A prequalification questionnaire (PQQ) prevents this. It's the structured process of verifying a subcontractor's competence, insurance, and compliance before you appoint them — not after they've started work and you're already exposed.

This guide covers what a PQQ should include for UK construction, how industry standards have changed, and how to build one that actually protects your projects.

What a PQQ covers

A PQQ isn't a tender document. It doesn't evaluate price or programme. It answers one question: is this subcontractor capable of doing this work safely and legally?

The core areas:

1. Company information — legal entity, company number, registered address, key contacts, years trading
2. Financial standing — turnover, insurance cover levels, credit references
3. Insurance — employers' liability, public liability, professional indemnity (where applicable)
4. Health and safety — policy, accident records, enforcement notices, risk assessment capability
5. Competence and training — CSCS cards, trade certifications, training records
6. Environmental — waste management, environmental policy, relevant certifications
7. Quality — quality management system, defect history, relevant accreditations
8. References — recent similar projects, client contacts

For a pre-built PQQ covering all of these areas, download our free PQQ template — it's structured for UK construction subcontractor prequalification with around 35 questions across 6 sections.

PAS 91 is gone — what replaced it

If you've used PAS 91 as your PQQ template, you should know: PAS 91 is no longer maintained by BSI. It hasn't been updated to reflect recent legislative changes and should not be relied on as a current standard.

PAS 91 was a standardised PQQ introduced in 2010 by the British Standards Institution. It worked well for a decade, but it wasn't updated to reflect the Building Safety Act 2022 or the tightening competence requirements across the industry.

What replaced it:

For public sector and Tier 1 projects, the Common Assessment Standard (CAS) developed by Build UK is now the recognised pre-qualification framework. CAS v5 (current) includes:

• An industry-agreed question set with assessment standards
• A dedicated Building Safety section covering organisational capability under the Building Safety Act
• Proportionate standards for micro-businesses
• Two certification levels: desktop and site-based
• Recognition by central government and public sector procurement bodies

For private sector work, there's no mandated standard. Most principal contractors create their own PQQs or adapt templates from industry bodies. This is where having a well-structured PQQ matters most — without a standard to follow, it's easy to miss critical areas.

The six sections your PQQ needs

1. Company and legal status

• Registered company name and number (verify on Companies House)
• Trading name if different
• Registered address and operational address
• Date of incorporation and years trading in construction
• Key contact for compliance matters
• Any parent company or group structure

Why this matters: You need to know who you're contracting with. A recently incorporated company trading under a well-known name may not have the track record implied.

2. Insurance

• Employers' liability: policy number, insurer, cover amount, expiry date. Minimum £5M cover is a statutory requirement under the Employers' Liability (Compulsory Insurance) Act 1969.
• Public liability: cover amount and expiry date. Specify your minimum requirement (typically £1M–£10M depending on project value).
• Professional indemnity: if the subcontractor provides design services.
• Copies of current certificates — not just confirmation of cover.

Why this matters: Insurance is the one area where a gap creates immediate legal exposure. An operative working on your site without valid EL insurance is a criminal offence for their employer and a CDM failure for you as principal contractor.

3. Health and safety

• Written health and safety policy (required by law for any employer with 5+ employees)
• RIDDOR reportable incidents in the last 3 years — numbers and brief descriptions
• HSE enforcement notices, improvement notices, or prohibition notices in the last 5 years
• Name of competent health and safety advisor (internal or external)
• Accident frequency rate if available

Why this matters: Past safety performance is the best predictor of future safety performance. A firm with multiple enforcement notices needs scrutiny — not necessarily rejection, but a clear understanding of what happened and what changed.

4. Competence and workforce

• CSCS card details for operatives who will work on your project (card type, number, expiry)
• Trade-specific certifications: Gas Safe, NICEIC, IPAF, PASMA, CITB, or others relevant to the work scope
• Apprenticeship and training programmes
• How the firm ensures workforce competence for the specific work they'll do

Why this matters: CDM 2015 Regulation 8 requires you to satisfy yourself that anyone you appoint has the skills, knowledge, training, and experience to carry out the work safely. Your PQQ is how you evidence that check. See our CDM compliance guide for the full regulatory picture.

5. Environmental and quality

• Environmental policy and waste management procedures
• ISO 14001 or equivalent environmental certification (if applicable)
• Quality management system (ISO 9001 or equivalent)
• Defect rates or warranty claims history on recent projects
• How the firm manages quality on subcontracted work

Why this matters: Environmental compliance is increasingly a tender requirement, especially for public sector and Tier 1 contracts. Quality history indicates whether the firm delivers work right first time or generates costly remediation.

6. References and track record

• Three recent projects of similar type, value, and complexity
• Client contact details for reference checks
• Brief description of scope, value, and outcome
• Any projects terminated early or subject to dispute — and the circumstances

Why this matters: References are the reality check. A firm that looks perfect on paper may have a trail of disputes. Ask references specific questions: "Did they deliver on time?", "Were there any compliance issues?", "Would you use them again?"

Common PQQ mistakes

Asking too much too early. A 20-page PQQ for a £5,000 plastering job will deter good subcontractors. Scale the PQQ to the risk: small jobs need core insurance and competence checks, not a full CAS-level assessment.

Collecting but not verifying. Receiving a PQQ response isn't the same as verifying it. Check insurance certificates are current. Verify company details on Companies House. Call at least one reference.

One PQQ for all trades. A groundworker and an electrician have different competence requirements. Your PQQ should include trade-specific questions — a generic template misses these.

Never updating. If a subcontractor completed your PQQ two years ago, their insurance, workforce, and safety record may have changed. Re-qualify annually or at the start of each new project.

From PQQ to ongoing compliance

The PQQ is the starting point, not the finish line. Once you've prequalified and appointed a subcontractor, you need to track the documents they submitted — insurance expiry dates, CSCS card renewals, certification validity. Pre-qualification without ongoing monitoring is a compliance gap waiting to happen.

For the full process from prequalification through to site monitoring, see our guide to managing subcontractors in construction. For on-site compliance checks, see the on-site compliance checklist.

Sources

• The Construction (Design and Management) Regulations 2015 (SI 2015/51)
• Employers' Liability (Compulsory Insurance) Act 1969
• Building Safety Act 2022 (c. 30)
• Build UK — Common Assessment Standard (CAS)

This guide is for informational purposes and does not constitute legal advice. For project-specific prequalification requirements, consult your legal or procurement advisor.

Last reviewed: 11 March 2026

If you're a UK contractor looking for a free way to manage subcontractor compliance, here's an honest breakdown of what's actually available and where the limitations are.

What "free" usually means

The subcontractor management software market uses "free" in three different ways:

Free trial (14–30 days). Full features, temporary access. You get a clear picture of what the tool does, but you're paying after the trial or losing access. Useful for evaluation, not a long-term solution.

Free tier (permanent but limited). Typically capped at 3–5 users, a small number of subcontractors, or basic features only. Often enough for a sole trader managing 2–3 subs. Rarely sufficient for a principal contractor managing 10+ subcontractors across multiple projects.

"Free" with mandatory upsell. Core features are free, but the capabilities you actually need — expiry alerts, reporting, document storage beyond a threshold — sit behind a paywall. You discover this after investing time in setup.

