Guidance · Reviewed October 2026
Who the Building Safety Act 2022 applies to, what the Building Safety Regulator does, how the three gateways work, and the second staircase and Building Safety Levy changes that took effect in autumn 2026.
The short answer
The gateways and the occupation duties apply only to higher-risk buildings: at least 18 metres or 7 storeys, with at least two residential units. But the dutyholder and competence regime applies to all building work in England, whatever its size, and so do the tougher penalties for breaching the Building Regulations. That is the part most businesses wrongly assume they are outside.
How Much of This Applies to You?
The regime is layered. Each tier below adds to the one before it rather than replacing it, so read on until you reach the description that fits your work.
Any building work in England
The dutyholder and competence regime applies to you. Not just tall buildings, not just residential: all building work.
Building a higher-risk building
Add the three gateways, BSR building control approval, the golden thread and change control. A different way of running a project, not extra paperwork on the same one.
Developing new homes
Add the second staircase guidance for flats with a storey at 18 metres or more (from 30 September 2026), and the Building Safety Levy (from 1 October 2026). Both turn on the date of your building control application.
Managing an occupied higher-risk building
Add registration, accountable person duties, a safety case report, building assessment certificates, mandatory occurrence reporting and resident engagement.
The BSR left the HSE in January 2026
The Building Safety Regulator was originally set up inside the Health and Safety Executive. On 27 January 2026 it became a standalone body sponsored by the Ministry of Housing, Communities and Local Government, taking its Building Safety Act functions with it. HSE is supporting the transition until December 2026, and existing Gateway 2 and Gateway 3 applications transferred across. The move is a step towards a single construction regulator. If your guidance or contract wording describes the BSR as part of the HSE, it needs updating.
What the Building Safety Regulator Does
The BSR is the national regulator for building safety and standards in England. It has three jobs: acting as building control authority for higher-risk buildings, overseeing those buildings once occupied, and raising competence across the built environment. It can enforce building safety law and prosecute.
In practice, approval is not a formality, decisions take time, and incomplete applications are rejected rather than negotiated. That belongs in your programme and cost planning, not just your compliance file.
Which Buildings Are Higher-Risk?
Settle this first, because almost everything else follows from it. For design and construction, a higher-risk building is at least 18 metres in height or has at least 7 storeys, and contains at least two residential units. Both limbs must be met: a 20-metre office block is not higher-risk, and neither is a block of flats under 18 metres with fewer than seven storeys.
| Building type | Design and construction | In occupation |
|---|---|---|
| Two or more residential units | In scope at the height threshold. | In scope at the height threshold. |
| Hospitals and care homes | In scope at the height threshold. | Out of scope. |
| Hotels, secure residential institutions, military premises | Excluded. | Excluded. |
In occupation, buildings containing Ministry of Defence or armed forces living accommodation are excluded too. MHCLG published an initial review of the definition in December 2025 and has said it will keep it under review, so check the current position on borderline buildings rather than relying on a rule of thumb.
Two clarifications are worth holding onto. The gateway regime applies to higher-risk building work: building a new one, or work that turns an existing building into one. It does not apply to every job in an existing tall block. And everything here applies in England; Scotland, Wales and Northern Ireland have their own arrangements.
The Three Gateways
Gateway 1: planning
A fire statement must accompany the planning application, showing fire safety has been designed in rather than bolted on later.
Gateway 2: before work starts
Building control approval from the BSR. The application includes the construction control plan, change control plan, mandatory occurrence reporting plan, fire and emergency file, and a client declaration that the principal designer and principal contractor are competent. Work cannot start without approval.
Gateway 3: before occupation
A completion certificate from the BSR confirming the building as built complies. The golden thread passes to whoever is responsible in occupation. No certificate, no occupation.
Build realistic gateway durations into the programme from the outset. The BSR has been clearing a backlog and has set a target of responding to non-complex Gateway 2 applications within 18 weeks by March 2027. Treat that as an indication of scale, not a guarantee. Incomplete applications are rejected before assessment begins, so submission quality is a programme risk in its own right.
Second Staircases and the Building Safety Levy
Two changes took effect within two days of each other, and both turn on the date of your building control application rather than when you start on site.
From 30 September 2026: second staircases
Approved Document B was updated in March 2024 so that new blocks of flats with a storey at 18 metres or more should be served by more than one common staircase, with design provisions to support evacuation lifts. A 30-month transitional period ended on 30 September 2026. The 18-metre threshold matches the higher-risk building definition.
