Guidance · Reviewed August 2026
Who the Building Safety Act 2022 applies to, what the Building Safety Regulator now does, how the three gateways work, and the two deadlines that land in autumn 2026 — one of which is triggered by a date most programmes have not written down.
The short answer
The gateways and the occupation duties apply only to higher-risk buildings — at least 18 metres or 7 storeys, with at least two residential units. But the dutyholder and competence regime applies to all building work in England, whatever its size, and so does the increase in penalties. That is the tier most businesses wrongly assume they are outside.
How Much of This Applies to You?
The regime is layered. Each tier below adds to the one above it rather than replacing it, so read down until you reach the description that fits your work.
Any building work in England
The dutyholder and competence regime applies to you. Not just tall buildings, not just residential — all building work.
Building a higher-risk building
Add the three gateways, BSR building control approval, the golden thread and change control. A different way of running a project, not extra paperwork on the same one.
Developing new homes anywhere
Add the Building Safety Levy from 1 October 2026, and the second staircase requirement from 30 September 2026. Both bite at building control application stage.
Managing an occupied higher-risk building
Add registration, accountable person duties, a safety case report, building assessment certificates, mandatory occurrence reporting and resident engagement.
Update: the BSR left the HSE in January 2026
The Building Safety Regulator was originally set up inside the Health and Safety Executive. On 27 January 2026 it became a standalone executive non-departmental public body sponsored by the Ministry of Housing, Communities and Local Government, taking all Building Safety Act functions with it. The HSE is supporting the handover through to December 2026, and existing Gateway 2 and Gateway 3 applications transferred across. The move implements the Grenfell Tower Inquiry’s first Phase 2 recommendation and is a step towards a single construction regulator. If you hold guidance or contract wording describing the BSR as part of the HSE, it needs updating.
What the Building Safety Regulator Does
The BSR is the national regulator for building safety and standards in England. It has three jobs: acting as building control authority for higher-risk buildings, overseeing those buildings once occupied, and raising competence across the built environment. It can enforce building safety law and prosecute in its own name.
Practically, it is a more assertive regulator than what came before. Approval is not a formality, decisions take time, and incomplete applications get rejected rather than negotiated. That belongs in your programme and cost planning, not your compliance file.
Which Buildings Are Higher-Risk?
Settle this first, because almost everything else follows from it. A higher-risk building is at least 18 metres in height, or has at least 7 storeys; and contains at least two residential units. Both limbs must be satisfied — a 20-metre office block is not higher-risk, and a six-storey block of flats is not either.
| Building type | Design and construction | In occupation |
|---|---|---|
| Two or more residential units | In scope at the height threshold. | In scope at the height threshold. |
| Hospitals and care homes | In scope at the height threshold. | Out of scope. |
| Hotels, secure residential institutions, military barracks | Excluded. | Excluded. |
Buildings containing Ministry of Defence living accommodation are excluded too. The definition has been under review — MHCLG published an initial review in December 2025 — and the counting of storeys has been litigated, so check the current position on borderline buildings rather than relying on a rule of thumb.
Two clarifications worth holding onto. The gateway regime bites on higher-risk building work — building a new one, or work that turns an existing building into one — not on every job in an existing tall block. And everything here applies in England; Scotland, Wales and Northern Ireland have their own arrangements.
The Three Gateways
Gateway 1 — planning
A fire statement must accompany the planning application, showing fire safety has been designed in rather than bolted on later.
Gateway 2 — before work starts
Building control approval from the BSR, replacing the old deposit of plans. Needs the construction control plan, change control plan, mandatory occurrence reporting plan, fire and emergency file, and a signed client declaration of duty holder competence. Work cannot start without it.
Gateway 3 — before occupation
A completion certificate from the BSR confirming the building as built complies. The golden thread passes to whoever is responsible in occupation. No certificate, no occupation.
Build realistic gateway durations into the programme from the outset. The BSR has been clearing a backlog and has set itself a target of responding to non-complex Gateway 2 applications within 18 weeks by March 2027 — treat that as an indication of scale, not a guarantee. Applications that arrive incomplete are invalidated before assessment even begins, so submission quality is a programme risk in its own right.
Two Deadlines Land in Autumn 2026
Both fall within two days of each other, and both are triggered by the date of your building control application rather than by when you start on site. That makes the application date the single most important number in your programme this year.
30 September 2026 — the second staircase requirement
Approved Document B was amended in March 2024 so that a block of flats with a top storey at 18 metres or above should be served by more than one common staircase. That change carried a 30-month transitional period, and it expires on 30 September 2026. The 18-metre threshold was set to match the higher-risk building definition, so the two regimes now speak the same language.