What free tools can and can't do

Most free options in this space are general contractor management or project management tools that include some subcontractor features. Here's where they typically fall short for UK construction compliance:

What they usually cover:

• Basic contact management (subcontractor names, addresses, phone numbers)
• Simple document storage (upload a file, find it later)
• Task assignment and scheduling
• Basic reporting

What they usually miss:

• Insurance expiry tracking with automated alerts. Storing a PDF of an EL certificate is not the same as tracking that it expires on 15 August and sending a reminder 30 days before. Most free tools store files — they don't track what's inside them.
• UK-specific compliance fields. CSCS card types and numbers, CIS verification status, CDM competence evidence — these require purpose-built data fields, not generic document storage.
• Individual operative tracking. A subcontractor firm might have 15 operatives. Free tools often track companies only. But CSCS cards, training certificates, and competence records belong to individuals, not firms.
• Audit-ready reporting. When a client auditor asks for a compliance pack, can you generate one in 5 minutes? Free tools rarely offer this — you'll be manually copying data into a document.

The spreadsheet: still the most common "free" option

For most UK contractors managing subcontractor compliance without paid software, the real tool is a spreadsheet. Excel or Google Sheets with columns for subcontractor name, EL expiry, PL expiry, CSCS status, CIS verification date.

Spreadsheets are genuinely free, flexible, and familiar. They work until they don't:

• No automated alerts. You need to open the spreadsheet and check dates manually. If nobody checks for two weeks, you miss an expiry.
• No version control. Three people updating the same spreadsheet — or worse, three copies of the same spreadsheet — creates conflicting records.
• No subcontractor self-service. You're still chasing documents by email and manually entering data from photographed certificates.
• Scale ceiling. At 10–15 active subcontractors, a well-maintained spreadsheet is manageable. At 30+, it becomes unreliable. The more subcontractors you add, the more likely it is that gaps go unnoticed.

For a detailed guide on what to track, use our free compliance checklist generator — it produces a checklist tailored to your specific trade types and project scope. That checklist can also serve as the column headers for your spreadsheet if you're not ready for dedicated software.

Free tools worth using alongside your tracking system

While comprehensive free subcontractor management software is rare, there are free tools that solve specific parts of the compliance problem:

Insurance tracking. Our free insurance expiry calculator lets you enter renewal dates for each subcontractor and see a traffic-light dashboard — green, amber, red — with suggested reminder dates at 30, 14, and 7 days before expiry.

Pre-qualification. Our free PQQ template covers competence, insurance, health and safety, environmental, and quality questions based on UK construction requirements. Download and customise it for your projects.

CIS verification. HMRC's CIS verification service is free to use — you verify each subcontractor's tax status directly with HMRC before making payments.

CDM guidance. The HSE's CDM 2015 guidance is free and explains contractor and principal contractor duties. Our CDM compliance guide breaks this down into a practical step-by-step process.

When free stops being enough

The honest answer: free tools work for small operations with simple compliance needs. Here are the signals that you've outgrown them:

• You've missed an insurance expiry. If a subcontractor worked on site with expired EL insurance and you didn't know, your manual tracking has failed. Under the Employers' Liability (Compulsory Insurance) Act 1969, the fine is up to £2,500 per day.
• Audit preparation takes hours, not minutes. If producing a compliance pack for a client auditor means opening multiple files, checking multiple spreadsheets, and manually compiling a report, you're spending time you don't have.
• You're managing more than 15 active subcontractors. The number of documents, expiry dates, and personnel records exceeds what manual processes can reliably track.
• Subcontractors are slow to return documents. Without a self-service portal where subs can upload from their phone, you're chasing by email and text. That chasing eats hours every week.

For an in-depth look at what to evaluate when you're ready to move beyond free tools, see our subcontractor compliance software buyer's guide and the broader subcontractor management software guide.

Sources

• Employers' Liability (Compulsory Insurance) Act 1969
• HSE — Contractor roles and responsibilities under CDM 2015
• GOV.UK — Construction Industry Scheme

This guide is for informational purposes and does not constitute legal advice.

Last reviewed: 11 March 2026

This is where compliance management actually gets tested. The checks you ran before appointment don't stay valid forever. Insurance expires. New operatives arrive without being inducted. Method statements written for the first phase don't cover the work happening in week six. If you're only checking compliance at the start of a project, you're only managing the risk you can see on day one.

This checklist covers what to check daily, weekly, and monthly to maintain subcontractor compliance on a live UK construction site. For the full pre-qualification and appointment process, see our guide to managing subcontractors in construction.

Daily compliance checks

These are quick checks — 5 to 10 minutes during your morning walkdown:

• CSCS cards visible. Every operative on site should be wearing their CSCS card. If someone can't produce a valid card when asked, they shouldn't be working until it's verified. Under CDM 2015 Regulation 8, you must satisfy yourself that anyone carrying out work has the skills, knowledge, training, and experience to do so safely.
• PPE compliance. Are operatives wearing the correct PPE for their task? Hard hat, hi-vis, steel-toed boots are baseline — but specific trades may require additional protection (RPE for dusty work, harnesses at height, eye protection for grinding).
• Work matches the method statement. Is the work being done consistent with the RAMS the subcontractor submitted? If the scope has changed — different equipment, different location, additional hazards — the risk assessment must be updated before work continues.
• Site access control. No unauthorised personnel on site. This includes subcontractor operatives who haven't completed their site induction, visitors without sign-in, and anyone from firms that haven't been through pre-qualification.
• Welfare facilities. Toilets, washing facilities, drinking water, rest areas, drying rooms — all functioning and accessible. This is a principal contractor duty under CDM 2015.

Weekly compliance checks

Set aside 30 minutes once a week for these:

• New operatives check. Has any subcontractor brought new people on site this week? Every new operative needs a site-specific induction and CSCS card verification before starting work. Ask subcontractor supervisors directly — don't wait for them to tell you.
• Permit-to-work review. For high-risk activities (hot works, confined spaces, working at height, electrical work near live services), check that permits are current, conditions are being followed, and permits are being closed out after the work is complete.
• Near-miss and hazard review. Are near-misses being reported? If the site has had zero reported near-misses in a month, that usually means under-reporting, not a perfect safety record. Review any reports from the week and check that corrective actions were completed.
• Housekeeping and access routes. Cluttered access routes, materials stored in walkways, trailing cables — these are both CDM compliance issues and leading indicators of a site where safety standards are slipping.
• Subcontractor coordination. When multiple subcontractors are working in the same area, are their activities coordinated to prevent conflicts? Steelwork overhead while groundworkers are below. Electricians pulling cables through spaces where plasterers are working. Check the construction phase plan covers these interactions.

Monthly compliance checks

These take longer but catch the issues that daily and weekly checks miss:

• Insurance expiry review. Pull up every active subcontractor's EL and PL certificates. Are any expiring in the next 30 days? Chase renewals now, not after the cover lapses. A subcontractor whose employers' liability insurance has expired should not work on site — their employer faces a fine of up to £2,500 per day under the Employers' Liability (Compulsory Insurance) Act 1969, and allowing them to continue weakens your CDM compliance evidence. Our free insurance expiry calculator gives you a traffic-light view of which subcontractors are approaching or past their renewal dates.
• RAMS currency check. Has the work scope changed since the risk assessments were submitted? New phases, different equipment, changed site conditions — all require updated RAMS. Generic method statements that haven't been reviewed since the start of the project are a common CDM finding.
• CIS verification status. Subcontractor tax status can change. If you haven't re-verified with HMRC recently, you may be applying the wrong deduction rate. Check the CIS verification guidance for the current process.
• Training and competence evidence. For long-running projects, check that any time-limited training certifications (IPAF, PASMA, first aid, fire marshal) are still valid. These tend to have 1–3 year renewal cycles.
• Construction phase plan update. The plan should reflect what's actually happening on site. If new subcontractors have been appointed, phases have changed, or significant hazards have emerged, the plan needs updating. This is a principal contractor responsibility under CDM 2015 — see our principal contractor duties guide.

