Most UK principal contractors understand that they need to collect compliance documentation from their subcontractors. Insurance certificates, RAMS, method statements — the admin team gathers these before work starts, files them somewhere, and moves on. What happens when those documents expire six months into a twelve-month project is a different matter entirely.
This is where the gap between having a compliance process and actually managing compliance becomes real.
What UK law says about subcontractor management
Under CDM Regulation 8, principal contractors have a duty to plan, manage, monitor, and coordinate the construction phase — including the work of all contractors and subcontractors operating on the site. That duty doesn't end when the subcontractor starts work. It's a continuing obligation throughout the project under UK health and safety legislation.
Under the Management of Health and Safety at Work Regulations 1999, you also have a duty to assess the risks from your own undertaking — which includes the activities of contractors working on your behalf. If a subcontractor's work creates a hazard that affects your workers, that's a risk you need to have assessed and controlled.
What this means practically is that "they had their insurance when we started them" is not a complete defence if that insurance has since expired and something goes wrong.
The documentation you need from every subcontractor
Before work starts, you should have:
Employers' liability insurance. Legally required for any employer operating in the UK, minimum cover £5 million (though most policies are £10 million). The certificate must show the company name exactly as it appears on any contract or purchase order — discrepancies between the trading name and the insured entity are common and can create coverage gaps.
Public liability insurance. Covers damage to third parties. Minimum levels vary by trade and project, but £2 million is common for smaller contractors; many clients specify £5 million or £10 million. Check your contract requirements.
Risk assessments and method statements specific to the work they'll be carrying out on your site. Generic RAMS copied from another project don't satisfy this requirement. The assessments need to identify the specific hazards at your site and the control measures that will be applied. You should review and accept these before allowing work to begin — and keep a record showing that you did.
Worker competency documentation. For trades that require certification — scaffolders (CISRS), plant operators (CPCS, NPORS), electricians (ECS card), asbestos workers — you should have evidence of current certification for everyone they put on your site. See our guide on CSCS card and certification expiry tracking for more detail.
The expiry problem
Employers' liability insurance policies typically run for twelve months. On a project that runs for twelve months, you'll likely see every subcontractor's insurance expire and be renewed at some point during the works. If you collected their certificate in January and it expires in October, and their renewal is delayed, you could have subcontractors operating without valid insurance on your site in November.
This isn't hypothetical. Insurers do impose payment terms. Renewals slip. Some smaller subcontractors have cash flow issues that occasionally delay renewal. The only way to manage this is to have a system that tracks expiry dates and alerts you when something needs to be renewed — not to rely on subcontractors flagging it themselves.
The same applies to individual worker certifications. A CSCS card that was valid at the start of a project may expire mid-project. On a busy site with multiple subcontractors, tracking this manually across your whole workforce is effectively impossible.
Reviewing RAMS — the step most UK companies skip
Collecting RAMS is not the same as reviewing them. The review step — where someone with authority and competence looks at the risk assessment and method statement, confirms it's appropriate for the work on your site, and formally approves it — is frequently skipped or done so superficially that it provides no real protection.
Problems that a proper review would catch: RAMS that reference different site conditions to yours, RAMS that don't account for proximity to public areas, RAMS that specify plant or equipment that isn't what the subcontractor is actually going to use.
A review that results in no questions, no requests for revision, and no formal record of acceptance doesn't look like a review to an HSE inspector — it looks like rubber-stamping.
Integrating subcontractors into your site safety management
Beyond documentation, CDM requires you to coordinate between contractors. In practice, this means: briefing subcontractors on the CPP and any site-specific rules before they start, including them in toolbox talks where their activities create relevant risks, ensuring clear interfaces between trades especially where working sequences create temporary hazards, and keeping records of all of this.
When subcontractors attend a toolbox talk, their attendance should appear in the record. This documentation feeds directly into your CDM compliance audit pack if a client or HSE inspector requests evidence.
What a working compliance dashboard looks like
The UK principal contractors who manage subcontractor compliance well typically have some form of single view — either a spreadsheet that's actively maintained (which works at small scale, doesn't scale) or a dedicated system that tracks each subcontractor's documentation status, flags upcoming expiries, and provides evidence of review.
Lasso includes a subcontractor compliance module that does exactly this: each subcontractor has a profile with their insurance certificates, RAMS, and worker certifications attached, with expiry dates tracked automatically. You get an alert at 30, 14, and 7 days before anything expires, and the compliance dashboard shows at a glance which subcontractors are fully current and which need attention.
When a client or inspector asks about a subcontractor's compliance status, it's not a question you need to answer from memory or go looking for paperwork to support — it's visible on the screen.
Sign up for Lasso to see how it handles subcontractor compliance management.
Frequently asked questions
What insurance must subcontractors have on a UK construction site?
Employers' liability insurance is a legal requirement for any employer in the UK — minimum cover is £5 million, though most policies are £10 million. Public liability insurance is standard practice with typical minimums of £2–10 million depending on project requirements.
Is a principal contractor responsible for a subcontractor's compliance in the UK?
Under CDM Regulation 8, UK principal contractors must plan, manage, monitor, and coordinate all contractors on the project. This is a continuing duty throughout the project. A principal contractor who fails to manage subcontractors adequately can face HSE enforcement action.
What happens if a subcontractor's insurance expires during a UK construction project?
If a subcontractor's employers' liability insurance lapses and an incident occurs, claims may not be honoured. As principal contractor, you are expected to monitor subcontractor insurance throughout the project — not just at appointment. This risk falls partly on the principal contractor.
What documentation should a UK principal contractor collect from subcontractors?
Employers' liability insurance, public liability insurance, RAMS specific to your site, and worker competency documentation (CSCS, CPCS, CISRS etc). These should be reviewed — not just collected — with expiry dates tracked and alerts set.