Schemes can still rely on the previous guidance only if both apply: a building notice, initial notice or full plans application was given or made before 30 September 2026; and the work is “sufficiently progressed” within the 18 months beginning on that date, so by the end of March 2028. For a new building, that means the pouring of concrete for permanent trench, pad or raft foundations, or the permanent placement of piling, has started. For work to an existing building, it means the work has started.
If you are relying on the transitional route, the foundation or piling start date is now a hard milestone in your programme.
From 1 October 2026: the Building Safety Levy
The Building Safety Levy (England) Regulations 2025 were made on 19 November 2025 and came into force on 1 October 2026. The levy applies to new residential development across England, not only higher-risk buildings, including build-to-rent, retirement housing, purpose-built student accommodation and the residential element of mixed-use schemes.
It is charged per square metre of floorspace at rates set for each local authority area, with a reduced rate for qualifying previously developed land. The developer named as client on the building control application is liable, and the local authority collects it. A completion certificate cannot be issued until the levy is paid, so it is a gate on handover, not just an invoice.
Check the exemptions before assuming you are caught. Developments of fewer than 10 dwellings, or fewer than 30 purpose-built student bedspaces, are exempt, which takes many small developers out of the charge. Non-profit registered providers of social housing and their wholly owned subsidiaries are exempt, as are affordable homes, and buildings such as care homes, hospitals, hotels, school accommodation and refuges. An exempt scheme may still have to evidence its exemption.
The application date decides liability. Building control applications or initial notices properly made before 1 October 2026, and variations to them, are outside the levy, whatever the planning or commencement date. An earlier application that is rejected and resubmitted on or after that date becomes liable.
Duties Once the Building Is Occupied
For occupied higher-risk buildings, the Act creates the accountable person: whoever owns or is responsible for repairing the structure or common parts. Where there is more than one, a principal accountable person carries the building-wide duties. They include registering the building with the BSR, preparing and maintaining a safety case report assessing the risks of fire spread and structural failure and how they are controlled, applying for a building assessment certificate when directed, operating mandatory occurrence reporting, and running a resident engagement strategy with a complaints route.
The BSR calls in building assessment certificates in priority order rather than all at once, so the timing is not in your hands. Buildings currently prioritised include those at least 30 metres high with at least 11 residential units, those of 18 to 29.99 metres with at least 378 residential units, buildings with combustible aluminium composite material cladding, and large panel system blocks built between 1956 and 1973 with a gas supply where it is unclear whether strengthening work has been done.
The clock is short once it starts
A principal accountable person directed to apply has 28 days to submit the application, and failing to apply without reasonable excuse is an offence. The BSR uses the contact details given at registration, so changes must be notified within 14 days. If your building sits outside the priority criteria the direction may be some way off, but the safety case report is a standing duty regardless, and assembling one inside 28 days is the wrong way round.
Accountable Person or Responsible Person?
Two different roles under two different pieces of law, frequently confused, and often held by different organisations in the same building.
| Responsible person | Accountable person | |
|---|---|---|
| Comes from | Regulatory Reform (Fire Safety) Order 2005. | Building Safety Act 2022. |
| Applies to | Non-domestic premises and the common parts of residential buildings, at any height. | Occupied higher-risk buildings only. |
| Covers | Fire safety duties, plus the Fire Safety (England) Regulations 2022 for high-rise blocks: secure information boxes, floor plans and monthly checks of firefighting equipment. | Structure and common parts: registration, safety case report, building assessment certificate, occurrence reporting, resident engagement. |
| Run together? | Yes. Both sets of duties apply at the same time in the same building. | Yes, and independently of each other. |
The Dutyholder and Competence Regime
This part is widely missed because it is not limited to tall buildings. The Building Regulations etc. (Amendment) (England) Regulations 2023 apply a dutyholder regime to all building work in England, naming the client, principal designer, designers, principal contractor and contractors. Everyone carrying out design or building work must be competent, meaning they have the skills, knowledge, experience and behaviours for the work, and organisations need matching capability. Clients must satisfy themselves of that competence and, on higher-risk work, declare it.
Building Regulations Principal Designer or CDM Principal Designer?
