Everything you need to know.

A premises is generally in scope if it is used for one of the qualifying public-facing purposes set out in the Act and it can reasonably expect to have a certain number of people present at the same time. If it’s a public-facing site where people gather - shops, hospitality, entertainment, hotels, places of worship, healthcare, education, and similar - it’s worth checking carefully.

Groundwork’s guided prompts walk you through this, based on your premises’ use and expected numbers, so you don’t have to interpret the legislation cold.

There are two tiers based on how many people a premises can reasonably expect:

• Standard tier - the lower band. The focus is on reasonably practicable procedures using existing resources.
• Enhanced tier - the higher band, for larger premises. This adds more formal requirements, including documented assessments and additional measures.

There’s also voluntary readiness - for premises below the threshold that still want to prepare as good practice.

The count is about how many individuals may be present at the same time in connection with the premises’ qualifying use - and it includes staff, not just visitors or customers. It’s a “reasonable expectation” of maximum occupancy, not an average.

Importantly, the number only matters once the premises qualifies by its use - headcount alone, at a non-qualifying premises, doesn’t bring it into scope.

As pure workplaces - no. A premises whose principal use is as an office, warehouse, or factory is not a qualifying public-facing use, so it falls outside the Act’s scope regardless of how many staff it has.

The exception: if part of such a premises is used for a qualifying public-facing purpose - for example a shop or café open to the public within it - that part can be in scope. Groundwork helps you work out where that line falls for a mixed-use site.

Yes - education is a qualifying use, so schools, colleges and similar settings are in scope. However, most education settings (below higher-education level), along with places of worship and childcare, are treated as standard tier even if their numbers would otherwise put them in the enhanced band - a deliberate cap in the legislation.

So a large school is in scope, but capped at standard-tier duties. Universities and higher education are not capped and can be enhanced tier.

Healthcare - including hospitals, clinics, and surgeries - is a qualifying use and is in scope. Unlike schools, healthcare is not capped at standard tier: a large hospital escalates normally and can be enhanced tier.

Large hospital sites also often involve multiple buildings operated by one trust, in which case the numbers aggregate across the site and the trust is the responsible person. Groundwork’s prompts account for multi-building sites.

Voluntary readiness is for premises that fall below the threshold, or that simply want to prepare ahead of any duty. It isn’t a statutory tier and carries no legal obligation - but producing a readiness document is good practice, and it’s a genuine signal to partners, insurers and guests that you take preparedness seriously.

Groundwork lets any premises produce a voluntary readiness document, clearly framed as good practice rather than a legal requirement.

Absolutely. Groundwork is a commercial tool, and any organisation can use it - whether it’s legally in scope or simply wants a structured, verifiable preparedness record. We’re always clear about whether a duty applies to you, so you buy it knowing exactly where you stand: as a legal duty, or as voluntary good practice.

Where several buildings form one site under one operator - a hospital trust, a campus, a retail complex - the Act can treat them together, with numbers aggregating across the site and one responsible person accountable. Groundwork asks how many buildings make up your site and whether they’re operated as a single premises, so the scoping reflects your actual situation rather than assuming a single building.

The guidance suggests reviewing periodically - typically around once a year is a sensible benchmark - but for standard-tier premises that’s good practice rather than a fixed statutory interval. The more important trigger is material change: a change to how the premises is used, a significant change in expected numbers, a change to the layout or immediate surroundings, or a change of responsible person.

Groundwork offers a calendar reminder for your review date and lists the change-triggers so you know when to revisit sooner.

Groundwork is a self-serve tool that helps you produce a structured, professional, verifiable readiness document. You answer guided prompts about your premises, procedures and preparations, and it generates a clean document you download and keep.

It structures your own facts and judgements into the right shape - it doesn’t assess your premises or tell you what your procedures should be.

No - and this is deliberate. Groundwork captures what you record; it does not judge your premises, assess vulnerability, or advise you on what’s safe. The responsible person supplies the facts and makes the judgements; we provide the structure and turn it into a document. This keeps you in control and keeps the document an honest record of your preparation.

For a standard-tier premises, most people complete it in well under an hour. The prompts are structured and plain-English, and you only provide information you already know about your own premises - there’s no research or interpretation of legislation required on your part.

You pin the places that matter - doors, exits, assembly points, and similar - using precise coordinates (and what3words), so your procedures reference exact, unambiguous locations, the same kind emergency services can use. You can also enter locations by typing coordinates or an address, so a map isn’t the only way to add them.

All of this location detail is created and kept on your own device - it’s never stored on our servers.

A clean, professionally styled PDF, generated in your browser. It carries a cover with your reference details, your organisation and premises information, your marked locations, your four procedures, and a sign-off section - plus a QR code and reference for verification. It’s designed to be something you’re comfortable showing to a partner, an insurer, or an inspector.

Yes. The structured data is carried inside the PDF, so when you need to amend it you simply re-upload your own document and update it - no starting from scratch. Each amendment produces a fresh version with its own reference, and increments the version so the history is clear.

