Subcontractor Compliance: What UK Principal Contractors Are Legally Required to Check

Principal contractors on UK construction projects carry legal obligations that most project management frameworks underestimate. The subcontractor compliance checks you run at the start of a project are not a matter of internal policy — they flow directly from the Construction (Design and Management) Regulations 2015, the Employers' Liability (Compulsory Insurance) Act 1969, and the Construction Industry Scheme (CIS) administered by HMRC.

Getting them right is not just about avoiding fines. It is about being able to demonstrate, when HSE or a client's auditor asks, that you took the right steps at the right time.

The legal framework

Four obligations, from three legal frameworks, govern what principal contractors must check about their subcontractors:

CDM 2015 Regulation 8(1) sets out the competence standard: every contractor appointed must have "the skills, knowledge and experience, and, if they are an organisation, the organisational capability, necessary to fulfil the role that they are appointed to undertake, in a manner that secures the health and safety of any person affected by the project." Regulation 8(3) places the obligation on "a person who is responsible for appointing a designer or contractor" — whoever makes the appointment, which for subcontractors is usually the principal contractor or the contractor letting the package — to "take reasonable steps to satisfy themselves" that this standard is met. This is a substantive competence check — not a form-filling exercise.

CDM 2015 Regulation 13 sets the principal contractor's side: it "must plan, manage and monitor the construction phase" (13(1)) and must ensure that employers and, where necessary, self-employed persons "where required, follow the construction phase plan" (13(3)(c)(ii)). Regulation 15 is addressed to each contractor, not to you as principal contractor: a contractor "must comply with" your directions and "the parts of the construction phase plan that are relevant to that contractor's work" (15(3)), and must give "each worker under their control" appropriate supervision, instructions and information (15(8)).

The Employers' Liability (Compulsory Insurance) Act 1969 requires "every employer carrying on any business in Great Britain" to insure against liability for injury or disease sustained by its employees (section 1(1)), and the Employers' Liability (Compulsory Insurance) Regulations 1998 set the minimum cover at £5 million (regulation 3(1)). The Act does not extend to Northern Ireland (section 7(2)), which has its own equivalent in the Employer's Liability (Defective Equipment and Compulsory Insurance) (Northern Ireland) Order 1972. A subcontractor that employs people and is not insured as the Act requires commits an offence (section 5) — and you are the one who appointed them. A sole trader with no employees is outside the duty, though your own policy or your client's contract may still require them to hold cover.

The Construction Industry Scheme (CIS) requires the contractor making the payment to verify the subcontractor with HMRC before paying them (CIS has no principal-contractor concept; regulation 6(1) of the CIS Regulations: "A contractor must verify"). The verification determines whether the subcontractor should be paid gross, at the standard 20% deduction, or at the higher 30% rate GOV.UK gives for unregistered subcontractors.

These four obligations are not optional extras. They represent the minimum legal baseline for subcontractor compliance in the UK construction industry.

Before the subcontractor starts on site

The most critical compliance window is before first appointment or before the subcontractor mobilises to site. Once work starts, fixing a gap becomes significantly more complicated. For the document-by-document version of this stage, see our subcontractor onboarding documents guide.

Competence evidence (CDM Regulation 8)

You need evidence that the subcontractor has the skills, knowledge, experience, and organisational capability for the specific work on your project. The kind of evidence depends on the trade:

Trade qualifications: CSCS cards confirming the appropriate card type for the work being carried out. A groundworker's card does not qualify for electrical work — check the specific card type against the task.
Specialist certifications: NICEIC for electrical contractors, Gas Safe for gas work, CHAS or Constructionline for broader competence assessment. These are not CDM requirements, but they are standard industry evidence of the competence assessment you need to demonstrate.
Company health and safety policy: Section 2(3) of the Health and Safety at Work etc. Act 1974 requires an employer to prepare a written statement of its health and safety policy, and the Employers' Health and Safety Policy Statements (Exception) Regulations 1975 exempt an employer with fewer than five employees (regulation 2) — so any employer with five or more employees must have one. Requesting it provides evidence of basic safety management.
Previous CDM experience: On multi-contractor projects, evidence that the subcontractor's operatives understand their duties under CDM 2015 is part of the Regulation 8 assessment.

Use a structured contractor prequalification questionnaire (PQQ) to collect this evidence consistently. A PQQ that covers the same categories for every subcontractor also creates an audit trail showing you applied a consistent standard.