When you find a gap

Compliance gaps are inevitable. What matters is how quickly you identify and resolve them:

Immediate stop situations:

• Expired employers' liability insurance — stop work until a current certificate is provided (the employer's obligation under the EL Act, and evidence you need for CDM compliance)
• Operative on site without valid CSCS card — remove from site until verified (industry best practice and a common client requirement, supporting CDM Regulation 8 competence checks)
• Work being done without an adequate risk assessment — stop the task

Corrective action situations:

• RAMS not updated for current phase — subcontractor must submit revised RAMS before resuming that work scope
• Training certification expired — operative cannot carry out the activity requiring that certification until renewed
• Permit-to-work conditions not being followed — stop the permitted activity, review with the subcontractor

In every case, document what you found, when, and what action you took. A clear audit trail demonstrates you're meeting your duty to manage compliance "so far as is reasonably practicable" — the standard under UK health and safety law. When HSE inspects or a client audits, your records are the evidence.

Making it sustainable

Running these checks across 20 or 30 subcontractors with spreadsheets and memory is where most contractors struggle. The daily and weekly checks are manageable with discipline. The monthly checks — tracking insurance expiry dates, CSCS renewals, CIS re-verification, training certificates — are where manual processes break down.

Generate a complete list of what you need to track for your specific project with our free compliance checklist generator. For an overview of what dedicated subcontractor compliance software can automate, see our buyer's guide.

Sources

• The Construction (Design and Management) Regulations 2015 (SI 2015/51)
• HSE — Contractor roles and responsibilities under CDM 2015
• Employers' Liability (Compulsory Insurance) Act 1969
• GOV.UK — Construction Industry Scheme

This guide is for informational purposes and does not constitute legal advice. For project-specific compliance questions, consult a qualified health and safety professional.

Last reviewed: 11 March 2026

General contractor management tools handle scheduling, progress tracking, and payments. Compliance software solves a different problem: are your subcontractors legally allowed to work on your site right now?

This guide explains what subcontractor compliance software does, how to evaluate it for UK construction, and when a dedicated tool makes more sense than a compliance module bolted onto a broader platform. For a wider look at the subcontractor management software category, see our buying guide.

The compliance document lifecycle

Compliance isn't a one-off check. Documents cycle through five stages, and your software needs to handle all of them:

1. Collect — Insurance certificates, CSCS card details, CIS verification, trade qualifications, RAMS. The bottleneck is chasing subcontractors. Software that lets subs upload directly from their phone (photograph a cert, submit in 60 seconds) removes this friction.

2. Verify — Is the EL certificate current? Does the cover amount meet your £5M minimum? Is the CSCS card type correct for the work scope? Manual verification is slow and error-prone. Good compliance software flags mismatches automatically.

3. Track — Every document has an expiry date. EL and PL certificates typically renew annually. CSCS cards expire every 5 years. CIS verification status can change between tax years. The software needs to maintain a live register with countdown tracking.

4. Alert — Automated reminders at 30, 14, and 7 days before expiry. Not just to you — to the subcontractor as well. By the time you notice an expired certificate manually, the gap may have existed for weeks.

5. Report — When a Tier 1 client auditor arrives or HSE inspects, you need a clean compliance pack within minutes, not hours. The software should generate audit-ready reports showing current status, document history, and any resolved gaps.

Most general contractor management tools handle step 1 (document storage) and stop there. Dedicated compliance software covers the full lifecycle.

UK-specific requirements your software must handle

Software built for the US market or designed as a generic international platform will miss requirements that are specific to UK construction:

CDM 2015 compliance. The Construction (Design and Management) Regulations 2015 place specific duties on principal contractors. You must verify subcontractor competence (Regulation 8), maintain construction phase plans, and keep records of inductions and RAMS. Your compliance software should link competence evidence to specific operatives and projects — not just store files in a folder. For a full breakdown, see our CDM compliance guide.

Employers' liability insurance. A statutory requirement under the Employers' Liability (Compulsory Insurance) Act 1969. Your software must track policy numbers, cover amounts, insurer names, and expiry dates for every subcontractor — and distinguish EL from PL and PI cover. Our free insurance expiry calculator shows what this tracking should look like in practice.

CIS verification. The Construction Industry Scheme requires you to verify each subcontractor with HMRC and apply the correct deduction rate. Verification status can change, so your software needs to flag re-verification deadlines — not just record the initial check.

CSCS card tracking. Individual-level, not company-level. A subcontractor with 15 operatives has 15 different cards with different types, numbers, and expiry dates. The software should track each operative separately.

Building Safety Act 2022. The Building Safety Act 2022 is raising competence requirements across the industry. If your compliance software can't track competence evidence beyond basic certifications — training records, CPD, role-specific qualifications — it may not keep pace with tightening requirements.

Dedicated compliance tool vs. compliance module

The market splits into two categories:

Dedicated compliance platforms focus entirely on document collection, expiry tracking, and audit reporting. They tend to be simpler, cheaper, and faster to implement. If your primary pain is "I can't tell which subcontractors are compliant right now," this is what you need.

Broader contractor management platforms include compliance as one module among many — alongside scheduling, payments, safety management, and project tracking. They're typically more expensive and take longer to set up. If you need all of those features, the integration is valuable. If you only need compliance, you're paying for capabilities you won't use.

How to decide:

• Managing 10–30 subcontractors with compliance as the primary gap? Dedicated tool.
• Managing 50+ subcontractors with compliance, scheduling, and payment needs? Broader platform may justify the cost.
• Currently using spreadsheets for compliance? A dedicated tool is the lowest-friction step up. A full platform change is a bigger commitment.

What to test before you commit

Before choosing any compliance software, run this practical evaluation:

• Upload test: Ask a subcontractor to submit an insurance certificate using their phone. Time it. If it takes more than 2 minutes or requires a desktop, adoption will be low.
• Expiry alert test: Set a test expiry date for next week. Does the system send reminders at the intervals you configured? Do reminders go to both you and the subcontractor?
• Audit report test: Generate a compliance report for all subcontractors on a project. Does it show current status, document history, and outstanding gaps in a format you could hand to a client auditor?
• UK compliance test: Can the system distinguish between EL, PL, and PI insurance? Does it track CSCS cards at individual level? Can it record CIS verification status?

If a tool fails any of these tests, it's not solving your actual problem — regardless of how polished the dashboard looks.

Use our free compliance checklist generator to map out exactly which documents you need to track for your trade types and project scope. That gives you a concrete feature list to test against.

Sources

• The Construction (Design and Management) Regulations 2015 (SI 2015/51)
• Employers' Liability (Compulsory Insurance) Act 1969
• GOV.UK — Construction Industry Scheme
• Building Safety Act 2022 (c. 30)

This guide is for informational purposes and does not constitute legal advice.

Last reviewed: 11 March 2026

This guide breaks down every principal contractor duty under the Construction (Design and Management) Regulations 2015, with the regulation numbers, practical actions, and common failures for each.

For a broader overview of CDM compliance and all five duty holder roles, see our CDM compliance guide.

When must a principal contractor be appointed?

On any project with more than one contractor, the client must appoint a principal contractor in writing before the construction phase begins (Regulation 5). If the client fails to do this, the client themselves takes on the principal contractor duties.

A principal contractor must be a contractor — you can't appoint a consultant, architect, or other non-contractor to this role.

Your duties before construction starts

Prepare the construction phase plan (Regulation 12)

The construction phase plan must be prepared, or at minimum started, before the construction phase begins. It is a living document — not a one-off submission that sits in a drawer.

