IN Brief:
- Build UK released Common Assessment Standard version 6 on 1 November 2026.
- Competence questions move into Quality, while companies outside regulated building work must actively opt out of Building Safety.
- Drugs and alcohol policies and fraud-prevention procedures become mandatory prequalification requirements for all companies.
Build UK has issued version 6 of the Common Assessment Standard for construction supply chain prequalification. The revised requirements, introduced on 1 November 2026, move competence questions into the Quality section and alter how suppliers determine whether to complete Building Safety questions. They also change information-security exemptions and make specified governance controls, including drugs and alcohol policies and fraud-prevention procedures, mandatory for all companies.
The Common Assessment Standard establishes a common set of questions and assessment requirements for organisations seeking access to construction supply chains. Companies undergo certification through a recognised assessment body, which checks evidence of their organisational systems and capabilities. Contractors and clients that accept the standard can use that certification during supplier selection rather than requiring every applicant to complete a separate, wholly different prequalification process for each procurement route. Certification is generally renewed annually.
Version 6 changes the distribution of competence questions that previously sat in the Building Safety section. Questions covering training and supervision arrangements, compliance with relevant work requirements, and awareness of changing legislation and technical standards now sit within Quality. Moving these checks means companies complete the competence material regardless of whether they undertake building work that triggers the Building Safety section. The adjustment separates an industry-wide assessment of organisational competence from particular statutory dutyholder questions.
Scaffolding and temporary works contractors are particularly affected. Following clarification of the applicable regulatory scope, temporary works and scaffolding are outside the Building Regulations provisions governing building work unless the activity forms part of the completed structure or otherwise meets the definition of regulated building work. Businesses that do not undertake such work must actively opt out of the Building Safety section and provide a statement confirming their position, rather than answer questions about duties that are inapplicable to their operations.
The Building Safety opt-out applies according to the work a contractor undertakes, including whether any temporary works form part of the completed structure. A scaffolding specialist may therefore have to confirm that its activities fall outside the relevant definition of building work while still providing organisation-wide evidence of training, supervision, and competence. Contractors carrying out both temporary and permanent works must assess the scope of their activities before choosing how to complete that section. The distinction affects the questions they answer under the certification scheme, while their legal and site-safety duties continue to arise from the work performed.
Version 6 also revises the Information Security section. The previous exemption associated with Cyber Essentials Plus has been removed, leaving ISO 27001 certification as the specified route to exemption from those questions. Suppliers relying on other information-security credentials will need to complete the relevant assessment material under the new question set. Alongside this change, fraud-prevention procedures, a designated person responsible for quality, and a drugs and alcohol policy become mandatory requirements for all companies, broadening the evidence assessed beyond health and safety arrangements.
The Finishes and Interiors Sector has highlighted the amended Building Safety requirements for specialist subcontractors. Its technical director, James Parlour, has supported the clarification while continuing to call for mutual recognition between assessment arrangements. Contractors working with several clients can reduce duplicated submissions where those clients accept a recognised Common Assessment Standard certificate. Companies still need to maintain the underlying evidence, because the certificate is based on an assessment of their systems rather than an indefinite approval to undertake any category of construction work.
Build UK lists seven recognised assessment bodies covering different certification products, including Achilles, Compliance Chain, Constructionline, CQMS, SCCS, Smas Worksafe, and Veriforce CHAS. The standard offers desktop and site-based certification levels, depending on the contractor’s activities and client requirements, with proportionate assessment arrangements available to qualifying micro-businesses. A site-based assessment involves verification of the implementation of procedures as well as the documents supplied, whereas a desktop audit examines evidence remotely.
A company certified by one recognised assessment body can authorise sharing of its certification information with another, widening access to contractors and clients that use different assessment providers. The arrangement reduces repeated prequalification where the same Common Assessment Standard is accepted. A procuring contractor may still request evidence specific to a work package, such as relevant experience, competence in a defined operation, or a proposed method of delivery. Shared certification and project-specific evaluation therefore operate at different stages of supplier selection.
Build UK lists major contractors and public procurement organisations among the clients accepting the standard, and an increasing number of tenders rely on Common Assessment Standard certification. The updated question set will therefore affect suppliers renewing their assessments as well as companies entering those supply chains for the first time. Established questionnaire templates may need revision where they still place the competence questions under Building Safety or assume that Cyber Essentials Plus provides an information-security exemption. The recognised assessment bodies are responsible for applying the current requirements during certification.
Suppliers approaching certification or renewal will need the version 6 question set and the evidence requirements of their selected assessment body. Competence records now sit in Quality; businesses outside the relevant Building Regulations scope must document their Building Safety opt-out; and information-security responses must reflect the narrower ISO 27001 exemption. The additional mandatory policies and nominated quality responsibility also need to be supported by records that can be assessed. Recognised assessment bodies will apply the updated question set within the annual certification process.
