Miss the 28-day BAC deadline and the breach is yours

You have 28 calendar days from the moment the Building Safety Regulator tells you to apply for a building assessment certificate. Miss that window and you are in breach of your duties under Part 4 of the Building Safety Act 2022, and the enforcement action that follows lands on the principal accountable person. In a high-rise residential block, that is a named individual, and the name is usually yours.

The certificate itself is not the hard part. The hard part is proving, on the day the BSR asks, that the safety case report, the resident engagement strategy and the mandatory occurrence reporting system you uploaded are backed by records you can actually produce.

The duty is short; the evidence trail is not

The Building Safety Regulator published its guidance on applying for a building assessment certificate on 4 April 2024, and it applies in England. The service is for the principal accountable person of a registered high-rise residential building, and only once the BSR has told you to apply. A high-rise residential building here means at least 7 storeys or at least 18 metres high, with at least 2 residential units, registered with the BSR before people live there.

When the BSR tells you to apply, you have 28 calendar days to submit. The application charge is £312, which covers the BSR's work assessing the application under its charging scheme. You will need card or invoice details, and a purchase order number if your finance team insists on one. None of that is the risk. The risk is the confirmation you sign that the information the BSR holds is up to date, and the documents you upload to support it.

If you do not submit by the deadline, you are in breach, and the BSR can take enforcement action in line with its enforcement policy statement. That is the consequence in plain terms: a missed date becomes a named breach.

What the inspector will actually ask to see

The application is not a form. It is a bundle. You must upload your safety case report, information about your mandatory occurrence reporting system, and your resident engagement strategy. You must provide the serial numbers of any compliance notices issued by the BSR that are currently in force. You must confirm that you and any other accountable persons for the building are providing building information to relevant individuals and organisations.

After submission, the BSR may ask for additional records or other documents. It may ask for a meeting, virtual or in person. It may ask for a demonstration of the systems you use to manage building safety risks, for example the maintenance of control measures. That last one is where portfolios come apart, because a demonstration is not a description. It is someone opening a system and showing the last inspection, the last repair, the last sign-off, in front of a regulator.

In a residential block, the control measures are the unglamorous ones: the fire doors that get propped open, the dry risers, the smoke vents, the emergency lighting, the compartmentation that nobody sees until it fails. The inspector is not reading your intentions. They are checking whether the maintenance record matches the risk you described in the safety case report.

Where the evidence usually lives, and why it goes missing

In most portfolios, the safety case report sits with the building safety manager. The mandatory occurrence reporting log sits with the managing agent. The resident engagement records sit with the customer team. The compliance notices sit in a folder someone inherited. The maintenance evidence sits with the contractor, in a portal you do not control.

That is the structural problem. The BSR asks one question and the answer requires four systems and three organisations to agree. When they do not, the principal accountable person signs a confirmation that the information is up to date, and cannot prove it.

Good looks like a single evidence index per building, mapped to the three documents the BSR assesses, with the owner of each record named and the date it was last verified. Not a shared drive. An index that a colleague can hand to an inspector without calling you first.

The registration data matters here too. When you registered the building, you supplied the number of floors, the height in metres, the number of residential units, the year it was built, the address, and details of the principal accountable person and any other accountable persons. The BSR uses that information to prioritise buildings for the building assessment certificate process. If your register entry is stale, your prioritisation and your application both rest on the wrong facts. The registration fee was £251, and there is no additional fee for the structure and safety information, so there is no cost excuse for leaving it out of date.

The five-year clock and the update you must not sit on

The BSR aims to reassess a building's certificate every 5 years, and it will tell you when the current certificate needs reassessing. That is not a reason to relax. If you update your safety case report to include new or increased building safety risks, or further measures taken to manage them, you must tell the BSR as soon as possible. The BSR will ask for the date of the update, a brief description, and the reason for making it.

This is the quiet failure mode in a large portfolio. A risk is identified at building level, the report is updated locally, and the regulator is never told because the update sits in a file that nobody routes upward. The certificate then rests on a version of the safety case that is no longer true.

Buildings currently prioritised for a certificate include those 18 to 29.99 metres high with more than 378 residential units, those over 30 metres high with more than 11 residential units, those clad with combustible aluminium composite material, and large panel systems built between 1957 and 1973 with a gas supply where it is unclear whether reinforcement work has been carried out. If any of those describe a block you answer for, the evidence test is not theoretical. It is scheduled.

For the wider duty that puts a building on this list in the first place, the height and storey threshold is worth revisiting in 18 metres or 7 storeys: the line that names you. And because the safety case leans on fire risk evidence, the record-keeping lessons in what the Fire Safety Act 2021 changed apply directly to what an inspector will ask to see.

Further reading: Apply for a building assessment certificate, Preparing a building assessment certificate application, Register a high-rise residential building.

Your 60-second self-check

• Could you produce, today, the current safety case report, the mandatory occurrence reporting information and the resident engagement strategy for every high-rise residential building in your portfolio, in the form you would upload?
• Do you hold the serial numbers of every BSR compliance notice currently in force against those buildings, in one place?
• If the BSR asked for a demonstration of your control measure maintenance tomorrow, could someone other than you run it without calling you first?

If the honest answer is that the records sit with three different people and none of them reports to you, send the free 5-minute Director's Risk Check to the colleague who holds the files, and ask for the briefing back. It gives you a control score and the portfolio's breach exposure with official sources, so the conversation at your next management meeting starts from evidence rather than reassurance.

Herman's verdict

A building assessment certificate is not a document you obtain. It is a claim you make about your own records, signed by name, and tested by a regulator who may ask you to demonstrate it live. The portfolios that pass are the ones where the evidence was already indexed before the letter arrived.

— Herman