What it must cover:

• A description of the project and its key phases
• Management arrangements: who is responsible for what, how communication works, how health and safety is monitored
• Site rules (PPE requirements, permits, access control, working hours)
• Specific measures for managing high-risk work: work at height, excavation, confined spaces, demolition, hot works
• Arrangements for monitoring compliance and reviewing the plan
• Emergency procedures

Common failure: Producing a generic template that doesn't reflect the actual project. A construction phase plan that doesn't address site-specific risks won't satisfy an HSE inspection, even if it exists on file.

Verify contractor competence (Regulation 8)

Before any contractor starts work on the project, you must take reasonable steps to satisfy yourself that they have the skills, knowledge, experience, and — if they're an organisation — the organisational capability to carry out the work safely.

What this means in practice:

• Check employers' liability insurance (minimum £5M cover, valid certificate)
• Check public liability insurance (cover level matching contract requirements)
• Verify CSCS cards for operatives (card type must match the work)
• Review trade-specific qualifications (Gas Safe, NICEIC, etc.)
• Obtain a copy of their health and safety policy (legal requirement for firms with 5+ employees)
• Request references or evidence of similar work completed safely

For a full subcontractor compliance checklist, see our guide to managing subcontractors in construction. You can also generate a tailored compliance checklist for your specific project trades, or use our PQQ template to structure your prequalification process.

Obtain pre-construction information (Regulation 4)

The client must provide pre-construction information relevant to the project. As principal contractor, you should ensure you've received this before starting the construction phase plan. This includes:

• Information about existing structures, hazards, and services
• Previous health and safety files for the site
• Information about significant design or construction risks identified by the principal designer

Your duties during construction

Coordinate contractors on site (Regulation 13)

This is the core of the principal contractor role. You must actively coordinate all contractors working on the project to ensure their work doesn't create risks for each other or for other people affected by the work.

What coordination looks like:

• Progress meetings that include health and safety as a standing agenda item — not an afterthought
• Sequencing work to avoid trade conflicts (e.g., not scheduling work at height above ground-level trades)
• Sharing information between contractors about hazards their work creates for others
• Resolving conflicts when one contractor's method statement is incompatible with another's

Common failure: Treating coordination as a paperwork exercise. Having signed method statements on file doesn't satisfy Regulation 13 if the actual work on site isn't being actively managed.

Provide site-specific inductions (Regulation 14)

Every worker must receive a site-specific induction before starting work. The induction must cover:

• Site-specific hazards and risks (not just generic construction risks)
• Emergency procedures and assembly points
• First aid arrangements
• Site rules and access restrictions
• Welfare facilities
• How to report hazards, near-misses, and unsafe conditions

Common failure: Using the same generic induction for every project. If the induction doesn't mention the specific risks of this site — asbestos on the third floor, live services in the basement, restricted access near the public highway — it hasn't met the legal requirement.

Consult and engage workers (Regulation 14)

Workers must be consulted about matters affecting their health, safety, and welfare. This isn't a suggestion — it's a legal duty under CDM 2015.

What this means:

• Provide mechanisms for workers to raise concerns (toolbox talks, safety notice boards, safety representatives)
• Respond to concerns raised — not just log them
• Involve workers in risk assessments where practical
• Ensure subcontractor employees have the same access to consultation as your direct employees

Prevent unauthorised access (Regulation 13)

You must take reasonable steps to prevent people who are not authorised from entering the construction site. This includes members of the public, children, and workers from other projects.

Ensure welfare facilities (Regulation 13)

Welfare facilities must be provided from day one of the construction phase and maintained throughout. These include:

• Toilets and washing facilities
• Drinking water
• Rest areas with seating and heating
• Changing rooms and lockers (if needed)
• Facilities for drying wet clothing

Monitor compliance throughout (Regulation 13)

Your responsibilities don't end once contractors are on site and inducted. You must monitor compliance throughout the construction phase.

Proactive monitoring:

• Regular site inspections and safety tours
• Checking that method statements are being followed
• Verifying that PPE is being worn correctly
• Confirming that safety controls (edge protection, excavation support, scaffolding standards) are in place

Reactive monitoring:

• Investigating accidents, incidents, and near-misses
• Reviewing compliance after any changes to work scope or site conditions
• Checking subcontractor document expiry dates (insurance, CSCS, qualifications)

Common failure: Only monitoring reactively — investigating after something goes wrong. CDM requires proactive management. If you're only checking compliance when there's an incident, you're not meeting the standard.

Your duties at project completion

Ensure the health and safety file is updated (Regulation 12)

The principal designer is responsible for preparing and maintaining the health and safety file, but the principal contractor must provide information needed for the file and ensure it's passed to the client at the end of the project.

The file should include:

• As-built drawings and specifications
• Details of materials used (especially hazardous materials)
• Information about installed services
• Maintenance and cleaning requirements
• Residual risks that need managing during future work

Frequently asked questions

Can a client be a principal contractor?

Yes, if the client is a contractor and wishes to take on the role. They must still meet the competence requirements and fulfil all principal contractor duties.

What's the difference between principal contractor and contractor?

Every contractor has duties to plan, manage, and monitor their own work. The principal contractor has additional duties to coordinate all contractors on the project, prepare the construction phase plan, and manage site-wide health and safety. There is only one principal contractor per project.

Who appoints the principal contractor?

The client appoints the principal contractor in writing. On projects with more than one contractor, this appointment must be made before the construction phase begins.

Sources

• The Construction (Design and Management) Regulations 2015 (SI 2015/51)
• HSE — Principal contractor duties under CDM 2015
• HSE L153 — Managing health and safety in construction

This guide is for informational purposes and does not constitute legal advice. For project-specific CDM compliance questions, consult a qualified health and safety professional.

Last reviewed: 11 March 2026

The Construction Industry Scheme (CIS) is one of the most straightforward compliance obligations UK contractors have. But it catches people out because verification status isn't static — it can change between tax years and even within them. With the new tax year starting on 6 April 2026, now is the time to re-verify your subcontractors and check your processes.

This guide covers how CIS verification works, what to check before April 2026, and common mistakes that create HMRC liability.

What CIS is and who it applies to

CIS is a tax deduction scheme administered by HMRC. When a contractor pays a subcontractor for construction work, the contractor must deduct tax from the payment and pay it to HMRC on the subcontractor's behalf. The subcontractor can then claim credit for the deduction on their tax return.

You must register as a CIS contractor if:

• You pay subcontractors for construction work (not just materials or plant hire)
• Your annual spending on construction operations exceeds £3 million, or
• You're a deemed contractor (e.g., government bodies, housing associations) spending over £1 million on construction

Construction operations covered by CIS include: building, alteration, dismantling, construction, repair, decoration, demolition, and installation of heating, lighting, power supply, drainage, and communication systems. Land preparation and site clearance are also included.

Not covered: professional services (architecture, surveying), material delivery without installation, manufacturing off-site, and carpet fitting.

How CIS verification works

Before making your first payment to any subcontractor, you must verify them with HMRC. You can verify online through the HMRC CIS online service or by phone.

HMRC will confirm one of three deduction rates:

• 0% (gross payment status) — the subcontractor receives the full payment with no deductions. Gross status is granted to subcontractors with a clean compliance record, proven turnover threshold, and timely tax returns.
• 20% (net payment status) — the standard rate. You deduct 20% from the labour element of each payment and pay it to HMRC.
• 30% (unverified) — if the subcontractor isn't registered for CIS, or HMRC can't verify them, you must deduct 30%. This is the highest rate and often catches subcontractors by surprise.

