Prefer to listen?
This article is also available as a podcast episode
The Building Safety Regulator spent 2025 and the first half of 2026 clearing the Gateway 2 backlog, and by most measures it worked. Legacy new-build applications fell from ninety-four to three. Approval rates climbed past eighty per cent. Government reported approvals up twenty-eight per cent and processing times down fifteen weeks.
The queue did not disappear. It moved.
The numbers
Gateway 3 — the completion certificate stage, the last hard stop before a higher-risk building can be occupied — runs at a median of 16 weeks against an 8-week statutory target. Of 158 applications submitted in 2025, 55 took more than three months. One took 550 days. As at January 2026, around 5,600 completed homes were sitting empty waiting for sign-off.
Building assessment certificates, which occupied higher-risk buildings must obtain, are worse. Nearly two thousand buildings have been directed to apply since April 2024. Of 567 completed assessments, 73% were refused. Over 1,100 buildings were awaiting determination out of 1,679 validated applications.
A three-quarters refusal rate is not a story about a hostile regulator. It is a story about applicants sending the wrong thing.
What the regulator says is going wrong
The BSR’s own diagnosis is worth quoting in substance, because it is the whole post in one sentence: applicants submit documentation that describes processes rather than demonstrating that safety is actually being managed.
That distinction is easy to nod at and hard to act on, so here is what it means in practice.
A process description says: “Change control is managed through the design change procedure set out in the project execution plan, which requires all changes to be approved by the design manager.”
A demonstration says: “Forty-seven changes were raised after the design freeze on 14 March. Each was assessed against the fire strategy by the fire engineer before approval. Six were rejected. Here is the register, here are the six rejection notes, here is the revised fire strategy at revision C and the compartmentation drawings it drove.”
The first tells the regulator you have a procedure. The second tells them the building is safe and shows how you know. They are not the same submission and the second one is much harder to produce retrospectively.
What a Gateway 3 pack has to contain
The golden thread duty covers what must be created, maintained and handed over. At completion, the client transfers everything to the accountable person, who must confirm receipt in a format they can actually use. That last phrase does more work than it appears to.
The pack needs:
As-built information. Not the tender drawings. Not the construction issue set with a covering note saying it was built broadly to this. The building as it stands, with the changes incorporated and the record demonstrably reconciled to what was inspected.
The change control record. Every change, when, why, who approved it, what it affected, and — critically — whether it affected anything in the fire or structural strategy. This is the single document that most projects cannot produce to the standard required, because change was managed in email and meeting minutes.
Competence declarations. For the dutyholders, mapped to the published frameworks — BSI Flex 8670 as the core criteria, PAS 8671 for principal designers, PAS 8672 for principal contractors. Named individuals, not organisational statements.
The construction control plan, and evidence that it was followed.
The fire safety file, structured rather than assembled. BS 8644-1:2022 is the standard for the digital management of fire safety information and is the right basis for it. ISO 19650-6, published in January 2025 with UK guidance added to the IMI Framework in June 2026, gives risk, incident and treatment information an actual schema — which is what turns a folder of PDFs into something a duty-holder can query.
Compliance documentation — how each applicable Building Regulations requirement was satisfied, and the evidence.
The transfer itself, with the accountable person’s confirmation of receipt.
Where there are gaps in legacy information, and on a refurbishment there always are, you must document why. An unexplained gap reads as an omission. An explained gap reads as a controlled position.
The commercial exposure nobody prices
This is where Gateway 3 stops being a compliance topic and becomes a cash topic.
Sixteen weeks between practical completion and a completion certificate is sixteen weeks in which the building cannot be occupied, units cannot complete, and — on most standard forms — the final account and retention release are hostage to a determination neither party controls.
Three things to do about that, all of which happen at contract stage rather than at handover:
- Do not let the whole retention release turn on Gateway 3. Split it. A defects-related tranche and a certification-related tranche behave differently and should be treated differently.
- Name the regulator’s determination period in the extension of time and loss and expense provisions. A determination running past its statutory target is a risk somebody carries. If the contract is silent, it is the contractor, and on a subcontract with no equivalent protection it is the subcontractor — carrying liquidated damages exposure for a delay caused by a regulator.
- Agree who owns the information pack, and resource it. On most projects the answer is “the contractor, somehow, at the end”, which is why it arrives incomplete. It is a workstream with a cost, not an administrative afterthought.
What is changing at the regulator
Two things worth knowing, because they change the odds.
The 9 July 2026 announcements committed the BSR to a more proportionate, intelligence-led and risk-based approach to building assessment certificates, with assessment focused on evidence of effective safety management rather than process compliance — and promised simplified assessment criteria and clearer technical guidance from September 2026. If you are preparing an application now, that guidance should be the first thing you read.
Separately, the BSR’s strategic plan targets 12 weeks for non-complex remediation applications and 18 weeks for non-complex Gateway 2 by March 2027, with more inspection during construction. More inspection during construction is the significant part: it means the evidence trail is being tested as you build rather than only at the end, which is better for everyone who was keeping one and considerably worse for everyone who was not.
The uncomfortable truth about timing
Almost everything that makes a Gateway 3 submission pass is created during the project, not at the end of it.
You cannot retrospectively produce a contemporaneous change register. You cannot retrospectively demonstrate that a design freeze was held. You cannot reconstruct why a product substitution was accepted eighteen months ago if nobody wrote it down, and — following the Construction Products Reform White Paper — product suitability now sits explicitly with the Building Regulations principal designer.
Which means the honest advice for anyone with a higher-risk building currently on site is: stop treating the golden thread as a handover deliverable and start treating it as a live obligation with an owner, a budget and a weekly rhythm. The projects that pass Gateway 3 first time are not the ones with the best documents at the end. They are the ones where somebody has been keeping the record since Stage 2.
And for anyone advising accountable persons on occupied buildings: prepare the safety case now rather than waiting to be directed. A three-quarters refusal rate, against guidance that has only just been improved, is not a queue you want to join twice.
If you have a higher-risk building heading toward completion and you are not confident the information pack will survive first contact with the regulator, that is a specific, contained piece of work we do — auditing what exists, identifying what is missing, and setting up the record so the rest of the job produces it as you go.
Related reading
- Soft Landings: How to Hand Over a Building That Actually Works
- The Golden Thread of Information: What SME Clients and Duty-Holders Must Actually Maintain
- The Health & Safety File and O&M Manuals: What Goes In, and Who’s Responsible
- Gateway 2 Is Delaying Your Project — Who Bears the Risk, and How to Protect Your Programme