it.

IRAPI: the new index that can leave your pool unfit

This did not exist before 2026 and it is the most usable thing in the whole update for a management council. Resolución 234 creates the Índice de Riesgo del Agua de Estanques de Piscinas y Estructuras Similares (IRAPI), the pool water risk index, which turns the results of the analyses into a single number between 0 and 100. It is not a voluntary indicator: whoever is responsible for the pool is required to calculate it, tank by tank, and the health authority checks it during the inspection visit. The IRAPI risk index tool works it out pool by pool.

• —VCM, the 45%: the microbiological characteristics: heterotrophs, Escherichia coli, thermotolerant coliforms and Pseudomonas aeruginosa.
• —VCR, the 20%: the concentration of the disinfectant residual.
• —VAC, the 30%: the characteristics tied to chlorination: pH, ORP and cyanuric acid.
• —VCT, the 5%: turbidity.

Every parameter out of compliance contributes its risk score, and the nine scores add up to a hundred:

And the result is classified like this:

The penalties: not one regime, but three

People speak of "the Ley 1209 fine" as though it were the only risk. There are three parallel regimes, and the quickest of them is not the fine.

The most dangerous route in operational terms is the third: anybody can call the police because children are using a pool that does not comply, and the inspector can suspend the activity on the spot, with no prior proceedings. It is not the fine that arrives first: it is the closure.

What the building manager is answerable for

Here is the sentence every building manager should read once a year, and it sits in Ley 675, not in Ley 1209:

Read that slowly. If the pool does not comply with the law and an accident happens, the manager’s negligence is presumed. It does not have to be proved: it is the manager who has to rebut it. The burden of proof reverses on the bare fact of the breach of the law.

And it meshes with two further things: the statutory purpose of the legal person includes "complying with the law and securing compliance with it", and among the manager’s functions is "caring for and watching over the common property". The pool is common property.

If the general meeting will not pay

This is the real scenario, and the statute gives more room than is usually used.

1. 1The contingency fund comes first. The statute allows an additional extraordinary levy to be approved only once the resources of the fund prove insufficient. That is the order the law sets, not an option.
2. 2The 70% majority does not always apply. It is triggered only where the extraordinary levy exceeds four times the necessary monthly service charge. Below that threshold a simple majority is enough. Many of these upgrades fit below it.
3. 3The manager can challenge the decision. The statute expressly empowers the manager to challenge decisions of the general meeting that do not conform to legal requirements. A decision refusing the funds needed to comply with a mandatory safety law is a natural candidate.
4. 4And the manager can have it minuted. Against a presumption of negligence, having warned, convened and challenged in writing is the only real defence left.

What it costs to come into compliance

I am not going to give a figure, and I want to explain why: there is no official or professional-body source in Colombia with prices for bringing a pool into line with this law. The quotations in circulation come from suppliers with a direct interest in the number. What can be given is the structure of the cost, which follows from the duties themselves:

• —A measured survey and technical drawings signed by a professional with a current licence. In most communities these drawings do not exist and have to be produced from scratch.
• —Work on the pool shell for the second drain, where it applies: emptying, partial demolition of the floor, pipework, hydraulic balancing and re-waterproofing. It is by far the largest item, and it is the one that makes meetings say no.
• —Anti-entrapment covers for every suction outlet.
• —A vacuum release system, with its electrical and hydraulic installation.
• —A manual emergency stop, signposted and accessible.
• —A self-contained immersion alarm, of at least 80 dB.
• —An enclosure with access control.
• —Depth signage and marking of the changes of level on the floor.
• —Equipment: two lifebuoys with line, a shepherd’s crook, an entryphone, and a complete first-aid kit, which the rule itemises, and which runs to a water rescue spineboard, a cervical collar and oxygen therapy.
• —Recurring costs: a lifeguard for weekends and holidays, and quarterly laboratory analyses (monthly in peak season), plus the analyses triggered by a faecal contamination event, which arrive whenever they arrive and have to be budgeted for.

A quick check, for the management council

Eleven questions, the same as in the Ley 1209 compliance tool. If any of them is answered no, there is a breach today:

1. 1Is there an enclosure with access control, closed when the pool is not in service?
2. 2Is there an immersion alarm working outside opening hours?
3. 3Does every drain have its anti-entrapment cover, complete and uncracked?
4. 4Is there a vacuum release system, and has anybody ever tested it?
5. 5Is the manual pump stop outside the plant room, visible and signposted?
6. 6Do the safety plan and the rules of use exist, in writing?
7. 7Do the rules prohibit entry with chains, necklaces and loose clothing?
8. 8Is the log book or computerised register up to date, with the daily measurements, the hours of operation and the top-up water?
9. 9Are this month’s laboratory results displayed on the noticeboard?
10. 10Is there a certified lifeguard at weekends and in the school holidays?
11. 11Has anybody worked out the IRAPI for each tank, and does the result sit between 0 and 10?

Everything above is transcribed from the official texts in force. The amounts of the fines are given in minimum wages because their value in pesos changes every year.