The transitional route requires both: a building notice, initial notice or full plans application given or made to the building control authority before 30 September 2026; and work started and “sufficiently progressed” before that day, or within the 18 months beginning on it — a longstop of 30 March 2028. For a new building, “sufficiently progressed” means the pouring of concrete for permanent trench, pad or raft foundations, or the permanent placement of piling, has started. For work to an existing building it means the work has started; for a material change of use, that work to bring the change about has started.
The wider 2026 amendment also strengthens guidance on evacuation lifts, smoke control and escape provision, so a single-staircase scheme in design needs checking against more than the staircase count alone.
1 October 2026 — the Building Safety Levy
The Building Safety Levy (England) Regulations 2025 were made on 19 November 2025 and come into force on 1 October 2026. The levy applies to residential development across England — not only higher-risk buildings — including build-to-rent, retirement housing, purpose-built student accommodation and the residential element of mixed-use schemes.
It is charged per square metre of chargeable floorspace, at rates set for each local authority in the regulations and weighted by average local house prices, with a discount for previously developed land. The developer making the building control application is liable, the local authority collects it, and payment falls due before the earlier of completion or occupation. A completion certificate must not be issued where the levy is unpaid — so it is a gate on handover, not just an invoice.
Check the exemptions before assuming you are caught. Sites of fewer than 10 dwellings — or fewer than 30 bedspaces for purpose-built student accommodation — are exempt, which takes most small developers out of the charge. Non-profit registered providers of social housing and their wholly owned subsidiaries are exempt persons: all their works are exempt whatever the intended use. Care homes, hospitals, hotels and school accommodation are exempt by building use. An exempt scheme may still have to evidence its exemption.
There is no transitional relief. Liability turns on whether the building control application was made before or on/after 1 October 2026 — not on planning permission or commencement, a departure from how CIL and section 106 work. Applications made before that date escape the levy, as do variations to them. But an early application that is rejected and resubmitted after the date becomes liable at that point.
Duties Once the Building Is Occupied
For occupied higher-risk buildings the Act creates the accountable person — whoever owns or is responsible for repairing the structure or common parts — and, where there is more than one, a principal accountable person carrying the building-wide duties. Those duties include registering the building with the BSR, preparing and maintaining a safety case report assessing fire spread and structural failure risks and showing how they are controlled, applying for a building assessment certificate when directed, operating mandatory occurrence reporting, and running a resident engagement strategy with a complaints route.
Building assessment certificates are being called in by the BSR in priority order rather than all at once, so the timing is not in your hands. A building is currently prioritised if it meets any one of four criteria: 18 to 29.99 metres high with more than 378 residential units; over 30 metres high with more than 11 residential units; clad with combustible aluminium composite material; or a large panel system built between 1957 and 1973 with a gas supply where it is unclear whether reinforcement work has been carried out.
The clock is short once it starts
A principal accountable person directed to apply has 28 days to submit the application, and failing to apply without reasonable excuse is an offence. BSR uses the contact details given at registration, so those must be kept current — changes have to be notified within 14 days. If your building sits outside the priority criteria the direction may be some way off, but the safety case report is a standing duty regardless, and assembling one to order inside 28 days is the wrong way round.
Accountable Person or Responsible Person?
Two different roles under two different pieces of law, frequently confused, and often held by different organisations in the same building.
| Responsible person | Accountable person | |
|---|---|---|
| Comes from | Regulatory Reform (Fire Safety) Order 2005. | Building Safety Act 2022. |
| Applies to | Non-domestic premises and the common parts of residential buildings, at any height. | Occupied higher-risk buildings only. |
| Covers | Fire safety duties, plus the Fire Safety (England) Regulations 2022 for high-rise blocks — information boxes, floor plans, equipment checks. | Structure and common parts: registration, safety case report, building assessment certificate, occurrence reporting, resident engagement. |
| Run together? | Yes — both sets of duties apply at the same time in the same building. | Yes — and independently of anything the BSR requires. |
The Dutyholder and Competence Regime
This part is widely missed because it is not limited to tall buildings. The Building Regulations etc. (Amendment) (England) Regulations 2023 apply a dutyholder regime to all building work, naming the client, principal designer, designers, principal contractor and contractors, and requiring each to be competent — the skills, knowledge, experience and behaviours for the work, with organisations needing matching capability. Clients must satisfy themselves of that competence and, on higher-risk work, declare it.
Building Regulations Principal Designer or CDM Principal Designer?
