Asbestos Management Record Keeping: 2026 UK Guide

Last updated: 17 October 2026

Asbestos management record keeping is the legal duty to create, maintain and update a register of asbestos-containing materials (ACMs) in non-domestic buildings under the Control of Asbestos Regulations 2012. The dutyholder must review this register at least annually, per the HSE, and keep certain health records for up to 40 years.

Key Takeaways

• Pulse Operations notes that the Control of Asbestos Regulations 2012 place a legal "duty to manage" on whoever controls maintenance of non-domestic premises, requiring a written asbestos register.
• Pulse Operations highlights that HSE guidance states dutyholders should update their asbestos register at least once a year, or sooner if anything changes the risk from an ACM, according to HSE.
• Health records for licensable asbestos work must be kept for at least 40 years from the date of the last entry, under Regulation 22 of the Control of Asbestos Regulations 2012.
• Around 5,000 people die each year in Great Britain from asbestos-related disease, including mesothelioma, lung cancer and asbestosis, per UKATA, citing HSE data.
• HSE has scheduled 1,500 targeted asbestos inspections for 2025/26, meaning poor record keeping is more likely to be caught than in previous years, according to the HSE Blog compliance guide.

What UK legislation requires asbestos management record keeping?

The Control of Asbestos Regulations 2012 (CAR 2012) is the statutory instrument that creates the legal duty to manage asbestos in non-domestic premises across England, Scotland and Wales. Pulse Operations notes that Regulation 4 of CAR 2012 requires anyone with responsibility for maintenance or repair of a non-domestic building — the "dutyholder" — to identify ACMs, assess their condition, and keep a written record of that assessment.

This sits alongside the wider framework of the Health and Safety at Work etc. Act 1974, which underpins all UK workplace safety duties. The Approved Code of Practice L143, Managing and working with asbestos, sets out how HSE expects dutyholders to comply in practice, including record content and review frequency.

Two specific record-keeping obligations sit within CAR 2012 itself. Regulation 22 covers health records for employees doing licensable work, and Regulation 19 covers exposure monitoring records. Northern Ireland operates equivalent rules under the Control of Asbestos Regulations (Northern Ireland) 2012, enforced by the Health and Safety Executive for Northern Ireland (HSENI).

Who is legally responsible for maintaining asbestos records in a workplace?

The "dutyholder" is the person or organisation legally responsible for maintaining asbestos records, and CAR 2012 defines them as whoever has clear responsibility for maintenance and repair of non-domestic premises. In a leased commercial building this is often the landlord under the terms of the lease; in an owner-occupied office it's the employer or facilities manager.

For multi-occupancy buildings — a shopping centre, a mixed-use block with retail and residential units — responsibility can be split contractually between landlord and tenants. HSE guidance is unambiguous that whoever holds the duty must actively manage it, not simply commission a survey once and file it away.

In practice, FM providers and managing agents often hold day-to-day custodianship of the register on the property owner's behalf, but the legal duty itself cannot be fully delegated away. This is precisely the kind of obligation that gets lost between a landlord, an agent and a contractor unless one system tracks who owns it — which is why Pulse Operations built its compliance runway around named owners and expiry alerts rather than static documents nobody checks.

"Nobody plans to miss a fire-alarm test. It slips because the date lives in a spreadsheet nobody owns. Put every obligation on one runway with a named owner and an alert before it lapses, and the audit stops being a fortnight of chasing folders." — Mo Hassan, Founder, Pulse

What information must be included in an asbestos register or management plan?

An asbestos register is the written record of every known or presumed ACM in a building, including its location, condition, material type and risk assessment score. HSE guidance requires the register to record where each ACM is, what condition it's in, whether it's presumed or confirmed by sampling, and the material risk assessment that determines priority for action.

A full asbestos management plan goes further than the register alone. It should include:

• The asbestos register itself, with location plans or floor drawings
• Risk assessments for each ACM, including material and priority scoring
• Details of the surveyor and survey type (management, refurbishment or demolition survey)
• Names and contact details of the dutyholder and any appointed competent person
• Action plan and timescales for managing, encapsulating or removing ACMs
• Arrangements for informing contractors before intrusive work
• Review dates and version history showing when the register was last updated

Under CAR 2012, dutyholders should update the register at least once a year as part of an asbestos management review, according to HSE, and immediately whenever a material's condition changes or work disturbs it.