The roles carry the same name but are separate appointments under separate legislation. The same organisation often fills both, but they are not automatically the same appointment, and the duties differ.
| Building Regulations PD | CDM 2015 PD | |
|---|---|---|
| Comes from | Building Regulations 2010, Part 2A (inserted in 2023). | Construction (Design and Management) Regulations 2015. |
| Concerned with | Compliance of the design with the Building Regulations. | Health and safety, planned from the pre-construction phase. |
| Required when | Building work in England with more than one contractor. | Construction projects in Great Britain with more than one contractor. |
| Appointment | By the client, in writing, with competence checked. | By the client, in writing, with competence checked. |
If you have not consciously made both appointments, check whether you have made either. Full detail on the health and safety side is in our CDM 2015 guidance. To find principal designers covering your area, try our sister site, Raybee.
Free F10 Notification Checker
Get the CDM position straight alongside the building safety questions. Our free checker applies the CDM 2015 regulation 6 test to your project, tells you whether it must be notified to HSE and why, shows who has to be appointed in writing, lists the documents the project needs, and sets out the details the F10 form asks for. Printable record at the end, no signup.
Check your CDM position ↗ Free · on envicourse.com, our course marketplace · opens in a new tab
The Golden Thread
The golden thread is the duty to create, keep and hand on accurate information about a higher-risk building across its whole life: what it is made of, how it was built, what has changed, and how it is meant to perform. It must be held digitally, kept current and be available to those who need it.
In practice it is less a document than a discipline. If change control is weak the golden thread will be wrong, and a wrong golden thread is worse than none, because people rely on it. It also has to survive handover at Gateway 3, when responsibility passes to whoever manages the building in occupation, so it needs to be built in a form somebody else can pick up.
What Happens If You Get It Wrong
The enforcement position changed sharply and is the part most likely to be underestimated.
| What changed | Why it matters |
|---|---|
| Tougher penalties | Breaching the Building Regulations used to be a magistrates’ court offence only. It can now be tried in the Crown Court, with an unlimited fine and up to two years’ imprisonment, plus a daily fine while the default continues after conviction. |
| Ten years to require changes | A notice requiring non-compliant work to be removed or altered could previously only be served within 12 months of completion. That window is now ten years, long after the team that built it has moved on. |
| Compliance and stop notices | Building control can require non-compliant work to be put right by a set date, or halt work entirely. Breaching either notice is itself an offence carrying the same penalties. |
| Individuals, not just companies | Where an offence involves the consent or connivance of a director or manager, or their neglect, that person can be prosecuted alongside the organisation. |
| Occupation offences | Allowing a higher-risk building to be occupied without a completion certificate, and occupation of an unregistered higher-risk building, are offences in their own right. |
The practical consequence is about records. With a ten-year window, the question will not just be what you did, but what you can still show you did, years later and probably from someone else’s files.
What You Can Do to Prepare
- Establish whether any building in your portfolio or pipeline meets the higher-risk definition, and record how you reached that conclusion.
- For residential schemes, check when the building control application was made: it decides both the levy and whether the second staircase transitional route is open.
- If you rely on the transitional route, programme the foundation or piling start well before the end of March 2028.
- Check whether the Building Safety Levy exemptions apply, and if not, model the charge into appraisals using the rate for your local authority.
- Carry out a building-safety risk assessment covering fire spread and structural failure across the building’s life.
- Name your dutyholders in writing, for both the Building Regulations and CDM, and hold evidence of competence rather than assurances.
- Plan gateway submissions as programme milestones with real durations, and draft the supporting documents early.
- Set up information management and change control that can carry a golden thread, before the project generates information you cannot reconstruct.
- Expect competence questions at pre-qualification. The Common Assessment Standard, offered through schemes such as CHAS, now includes a building safety section, so the evidence you assemble here gets used twice.
- Keep records in a form that will still be retrievable and legible in ten years.
- Train the people responsible and record who is competent to do what. The free Envico tools and templates include a training matrix you can use as the record.
- Identify wider gaps with a health and safety risk review.