Because we don’t store your document, you amend from your own copy - which is why keeping your file safe matters.

No account is needed to produce and keep your document - and there’s nothing stored on our side to log into. Your document lives with you. This is a deliberate part of the design: the fewer places your information sits, the safer it is.

We’ll tell you honestly. If the guided prompts indicate you’re not legally in scope, we say so plainly - and point you to free official resources rather than selling you something you don’t need. You can still choose to produce a voluntary readiness document if you’d find it useful, framed clearly as good practice.

Yes. Multi-site operators produce a document per site, each with its own reference, and can track them centrally - which are current, which are due for review, which still need one. You can add your own internal branch or site reference to each, so Groundwork’s records line up with your estate records.

A map is a convenience, not a requirement. Every location can be entered as text - coordinates, what3words, or an address - so the tool is fully usable without clicking a map. This keeps it accessible to everyone, including screen-reader users, and useful even where a map is impractical.

On your own device - never on our servers. Everything describing your premises’ locations, layout, and procedures is created and stored entirely within your own browser. Your finished document is downloaded to you. We can’t retrieve it, because we never receive it.

This is the single most important thing to understand about Groundwork: we don’t hold what we don’t need.

Because a central store of many sites’ layouts, vulnerabilities and procedures would be exactly the kind of information this legislation exists to protect - a single target worth attacking. So we deliberately don’t build one. What we never hold cannot be leaked, sold, or misused. The discipline that looks like a constraint is actually the product’s strongest protection.

Only a small, non-sensitive index - enough to let a document be verified as genuine later. That’s things like the site reference, document reference, version, status, organisation name, town and postcode, the relevant dates, and a cryptographic fingerprint of the document. It contains no locations, procedures, or anything describing how your premises is laid out or protected.

No. We do not sell your data, and we do not share it for third-party advertising or marketing. Our commercial model is the tool and its verification service - never your data.

No - and this is structural, not just a promise. Because your sensitive premises data is never stored on our servers, there is no dataset of it for any AI or language model to be trained on, ours or anyone else’s. The protection is built into how the system works: what we never hold can’t be trained on.

We operate in line with UK data protection law. For the limited non-sensitive index we hold, Aulter Ltd acts as data controller, and you have the usual rights - access, correction, erasure and more. Because we don’t hold the sensitive contents of your document, those remain entirely within your own control. Our Privacy Policy and Data Statement set this out in full.

Your document is already yours - it’s on your device, not ours, so nothing happens to it on our side. For the non-sensitive index record, we retain it only as long as it’s relevant for verification, and you can ask us to erase your personal data at any time.

Because the sensitive contents never leave your device, they can’t be exposed by any compromise of our systems - there’s simply nothing sensitive on our side to expose. The security of the document itself then rests with you, which is why we encourage you to store your downloaded file safely.

Only the people you choose to show it to. Groundwork never shares your document - we don’t have it. If you give someone your document or its reference, they can verify it’s genuine, but verification returns only non-sensitive status information, never the contents.

Verification confirms that a document is a genuine Groundwork document, its version, its status (active or superseded), and when it was created. It’s a way for anyone you show a document to - an event organiser, a partner, an insurer, an inspector - to confirm it’s real and current.

It does not certify the document’s contents or confirm compliance with the Act - it confirms authenticity and date, nothing more.

When your document is generated, we create a cryptographic fingerprint (a hash) of that exact file and record it against your reference and dates. We store only that fingerprint, never the document. Anyone checking a reference gets back the non-sensitive status - genuine, version, dates - confirmed against that record. The document itself never needs to be held by us for this to work.

Every document carries a QR code and a reference. Scanning the QR, or entering the reference on our verification page, returns the result instantly. There’s a single verification page that handles any document - you don’t need a separate link per document.

A positive result confirms the document is genuine and shows the organisation name, the creation date, the version, the status (active or superseded), and the review-due date. It never shows contact details, locations, or any content of the document.

Because a document can be genuine but superseded - an older version that’s since been amended. Showing status means someone verifying can tell the difference between a current document and an out-of-date one, so nobody relies on a stale version. It’s a small detail that makes verification genuinely trustworthy.

The verification page will clearly say no genuine document was found for that reference. That’s a useful signal in itself - it means the document may not be authentic. A “not found” result is as informative as a positive one.

A forged document with a made-up reference simply won’t verify - there’s no matching record, so it returns “not found”. And because we hold a fingerprint of the genuine file, an altered version of a real document won’t match the recorded fingerprint. Verification is what makes a Groundwork document hard to fake convincingly.

One-off verification - scanning a QR or entering a single reference - is a straightforward check. Bulk and programmatic verification for organisations validating many documents at once is offered as a service to insurers, lenders, and estates; see the Insurance & finance section.