Deductions apply to labour costs only. If a subcontractor's invoice separates labour and materials, you only deduct from the labour portion. If the invoice doesn't separate them, you must deduct from the total.

What to check before April 2026

The UK tax year runs from 6 April to 5 April. The start of the new tax year is when CIS verification status is most likely to change. Here's what to do before April 2026:

1. Re-verify all active subcontractors

Verification status can change for several reasons:

• HMRC revokes gross payment status if the subcontractor fails the compliance test (late tax returns, outstanding tax debts)
• A subcontractor who was unverified may have registered for CIS and now qualifies for net or gross status
• Company restructuring or changes in legal entity may affect verification

Re-verify every active subcontractor with HMRC before your first payment in the new tax year. Don't assume last year's rate still applies. A 5-minute check per subcontractor can save thousands in penalties and under-deduction liability.

2. Reconcile your CIS deductions

Before the tax year ends on 5 April 2026, reconcile your CIS deduction records against your payment records. Check that:

• Every subcontractor payment has the correct deduction applied
• Monthly CIS returns match your actual payments and deductions
• You have verification records for every subcontractor you've paid

3. Check your monthly return filing

CIS returns are due by the 19th of each month. Late filing penalties are automatic:

• 1 day late: £100
• 2 months late: £200
• 6 months late: £300 or 5% of the CIS deductions (whichever is higher)
• 12 months late: £300 or 5% of the CIS deductions (whichever is higher) — plus potential additional penalties

If you have outstanding returns for the current tax year, file them before the year-end to avoid compounding penalties into the new year.

4. Update your subcontractor records

For each active subcontractor, ensure you have:

• Their Unique Taxpayer Reference (UTR) or company registration number
• National Insurance number (for sole traders)
• Current verification status and the date it was confirmed
• A record of all payments and deductions made in the current tax year

Common CIS mistakes

Applying the wrong deduction rate. This is the most common issue. If you deduct 20% when HMRC's current rate is 30%, you're liable for the shortfall. Always verify before the first payment and re-verify when status may have changed.

Not separating labour and materials. If a subcontractor's invoice doesn't break out materials separately, you must deduct CIS from the total payment amount. Subcontractors who want to avoid this should itemise their invoices.

Forgetting to verify new subcontractors. Every new subcontractor must be verified before you make the first payment. Not after the first invoice. Not at the end of the month. Before the payment.

Treating CIS registration as a one-off. Verification isn't permanent. A subcontractor's status can change at any time, and HMRC expects you to re-verify periodically — particularly at the start of each tax year.

Missing the employment status question. CIS applies to self-employed subcontractors. If a worker is actually an employee (based on HMRC's employment status tests), CIS doesn't apply — PAYE does. Getting this wrong creates a different, larger liability. Use the HMRC CEST tool if you're unsure.

CIS and your wider compliance obligations

CIS verification is one part of the subcontractor compliance picture. Under CDM 2015, principal contractors must also verify insurance, CSCS cards, competence, and health and safety capability. For the full pre-appointment process, see our subcontractor management guide. For a structured approach to pre-qualification, try our free PQQ template.

The practical challenge is tracking all of these obligations across 20 or 30 active subcontractors. CIS verification dates, insurance expiry dates, CSCS card renewals — each with different timescales and renewal processes. Our free insurance expiry calculator can help with the insurance side, and our CDM compliance guide covers the broader regulatory framework.

Sources

• GOV.UK — Construction Industry Scheme
• GOV.UK — Use the Construction Industry Scheme online
• GOV.UK — Check Employment Status for Tax (CEST)
• The Construction (Design and Management) Regulations 2015 (SI 2015/51)

This guide is for informational purposes and does not constitute tax or legal advice. For CIS-specific questions, consult your accountant or HMRC directly.

Last reviewed: 11 March 2026

If you're involved in a UK construction project as a client, designer, or contractor, CDM compliance is a legal obligation, not a recommendation. For a practical compliance checklist and step-by-step process, see our complete CDM compliance guide or generate a free compliance checklist for your project.

What CDM 2015 actually requires

CDM 2015 is built around a simple principle: health and safety risks should be managed throughout the entire project lifecycle, starting at the design stage rather than waiting until work reaches site.

The regulations require five things:

1. Appoint the right people. On multi-contractor projects, the client must appoint a principal designer (for the pre-construction phase) and a principal contractor (for the construction phase) before work begins.
2. Plan before you build. A construction phase plan must be prepared before the construction phase starts. This covers site rules, health and safety arrangements, and measures for managing high-risk work.
3. Verify competence. Every person or organisation appointed to work on the project must have the skills, knowledge, experience, and organisational capability for the role (Regulation 8).
4. Coordinate and communicate. Duty holders must cooperate and share information. The principal contractor must coordinate all contractors on site. Workers must be consulted about health and safety matters.
5. Document and hand over. A health and safety file must be maintained and passed to the client at project completion.

For a detailed breakdown of principal contractor duties and a subcontractor compliance checklist, see our CDM compliance guide.

Who has duties under CDM?

CDM 2015 assigns responsibilities to five duty holder roles. On small projects with a single contractor, one person may wear multiple hats. On larger projects, each role is distinct.

Workers also have duties: they must take care of their own health and safety, cooperate with their employer, and report anything they believe is dangerous.

On projects with only one contractor: The contractor takes on the duties of both contractor and principal contractor. The client still has duties but does not need to appoint separate principal designer or principal contractor roles.

What happens if you don't comply

CDM 2015 is enforced by the Health and Safety Executive (HSE). Non-compliance is a criminal offence.

Enforcement actions include:

• Improvement notices — requiring you to fix a specific problem within a set timeframe
• Prohibition notices — stopping work immediately where there is a risk of serious personal injury
• Prosecution — for serious breaches or persistent non-compliance

Penalties for health and safety offences:

• Unlimited fines for organisations
• Fines and/or imprisonment for individuals (up to 2 years for most offences under the Health and Safety at Work etc. Act 1974)
• Manslaughter charges in cases where gross negligence causes death

The Sentencing Council guidelines link fines to the size and turnover of the offending organisation. For the most serious breaches, fines can reach six or seven figures depending on the size of the organisation and the level of culpability — and courts can go above the starting points.

Beyond criminal penalties, non-compliance can lead to:

• Civil claims from injured workers
• Contract termination by clients who require CDM compliance as a condition
• Insurance invalidation if an insurer finds you were non-compliant at the time of an incident
• Reputational damage that affects future tender outcomes

CDM compliance in 2026: what's changing

CDM 2015 itself hasn't changed, but the regulatory environment around it is tightening.

The Building Safety Act 2022 introduced a new Building Safety Regulator and strengthened competence requirements for duty holders on higher-risk buildings. While primarily targeting residential buildings over 18 metres, the Act's emphasis on demonstrating competence — not just declaring it — is raising standards across all construction work.

For principal contractors, this means having documents on file isn't enough — you need to demonstrate that you're actively managing compliance, verifying subcontractor competence, and monitoring ongoing adherence.

Frequently asked questions

Is CDM a legal requirement?

Yes. CDM 2015 applies to all construction work in Great Britain. It is law, not guidance. Non-compliance is a criminal offence enforced by the HSE.

Does CDM apply to small projects?

Yes. There is no minimum project size. A single-contractor kitchen refurbishment is covered, as is a multi-billion pound infrastructure project. The duties scale with project complexity, but the regulations apply universally.

What does CDM compliance mean in practice?

