In this article
A kitchen that runs for years without a single pest sighting isn't lucky — it's on a visit rhythm that was actually matched to what the building attracts. Most kitchens aren't: the contract with the pest controller is a flat quarterly visit, whether the kitchen sits at street level next to an open bin or two floors up with a sealed waste room. That gap — between what your building genuinely attracts and what the contract actually covers — is where an infestation starts, and exactly what an inspector looks at first.
Pest control sounds like a formality: someone shows up, sets a few bait boxes, signs a form. In practice it's one of the few HACCP prerequisites written explicitly into EU law — not as a suggestion, but as a condition for staying open. Regulation (EC) No 852/2004, Annex II, requires every food business to have "adequate procedures... in place to control pests", as one of the prerequisite programmes a HACCP system is built on top of.
What that regulation doesn't specify is how often. That's exactly where most independent venues get it wrong: they take the cheapest contract with the fewest visits, without ever looking at what their own building actually attracts. A ground-floor kitchen beside an open bin in a fifty-year-old building carries a fundamentally different risk than a first-floor kitchen with a sealed waste room — but many pest controllers sell both the same flat contract.
The industry does have a standard for this: EN 16636, the European certification standard from CEPA (the Confederation of European Pest Management Associations), which requires professional pest controllers to base their visit rhythm on an actual risk assessment of the building — not a flat quarterly schedule. Almost no independent owner has ever seen that assessment.
The tool further down takes your own risk factors, your current visit rhythm and your average daily revenue, and turns them into three numbers: how many visits a year you're missing against your own risk, what a confirmed infestation actually costs, and how many times bigger that is than a risk-matched contract would have cost.
Why this starts with the risk profile, not the contract
Pests aren't a random accident — they follow predictable behaviour. Rats and mice seek warmth, food and an inconspicuous way in; cockroaches seek moisture and warmth; flies follow exposed waste. The more of those conditions your building offers — ground-floor level, an open or poorly sealed waste point, an older façade with gaps, dry-goods storage such as flour or grain kept in open bags — the higher the chance that a visit rhythm which is more than enough for another building is simply not enough for yours.
For an owner, that's not an abstract debate — it's a bill with two completely different sides. One side is the contract itself: a recurring, predictable cost you schedule yourself, usually fifteen to thirty minutes of a technician's time who already knows the building. The other side is what a confirmed infestation costs if it happens anyway — an emergency treatment, possibly a closure ordered by the inspection service, and reputational damage that lasts far longer than the closure itself.
This article lays those two sides side by side, with your own numbers — not to scare anyone, but to finally put a real figure on a risk most venues have never actually run.
The 7 numbers behind your risk
Each of these seven numbers is its own dial that determines how big your real risk is — and together they're exactly the model behind the tool further down.
1. 852/2004 — the EU regulation that makes pest control mandatory, not optional
Regulation (EC) No 852/2004 of the European Parliament and of the Council, Annex II, lists the prerequisite conditions every food business in the EU must meet before a HACCP system can even sit on top of them: maintenance, calibration, supplier controls among them — and explicitly "adequate procedures... in place to control pests". It doesn't sit among the recommendations. It sits among the conditions.
That makes it fundamentally different from, say, the choice between leasing or buying kitchen equipment: this isn't a business trade-off you can postpone. An inspector who finds no evidence of a pest-control procedure at all doesn't need to find an actual pest to log a failure — the absence of a procedure is itself the failure.
2. EN 16636 — the standard a real contract is certified against
CEPA, the Confederation of European Pest Management Associations, represents 25 national and regional trade associations across an industry with a turnover of more than three billion euros, set up in 1974 by the Belgian, British, Dutch, French and Spanish national associations together. Its standard, EN 16636, defines what a professional pest-control company actually has to do to call itself "certified" — and that is explicitly more than setting bait boxes on a flat schedule.
An EN 16636-certified company bases its visit rhythm on a risk assessment of the building itself: location, age, waste management, storage practices. Anyone who signs the cheapest flat contract without that assessment is paying for visits that might be exactly right for a different building — and nowhere near enough for their own.
3. 4, 6, 12 or 24 — how often your own building actually needs a visit
There's no EU law that sets an exact number of visits per year for every building — the building's own risk profile decides that, the same way deep-fry and grill hours decide an extraction-hood cleaning schedule. This article uses a simplified model with four risk bands, built from four common risk factors — ground-floor level (+2 points), an open or poorly sealed waste point (+2), a building older than 25 years (+2) and open storage of dry goods such as flour or grain (+2), together adding up to a risk score from 0 to 8 — as an illustrative guide, not literal legal text.
A score of 0 to 2 is "low risk" (typically 4×/year is enough), 3 to 4 is "moderate" (6×/year), 5 to 6 is "high" (12×/year, monthly — the point where most EN 16636-certified contracts step up to a monthly rhythm) and 7 or 8 is "very high" (24×/year, fortnightly). The tool further down uses exactly this breakdown to work out how often your own building genuinely needs a visit, and how that compares with what you currently have scheduled.
Four factors add up to a score from 0 to 8 — and that score decides the risk band, not a flat quarterly schedule.
5 of 8 points — "high risk"
visits a year is the recommended rhythm for a building with this score (5/8) — the point where most EN 16636 contracts step up to monthly.
Past the 4-point line, most certified contracts step up from bi-monthly to monthly visits — not because the law sets that exact point, but because the risk factors start compounding from there.