An insurer can verify that a readiness document held by one of their insured sites is genuine and current - one at a time, or across their whole book at once. Demonstrable, verifiable readiness is a useful risk signal, and it’s increasingly relevant to how sites are underwritten. Groundwork gives insurers a way to confirm it cheaply and at scale, without ever handling sensitive premises data.

Lenders and commercial property owners can verify that the premises on their book are taking active steps to meet their obligations - a portfolio-level view of which properties hold a current readiness document, which are due for review, and which have none. It’s a risk signal for lending decisions, covenants, and property insurance, using the same verification engine.

Never. Validation returns only non-sensitive status and identity for matching - existence, status, version, dates. It never returns your premises detail, procedures, or locations, because we don’t hold those in the first place. There’s nothing sensitive for us to share, by design.

From you - the site. An insurer must obtain the reference from their own customer; we never provide, sell, or supply lists of customers or references to insurers. You stay in control: an insurer can only validate a document whose reference you chose to give them.

For organisations that want verification built into their own systems, we offer a programmatic route: a batch-validation API, with support for agent-based (MCP) access, so status checks can run automatically within a CRM, underwriting system, or portfolio tool. It returns structured results - genuine, status, version, dates - for many references at once.

There’s also a self-serve route for less technical teams: upload a file of references, download the results, no integration required. See the developer page for detail.

No. It’s consented, site-owned proof, shared by choice - the site gave their reference to their insurer or lender, and the check returns only non-sensitive status. No data changes hands beyond a genuine/not-genuine, current/superseded confirmation. It’s verification, not a data transaction.

Potentially, over time. Insurers themselves have noted that a proportionate, demonstrable security plan can make a premises a better-rated risk, while identified failings could push the other way. We don’t make promises on anyone’s behalf - but a verifiable readiness document is exactly the kind of evidence that supports those conversations.

Access is granted to authorised parties, and can be withdrawn. The developer page sets out the API and agent access, the self-serve upload route, and how access works. We discuss access directly rather than listing prices publicly - get in touch through the contact page.

Producing a readiness document is £49. That gives you a complete, professionally styled, verifiable document you download and own.

Amending and reissuing a document is £9. Because the structured data is carried inside your document, amending re-uses your existing work rather than starting again - you re-upload, update what’s changed, and reissue a fresh version.

No. It’s a one-off fee per document, with a low amendment fee when you need to update it. There’s no recurring subscription and no account to maintain. You pay for what you produce.

For standard-tier premises, the official guidance is clear that you don’t need to hire a consultant - the duty is designed to be met yourself. So the honest comparison isn’t against consultancy fees; it’s against doing it yourself from a blank page. Groundwork’s value is the structure, the correct scoping, the professional output, and the verification - saving you the time and uncertainty of doing it alone.

Enhanced-tier premises have more involved requirements, and pricing for that and for multi-site or enterprise needs is discussed directly. Get in touch through the contact page and we’ll talk through what fits.

Only the £9 amendment fee when you actually make a change. Simply holding your document costs nothing - it’s yours. You’d pay to amend when your premises, numbers, layout, or circumstances change, or at a periodic review if something needs updating.

Multi-site operators produce a document per site. For larger estates and for the insurer, lender, and portfolio verification service, we discuss arrangements directly rather than listing prices publicly - get in touch and we’ll find what works for your scale.

No - and we’re careful to be honest about this. Groundwork is a private, commercial product. It is not affiliated with, endorsed by, or acting on behalf of the SIA, the Home Office, or the police. No regulator endorses commercial products of this kind. We build to align with the published statutory guidance; we never imply an endorsement we don’t have.

No. A document is evidence of diligence - a record of the preparation you’ve undertaken - not a certificate of compliance. Only the regulator can determine compliance. We’re deliberate about this wording throughout, because claiming otherwise would be misleading.

Because we’re built on accuracy and restraint rather than overclaiming. We reflect the duty as it actually is - telling you honestly when you’re out of scope, never implying systems or measures the law doesn’t require, and never suggesting a document certifies compliance. In a market where preparedness is sometimes over-sold, being the accurate, honest option is the whole point.

Accessibility matters to us, both because a significant part of our market operates under accessibility requirements and because the person completing a document may themselves have a disability. Every location can be entered by typing rather than only by clicking a map, the interface is built to work by keyboard and with screen readers, and we design to recognised accessibility standards.

No - the opposite. We’d rather tell you that you’re out of scope, or that you only need a lighter standard-tier approach, than inflate your obligations. Overstating the duty might sell more in the short term, but it destroys the credibility that matters to the sites, insurers, and regulators we work alongside.

The scoping is guidance based on the information you provide and the published statutory guidance - it’s there to help, not to make a binding legal ruling. The determination is ultimately yours as the responsible person. If your situation is unusual, you can record your own judgement, and where appropriate seek professional advice.

Groundwork is operated by Aulter Ltd, a company registered in England and Wales (company number 10931400). Our aim is straightforward: help premises meet the Act accurately and keep their readiness current, with an honest, privacy-first tool.