CDM compliance means having the right people appointed, a construction phase plan in place before work starts, documented evidence of competence for everyone on the project, active coordination between duty holders, and ongoing monitoring throughout the construction phase. It is not a one-off paperwork exercise — it requires continuous management.

What happens if you don't follow CDM?

The HSE can issue improvement notices, prohibition notices (stopping work immediately), or prosecute. Fines are unlimited for organisations. Individuals can face fines and imprisonment. In fatal cases, gross negligence manslaughter charges may apply.

Sources

• The Construction (Design and Management) Regulations 2015 (SI 2015/51)
• HSE — CDM 2015 guidance
• Health and Safety at Work etc. Act 1974
• Building Safety Act 2022
• Sentencing Council — Health and safety offences guidelines

This guide is for informational purposes and does not constitute legal advice. For project-specific CDM compliance questions, consult a qualified health and safety professional.

Last reviewed: 11 March 2026

This guide focuses on what UK contractors should evaluate when choosing software to manage subcontractor compliance. Not project management. Not generic "contractor management." Compliance.

What subcontractor management software actually does

At its core, subcontractor management software helps you collect, organise, and track the documentation and compliance status of every subcontractor working on your projects. For UK construction contractors, that means:

• Document collection — insurance certificates, CSCS cards, trade qualifications, RAMS, CIS verification
• Expiry tracking — automated alerts when insurance, certifications, or training are about to lapse
• Compliance dashboards — at-a-glance view of which subcontractors are compliant and which have gaps
• Audit-ready reporting — the ability to produce a clean compliance file when a client auditor or HSE inspector asks

Some tools also cover prequalification questionnaires (PQQs), subcontractor portals for document submission, and CIS tax deduction management.

The five compliance features UK contractors need

Most software comparison articles list generic features. Here are the specific capabilities that matter for UK construction compliance.

1. Employers' liability insurance tracking

This is non-negotiable. Under the Employers' Liability (Compulsory Insurance) Act 1969, every employer must hold EL insurance with a minimum £5M cover. The fine for operating without it is up to £2,500 per day.

What to check: Does the software track EL policy numbers, cover amounts, insurer names, and — critically — expiry dates? Can it send automated reminders before certificates lapse? Can you see at a glance which subcontractors have expired or expiring cover?

Many general contractor management tools don't distinguish between insurance types. You need a tool that understands the difference between EL, PL, PI, and trade-specific insurance — and tracks each separately. To see what effective insurance tracking looks like, try our free insurance expiry calculator.

2. CSCS card management

CSCS cards verify that construction workers have the right training and qualifications for the work they're doing. While CSCS is not a direct statutory requirement under CDM 2015, most clients and principal contractors require valid cards as evidence of competence under Regulation 8 — and Build UK's Common Assessment Standard expects it.

What to check: Can you record card types, card numbers, and expiry dates for individual operatives — not just companies? When a card expires or a new operative joins a subcontractor's team, does the system flag it?

The common gap here: many tools track company-level compliance only. But CSCS cards are held by individuals, and a subcontractor might have 15 operatives with different card types and expiry dates.

3. CIS integration

The Construction Industry Scheme requires contractors to verify subcontractors with HMRC and apply the correct tax deduction rate (0%, 20%, or 30%). Getting this wrong creates HMRC liability.

What to check: Does the software verify CIS status? Can it flag when a subcontractor's verification status changes (e.g., from gross to net payment)? Does it integrate with your accounting system for CIS returns?

CIS is a UK-specific requirement. Software designed for the US or international market won't handle it unless UK-specific features have been added.

4. CDM compliance support

CDM 2015 requires principal contractors to ensure subcontractor competence, maintain construction phase plans, and keep records of site inductions, RAMS, and compliance checks.

What to check: Can the software store and track RAMS submissions per subcontractor per project? Does it record site inductions? Can you link competence evidence (qualifications, training records) to specific subcontractors and operatives?

5. Subcontractor self-service

The biggest bottleneck in compliance management isn't the checking — it's the chasing. Every hour you spend emailing subcontractors for updated insurance certificates is an hour you're not managing the project.

What to check: Does the software let subcontractors upload documents directly — ideally from their phone? Can they photograph a certificate and submit it in under a minute? Does the system notify you when a new document arrives, or does it sit in a queue nobody checks?

A subcontractor portal that's genuinely easy to use (not a complex enterprise system with a login process) dramatically reduces the time you spend chasing paperwork.

Questions to ask before buying

These apply to any subcontractor management tool you're evaluating:

1. Is it built for UK construction? Tools designed for US contractors won't handle CIS, CSCS, CDM, or UK employers' liability requirements. International tools with a "UK version" may be superficial adaptations.

2. What does it actually cost? Look for transparent pricing. Some tools only offer "contact us for a quote" — which usually means enterprise pricing that won't suit a firm managing 10–50 subcontractors. Calculate cost per subcontractor per month.

3. How long to get value? If setup takes weeks and requires a consultant, it may not be worth it for smaller contractors. You want to be tracking compliance within days, not months.

4. Can subcontractors actually use it? Ask for a demo of the subcontractor experience, not just the contractor dashboard. If your subs need training to upload a certificate, adoption will be low and you'll be back to email chasing.

5. What happens to your data? Can you export your subcontractor records if you switch tools? Are documents stored securely and backed up? Where is the data hosted (UK data residency matters for some contracts)?

The spreadsheet vs. software decision

Many contractors manage compliance in spreadsheets. This works up to a point — typically around 10–15 active subcontractors. Beyond that:

• Expiry tracking fails. Spreadsheets don't send reminders. Expired certificates go unnoticed.
• Version control breaks down. Which copy of the spreadsheet is current? Who updated it last?
• Reporting is manual. Producing an audit-ready compliance pack means copying data into a document, not clicking a button.
• Scale doesn't work. Adding a new project means duplicating the spreadsheet and hoping the formulas still work.

The decision isn't "spreadsheet or software" — it's "at what point does the risk of a compliance gap cost more than the software?" For a principal contractor managing 20+ subcontractors across multiple sites, that point has usually passed. For a detailed breakdown of what you should be tracking, see our CDM compliance guide and the subcontractor compliance checklist generator.

What to avoid

• All-in-one construction ERPs when you only need compliance. Enterprise platforms with compliance as a minor feature tend to be expensive, complex, and require extensive setup. If your primary need is subcontractor compliance tracking, look for a focused tool.
• US-built tools without genuine UK adaptation. Features like CIS, CSCS, CDM, and UK insurance types need to be built in, not bolted on.
• Tools without mobile access for subcontractors. If your subs can't submit documents from a phone on site, adoption will be low.
• Long contracts with no exit clause. You're evaluating whether a tool works. Lock-in before you've confirmed it fits your workflow is a risk.

Sources

• Employers' Liability (Compulsory Insurance) Act 1969
• The Construction (Design and Management) Regulations 2015 (SI 2015/51)
• GOV.UK — Construction Industry Scheme

This guide is for informational purposes and does not constitute legal advice.

Last reviewed: 11 March 2026

Managing subcontractors in construction isn't just about scheduling trades and chasing progress. Under CDM 2015, principal contractors have a legal duty to verify every subcontractor's competence, insurance, and documentation before they begin work. Get this wrong, and you're exposed — legally, financially, and operationally.

This guide walks through a compliance-first process for managing subcontractors on UK construction projects, from pre-qualification through to ongoing monitoring. For the full regulatory breakdown, see our CDM compliance guide. For a plain-English overview of what CDM compliance means and what the penalties are, see What is CDM compliance?.

