The golden thread and safety case reports explained: duties for high-rise residential buildings

Once people live in them, the regime covers high-rise residential buildings: at least seven storeys or at least 18 metres high, with at least two residential units. Height is measured from the ground to the top of the floor of the top storey, ignoring rooftop plant, and storeys below ground don't count. Buildings made up entirely of a hotel, a hospital, a care home, a secure residential institution or military accommodation are left out.

The Act calls the rest higher-risk buildings, and each one must be registered with the Building Safety Regulator before anyone moves in. There's a fee for each building, and key information about its structure and fire safety must follow within 28 days. The registration number begins with HRB, and the regulator quotes it every time it contacts you.

Since January 2026, the regulator has been a public body in its own right, separate from the Health and Safety Executive.

Every building has one or more accountable persons: whoever owns, or has a legal duty to repair, the common parts, like the structure and exterior, corridors, lobbies and stairs. That could be a freeholder, a landlord, a council, a housing association or a management company. Each building has one principal accountable person.

Where there are several, it's the one responsible for the structure and exterior. They can hire a managing agent to do the work, but they can't hand over the legal responsibility.

Accountable persons must assess and manage the risks of fire spreading and of structural failure in their parts of the building. The principal accountable person must also register the building, prepare and keep up to date the safety case report, and run a mandatory occurrence reporting system. They run a complaints system, prepare a resident engagement strategy, display key information in the building, and apply for a building assessment certificate when the regulator asks.

Before a new higher-risk building can be lived in, it passes three gateways. Gateway one is at planning. Since August 2021, a planning application for a building of 18 metres or seven storeys with two or more homes must include a fire statement, and the planning authority must consult the Building Safety Regulator before it decides.

Gateway two comes before building work starts. For these buildings, the regulator is the building control authority, and work can't begin until it has approved the plans. It has 12 weeks to decide on a new building, or 8 weeks for work to an existing one, unless both sides agree longer.

Gateway three comes at completion. The regulator checks the finished work, and nobody may move in until it has issued a completion certificate. That's when the golden thread is handed over.

The golden thread is the building's information, kept digitally, securely, available when it's needed, in a form people can use, in plain English, and as a single source of truth. It starts during design and construction, with the client, the principal designer and the principal contractor. When the work is finished, the client hands it to the accountable person, who must confirm they've received it in a format they can use.

Once people live there, the accountable persons keep it up to date.

For an occupied building, the thread must hold the health and safety file, the safety case report, the resident engagement strategy and the mandatory occurrence reporting system. It should also hold records of refurbishments, information from previous owners, such as inspections and maintenance, and which building regulations the building was built to. On request, it must be shared with the regulator, with other accountable persons, and with residents and owners in the building.

The safety case report sets out the building's fire and structural safety risks, and how they're being managed. It should describe the building itself, who is responsible, how it's built, its structural condition, and any work done since it was built. It should cover the fire safety measures, like compartmentation, fire doors, smoke control, escape routes, stairs, alarms and sprinklers.

And it should summarise the risk assessments, the emergency plan and the safety management systems.

The report is a living document. Update it when improvement work is done, or when work affects the building's safety risks, and date it or give it a version number. If an update records new or increased risks, or new measures to manage them, tell the regulator as soon as possible.

The regulator may ask for the updated report, and charges if it reviews it.

At some point, the regulator will tell the principal accountable person to apply for a building assessment certificate. The application must go in within 28 calendar days. It includes the safety case report, information about the mandatory occurrence reporting system, the resident engagement strategy, and any compliance notices in force.

There's an application charge, plus a charge for the regulator's assessment work, and the current amounts are on GOV.UK.

Most problems are resolved by working with the regulator. If not, it can issue compliance notices, and in some cases prosecute. For a serious failure, or at least two failures under the Act, it can ask the First-tier Tribunal for a special measures order, which puts a special measures manager in charge.

Accountable persons have powers too. They can ask for access to a flat with at least 48 hours' written notice, and can issue a contravention notice if a resident creates a safety risk or interferes with a safety item.