Employers' liability insurance

Request the current employers' liability certificate and check the following — our guide to verifying subcontractor insurance walks through each in detail:

Cover is current — verify the policy expiry date and confirm the certificate is valid for the period the subcontractor will be on site
Cover level is at least £5 million — the statutory minimum the 1969 Act requires, set by regulation 3(1) of the Employers' Liability (Compulsory Insurance) Regulations 1998
The insured entity matches the contracting entity — if the company name on the certificate differs from the company you are contracting with, investigate before accepting it

If any of your subcontractors work labour-only, ask your insurer how your own policy treats them — the distinction between bona fide subcontractors and labour-only subcontractors is an insurance classification, and it changes who has to cover whom.

Set a reminder for the certificate's renewal date. Subcontractors frequently let EL cover lapse through oversight rather than intention. Our free insurance expiry calculator can track renewal dates across your subcontractor list and alert you 30, 14, and 7 days before expiry.

CIS verification

Before making any payment to a subcontractor, verify their CIS status with HMRC. HMRC's online CIS verification service (available through the Government Gateway) returns one of three statuses:

Gross payment status: no deduction required
Net payment (standard rate, 20%): deduct 20% before paying
Not registered (higher rate, 30%): deduct 30% — the rate GOV.UK gives for unregistered subcontractors, who have no net-payment status

Keep a record of the verification result and date for each subcontractor. CIS verification is one check of several before a first payment — our guide to verifying a subcontractor covers the full set.

RAMS before work starts

Require every subcontractor to submit risk assessments and method statements (RAMS) specific to the work on your project before work starts on site. CDM 2015 itself does not use the term RAMS, but site-specific RAMS are the usual evidence of two contractor duties in Regulation 15: to "plan, manage and monitor construction work" so that it is carried out, so far as is reasonably practicable, without risks to health and safety (15(2)), and to give workers information on the risks identified by the risk assessment under regulation 3 of the Management Regulations (15(9)(c)). Generic RAMS — templates with the previous project's name edited out — are poor evidence of either. The RAMS should address the actual hazards present on your actual site with the control measures the subcontractor's actual workforce will use.

For what a method statement must cover and how to review one properly, see our method statements in construction guide; for the legal framework behind the risk assessment half, see our construction risk assessment guide.

Review the RAMS against the relevant sections of your construction phase plan. If the RAMS are inadequate or do not reflect what you understand about the work scope, return them for revision before the subcontractor mobilises. Our RAMS in construction guide covers what a complete RAMS contains and how to review one.

You can generate a tailored compliance checklist for your project to confirm what documentation each trade type should be providing.

During the project

Subcontractor compliance is not a start-of-project box-tick. CDM 2015 Regulation 13(1) requires the principal contractor to "plan, manage and monitor the construction phase" throughout construction. Three areas require active management:

Insurance and certification expiry

EL certificates, professional indemnity policies, Gas Safe registration, NICEIC certification — all have renewal dates that fall during the project. Build a monitoring process:

Track expiry dates centrally, not in individual project files
Set alerts at 30, 14, and 7 days before expiry
Chase renewals before cover lapses — once a subcontractor is working on site without valid insurance, you have an enforcement exposure

CSCS card checks during the works

A CSCS card valid when the subcontractor mobilised may expire during a long project. Operatives also change — workers who arrive later may not have been through your pre-mobilisation check. Carry out periodic CSCS card checks on operatives working on site, not just at the start.

If an operative's card type does not match the work they are doing — or if they cannot produce a card — remove them from site and record the decision. CDM Regulation 8 applies throughout the project, not just at appointment.

CIS re-verification

There is no annual re-verification duty. GOV.UK's contractor guidance requires you to verify a subcontractor you have used before only "if you have not included them on a CIS return in the current or last 2 tax years" — so the ones to watch are subcontractors who have dropped off your returns, not the calendar. An HMRC audit that identifies payments made at the wrong deduction rate creates a liability for you, not the subcontractor.

What to keep on file

When HSE or a client auditor asks to see your subcontractor compliance records, you should be able to produce:

Completed PQQ for each subcontractor, with the evidence collected
Current EL certificate (and a log of previous certificates if the project spans a renewal)
CIS verification records, dated, for each subcontractor
RAMS received and approved before work started
Records of inductions given to each operative
A record of any compliance issues identified and how they were resolved

How you store these is a practical decision. What matters is that you can retrieve them quickly — during an inspection is not the time to search through email threads and shared drives.

For a broader look at how to structure a compliance management process across multiple subcontractors, see our guide to managing subcontractors in construction. To understand the CDM framework that underpins these requirements, see our CDM compliance guide.

SubComply is being built to hold the evidence this checklist asks for — documents, expiry dates and CIS verification status for every subcontractor, in one place. Join the waitlist to be notified when it launches.

Sources

This guide is for informational purposes and does not constitute legal advice. For project-specific compliance questions, consult a qualified health and safety professional.

Last reviewed: 8 October 2026