Gateway 2 Under the Building Safety Act: A Checklist for the Building Control Approval Application

Gateway 2 is the point at which a higher-risk building in England cannot start construction until the Building Safety Regulator has approved the application. It is not a form. It is a decision by the regulator that the design demonstrates compliance and that the people and the processes proposed to build it are competent and controlled. This article sets out who it applies to, what the application must contain, how the regulator determines it, and what the principal contractor needs in place on the day of approval and for every day after it.

Which buildings

For the design and construction phase, a higher-risk building is defined by section 120D of the Building Act 1984, inserted by the Building Safety Act 2022, together with the Higher-Risk Buildings (Descriptions and Supplementary Provisions) Regulations 2023, SI 2023/275. The building must be at least 18 metres in height or have at least seven storeys, and contain at least two residential units, or be a care home or a hospital. The 2023 regulations set the measuring rules: height is measured to the top floor surface, storeys below ground and roof-top plant are treated in a defined way, and a gallery or mezzanine is only a storey where it exceeds half the floor area below. They also list the exclusions, including hotels, secure residential institutions and military premises.

The determination is the first thing to record, and it should be recorded even when the answer is no. A twelve-storey residential block over commercial units is in scope. A two-storey commercial unit is not, but a written determination showing the height, storeys and use, with the regulations cited, is what a client's lawyer and the building control body will ask for. A building that changes during design, gaining a storey or a residential use, needs the determination redone.

The dutyholders

Part 2A of the Building Regulations 2010, in force since 1 October 2023, sets the dutyholder regime for all building work in England, not only higher-risk buildings: the client, the principal designer and the principal contractor, with duties of competence, planning, managing and monitoring, cooperation and information. For a higher-risk building the regime is applied with more formality. The client must appoint the principal designer and principal contractor in writing, must take reasonable steps to satisfy itself of their competence, including their organisational capability and any serious sanctions, and must notify the regulator of changes. The appointment and competence record is the first document in the Gateway 2 file, and the application requires declarations that the appointments have been made and the competence checked.

What the application must contain

The Building (Higher-Risk Buildings Procedures) (England) Regulations 2023, SI 2023/909, regulation 4 and Schedule 1, set out the contents of the building control approval application. The checklist the contractor should work through with the client and the principal designer runs, in outline:

1. The applicant and the dutyholders. Names and addresses of the client, the principal designer and the principal contractor, and confirmation of the appointments.
2. Description of the building and the work. Enough to fix the scope of what is being approved: the height, storeys, uses, and the higher-risk determination.
3. Drawings and plans. The design at a level that demonstrates compliance with each applicable requirement of Schedule 1 to the Building Regulations, not a planning set with a note that details will follow.
4. Building regulations compliance statement. How the design meets each requirement, and where and why it departs from Approved Document guidance. This is the document the regulator's multi-disciplinary team reads first, and it is where most rejections originate: a statement that lists the Approved Documents without explaining the strategy behind the design is not a compliance statement.
5. Competence declaration. That the client has taken reasonable steps to satisfy itself that the principal designer and principal contractor, and any other designers and contractors, are competent.
6. Construction control plan. How the principal contractor will plan, manage and monitor the work so that it complies: the inspection regime, the hold points, the records, the interface with the principal designer, and how compliance will be evidenced at completion.
7. Change control plan. How changes during construction will be identified, classified as recordable, notifiable or major, recorded on the change control log, notified to the regulator and, for a major change, held until approved.
8. Mandatory occurrence reporting plan. The system for identifying, reporting and recording safety occurrences under regulations 32 to 37, in place before construction begins.
9. Fire and emergency file and, where the building will be handed over in parts, a partial completion strategy.
10. Planning statement and any other information the regulator requires for the particular application.

Confirm each item against the current text of Schedule 1 before submission; the regulator's own guidance on the application, updated on 1 April 2026, describes what it expects to see under each heading.

How the regulator decides

The Building Safety Regulator has operated as a standalone body sponsored by the Ministry of Housing, Communities and Local Government since 27 January 2026. Its guidance sets a determination period of 12 weeks for a new higher-risk building and 8 weeks for work to an existing one, which can be extended by agreement. The regulator may approve, approve with requirements, or reject. Approval with requirements is common and the conditions attach to the approval: a requirement to submit further information before a stage, or to notify before a particular element is built, is a hold point and belongs on the notices and inspections tracker with a date.

Two consequences follow from approval. First, work must commence within three years or the approval lapses under section 32 of the Building Act 1984. Second, commencement itself has a definition: for higher-risk building work, regulation 46A of the Building Regulations 2010 treats the work as commenced when the client's statement confirms that 15 per cent of the work has been done, and the commencement notice goes to the regulator within the period the regulations set. The regulator's guidance states this as five working days; the regulations read as five days. Work to the shorter reading.

What the contractor needs on day one

The approval is granted on the strength of the plans in the application. From the first day on site the principal contractor is being audited against them, and the file that shows it should exist before the first excavation:

• The change control log, open, with the classification guide from regulations 18 to 26 to hand. Every change to the approved design, however small, is at least recordable. A notifiable change is notified before it is carried out. A major change is applied for and not carried out until approved; the regulator has six weeks to determine it. A log that starts in month four with the first big change has already failed.
• The mandatory occurrence reporting system, with the workforce briefed. A safety occurrence is one that meets the risk condition in regulation 35: it could cause a significant risk to life if it were not remedied. A notice goes to the regulator by the quickest practicable means and a report follows within ten days. A cavity barrier installed that is not the product assessed is an occurrence, and it is also a change, and the two records should cross-reference.
• The golden thread, meaning the information about the building that demonstrates compliance, kept in a facility that meets the standards in regulation 31 for accuracy, accessibility and security, from the approval onward and handed to the accountable person at completion. This is a schedule of information items, each with a provider, an update trigger and a format, not a folder named Golden Thread on a shared drive.
• The Regulation 7 record for materials: the combustible materials ban for relevant buildings under regulation 7(2), with every external wall product checked against its declared classification and a record that what was installed was what was assessed.
• The construction control plan in operation: inspection and test plans with the hold points the plan promised, records at each, and building control inspection records for every regulator visit with findings and actions.

Gateway 3 starts at Gateway 2

At completion the principal contractor and the client apply for a completion certificate under regulations 40 to 45 of SI 2023/909. The application includes declarations by the principal designer and the principal contractor that the building complies, a joint handover statement, and the golden thread information for the accountable person, and it is followed by the regulator's inspection. Under section 76 of the Building Safety Act 2022 the building cannot be occupied until the completion certificate is issued, and section 77 makes occupation without one an offence. Every declaration in that application depends on records kept from Gateway 2 onward: the change log that shows what was approved and built, the occurrence reports, the inspection records, the material checks. A contractor who treats Gateway 3 as a close-out exercise will find that the evidence it needs was never collected.

Buildings that are not higher-risk

Most of the dutyholder regime, the compliance statement discipline and the change control habit apply just as well to a building that falls outside the definition. The building control body is a local authority or a registered building control approver rather than the regulator; the notices are the ordinary ones under regulation 16, the completion certificate under regulation 17, and the fire safety information under regulation 38. A contractor who runs the same compliance plan on both types of building, with the higher-risk elements switched on where they apply, has one system instead of two.