Golden Thread: What the Building Safety Act Asks of Contractors

28 July 2026

The Grenfell Tower fire in 2017 revealed a records problem as well as a cladding problem. When investigators asked what the building was made of and who had approved the changes to it, nobody could give a straight answer. The documentation simply was not there. Dame Judith Hackitt's review of building regulations recommended a "golden thread" of information running through a building's whole life, and the Building Safety Act 2022 turned that recommendation into law. For higher-risk buildings in England there is now a legal duty to create and keep a live digital record of building safety information, held so it can pass from dutyholder to dutyholder without gaps.

If you never go near a tall residential block, it would be easy to file this under someone else's problem. Hold that thought. The duty applies directly to a defined set of buildings, but its expectations are already leaking into vetting questionnaires and handover requirements on ordinary jobs. The paperwork standards travel further than the duty does.

The Golden Thread Duty Under the Building Safety Act

Managing compliance in a spreadsheet?

ComplianceVault replaces the scramble. Free to get started, no card needed.

View pricing →

Strip away the consultancy language and the golden thread is a record-keeping duty. During design and construction, the Building (Higher-Risk Buildings Procedures) (England) Regulations 2023, in force since 1 October 2023, require the golden thread to be created, kept up to date and handed over at completion. Once the building is occupied, section 88 of the Building Safety Act 2022 puts the duty to keep and share prescribed information on the accountable person, and that duty took effect on 16 January 2024. Government guidance describes what the record must look like:

Digital. Paper files and email chains do not meet the duty. The record must be held electronically with version control, so anyone can see what changed and when.
Structured. Information sits in a logical order that another person could follow, rather than a shared drive named "Site Stuff Final v2".
Accessible. The people who need the information can reach it quickly, without asking the one person who knows where things live.
Accurate and current. The record reflects the building as it stands today, including every change made during construction, and it is updated as work proceeds.

None of that requires exotic software. It requires discipline: one current version of each document, and a named owner responsible for keeping it that way.

Who the Duty Catches Directly

The core duties bite on higher-risk buildings. Under government guidance and the Higher-Risk Buildings (Descriptions and Supplementary Provisions) Regulations 2023, a higher-risk building in England is one that is at least 18 metres tall or has at least seven storeys, and contains at least two residential units. It only needs to meet one of the height tests, not both. During design and construction, care homes and hospitals that meet the same threshold are also caught, although they fall out of the regime once occupied.

On a higher-risk building project, the golden thread is a shared job. The client must set up the digital record-keeping system and the standards for using it. The principal designer keeps design information current, while the principal contractor records what was actually built, including every departure from the approved design. If those role names sound familiar, they should: they mirror the appointments under CDM 2015, and our guide to CDM 2015 duty holders explains who holds which role and when.

The record follows the building through the Building Safety Regulator's gateway approvals, and at completion it transfers to the accountable person who manages the occupied building. Failing to hand the golden thread over when responsibility changes hands is a criminal offence. The record is the evidence base the regulator works from, so gaps in it are visible in a way gaps in a site cabin lever-arch file never were.

Why Subbies Outside HRB Work Are Feeling It Anyway

Most contractors will never sign a gateway application. You will still meet the golden thread, second-hand.

Main contractors that carry out higher-risk building work do not run two document systems, one careful and one casual. They pick the stricter standard and apply it across every project, because that is cheaper than training site teams twice. So the vetting portal that used to accept a scanned insurance certificate now asks how you control document versions. Pre-start meetings want to know who owns your training records. And the handover pack that used to be a folder in the site office is increasingly expected as structured digital information, uploaded before the final valuation gets paid.

Clients are moving the same way. Frameworks and prequalification schemes now ask about information management alongside health and safety. If your answer is a shrug and a shared inbox, you score badly against the firm that can describe a system. Our UK construction compliance guide covers the wider set of records these assessments look for.

What Digital by Default Means for Your Paperwork

Forget the legislation for a moment and look at your own records the way a main contractor's vetting team would. Three tests matter.

Versioned. When your RAMS gets revised after a site walk, the old copy is marked superseded and the new one carries a date and a revision number. Anyone opening the folder finds one current document, and nobody prints v3 a fortnight after v5 replaced it.

Owned. Every record type has a named person responsible for keeping it current. The training matrix belongs to the office manager, insurance renewals to a director. When the owner is "the office", it is nobody.

Retrievable. If a main contractor emails at 3pm asking for your current employers' liability certificate, you can send it the same afternoon, with the cover level legible rather than buried in a scan of a scan. Speed is the test. A record you cannot produce on request may as well not exist.

The same logic covers the routine records a site generates. Scaffold inspection reports are a good example: the Work at Height Regulations require an inspection every 7 days, and a dated, versioned digital record proves at a glance that none were missed.

First Steps This Quarter

You do not need to buy anything to start. You need an afternoon and some honesty.

Start by listing what you hold: insurance certificates, training records and cards, RAMS, policies, accreditations, plant and inspection records. Write down where each one currently lives, then give every record type a named owner, one person each, with renewal dates in their diary rather than their memory.

Duplicates go next. Pick one storage location per document type and mark superseded versions clearly; a file-naming pattern with dates and revision numbers does most of the work here. Digitise the stragglers while you are at it. The SMSTS certificate in the van glovebox and the test certificates in the site office drawer get scanned this month, not eventually.

Then test the system on itself. Ask someone else in the business to assemble the documents a client would request and time how long it takes. Our post on what to include in a compliance pack gives you the target list, and the evidence pack preview tool shows how your documents would look assembled for a client. Finish by writing it down: a one-page document control note, covering who owns what and how versions work, turns your habits into a system you can describe on a vetting portal.

One caveat before you build anything elaborate. The golden thread rules are young and the detailed guidance is still maturing. The Building Safety Regulator continues to publish and refine guidance on what the record must contain and how the gateways operate, and industry bodies are still settling common standards for structuring the information, so watch the regulator's own output rather than second-hand summaries. Treat anyone selling a "fully golden thread compliant" product with mild suspicion, because no such certification exists.

The direction, though, is settled. Building records are going digital and versioned, with named owners, and clients will keep pushing that expectation down the supply chain regardless of building height. Keeping versioned, retrievable evidence is ComplianceVault's department, if you want that part handled. The Act exists because a simple question about one building met silence; when the question reaches you, answer it inside the hour.