The roles carry the same names but are separate appointments under separate legislation. The same organisation often fills both, and often should — but they are not automatically the same appointment, and the duties differ.
| Building regulations PD | CDM 2015 PD | |
|---|---|---|
| Comes from | Building Regulations etc. (Amendment) (England) Regulations 2023. | Construction (Design and Management) Regulations 2015. |
| Concerned with | Compliance of the design with the Building Regulations. | Health and safety in the pre-construction and construction phases. |
| Applies to | All building work in England, whatever its size. | All construction projects across Great Britain, higher-risk or not. |
| Appointment | Made deliberately, in writing, with competence evidenced. | Made deliberately, in writing, with competence evidenced. |
If you have not consciously made both appointments, assume you have made neither. Full detail on the construction-phase side is in our CDM 2015 guidance.
Free Envico F10 Notification Checker
Before the building safety questions, get the CDM position straight. Our free checker applies the CDM 2015 regulation 6 test to your project, tells you whether it must be notified to the HSE and why, shows who has to be appointed in writing and on what trigger, lists the documents the project needs, and sets out the details the F10 form asks for. Printable record at the end, no signup.
Check your CDM position ↗ Free · on envicourse.com
The Golden Thread
The golden thread is the duty to create, keep and hand on accurate information about a higher-risk building across its whole life — what it is made of, how it was built, what has changed, and how it is meant to perform. It must be digital, current, and available to those who need it.
In practice it is less a document than a discipline. If change control is weak the golden thread will be wrong, and a wrong golden thread is worse than none, because people rely on it. It is also the thing that has to survive handover at Gateway 3, when responsibility passes to whoever manages the building in occupation — so it needs to be built in a form somebody else can pick up.
What Happens If You Get It Wrong
The enforcement position changed sharply and is the part most likely to be underestimated.
| What changed | Why it matters |
|---|---|
| Penalties rose steeply | Breaching the building regulations was a summary offence with a fine capped at £5,000. It is now triable either way and carries an unlimited fine and up to two years’ imprisonment, with a daily fine while the default continues after conviction. |
| The window is now ten years | Action could previously only be taken within 12 months of completion. Work signed off today stays exposed until well into the 2030s, long after the team that built it has moved on. |
| Compliance and stop notices | The BSR can require non-compliant work to be remedied by a set date, or halt work entirely. Contravening either without reasonable excuse is itself an offence carrying the same penalties. |
| Individuals, not just companies | Where an offence involves the consent or connivance of a director or manager, or their neglect, that person can be prosecuted alongside the organisation — including the prison element. |
| Occupation offences | Allowing a higher-risk building to be occupied without a completion certificate, and failing to register an occupied higher-risk building, are specific offences in their own right. |
The practical consequence is about records. A ten-year window means the question will not be what you did, but what you can still show you did, years after the fact and probably from someone else’s files.
What You Can Do to Prepare
- Establish whether any building in your portfolio or pipeline meets the higher-risk definition, and record how you reached that conclusion.
- Review every residential scheme in design against the two autumn 2026 deadlines, and work out whether bringing the building control application forward is worth doing.
- Check any residential scheme with a top storey at 18 metres or above against the second staircase requirement, and confirm whether the transitional route is realistically available.
- Check whether the Building Safety Levy exemptions apply to your scheme, and if they do not, model the charge into appraisals using the rate published for your local authority.
- Conduct a building-safety risk assessment covering fire spread and structural failure across the life-cycle.
- Name your dutyholders in writing, for both building regulations and CDM, and hold evidence of competence rather than assurances.
- Plan gateway submissions as programme milestones with real durations, and draft the supporting documents early.
- Set up information management and change control that can carry a golden thread, before the project generates information you cannot reconstruct.
- Expect competence questions at pre-qualification — CHAS and SSIP accreditation now include building safety questions, so the evidence you assemble here gets used twice.
- Keep records in a form that will still be retrievable and legible in ten years.
- Train the people responsible and record who is competent to do what — the free Envico tools and templates include a training matrix you can use as the record.
- Identify wider gaps with a health and safety risk review.
Training
Competence is now a legal test rather than a good intention, and it has to be demonstrable — recorded, current and attributable to a named person. There is no single mandatory qualification, so the route depends on the role.
| If you need to… | Usual route |
|---|---|
| Understand the Act itself | Building Safety Act 2022 Awareness — self-paced e-learning covering the gateways, the golden thread, accountable person duties and competency standards. |
| Hold a dutyholder role | CDM training alongside the awareness course — both regimes apply to most projects. |
| Assess risk properly | IOSH Managing Safely, or the wider risk assessment training courses. |
| Supervise or manage a site | SSSTS for supervisors, SMSTS for site managers. |
| Hold a formal qualification | NEBOSH General Certificate, or the Construction Certificate for site-based roles. |
| Cover specific hazards | Fire safety, asbestos and working at height for refurbishment and maintenance work. |
Frequently Asked Questions
Is the Building Safety Regulator still part of the HSE?
