Most mid-market construction firms have decided the golden thread is somebody else’s problem. They’re half right. And the half they’ve got wrong is the half that’s going to cost them work.
If you haven’t come across the term, here’s the plain version. The golden thread is a legal requirement, introduced by the Building Safety Act 2022, to keep a single, reliable, up-to-date record of the safety-critical information about a building — what it’s made of, how it was designed and built, what has changed over time, and who signed off on what. The thinking is that the information about a building should run unbroken from the very first design decision, through construction, and across the building’s entire life, so that anyone responsible for it can always find the truth in one place. That continuous, trustworthy record is the “thread” — and keeping it intact and accessible is the legal duty.
In practice that means the drawings, the specifications, the fire and structural details, the record of every change, the maintenance logs and the sign-offs — all held digitally, version-controlled, and written plainly enough that an ordinary person can actually understand them. Not a pile of PDFs scattered across inboxes and a filing cabinet.
It applies to higher-risk buildings: in England, broadly anything at least 18 metres tall, or with at least seven storeys, that contains two or more residential units. The legal duty to create and maintain the thread sits with the client, the principal designer, and the principal contractor.
So if you’re a firm that builds schools, warehouses, fit-outs, and the occasional low block that doesn’t hit the height threshold, the obvious conclusion is that none of this touches you. No higher-risk buildings, no golden thread, no problem.
That’s the half that’s wrong.
Why it lands on your desk anyway
Two things are happening, and neither of them waits for you to be the legally responsible party.
The first is supply chain flow-down. When you subcontract on a higher-risk project, the principal contractor is on the hook for information and competence that runs all the way down to their suppliers. They can’t prove their own compliance without proving yours. So the requirement arrives as a contract clause: provide your records, in this format, with version control, on demand. You don’t have a statutory duty. You have a commercial one — and it’s enforced by whether you get paid and whether you get the next job.
The second is standardisation. A main contractor running golden-thread discipline on its higher-risk jobs is not going to run a separate, looser system for everything else. It’s easier to apply one standard across the board. So the information demands that started with eighteen-metre towers are quietly becoming the way serious main contractors expect everyone to work, on every job. The threshold is a legal line. It was never going to stay a commercial one.
What actually breaks
Here’s where it gets expensive, and it has nothing to do with safety law. It’s about whether you can produce information on demand.
Picture the request. A main contractor’s document controller emails you: we need the as-built information for your package, the sign-offs, the material certificates, the record of who changed what and when, in our format, by Friday. And you know the information exists. It’s in an email thread somewhere. The certificate is a photo on a site manager’s phone. The change was agreed verbally and confirmed in a WhatsApp message. The sign-off is a scan in a folder called “final FINAL v3”.
It all exists. It’s just scattered across six places and three people, none of whom are in the office on Thursday. Pulling it together is two days of someone’s week — and it’s two days every single time the request comes in. Multiply that across every project where a main contractor now expects it, and you have a standing cost that didn’t exist three years ago.
The fix isn’t a document graveyard
The instinct is to buy a big document management platform. Or worse, to create a shared-drive folder structure and a policy that everyone is supposed to follow. Both fail the same way. They assume people will stop what they’re doing on site and go and file things properly. They won’t. They never have. The information ends up in the platform about as reliably as it ended up in the folder, which is to say sometimes.
The thing that works is narrower and more boring. A tool that captures the record as the work happens, where it happens — the certificate photographed and tagged to the job on site, the variation logged the moment it’s agreed instead of three weeks later, the sign-off captured when it’s given. Not a vault you have to remember to fill. A working tool that produces the trail as a by-product of doing the job, so that when the Friday email arrives, the answer is a thirty-second export instead of a two-day excavation.
That’s a purpose-built piece of software, fitted to how your firm actually works. It is emphatically not a ten-module platform. And it’s not the principal contractor’s system that you’re forced to log into, the one that fits your process like a borrowed suit.
Where this doesn’t apply
If you never work inside a larger supply chain — if you’re always the principal contractor on your own small jobs and nobody downstream is asking you for structured records — then this genuinely isn’t your problem yet, and you shouldn’t spend a penny on it. If your main contractors are still happy with a folder of PDFs emailed over, fine, wait. And if you actually build higher-risk buildings, this stops being a commercial nicety and becomes a legal obligation, and you need a great deal more than a blog post about it.
But for the large and growing middle — firms that subcontract to main contractors who have woken up to the Building Safety Act — the demand for fast, structured, accessible records is already here, and it’s only going one way. The firms that can answer the Friday email in thirty seconds will quietly become easier to work with than the firms that can’t. On a framework, easier to work with is most of the battle.
If you’re getting these requests and dreading them, that’s the signal. Get in touch.