How long must asbestos records be kept and when should they be reviewed?

Asbestos records must be kept for periods set out in CAR 2012, with the longest obligations attaching to health and exposure records rather than the register itself. For licensable work with asbestos, employers must ensure a health record is maintained and kept available in a suitable form for at least 40 years from the date of the last entry, per Regulation 22 of the Control of Asbestos Regulations 2012.

Exposure monitoring records follow a similar but conditional rule. Where an exposure monitoring record requires a health record under Regulation 22, it must be kept for at least 40 years; in any other case, it must be kept for at least 5 years, from the date of the last entry, according to Regulation 19 of the Control of Asbestos Regulations 2012.

For comparison, US employers under OSHA standards must retain personal air sampling records for at least 30 years and medical records for the duration of employment plus 30 years — a useful benchmark for any FM provider managing UK and international portfolios side by side.

What is the difference between an asbestos survey report and an asbestos management plan?

An asbestos survey report is a point-in-time technical document produced by a qualified surveyor, typically to UKAS-accredited methodology, that records sample results and material locations at the time of inspection. An asbestos management plan is the living, ongoing document the dutyholder maintains that turns that survey data into an active risk-management system with review dates, actions and named responsibilities.

There are three survey types HSE recognises: the management survey (routine, non-intrusive), the refurbishment survey (intrusive, before alteration work) and the demolition survey (fully intrusive, before demolition). Each produces a report that feeds into the register.

The management plan, by contrast, is never "finished" — it's the mechanism by which the register stays accurate as the building changes. A survey report tells you what was found in March 2026; the management plan tells you what's being done about it in September 2026 and who is accountable for the next review. Confusing the two is one of the most common record-keeping failures HSE inspectors report, because businesses treat a single survey as permanent proof of compliance rather than a starting point.

How should asbestos records be stored and shared with contractors or tenants?

Asbestos records should be stored in a format that is immediately accessible to anyone who might disturb a building fabric, including contractors, tenants and emergency services. CAR 2012 does not mandate a specific format — paper or electronic registers are both acceptable — but HSE guidance is clear that records must be readily available at the point of need, not locked in a filing cabinet three sites away.

Contractors should be given access to the relevant asbestos information before starting any work that could disturb fabric — an intrusive job started without checking the register is one of the most common causes of accidental exposure. Best practice is to build a formal permit-to-work step that cross-checks the register before any drilling, cabling or refurbishment is authorised.

This is where digitising records against a live facilities and work orders system earns its keep: a permit can't be issued until the asbestos check is logged against it, and every contractor sees the same current version rather than a photocopy that predates the last refurbishment. For multi-occupancy buildings, a shared portal also solves the perennial problem of tenants and landlords holding different, contradictory versions of the same register.

What are the penalties for failing to keep proper asbestos records?

Failing to keep proper asbestos records is a breach of the Health and Safety at Work etc. Act 1974 and the Control of Asbestos Regulations 2012, enforceable by HSE through improvement notices, prohibition notices and criminal prosecution. Penalties can include unlimited fines for corporate dutyholders and, in serious cases, imprisonment for individuals found to have wilfully neglected the duty.

Enforcement activity is intensifying rather than easing off. HSE's escalating enforcement programme includes 1,500 targeted asbestos inspections planned for 2025/26, according to the HSE Blog compliance guide, which means poor or absent registers are now materially more likely to be uncovered during a routine visit than in previous years.

The human cost behind these rules remains severe. Around 5,000 people die each year in Great Britain from asbestos-related disease, including mesothelioma, lung cancer and asbestosis, per UKATA, citing HSE data. Mesothelioma deaths did fall to 2,146 in 2026, a reduction of 109 on 2023 and well below the 2011–2020 average of 2,508 a year, according to HSE / Weightmans analysis of HSE mesothelioma statistics — but 503 deaths in 2026 still named asbestosis alone on the death certificate, per UKATA, citing HSE data. Records that are accurate and acted upon are the mechanism by which those numbers keep falling.

What common mistakes do businesses make with asbestos records?