Training
Competence is now a legal test rather than a good intention, and it has to be demonstrable: recorded, current and attributable to a named person. There is no single mandatory qualification, so the route depends on the role.
| If you need to… | Usual route |
|---|---|
| Understand the Act itself | Building Safety Act 2022 Awareness: self-paced e-learning covering the gateways, the golden thread, accountable person duties and competence. |
| Hold a dutyholder role | CDM training alongside the awareness course, as both regimes apply to most projects. |
| Assess risk properly | IOSH Managing Safely, or the wider risk assessment training courses. |
| Supervise or manage a site | SSSTS for supervisors, SMSTS for site managers. |
| Hold a formal qualification | NEBOSH General Certificate, or the Construction Certificate for site-based roles. |
| Cover specific hazards | Fire safety, asbestos and working at height for refurbishment and maintenance work. |
Frequently Asked Questions
Is the Building Safety Regulator still part of the HSE?
No. The BSR became a standalone body on 27 January 2026, sponsored by the Ministry of Housing, Communities and Local Government. Its Building Safety Act functions moved with it, and HSE is supporting the transition until December 2026.
Does the Building Safety Act only affect high-rise buildings?
No. The gateway regime and the occupation duties apply only to higher-risk buildings, but the dutyholder and competence requirements apply to all building work in England, whatever its size or type. So do the tougher penalties for breaching the Building Regulations, and the Building Safety Levy applies to new residential development generally, not just tall buildings.
What is Gateway 2 and when does it apply?
Gateway 2 is the building control approval stage for higher-risk building work in England. The application goes to the Building Safety Regulator rather than local authority building control or a registered building control approver, and work cannot start until it is approved. The submission includes the construction control plan, change control plan, mandatory occurrence reporting plan, fire and emergency file, and a client declaration that the principal designer and principal contractor are competent. It applies to building a new higher-risk building, or work that turns an existing building into one, not to every job in an existing tall block.
Do we have to add a second staircase to our scheme?
For a new block of flats in England with a storey at 18 metres or more, Approved Document B now expects a second staircase unless the transitional route applies. That route needs both a building notice, initial notice or full plans application made before 30 September 2026, and foundation concrete or permanent piling started within the 18 months beginning on that date. Existing buildings are not required to retrofit a second staircase, though owners still carry duties under the Building Safety Act and the Fire Safety Order.
Will we have to pay the Building Safety Levy?
If you make a building control application on or after 1 October 2026 for new homes or student bedspaces in England, and no exemption applies, yes. Check the exemptions first: developments of fewer than 10 dwellings or 30 purpose-built student bedspaces, non-profit registered providers and their wholly owned subsidiaries, affordable homes, and buildings such as care homes, hospitals, hotels and school accommodation. Applications made before 1 October 2026, and variations to them, are outside the levy, though a rejected application resubmitted after that date becomes liable.
Are the CDM principal designer and the Building Regulations principal designer the same?
Not automatically. They are separate appointments under separate legislation with different duties: one concerned with the design’s compliance with the Building Regulations, the other with health and safety. Both are needed where there is more than one contractor. The same organisation often holds both, but each appointment has to be made deliberately, and a client can confirm in writing that its CDM appointees also hold the Building Regulations roles.
How long after completion can enforcement action be taken?
A notice requiring non-compliant work to be removed or altered can now be served up to ten years after completion, up from 12 months. Breaches of the Building Regulations can carry an unlimited fine and up to two years’ imprisonment, and senior individuals can be prosecuted alongside their organisation where the offence involved their consent, connivance or neglect.
What training do our people need for the Building Safety Act?
There is no single mandatory qualification. The law requires competence rather than a named certificate, so what you need depends on the roles your people hold. An awareness course such as our Building Safety Act 2022 Awareness course is the usual starting point. People in dutyholder roles will normally need role-specific training alongside it, and CDM training as well.
Does any of this apply outside England?
The higher-risk building regime described here applies in England, as do the Building Safety Levy and the second staircase guidance in Approved Document B. Scotland, Wales and Northern Ireland have their own building safety arrangements; Wales introduced its own dutyholder regime from 1 July 2026. CDM 2015 applies across Great Britain, with CDM (NI) 2016 covering Northern Ireland.
Related Guidance
General guidance only, reviewed October 2026 against the Building Safety Act 2022, the Building Regulations 2010 as amended in 2023, the Building Safety Levy (England) Regulations 2025, Approved Document B and current Building Safety Regulator guidance. Building safety regulation is changing quickly: the single construction regulator is in development and the higher-risk building definition is under review. Levy rates are set for each local authority area, so check the rate for yours. Envico is an independent training intermediary and is not affiliated with the HSE or the Building Safety Regulator.