The golden thread under the Building Safety Act: what contractors and housing providers need to keep, and for how long
Who owns the building record, what goes into it at Gateway 2 and Gateway 3, and how to keep it usable for 20+ years.
The golden thread is the digital record of a higher-risk building: approved plans, evidence that the work complies, every controlled change and the safety information needed to run it. In England it covers buildings of at least 18 metres or seven storeys with two or more homes, plus hospitals and care homes while they are designed and built.
The law sets out who builds the record and who keeps it, but says less about how. That gap is where most of the risk sits for contractors and housing providers. This guide covers the duties at each stage, what goes into the record, what the regulator checks at Gateway 2 and Gateway 3, and how to set up a system that still works when the people and the software change.
Contents
Who is responsible for the golden thread at each stage
During design and construction the client owns the record, the principal designer feeds the design into it and the principal contractor keeps the change log. After completion the accountable person takes it over and must keep it up to date for as long as the building is a higher-risk building.
| Stage | Client | Principal designer | Principal contractor | Accountable person |
|---|---|---|---|---|
| Design | Creates the electronic facility and gives the design team access | Provides the designs to the client before the application | Usually not yet appointed | None |
| Construction | Keeps the facility accurate, secure and up to date | Keeps design information current; manages design changes | Keeps the change control log; records evidence that the work complies | None |
| Handover | Hands the information over by the completion date, in its original filing structure | Signs its compliance declaration for Gateway 3 | Signs the compliance declaration for Gateway 3 | Confirms in writing that the information is enough to run the building |
| Occupation | Not responsible | Not responsible | Not responsible | Keeps the prescribed information and documents up to date; hands them on if the accountable person changes |
The client’s duties are in regulation 31 of the Higher-Risk Buildings Procedures Regulations 2023. The principal contractor’s change control log is in regulation 19, and the handover in regulation 38. In occupation, section 88 of the Building Safety Act 2022 puts the duty on the accountable person.
Two rules matter more than they first appear. A principal contractor that leaves a job must give the client a document explaining the arrangements it put in place within 28 days. And an outgoing accountable person must hand the information to the incoming one; failing to do so without a reasonable excuse is a criminal offence.
What goes into the golden thread: a checklist
During design and construction the record must hold the approved plans with the evidence of compliance, every controlled change and the documents that will go with the completion application. Previous versions of updated documents stay in it too.
Use this as a working checklist for a live project:
- Designs provided by the principal designer before the building control application.
- The fire statement from the planning stage.
- Approved plans and documents, with all the evidence recorded to show they comply with building regulations.
- Documents agreed under any requirement attached to the approval.
- The change control log: for each change, who recorded it, what changed and why, its classification, whose advice was taken and which documents it affects.
- Revised versions of documents affected by a change, with the earlier versions kept.
- Notices of any new principal designer or principal contractor.
- Copies of mandatory occurrence reports sent to the regulator.
- The construction control plan, change control plan, mandatory occurrence reporting plan, compliance statement and fire and emergency file.
- The draft completion certificate application and everything that will accompany it.
In occupation the list changes. Schedule 1 of the 2024 Keeping and Provision of Information Regulations prescribes what the accountable person keeps. It includes the completion certificate application and its documents, fire safety measures, structural safety measures, the safety case report, plans of the building as first built and as currently built, and maintenance and repair records.
Gateway 2 and Gateway 3: what the regulator expects
At Gateway 2 the Building Safety Regulator checks that the planned work will comply and that the client will manage it properly. At Gateway 3 it compares what was built with what was approved, using the change log and an inspection. Both depend on the golden thread being complete and well organised.
The statutory decision periods are 12 weeks for a new higher-risk building at Gateway 2, 8 weeks for work to an existing one, 6 weeks for a change control application and 8 weeks at Gateway 3. Each can be extended by written agreement, and in practice they are. The regulator’s figures for July to September 2026 show a median of 23 weeks for new-build Gateway 2 decisions, with 96–97% approved. No new-build project had yet reached Gateway 3.
The regulator has been specific about what slows applications down. In April 2026 it listed, for remediation applications, missing evidence, statements of future intent such as “design details will come later”, and “poorly organised documents: failing to use clear folder structures, indexes or ensuring documents link up correctly”. Its guidance on preparing an application also warns that uploading a construction phase health and safety plan in place of a construction control plan can get the application rejected.
The cost of lost records is visible in the same data. The regulator reports 66 transitional cases, projects that came back to it when their building control body stopped trading, and says that for these “much of the evidence that we now expect at gateway 2 is not available”.
