The Building Safety Act 2022 created a new regulatory regime for higher-risk buildings in England, built around a simple idea: someone must be identifiable, accountable, and able to demonstrate that the risks in a building are under control. This page explains how the regime fits together and what changed in 2026.
- Act
- Building Safety Act 2022 In force
- Regulator
- Building Safety Regulator, established as a body corporate by SI 2026/20, in force 27 January 2026
- Threshold
- At least 7 storeys or 18 metres, and at least 2 residential units
- Applies to
- England. Wales operates a separate regime
What counts as a higher-risk building
In England, a higher-risk building has at least 7 storeys or is at least 18 metres tall, and contains at least 2 residential units. Hospitals and care homes meeting the height threshold are in scope for the design and construction regime, but not for the in-occupation regime.
Buildings that are entirely a hotel, secure residential institution, military premises or prison are excluded from the in-occupation regime.
The regulator changed in January 2026
This is the change most published guidance has not caught up with. The Building Safety Regulator is no longer part of the Health and Safety Executive.
The Building Safety Regulator (Establishment of New Body and Transfer of Functions etc.) Regulations 2026 came into force on 27 January 2026. They establish the Building Safety Regulator as a body corporate in its own right, sponsored by the Ministry of Housing, Communities and Local Government rather than sitting inside the HSE. If a document you are relying on describes the regulator as an HSE directorate, it predates this change.
The two halves of the regime
| Design and construction | In occupation | |
|---|---|---|
| Controlled by | The gateways | Registration, safety case report, building assessment certificate |
| Who holds the duty | The client, principal designer, principal contractor | The principal accountable person and accountable persons |
| Hard stops | Cannot start work without Gateway 2. Cannot occupy without Gateway 3 | Cannot allow occupation of an unregistered building |
Duties in occupation, in order
- Establish who the accountable persons are, and which of them is the principal accountable person. This is decided by legal estate and repairing obligation, not by who manages the building.
- Register the building before anyone occupies it. The fee is £251, and key building information follows within 28 days.
- Assess the building safety risks, fire spread and structural failure, and take all reasonable steps to manage them.
- Prepare a safety case report as soon as the building is occupied or you become the principal accountable person.
- Operate a mandatory occurrence reporting system and a residents’ engagement strategy.
- Apply for a building assessment certificate when directed, within 28 calendar days.
The other half of the Act: who pays
Everything above concerns making buildings safe. Part 5 of the Act concerns who pays for it, and it works to a different threshold and a different set of definitions.
The leaseholder protections apply to a relevant building: at least two dwellings and either at least 11 metres or at least 5 storeys. That is lower than the higher-risk threshold of 18 metres or 7 storeys. A building can sit outside the safety case regime entirely and still be squarely inside the leaseholder protections, which is the single most common misreading of the Act.
Where a lease qualifies, Schedule 8 caps what the leaseholder can be charged towards remediating relevant defects, and in some circumstances nothing is payable at all. Establishing whether a lease qualifies turns on two documents: a deed of certificate from the leaseholder and a certificate from the landlord. See leaseholder protections and the deed of certificate.
Where most organisations are failing
Not at registration, and not at producing documents. 66% of building assessment certificate applications assessed this year were refused, and the regulator’s stated reason is that submissions addressed process compliance rather than effective safety management.
In other words, organisations are proving they have the required documents rather than proving their controls work. That distinction is the single most important thing to understand about this regime.