4. 8 visits a year you're missing against your own risk
A building with a risk score of 5 points falls into the "high risk" band — a recommended visit 12 times a year, i.e. monthly. A building that only books a visit every 3 months comes out at 4 a year — a gap of 8 visits that its own risk profile says should have happened.
That gap is almost never a deliberate choice. It's almost always simply never calculated: nobody has ever laid the building's four risk factors next to the existing contract to check whether the two still match.
Four risk bands, four visit rhythms — your building sits somewhere in this row.
The more of the four risk factors apply — ground floor, open waste point, older building, open dry-goods storage — the higher the score, and the more often a certified contract schedules a visit.
5. €1,020 — what a risk-matched contract actually costs per year
At €85 per visit and 12 visits a year for a "high risk" building, the recommended rhythm works out to €1,020 a year — a recurring, predictable cost you schedule yourself, the same way you schedule your grease-trap pump-out or your fire-extinguisher check.
Compare that to what you actually pay for visits today: if that's lower than €1,020, you're not paying less because you're efficient — you're paying less because the gap above exists.
6. €6,050 — what one confirmed infestation actually costs
An infestation that develops between two visits rarely announces itself politely. In a widely cited survey of US restaurant-goers, 81% say they'd never return after finding a pest on their plate, and 76% wouldn't return after seeing multiple pests anywhere in the venue — even with nothing on their own plate. 56% go on to post a negative review online. The UK's Food Hygiene Rating Scheme, one of Europe's most detailed public inspection systems, gives a rating of 0 — "urgent improvement necessary", with real emergency-closure risk — typically exactly when an inspector finds evidence of pests, and venues rated 2 or below are twice as likely to be linked to a food-poisoning outbreak as those rated 3 or above.
Here priced illustratively as an emergency treatment of €650 plus 3 disrupted days. At an average revenue of €1,800 a day, those disrupted days alone add up to €6,050 of exposed revenue — before the negative reviews that survey says follow more than half the time, or the conversation with the guests who were sitting there when it happened.
7. 6× — how much bigger that infestation is than a risk-matched contract would have cost
Set €6,050 of exposed revenue against the €1,020 a risk-matched visit rhythm costs per year, and the ratio comes out 6 times bigger. Put differently: staying on the right rhythm costs, in this example, a fraction of what one confirmed infestation costs — in lost revenue alone, before the reputational cost of the 81% who don't come back and the 56% who post about it.
That's the figure the tool below works out for your own venue: not a scare tactic, just a fair comparison between a cost you fully control and one that, on the day it happens, you no longer do.
Calculate your own pest risk
First add up your own risk points: ground-floor level (+2), an open or poorly sealed waste point (+2), a building older than 25 years (+2), open storage of dry goods such as flour or grain (+2) — a score from 0 to 8. Enter that score, your current visit rhythm and your average daily revenue. The tool works out which risk band your building falls into, how many visits you're missing against that risk, and how much bigger a confirmed infestation is than a risk-matched contract would have cost.
This is an illustrative model built on a simplified risk-band breakdown, not a substitute for a real risk assessment. For the exact rhythm your building needs, an EN 16636-certified pest controller on site is the only reliable source.
What's actually at stake in your building?
Enter your own numbers — the tool works out your risk band, the gap and the exposure.
—
An illustrative model built on a simplified risk-band breakdown, not an inspection report. For the exact rhythm your building needs: an EN 16636-certified pest controller on site, with a real risk assessment.
What this produces is deliberately an indication, not an inspection report: every building has its own location, condition and surroundings, and a certified pest controller can assess that precisely. What this model does get right is the ratio — a small, predictable cost against a much larger, unpredictable one — not the exact euros of your own building.
Already have a quote or a risk assessment from your own pest controller? Enter that figure under "cost per visit" instead of the default, and the tool immediately recalculates what the gap — and the exposure — actually mean for your venue.
Getting your pest-control contract right: the plan
There's no grey zone to sit in — just a risk assessment most venues have never actually had done, because nobody has ever laid the building next to the four risk factors.
Today
- Add up your own risk points: ground-floor level, an open waste point, a building older than 25 years, open dry-goods storage — and compare that with the four risk bands above.
- Find out how many visits your current contract actually provides per year, and when the last visit happened, with a dated report.
This month
- Ask your pest controller for a real risk-assessment report under EN 16636, not a standard form — and ask why the current visit rhythm was chosen.
- Check whether your pest controller is EN 16636-certified; if not, get a quote from at least one certified company to compare.
Ongoing
- Put the annual pest-control cost in your budget as a fixed line, next to your grease-trap pump-out and fire safety — not something "sorted out" after the fact.
- Keep every visit report dated in one place, so you can produce it within a minute if an inspector asks.
The number that counts
A kitchen that "looks clean" says nothing about whether the pest controller's visit rhythm is matched to what the building actually attracts — pests follow warmth, food and an inconspicuous way in, not what a guest sees at the table.
The difference between a contract that follows the building's own risk profile and one that's simply the cheapest standard package is rarely the amount that closes a venue on its own. It's the amount that, on the day it matters, turns a scheduled half-hour visit into an emergency treatment, possibly a closure, and reputational damage that lasts far longer than the closure itself.
Run the numbers with the tool above, ask for a real risk assessment from an EN 16636-certified pest controller, and put the result next to your grease trap and your fire safety — as a fixed cost you know, not a sighting you're waiting for.