Subcontractor Compliance: What UK Principal Contractors Are Legally Required to Check

Principal contractors on UK construction projects carry legal obligations that most project management frameworks underestimate. The subcontractor compliance checks you run at the start of a project are not a matter of internal policy — they flow directly from the Construction (Design and Management) Regulations 2015, the Employers' Liability (Compulsory Insurance) Act 1969, and the Construction Industry Scheme (CIS) administered by HMRC.

Getting them right is not just about avoiding fines. It is about being able to demonstrate, when HSE or a client's auditor asks, that you took the right steps at the right time.

The legal framework

Three separate legal frameworks govern what principal contractors must check about their subcontractors:

CDM 2015 Regulation 8(1) sets out the competence standard: every contractor appointed must have "the skills, knowledge and experience, and, if they are an organisation, the organisational capability, necessary to fulfil the role." Regulation 8(3) places the obligation on the principal contractor to "take reasonable steps to satisfy themselves" that this standard is met before appointment. This is a substantive competence check — not a form-filling exercise.

CDM 2015 Regulation 15 requires principal contractors to ensure contractors have been provided with the information they need to carry out the work safely, including the relevant parts of the construction phase plan. It also requires principal contractors to verify that contractors are complying with the construction phase plan during the works.

The Employers' Liability (Compulsory Insurance) Act 1969 requires every employer with employees to hold employers' liability insurance of at least £5 million cover. A subcontractor carrying out work on your site who does not have valid EL insurance is operating illegally — and you are the one who appointed them.

The Construction Industry Scheme (CIS) requires principal contractors to verify their subcontractors' CIS status with HMRC before making payment. The verification determines whether the subcontractor should be paid gross, at the standard 20% deduction, or at the higher 30% deduction rate (for unverified subcontractors).

These four obligations are not optional extras. They represent the minimum legal baseline for subcontractor compliance in the UK construction industry.

Before the subcontractor starts on site

The most critical compliance window is before first appointment or before the subcontractor mobilises to site. Once work starts, fixing a gap becomes significantly more complicated.

Competence evidence (CDM Regulation 8)

You need evidence that the subcontractor has the skills, knowledge, experience, and organisational capability for the specific work on your project. The kind of evidence depends on the trade:

Trade qualifications: CSCS cards confirming the appropriate card type for the work being carried out. A groundworker's card does not qualify for electrical work — check the specific card type against the task.
Specialist certifications: NICEIC for electrical contractors, Gas Safe for gas work, CHAS or Constructionline for broader competence assessment. These are not CDM requirements, but they are standard industry evidence of the competence assessment you need to demonstrate.
Company health and safety policy: Any employer with five or more employees must have a written health and safety policy under the Health and Safety at Work etc. Act 1974. Requesting it provides evidence of basic safety management.
Previous CDM experience: On multi-contractor projects, evidence that the subcontractor's operatives understand their duties under CDM 2015 is part of the Regulation 8 assessment.

Use a structured contractor prequalification questionnaire (PQQ) to collect this evidence consistently. A PQQ that covers the same categories for every subcontractor also creates an audit trail showing you applied a consistent standard.

Employers' liability insurance

Request the current employers' liability certificate and check:

Cover is current — verify the policy expiry date and confirm the certificate is valid for the period the subcontractor will be on site
Cover level is at least £5 million — the statutory minimum under the 1969 Act
The insured entity matches the contracting entity — if the company name on the certificate differs from the company you are contracting with, investigate before accepting it

Set a reminder for the certificate's renewal date. Subcontractors frequently let EL cover lapse through oversight rather than intention. Our free insurance expiry calculator can track renewal dates across your subcontractor list and alert you 30, 14, and 7 days before expiry.

CIS verification

Before making any payment to a subcontractor, verify their CIS status with HMRC. HMRC's online CIS verification service (available through the Government Gateway) returns one of three statuses:

Gross payment status: no deduction required
Net payment (standard rate, 20%): deduct 20% before paying
Net payment (higher rate, 30%): deduct 30% — applies to unverified subcontractors or those whose verification has failed

Keep a record of the verification result and date for each subcontractor. CIS status can change between tax years — re-verify periodically, particularly at the start of each new tax year in April.

RAMS before work starts

Every subcontractor must submit risk assessments and method statements (RAMS) specific to the work on your project before work starts on site. Generic RAMS — templates with the previous project's name edited out — do not satisfy CDM 2015. The RAMS must address the actual hazards present on your actual site with the control measures the subcontractor's actual workforce will use.

Review the RAMS against the relevant sections of your construction phase plan. If the RAMS are inadequate or do not reflect what you understand about the work scope, return them for revision before the subcontractor mobilises.

You can generate a tailored compliance checklist for your project to confirm what documentation each trade type should be providing.

During the project

Subcontractor compliance is not a start-of-project box-tick. CDM 2015 Regulation 15 requires principal contractors to monitor compliance throughout construction. Three areas require active management:

Insurance and certification expiry

EL certificates, professional indemnity policies, Gas Safe registration, NICEIC certification — all have renewal dates that fall during the project. Build a monitoring process:

Track expiry dates centrally, not in individual project files
Set alerts at 30, 14, and 7 days before expiry
Chase renewals before cover lapses — once a subcontractor is working on site without valid insurance, you have an enforcement exposure

CSCS card checks during the works

A CSCS card valid when the subcontractor mobilised may expire during a long project. Operatives also change — workers who arrive later may not have been through your pre-mobilisation check. Carry out periodic CSCS card checks on operatives working on site, not just at the start.

If an operative's card type does not match the work they are doing — or if they cannot produce a card — remove them from site and record the decision. CDM Regulation 8 applies throughout the project, not just at appointment.

CIS re-verification

If you are making multiple payments over an extended project, re-verify CIS status at the start of each new tax year (6 April) rather than relying on the original verification. An HMRC audit that identifies payments made at the wrong deduction rate creates a liability for you, not the subcontractor.

What to keep on file

When HSE or a client auditor asks to see your subcontractor compliance records, you should be able to produce:

Completed PQQ for each subcontractor, with the evidence collected
Current EL certificate (and a log of previous certificates if the project spans a renewal)
CIS verification records, dated, for each subcontractor
RAMS received and approved before work started
Records of inductions given to each operative
A record of any compliance issues identified and how they were resolved

How you store these is a practical decision. What matters is that you can retrieve them quickly — during an inspection is not the time to search through email threads and shared drives.

For a broader look at how to structure a compliance management process across multiple subcontractors, see our guide to managing subcontractors in construction. To understand the CDM framework that underpins these requirements, see our CDM compliance guide.

Join the waitlist for SubComply — automated document collection, expiry tracking, and CIS verification status across all your subcontractors, from one dashboard.

Sources

This guide is for informational purposes and does not constitute legal advice. For project-specific compliance questions, consult a qualified health and safety professional.

Last reviewed: 29 July 2026