Step 1: Pre-qualify before you appoint

Before signing a subcontract, verify that the firm can actually meet your compliance requirements. This isn't a tick-box exercise — it's your first line of defence under CDM Regulation 8, which requires you to ensure anyone you appoint has the right skills, knowledge, experience, and organisational capability.

Minimum pre-qualification checks:

• Employers' liability insurance — minimum £5M cover, current certificate with expiry date noted. This is a statutory requirement under the Employers' Liability (Compulsory Insurance) Act 1969. Fine for non-compliance: up to £2,500 per day.
• Public liability insurance — cover level matching your contract requirements (typically £1M–£10M depending on project value).
• CSCS cards for all operatives who will work on site. Check that the card type matches the work they'll do — a labourer card doesn't cover skilled trade work.
• CIS registration — verify the subcontractor's tax status with HMRC. You need to apply the correct deduction rate (0%, 20%, or 30%) from the first payment.
• Health and safety policy — a legal requirement for any business with five or more employees.
• Trade-specific certifications — Gas Safe registration, NICEIC, IPAF, PASMA, or other accreditations relevant to the work scope.
• References or track record — evidence they've delivered similar work safely and to standard.

Record the results of your pre-qualification checks. If a subcontractor can't provide the basics before appointment, that's a clear signal. Our free PQQ template covers all of these areas in a structured, downloadable format.

Step 2: Collect documentation before site access

Once appointed, collect the full compliance pack before the subcontractor starts on site. Not during the first week. Not "when they get around to it." Before they start.

The compliance pack should include:

• Current insurance certificates (EL, PL, PI if applicable)
• CSCS card details for every operative
• CIS verification confirmation
• Risk assessments and method statements (RAMS) specific to the work they'll do on your project
• Evidence of relevant training and competence
• Signed agreement to your site rules and safety standards

The common failure here is accepting generic RAMS. If the subcontractor hands you a template risk assessment with another project's name scratched out, send it back. RAMS must be site-specific and cover the actual hazards the operatives will face on your project.

Step 3: Induct every operative

CDM 2015 requires principal contractors to ensure all workers receive a site-specific induction before starting work (Regulation 14). This induction should cover:

• Site-specific hazards and risks
• Emergency procedures (assembly points, first aid, fire)
• Site rules (PPE, access restrictions, welfare facilities)
• Reporting procedures for near-misses and hazards
• Key contacts (site manager, first aider, fire marshal)

Record who was inducted, when, and by whom. Keep these records accessible — an HSE inspector or client auditor may ask to see them.

Step 4: Monitor compliance throughout the project

This is where most contractors fall down. Pre-qualification and induction happen at the start. But compliance isn't static — documents expire, personnel change, and work scopes evolve.

Ongoing monitoring should include:

• Insurance expiry tracking — set reminders at 30, 14, and 7 days before certificates expire. Chase renewals before cover lapses, not after.
• CSCS card checks — verify cards are still valid, especially for long-running projects. Cards expire, and new operatives may join mid-project without being checked.
• CIS re-verification — subcontractor tax status can change between tax years. Re-verify periodically to ensure correct deduction rates.
• RAMS reviews — if the work scope changes, the risk assessment must be updated. A RAMS written for groundworks doesn't cover the roofing phase.
• Site inspections — regular walkdowns to verify that the work matches the method statement and that PPE and safety controls are being followed.

The practical challenge is scale. With 20 or 30 active subcontractors, each with multiple documents and expiry dates, manual tracking in spreadsheets becomes unreliable. By the time someone notices a gap, it may have existed for weeks. Our free insurance expiry calculator can give you an instant snapshot of which subcontractors have expiring or expired cover.

Step 5: Handle non-compliance promptly

When you identify a compliance gap — and you will — act immediately. Typical scenarios:

• Expired insurance: Stop the subcontractor's work until a current certificate is provided. An employer operating without valid EL insurance commits a criminal offence under the EL Act. Separately, allowing uninsured subcontractors on site undermines the competence evidence you need under CDM Regulation 8.
• Missing CSCS cards: Operatives without valid CSCS cards should not be on site. While CSCS is not a direct statutory requirement, most clients require it and it serves as key evidence of competence under CDM Regulation 8.
• Outdated RAMS: If the risk assessment doesn't cover the current work, issue a stop until it's updated and reviewed.
• Unsafe practices observed: Address immediately, record the intervention, and follow up with the subcontractor's management.

Document everything. A clear audit trail of compliance checks, identified issues, and corrective actions demonstrates you've taken "reasonably practicable" steps — which is the legal standard under UK health and safety law.

The compliance-first mindset

Most subcontractor management guidance starts with contracts and scheduling. Compliance is treated as an afterthought — something to sort out in parallel or "when the paperwork catches up."

That approach creates risk. A compliance-first process means:

1. No appointment without pre-qualification
2. No site access without a complete compliance pack
3. No work without site-specific induction
4. No complacency — monitor throughout, not just at the start
5. No tolerance for gaps — act on non-compliance the day you find it

This isn't about being difficult. It's about protecting your workers, your subcontractors' workers, your business, and your licence to operate. Principal contractors who manage compliance proactively spend less time scrambling during audits and more time building.

Sources

• The Construction (Design and Management) Regulations 2015 (SI 2015/51)
• HSE — Principal contractor duties under CDM 2015
• Employers' Liability (Compulsory Insurance) Act 1969
• GOV.UK — Construction Industry Scheme

This guide is for informational purposes and does not constitute legal advice. For project-specific compliance questions, consult a qualified health and safety professional.

Last reviewed: 11 March 2026

If that question made you uncomfortable, you're not alone. CDM compliance is the legal foundation of every UK construction project, but most principal contractors manage it with a patchwork of spreadsheets, email chains, and good intentions. This guide breaks down what CDM 2015 actually requires, who is responsible for what, and how to build a compliance process that doesn't fall apart when an auditor walks in.

What CDM compliance actually means

CDM stands for the Construction (Design and Management) Regulations 2015 (SI 2015/51). These regulations set out how every construction project in the UK must be planned, managed, and coordinated to protect workers and anyone affected by the work.

CDM 2015 replaced the earlier 2007 regulations on 6 April 2015. The key shift: responsibility moved earlier in the project lifecycle, particularly into the design and planning phases where risks can be eliminated before anyone sets foot on site.

CDM applies to all construction work in Great Britain — from a kitchen extension to a £100M infrastructure project. There is no minimum project size. If construction work is happening, CDM applies.

The five CDM duty holder roles

CDM 2015 assigns legal responsibilities to five categories of duty holder. Each role carries specific obligations, and on most commercial projects, several of these roles are active simultaneously.

1. Client

The organisation or individual for whom the construction work is carried out. Under CDM 2015, even domestic clients have duties (though these can transfer to the contractor or principal contractor — see HSE guidance on CDM 2015).

Commercial clients must:

• Make suitable arrangements for managing the project (Regulation 4)
• Appoint a principal designer and principal contractor on projects with more than one contractor (Regulation 5)
• Ensure sufficient time and resources are allocated
• Provide pre-construction information to designers and contractors

2. Principal designer

Appointed by the client on multi-contractor projects. The principal designer plans, manages, monitors, and coordinates health and safety during the pre-construction phase (Regulation 11). They identify, eliminate, and control foreseeable risks through design decisions.

3. Principal contractor

This is where most of the day-to-day compliance pressure lands. The principal contractor plans, manages, monitors, and coordinates health and safety during the construction phase (Regulation 13). On projects with more than one contractor, the client must appoint a principal contractor — and that appointment must happen before the construction phase begins.

4. Designer

Anyone who prepares or modifies designs for a construction project. Designers must eliminate, reduce, or control foreseeable risks that may arise during construction, maintenance, and use of the building (Regulation 9).

