What buyers are
actually buying.

Most of the technical requirements: compartmentation, fire stopping, suppression, detection: existed already in BS 9991, BS 9999, the Approved Documents. What the Act added was a question the regulator now puts to the duty-holder: can you evidence it? That single shift moved compliance from cost line to risk register.

For an occupied higher-risk building, the answer has to be written down. The principal accountable person must prepare a safety case report setting out how the building's fire and structural risks have been assessed and what has been done about them. The regulator's own figures show how hard the question is to answer. Since building assessment certificates began in April 2024, the Building Safety Regulator has directed the principal accountable persons for nearly 2,000 buildings to apply, and in 2026, up to July, 66% of applications were refused, often because they focused on process compliance rather than effective management of safety. BSR is now moving to a more proportionate, risk-based way of assessing buildings; the duties themselves haven't changed.

What "evidenced" means in practice

The golden thread is a single, continuously-maintained body of evidence linking every life-safety design decision through to every as-built reality and every subsequent change. In theory it's a document. In practice it's a workflow: a static PDF doesn't survive a year of estate operations.

As a legal duty it applies to higher-risk buildings: at least 18 metres or seven storeys with at least two residential units, plus hospitals and care homes of that height while they are designed and built. The regulator's guidance says the information must be kept digitally, secure, available when someone needs it and as the building's single source of truth, with version control so changes can be seen. Once the building is occupied, accountable persons must keep it up to date. What a regulator expects to see, and in our experience what insurers increasingly ask for:

• Every asset on a register, with its last service date and its next
• Every survey, inspection and remediation timestamped and linked to the asset it affected
• Every drawing at the latest revision, with previous revisions retained and addressable
• The whole pack exportable on demand, with no gaps a regulator can probe

This is the operational consequence of the Act. It's not a writing exercise. It's an operating-stack exercise.

Three concrete changes in buyer behaviour

They're consolidating suppliers

Estates teams that used to procure survey, remediation, maintenance and certification across three or four contractors now look for one party who can hold the whole thread. Every additional supplier is an additional seam in the evidence pack: and seams are where regulators find problems. We're not the only ones seeing it: Marlowe, then a top-three player in each of its compliance markets, told shareholders in its 2024 annual report that clients often consolidate their supplier base in favour of partners with scale and breadth of capability.

They're asking operational questions on bid day

Bid evaluation used to score price, accreditations and references. Now it scores operating depth. What system holds your asset register? Show us a sample audit pack. These aren't aesthetic questions: they're triage. A supplier who can't show a live workflow has a price, but not a defensible price.

They're paying for posture, not for work

The buyer's job is to procure a position they can defend: to their insurer, their regulator, their board. The work is a means; the posture at the end of it is the thing being bought. Suppliers who frame their offer as work-units price themselves into commodity.

"Estates teams that used to procure across three or four contractors are now looking for one party who can hold the whole thread."

Where this leaves the mid-market

Most mid-market contractors have the trades; they don't have the operating stack to evidence them. The gap between a Tier-1's compliance arm and an SME contractor used to be people. It's now people and systems: and systems is the bigger half. A mid-market group running Uptick, Procore and M365 end-to-end carries an enterprise-grade posture into a mid-market deal, and that is exactly where a procurement team weighting compliance is looking.

The bottom line

Compliance under the Building Safety Act is not a deliverable. It's a state: continuously maintained, continuously evidenceable. The suppliers who'll win the next three years of work are the ones who treat it as an operating commitment, not a project commitment.

Sources

• Building Safety Regulator (GOV.UK): Keeping information about a higher-risk building: the golden thread
• legislation.gov.uk: Building Safety Act 2022, section 85 (safety case report)
• legislation.gov.uk: Building Safety Act 2022, section 88 (keeping information about higher-risk buildings)
• Building Safety Regulator and MHCLG (GOV.UK): BSR to introduce more proportionate and targeted approach for higher-risk building assessments, 9 July 2026
• MHCLG (GOV.UK): Fire safety: Approved Document B
• Marlowe plc: Annual Report and Financial Statements 2024 (PDF)

• Dan Small is Managing Director of AMPM Group. The group's flagship company, Gemini AMPM, operates Uptick, Procore and Microsoft 365 end-to-end across its life-safety and compliance work.