An HSE inspector visits your site and asks a straightforward question: who operated forklift #4 on the morning of 14 March, what did their pre-shift checklist show, and what time did the session begin?
If your operators share PINs, you cannot answer that. Not because the inspection wasn’t done — it may well have been. Because your system recorded a code, not a person. The audit trail collapsed the moment two operators started sharing credentials, and in an HSE inspection, an incomplete audit trail is treated the same as an absent one.
What PUWER actually requires
The Provision and Use of Work Equipment Regulations 1998 (PUWER) places a clear obligation on employers: under Regulation 9, only authorised and adequately trained operators may use work equipment. Under Regulation 6, inspections must be carried out and documented. ACOP L117 — the HSE’s Approved Code of Practice for rider-operated lift trucks — translates this into daily practice: pre-shift inspections tied to a named, authorised operator, with defects logged and resolved before the vehicle returns to service. The broader framework sits in ACOP L22 (Safe use of work equipment), which sets out the full employer obligations under PUWER across all work equipment.
The key phrase is named operator. PUWER does not just require that an inspection happened — it requires evidence that an authorised person conducted it. A shared PIN makes that evidence impossible to produce.
What shared PINs do to your audit trail
Shared PIN situations usually start as minor operational shortcuts: a forgotten code, a colleague covering a shift at the last minute. The compliance consequence is not minor.
When two operators share a PIN, every session under that code becomes legally ambiguous. If an incident occurs — a collision, a near-miss, a dropped load — the investigation will ask: who was operating? With a shared PIN, the honest answer is: we don’t know. Under PUWER, that ambiguity is the employer’s liability.
There is a quieter second problem: inspection validity. If the checklist for forklift #4 was completed under a shared credential, there is no way to confirm that the person who completed it was trained and authorised for that vehicle type. The record exists. Its legal weight does not.
During a PUWER inspection, HSE will typically request operator authorisation lists by vehicle class, training certificates (RTITB, ITSSAR or AITT) for each named operator, pre-shift inspection records linking operator, vehicle, date, and result, and evidence that defective vehicles were removed from service and returned only after repair. A folder of checklists with a shared PIN satisfies none of these adequately.
The real cost of getting this wrong
Failure to produce adequate PUWER records can trigger improvement notices, prohibition orders removing vehicles from service mid-operation, or prosecution under the Health and Safety at Work Act 1974 with unlimited fines for serious breaches. For most H&S Managers, the operational disruption — a prohibition notice on your most-used vehicles during peak hours — is the more immediate concern.
The financial exposure compounds quickly: equipment downtime, investigation costs, potential HSE fine, and insurance implications.
From compliance gap to audit-ready: XQ360 by Collective Intelligence Group
The operations that perform well in HSE inspections share one characteristic: their compliance record exists continuously as a byproduct of normal operations, not as something assembled before an inspection.
That requires individual authentication at the access point. Each operator logs in with their own PIN before the vehicle starts. The pre-shift checklist is required to complete before the session begins. Any defect triggers an automatic supervisor alert and blocks the vehicle from re-authorisation until the issue is resolved. The full session history — operator, vehicle, time, checklist result — is logged in real time and exportable in the format HSE expects.
XQ360 by Collective Intelligence Group builds exactly this into every vehicle in your fleet. Each PIN is assigned to one named, authorised operator — shared credentials are not possible by design. The 90-day history an HSE inspector requests takes minutes, not hours, to produce — filtered by vehicle, operator, or date range.
H&S Managers using XQ360 also report a measurable shift beyond compliance: checklist completion rates improve when individual accountability is visible, recurring defects on specific vehicles surface earlier, and supervisors spend less time on manual reporting. Compliance becomes a consequence of good operations — not a separate effort.
Frequently asked questions
Is sharing a PIN illegal under PUWER?
PUWER does not explicitly prohibit PIN sharing. What Regulation 9 requires is that only authorised, trained operators use work equipment, and that inspections are documented accordingly. Shared PINs make it impossible to demonstrate either requirement — which is why they create significant compliance exposure even when no incident has occurred.
Can paper records satisfy PUWER?
Technically yes, with extremely rigorous discipline. In practice, paper systems consistently fail the standard HSE inspectors apply — particularly for individual operator attribution and defect resolution records.
How long do PUWER inspection records need to be kept?
PUWER does not specify a minimum for daily records. Best practice recommends at least 3 years. LOLER thorough examination reports — the separate inspection regime for lifting equipment — should be kept for the life of the equipment. The HSE’s INDG422 guidance on thorough examinations explains the difference between daily pre-use checks and formal LOLER examinations in practical terms.
How does XQ360 prevent shared PINs and maintain a valid PUWER audit trail?
XQ360 assigns a unique PIN to each individual operator — the system does not allow a credential to be used by more than one person. Before a vehicle can start, the operator authenticates with their personal PIN, which the system cross-references against the authorised operator list for that vehicle type. The pre-shift checklist must then be completed before the session begins.
Every session is logged with the operator’s name, vehicle ID, start time, and checklist result — automatically, in real time, with no manual entry. If a defect is flagged, the supervisor receives an immediate alert and the vehicle is blocked from re-authorisation until the issue is resolved. The full history is exportable by vehicle, operator, or date range in the format HSE inspectors expect — typically produced in under five minutes.