5. Contractor

Every contractor on a project has duties to plan, manage, and monitor their own work. On multi-contractor projects, contractors must comply with directions from the principal contractor and cooperate with the project team (Regulation 15).

Workers also have duties — they must take care of their own health and safety, cooperate with their employer, and report anything they believe is a danger.

For a plain-English overview of what CDM compliance means and what happens if you get it wrong, see What is CDM compliance?.

What principal contractors actually need to do

If you're a principal contractor, Regulations 8 and 13–15 define your core obligations. Here's what that looks like in practice.

Before work starts

• Prepare a construction phase plan covering health and safety arrangements, site rules, and specific measures for high-risk work. This must be in place before the construction phase begins (Regulation 12).
• Verify contractor competence. Every contractor appointed to the project must have the skills, knowledge, experience, and organisational capability to carry out their work safely (Regulation 8).
• Check employers' liability insurance. This is a separate legal requirement under the Employers' Liability (Compulsory Insurance) Act 1969. The fine for operating without it is up to £2,500 for every day without cover. Minimum cover is £5M.
• Collect subcontractor documentation: insurance certificates, CSCS cards, trade qualifications, RAMS, and method statements specific to the project work.

During the project

• Coordinate all contractors working on site. This means active management — not filing paperwork. You need to know who is on site, what they're doing, and whether their work creates risks for others (Regulation 13).
• Provide site-specific inductions for every worker before they start. Generic inductions don't satisfy CDM — the induction must cover the specific hazards and rules of that site.
• Consult and engage workers about health, safety, and welfare matters. This is a legal requirement, not a nice-to-have (Regulation 14).
• Prevent unauthorised access to the site.
• Ensure welfare facilities are provided from day one and maintained throughout the project.
• Monitor compliance throughout — not just at the start. Insurance certificates expire. CSCS cards lapse. RAMS become outdated as work scope changes.

At completion

• Ensure the health and safety file is updated and handed to the client (Regulation 12).
• Review and capture lessons learned for future projects.

Subcontractor compliance checklist

This covers the documentation and checks a principal contractor should complete for every subcontractor on a multi-contractor project. For a step-by-step process from pre-qualification through to ongoing monitoring, see our guide to managing subcontractors in construction. You can also generate a tailored compliance checklist for your specific project trades.

Before the subcontractor starts on site:

• Valid employers' liability insurance certificate (minimum £5M cover, check expiry date)
• Public liability insurance certificate (check cover level matches contract requirements)
• Professional indemnity insurance (if applicable to the work type)
• CSCS cards for all operatives (check card type matches the work they'll do)
• CIS verification status with HMRC (for tax deduction purposes)
• Company health and safety policy (legal requirement for firms with 5+ employees)
• Risk assessments and method statements (RAMS) specific to the work on your project
• Trade-specific qualifications and certifications (Gas Safe, NICEIC, IPAF, PASMA, etc.)
• Evidence of CDM awareness training or competence

Ongoing checks during the project:

• Monitor insurance and certification expiry dates — set reminders at 30, 14, and 7 days before expiry
• Review and update RAMS when work scope changes
• Confirm CSCS cards are still valid for operatives on site
• Check CIS verification status hasn't changed (subcontractors can move between gross, net, and unverified)
• Record site inductions for every new operative
• Maintain a register of who is on site and when

Five compliance gaps that catch contractors out

1. Insurance certificates that expired months ago

The employers' liability cert was valid when the subcontractor started on site. That was 14 months ago. Nobody checked the renewal. Under the Employers' Liability (Compulsory Insurance) Act 1969, a subcontractor working without valid EL insurance faces a fine of up to £2,500 per day. Separately, expired insurance weakens the evidence you can point to when demonstrating CDM Regulation 8 compliance — that you took reasonable steps to assess competence.

2. CSCS cards that don't match the work

A subcontractor's operatives have CSCS cards, but they're labourer cards and the workers are doing skilled electrical work. CSCS card types indicate the level of competence assessed — a mismatch means the operative hasn't demonstrated competence for the work they're doing.

3. RAMS written for a different project

The subcontractor submitted RAMS, but they're generic templates with another project's name scratched out. Site-specific risk assessments are a CDM requirement. Generic documents that don't address the actual hazards on your site don't satisfy Regulation 13.

4. No system for tracking expiry dates

Most contractors track compliance in spreadsheets. Spreadsheets don't send reminders when an insurance certificate is about to expire. By the time someone notices, the subcontractor may have been working uninsured for weeks — and you've had an uninsured operative on your site without knowing it.

5. CIS verification drift

A subcontractor's CIS status can change between tax years — from gross payment to net payment, or to unverified. If you don't re-verify periodically with HMRC, you may be applying the wrong tax deduction rate, creating a liability for your business.

The Building Safety Act 2022: what's changing

The Building Safety Act 2022 is tightening competence requirements across the construction industry. While the Act primarily targets higher-risk buildings (residential buildings over 18 metres or 7 storeys), its competence framework is raising standards across the sector:

• Duty holders must demonstrate competence — not just claim it. The Act expects documented evidence of skills, knowledge, experience, and organisational capability.
• The Building Safety Regulator is promoting higher standards of competence for building control professionals and tradespeople across all building types.
• Principal contractors and principal designers face increased scrutiny of their ability to manage building safety risks throughout design and construction.

For principal contractors managing subcontractors, the practical impact is clear: a signed declaration isn't enough. You need documented evidence of qualifications, training, and current insurance.

Building a compliance process that actually works

CDM compliance isn't a one-off check. The difference between contractors who manage it well and those who scramble during audits comes down to three things.

Centralise documentation. Every subcontractor's compliance documents should be in one place. When a client auditor or HSE inspector asks to see an insurance certificate, you shouldn't need to search through emails, WhatsApp messages, and shared drives with ambiguous filenames.

Automate expiry tracking. Set up alerts for insurance renewals, CSCS card expiry dates, and CIS verification checks. Manual diary entries get missed. Automated reminders at 30, 14, and 7 days before expiry give you time to chase renewals before cover lapses. Our free insurance expiry calculator can give you an instant snapshot of which subcontractors need attention.

Make it easy for subcontractors. The harder you make it for a subcontractor to submit their documents, the longer it takes and the more chasing you do. If a sub can photograph their cert on their phone and upload it in under a minute, your compliance records stay current. If they need to scan, email, and follow up, they'll put it off.

Frequently asked questions

Is CDM compliance a legal requirement?

Yes. The Construction (Design and Management) Regulations 2015 apply to all construction work in Great Britain. Non-compliance is a criminal offence enforceable by the HSE, with penalties including unlimited fines and imprisonment for serious breaches.

What are the CDM requirements for projects with only one contractor?

On single-contractor projects, the contractor takes on the duties of both contractor and principal contractor. The client must still ensure the project is managed safely, but does not need to appoint a separate principal designer or principal contractor.

What happens if you don't follow CDM regulations?

The HSE can issue improvement notices, prohibition notices (stopping work immediately), or prosecute. Penalties for health and safety offences can include unlimited fines. For serious breaches causing death or serious injury, individuals can face imprisonment.

Sources

• The Construction (Design and Management) Regulations 2015 (SI 2015/51)
• HSE — CDM 2015 guidance
• HSE L153 — Managing health and safety in construction
• Employers' Liability (Compulsory Insurance) Act 1969
• Building Safety Act 2022

This guide is for informational purposes and does not constitute legal advice. For project-specific CDM compliance questions, consult a qualified health and safety professional.

Last reviewed: 11 March 2026