Every design and construction document classified, linked to the safety measure it proves and findable in seconds, from gateway 2 to handover and through occupation. The accountable person signs off what goes into the golden thread.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
A higher-risk building in England is one at least 18 metres or seven storeys high with at least two homes. For these buildings, the Building Safety Regulator is the building control authority. Work can't start until the BSR approves the gateway 2 application, which must show how the building will comply, with the fire and structural strategy, a construction control plan, a change control plan and a mandatory occurrence reporting plan. The building can't be occupied until the BSR issues a completion certificate at gateway 3, which needs the as-built information and proof that the golden thread has been handed to the accountable person.
The golden thread is the information that shows the building is safe and how it stays safe. It has to be digital, secure, available when needed, usable and a single source of truth. In practice it arrives from dozens of consultants and subcontractors: drawings in many revisions, specifications, product data sheets, fire test evidence, site inspection records, photos and commissioning certificates. Much of it sits in the common data environment, but just as much sits in email and subcontractor folders. Before gateway 3 and handover, people spend weeks proving that what was built matches what was approved, and that every controlled change was recorded.
Once the building is occupied, the principal accountable person keeps it up to date for the life of the building: the fire and structural safety measures, maintenance and inspection records, mandatory occurrence reports and complaint summaries for seven years, and the safety case. The BSR, other accountable persons and residents can ask for it. Gateway decision times have improved through 2026 as the regulator changed how it assesses applications, and a complete, well-organised submission remains the part a developer controls.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
Time to answer a question like 'show me the fire-stopping evidence for this riser', from a weekly sample.
ExampleFrom days to minutes
The share of fire and structural safety measures with every link in the chain, from design intent to commissioning.
ExampleAbove 95% before applying at gateway 3
Weeks from practical completion to a complete gateway 3 application.
ExampleDown by half
Correct classification and links on a weekly checked sample, by document type.
ExampleAbove 95%, reviewed weekly
Answers that cite the wrong document or claim evidence that isn't there. The measure that matters most.
ExampleNear zero, every one investigated
Requests from the BSR, other accountable persons and residents answered within the target the PAP sets.
ExampleEvery request, on time
Cross-sector rules are on the UK regulation map.
The BSR is the building control authority for higher-risk buildings and has been a standalone body under MHCLG since 27 January 2026. The design gives the BSR what it asks for, in the form it asks for, and never submits anything itself. This playbook covers England; Wales has its own higher-risk building regime, so check the Welsh rules for buildings there.
The BSR has 12 weeks to decide a gateway 2 application for a new building (8 weeks for work to an existing one) and 8 weeks for gateway 3. Every controlled change is recorded, and major changes need the BSR's approval before the work. During the work, the client keeps the golden thread in a digital system with version control, and hands it over before applying for a completion certificate. The accountable person confirms it was received in a usable form. The AI drafts change records and handover indexes; people classify the change and sign the handover.
In force since January 2024. Schedule 1 lists what accountable persons must keep, including the fire and structural safety measures, maintenance and inspection records, design codes and intent, and mandatory occurrence reports and complaint summaries for seven years. The classification uses that structure, so a gap in a category is visible straight away.
The golden thread must be digital, secure, available when needed, usable, a single source of truth, in plain English, and compliant with UK GDPR. The AI index is not the golden thread. It points to the authoritative record in the client's or accountable person's system, which keeps the versions and the approvals.
Principal designers and principal contractors report safety occurrences during design and construction, and the principal accountable person runs a reporting system in occupation. The AI can flag a site record that may describe an occurrence. It never decides whether to report, never submits a report, and never delays one.
The golden thread holds resident names, complaints and sometimes information about residents who need help to evacuate, which can be health data. That means a DPIA, processing in the UK, role-based access with personal data kept out of the general search index, a clear retention period, and a contract that stops providers training their models on your data.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: CDE, mailboxes, site recordsRead from the common data environment through its API. Copies are for processing only; the record stays where it is. | API Gateway, AWS Lambda, S3 | API Management, Azure Functions, Blob Storage | Kong, Ceph or IONOS S3 Object Storage |
| Reading and classifying documentsIn London, Bedrock Data Automation now processes requests in London only; confirm this again at build time, or use Textract and an in-region model. Test on real test certificates, marked-up drawings and site photos. | Bedrock Data Automation, or Amazon Textract plus a Bedrock model | Azure Content Understanding (includes Document Intelligence) | Open-source parsing (e.g. Docling) plus an open-weight vision model |
| Evidence links and gap rulesSafety measures, elements and the links between documents, plus the rules for a complete chain, as tested code. The model proposes links; the rules decide what a complete chain is. | Amazon RDS for PostgreSQL | Azure Database for PostgreSQL | PostgreSQL |
| Evidence search (retrieval)Indexes approved documents only, filtered by each user's access. Personal data stays out of the general index. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Reasoning and answersEvery answer cites its sources, and 'no evidence found' is a valid answer. AWS and Azure both offer a choice of models, including Claude. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| WorkflowRoutes each proposed entry to the right reviewer and records the approval. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Human reviewReviewers approve entries where they already work, not in a new screen. | In the information manager's existing CDE review workflow | In the information manager's existing CDE review workflow | In the information manager's existing CDE review workflow |
| GuardrailsIncluding grounding checks, so an answer without a source is blocked. | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protectionAccess follows the CDE's own roles, so the assistant never shows anyone more than they could already open. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every proposal, approval, question and answer, with the sources cited. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The common data environment, the change control register and the building safety and maintenance system stay where they are, whether on the developer's own servers or hosted by their suppliers. Nothing in this design moves the golden thread record.