At Gateway 3 the regulator will assess the completion application, compare the original approved documents with the updated ones, review the change log and inspect the work. Since 1 October 2026 it also can’t issue a completion certificate until the building safety levy is paid or a notice of no charge is confirmed.
After handover: format, ownership and access
By the completion date the client must give the golden thread information to the accountable person, in the filing structure it was kept in, with its indexes and keys, in a format the recipient can read, keep and update. The accountable person then confirms in writing that the information is enough to understand, operate and maintain the building.
The law sets standards for the record rather than naming a product. Information must be electronic, transferable without being lost or corrupted, accurate, intelligible to its readers, secure from unauthorised access, and changed only through procedures that record who made each change and when.
Who owns it. The regulations say who must hold and keep the information, not who owns the copyright in it. That depends on your contracts. If photos, inspection records and test sheets are produced by subcontractors, check that the licence in each subcontract covers them, survives termination and doesn’t depend on the subcontractor being paid.
Who can see it. Residents aged 16 and over, flat owners, the fire and rescue service and the regulator all have rights to parts of the information. There are limits for security, commercially sensitive data and personal data.
How long to keep it. There is no single retention period for the whole record. The accountable person’s duty runs for as long as the building is a higher-risk building, and some items have fixed windows: seven years for occurrence reports, complaint summaries and maintenance records, five years for contravention notices. Others only need the latest version. Separately, the Building Safety Act extended the limitation period for some Defective Premises Act claims to 30 years for those that accrued before 28 June 2022 and 15 years afterwards, which is a good reason to plan for decades, not years.
When the contractor or the software vendor is gone. No official guidance covers this directly. The closest rules are the duty to keep information transferable without loss and the duty to keep its filing structure at handover. In practice, the risk sits with records that never reached the client’s facility: evidence held in a subcontractor’s app, a personal phone or a project platform whose subscription lapses after the job.
A minimum golden thread system for a mid-sized contractor or housing provider
You don’t need a large IT project to meet the standards. You need one agreed place for the record, one filing structure, a change log that records who and when, and a routine that moves evidence into that place as the work happens.
Here’s the minimum we’d put in place:
- Agree the filing structure and naming rules before the construction phase starts, and write them into the construction control plan.
- Use one facility for the record. A common data environment works, and so does a well-run document management system, as long as it keeps version history and records who changed what.
- Make evidence capture part of the job. Photos of fire-stopping and cavity barrier inspections go into the facility before the work is closed up, not with the O&M manuals.
- Check every subcontract for a records clause and a licence that survives termination.
- Test the export every quarter: pull one building’s record out and check it opens elsewhere with its folders and indexes intact.
- Review access each quarter and remove leavers.
If you’re not sure where your current process leaks, a business operations audit maps how information actually moves on your jobs today. If you plan to use AI to search or summarise building records, set the rules first; our AI readiness and governance work covers that. For contract-side checks on notices and time bars, see our guide to AI contract review in construction.
Frequently asked questions
Does the golden thread apply to all buildings?
No. In England it applies to higher-risk buildings: at least 18 metres high or with at least seven storeys, containing at least two residential units. Hospitals and care homes of that height are covered during design and construction but not once occupied. Other buildings still need good records, but the golden thread duties don't apply.
How long must the information be kept?
There is no single period. The accountable person must keep the prescribed information up to date for as long as the building is a higher-risk building. Some items have fixed windows, such as seven years for occurrence reports and maintenance records, and some only need the latest version. Plan for the life of the building.
What format should the golden thread be in?
Electronic. The regulations require information that can be transferred without loss or corruption, is accurate and readable, is secure from unauthorised access, and records who changed what and when. At handover it must keep its original filing structure and indexes. No particular software is required.
Who owns the golden thread after handover?
The client hands it to the accountable person, who must keep it from then on. The regulations don't decide copyright in the documents, so ownership of drawings, photos and test records depends on your contracts and licences. Check them before handover, not after a dispute.
What does the principal contractor have to keep?
The principal contractor keeps the change control log, records evidence that the work complies and uses the client's facility to keep information up to date. If its appointment ends, it must give the client a document explaining its arrangements within 28 days. It signs a compliance declaration for Gateway 3.
What happens if a contractor goes out of business mid-project?
The client must notify the regulator of a new principal contractor, and the replacement reviews the arrangements left behind. Evidence still held only by the failed firm may be hard to recover, and work that can't be evidenced may have to be opened up. Moving evidence into the client's facility as work happens avoids this.
Business problem first. Technology second.
Need a golden thread record that survives staff and software changes? Book a 30-minute call
This guide is not legal advice.