No. The BSR became a standalone executive non-departmental public body on 27 January 2026, sponsored by the Ministry of Housing, Communities and Local Government. All Building Safety Act functions moved with it, though the HSE is supporting the transition until December 2026.
Does the Building Safety Act only affect high-rise buildings?
No. The gateway regime and the occupation duties apply only to higher-risk buildings, but the dutyholder and competence requirements introduced alongside the Act apply to all building work in England, whatever its size or type. So does the increase in penalties for breaching the building regulations, and the Building Safety Levy applies to residential development generally rather than only to tall buildings.
What is Gateway 2 and when does it apply?
Gateway 2 is the building control approval stage for higher-risk building work in England. The application goes to the Building Safety Regulator rather than to local authority building control or an approved inspector, and it replaces the old deposit of plans. Work cannot start until approval is granted. The submission needs the construction control plan, change control plan, mandatory occurrence reporting plan, fire and emergency file, and a client declaration that the principal designer and principal contractor are competent. It applies to building a new higher-risk building, or to work that converts an existing building into one — not to every job in an existing tall block.
Do we have to add a second staircase to our scheme?
If it is a new block of flats in England with a top storey at 18 metres or above, and it does not qualify for the transitional route, then yes from 30 September 2026. The transitional route needs both a building notice, initial notice or full plans application given or made before that date, and work started and sufficiently progressed before it or within the following 18 months — a longstop of 30 March 2028, with “sufficiently progressed” meaning permanent trench, pad or raft foundation concrete poured, or permanent piling started. Existing buildings are not required to retrofit a second staircase, though owners still carry duties under the Building Safety Act and the Fire Safety Order.
Will we have to pay the Building Safety Levy?
If you make a building control application on or after 1 October 2026 for work providing one or more dwellings or student bedspaces in England, and no exemption applies, then yes. Check the exemptions first: sites of fewer than 10 dwellings, or fewer than 30 purpose-built student accommodation bedspaces, are outside the charge, as are non-profit registered providers of social housing and their wholly owned subsidiaries, and buildings such as care homes, hospitals, hotels and school accommodation. There is no transitional relief — applications made before 1 October 2026 are outside the levy, as are variations to them, though an early application that is rejected and resubmitted after that date becomes liable.
Are the CDM principal designer and the building regulations principal designer the same person?
Not automatically. They are separate appointments made under separate legislation with different duties — one concerned with compliance of the design with the Building Regulations, the other with health and safety through the pre-construction and construction phases. The same organisation frequently holds both, and on most projects that makes sense, but each appointment has to be made deliberately and each set of duties discharged on its own terms.
How long can enforcement action be taken after work is finished?
Ten years from completion, extended from the previous 12 months. Breaches of the building regulations now carry an unlimited fine and up to two years’ imprisonment, and senior individuals can be prosecuted alongside their organisation where the offence involved their consent, connivance or neglect.
What training do our people need for the Building Safety Act?
There is no single mandatory qualification. The Act requires competence rather than a named certificate, so what you need depends on the roles your people hold and the work you do. An awareness course covering the Act, the gateways, the golden thread and dutyholder duties is the usual starting point for anyone with responsibilities under the regime — our Building Safety Act 2022 Awareness course covers that ground. Those in dutyholder roles will normally need role-specific training alongside it, and CDM training as well, since both regimes apply to most projects.
Does any of this apply outside England?
The higher-risk building regime described here applies in England, as do the Building Safety Levy and the second staircase requirement. Scotland, Wales and Northern Ireland operate their own building safety arrangements — Wales introduced a new building control regime of its own from 1 July 2026. CDM 2015 applies across Great Britain, with CDM (NI) 2016 covering Northern Ireland.
Related Guidance
Risk assessment →
CHAS accreditation →
Working at height →
Risk review →
All guidance topics →
General guidance only, reviewed August 2026 against the Building Safety Act 2022, the Building Regulations etc. (Amendment) (England) Regulations 2023, the Building Safety Levy (England) Regulations 2025, Approved Document B and current Building Safety Regulator guidance. Building safety regulation is changing rapidly — the second staircase requirement takes effect on 30 September 2026 and the Building Safety Levy on 1 October 2026, the single construction regulator is in development, and the higher-risk building definition is under review. Levy rates are set per local authority in the regulations, so check the rate published for your area. Envico is an independent training intermediary and is not affiliated with the HSE or the Building Safety Regulator.