Uses cloud AI
Document reading, the evidence index and the assistant can run in a UK cloud region, or on your own GPUs with open-weight models if building information must not leave your estate.
How they connect
A private link (AWS Direct Connect or Azure ExpressRoute) or a secure connection to the CDE's API. Only the documents being processed are sent, and proposals come back as events into the review workflow.
If the link drops
The golden thread record is untouched and fully usable. New documents queue for classification, and the backlog is processed and reviewed when the link returns.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Golden thread assistant
Where a person signs offThe information manager approves every entry. The principal designer and principal contractor classify every change and decide every occurrence report. The client signs the handover, and the principal accountable person signs off what goes into the golden thread in occupation. The assistant's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
The common data environment stays the golden thread record. It keeps the versions, the approvals and the audit trail. The AI reads through its API and writes only proposals, which become entries when a person approves them.
Events decouple the AI from the record. A new document, a new revision or a new question becomes a message on a queue. If the CDE is down, work waits safely, nothing is lost, and every message carries an ID so a retry never creates a duplicate link.
Classification follows open, documented structures, such as ISO 19650 information management and the categories in the 2024 regulations, so the golden thread outlives any one tool or supplier.
The AI can be switched off without touching the golden thread. If it's paused, people file and search the CDE exactly as before, and the record is complete either way.
Map where golden thread information lives today, agree the classification scheme, pick one building approaching gateway 3, check CDE access and measure the baseline.
Gate · must be true to passScheme agreed by the principal designer and contractor, CDE access confirmed, DPIA started, PAP's team involved.
One building in shadow mode: the AI classifies, links and answers; the information manager works as normal, and the two are compared.
Gate · must be true to passAccuracy within agreed limits, no unsupported answers in the sample, PAP's team confirm the handover index is usable.
Classification proposals and evidence search go live for that building, with monitoring, support and a rollback plan.
Gate · must be true to passMonitoring, support model, rollback plan and training in place.
Add the other buildings in construction, then occupied buildings, then reuse the pattern for safety case reviews and resident information requests.
Gate · must be true to passEach building passes the same pilot gate.
| Activity | Client director | Information manager | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Principal designer & contractor | Principal accountable person |
|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Consulted | Consulted |
| Classification scheme and gap rules | Accountable | Responsible | Consulted | Informed | Consulted | Responsible | Consulted |
| Target architecture | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Informed | Consulted |
| DPIA and access model | Accountable | Responsible | Consulted | Informed | Consulted | Informed | Consulted |
| Build and CDE integration | Informed | Consulted | Accountable | Responsible | Responsible | Informed | Informed |
| Accuracy testing on real documents | Informed | Accountable | Responsible | Consulted | Responsible | Consulted | Consulted |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted |
| Handover and life-of-building updates | Consulted | Responsible | Informed | Informed | Informed | Responsible | Accountable |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the classification and evidence model, the document reading, the integration with your common data environment, and the gates. I'd report to your programme board.
Option B
If your partner or your own team already has an architect, I'd take on the document reading, the evidence links and the CDE integration under their lead, and give them a second senior opinion on the rest, especially the access model and how answers are grounded.
Goes wrong
The assistant answers confidently from a superseded drawing.
How the design avoids it
Only approved, current revisions are indexed, every answer cites its sources, and superseded documents are labelled as such.
Goes wrong
The AI index quietly becomes the golden thread, and the CDE falls out of date.
How the design avoids it
The CDE stays the record. The AI only proposes; entries exist only once a person approves them.
Goes wrong
Everything is classified, but nobody can prove what was actually built.
How the design avoids it
Gap rules check the whole chain for each safety measure, down to installation and inspection records, not just whether a document exists.
Goes wrong
Handover arrives as a huge export the accountable person's team can't use.
How the design avoids it
Agree the structure with them in discovery and rehearse handover months before gateway 3.
Goes wrong
A site report describing a possible occurrence sits in a classification queue.
How the design avoids it
Possible occurrences skip the queue and go straight to the responsible person, and reporting never waits on the AI.
Changes already announced or under way that affect this design. More in the UK horizon scan.
The government consulted from 26 March to 28 May 2026 on how work to existing higher-risk buildings is categorised, and until 3 September 2026 on emergency works. Responses are awaited. Keep work categories as configuration, and make sure emergency work is reflected in the golden thread.
The BSR consulted on fire safety guidance from 25 March to 1 July 2026, including proposals on evacuation lifts and on combustible structure above 11 metres, with a proposed target date in 2029. Record which version of guidance each design relied on, so a later change is traceable.
The government's July 2026 response on the Single Construction Regulator says it will set, consult on and legislate for consistent information standards, and encourages industry to build on the golden thread principles. Use open structures and formats now, so a new standard is a mapping, not a migration.
The government intends to require a senior manager of the principal designer to confirm that all reasonable steps have been taken, and is consulting on its scope. Make every sign-off attributable to a named person in the record.
The government expects implementation to start from 2028, subject to legislation, with the BSR as its foundation and a digital-first approach. Keep the golden thread exportable in a form a new regulator could ask for.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