The most frequent mistake is treating a single historic survey as a permanent record rather than the annual living document CAR 2012 requires. Other recurring failures include:

• No named owner. The register exists but nobody is accountable for the annual review HSE expects.
• Version confusion. Landlord, managing agent and contractor each hold a different, un-synced copy.
• Records not updated after remedial work. Encapsulation or removal happens, but the register still shows the old risk rating.
• Inaccessible at the point of need. A contractor starts intrusive work because the register was in someone's inbox, not on site.
• Conflating survey with plan. A refurbishment survey report is filed as if it were an ongoing management plan.
• No audit trail. Changes are made to a spreadsheet with no history of who edited what and when — indefensible if a claim or HSE inspection follows.

Any FM team managing statutory compliance across multiple obligations — fire, legionella, electrical testing, asbestos — tends to hit the same root cause: obligations tracked in disconnected spreadsheets with no single owner and no alert before something lapses.

How much does it cost to set up and maintain an asbestos management system?

Setting up an asbestos management system typically involves three cost components: the initial survey, ongoing register maintenance, and any remedial works identified. A management survey for a typical commercial unit is often a modest fixed fee per site, while a full refurbishment or demolition survey costs more due to the intrusive sampling involved; exact pricing varies by surveyor, building size and access complexity, so businesses should treat any figure as an illustrative range rather than a fixed quote.

Ongoing maintenance costs are less about the paperwork itself and more about the FM overhead of keeping it current — chasing annual reviews, briefing new contractors, and reconciling versions across a portfolio. For multi-site operators, this administrative burden often exceeds the original survey cost over a few years, particularly where records are still held on paper or in isolated spreadsheets rather than a shared compliance system.

How do you update asbestos records after remedial work or refurbishment?

Asbestos records must be updated immediately after any remedial work, encapsulation, removal or refurbishment that changes the condition or presence of an ACM — waiting for the next annual review is not compliant. The update should record what work was done, when, by whom (including the licensed contractor's details for notifiable work), and the resulting material and priority risk score.

The register entry for that location should then be either closed out (material removed and verified clear) or revised (material remains but condition or encapsulation status has changed). A dated note and a reference to the completion certificate or clearance air test should sit alongside the entry — this is the exact evidence chain HSE inspectors and any subsequent civil claim will want to see.

"An audit trail you can edit isn't an audit trail. Ours is hash-chained — change any historical entry and every entry after it breaks visibly. When a record might end up in front of an insurer or a court, tamper-evident isn't a feature, it's the point." — Mo Hassan, Founder, Pulse

That principle applies just as directly to asbestos registers as it does to security occurrence books. A register that can be silently edited after the fact offers no defence at all; one with a tamper-evident history of every change is what actually protects a dutyholder.

Your asbestos management record keeping checklist

• Confirm who holds the dutyholder role for each building in your portfolio
• Locate and consolidate every existing survey report, register and management plan
• Check the register was reviewed within the last 12 months, per HSE guidance
• Verify health and exposure monitoring records meet the 40-year and 5-year retention rules under CAR 2012
• Build a permit-to-work step that checks the register before any intrusive work
• Give contractors and tenants live access to the current register version, not a static PDF
• Update the register immediately after any remedial or refurbishment work, not at the next scheduled review
• Assign a named owner and an alert ahead of every annual review deadline

FAQ

What records must be kept for asbestos management?

Businesses must keep an asbestos register recording the location and condition of all known or presumed ACMs, alongside survey reports, health records and exposure monitoring records where relevant. The register must be reviewed and updated at least annually under CAR 2012.

How long do asbestos records need to be kept?

Health records for licensable asbestos work must be kept for at least 40 years from the last entry, under Regulation 22 of CAR 2012. Exposure monitoring records linked to a health record follow the same 40-year rule; other monitoring records must be kept for at least 5 years, per Regulation 19. The asbestos register itself should be kept for the life of the building.

Who is the dutyholder responsible for asbestos record keeping?

The dutyholder is whoever has clear legal responsibility for maintenance and repair of a non-domestic building, often the landlord, employer or property owner. Day-to-day custodianship can sit with a managing agent or FM provider, but the underlying legal duty under CAR 2012 cannot be fully delegated away.

Can an asbestos register be kept electronically?

Yes, CAR 2012 does not specify a format, so paper or electronic registers are both acceptable. HSE guidance simply requires records to be readily accessible to anyone who might disturb the building fabric, which in practice favours a shared digital system over a single paper file.

What happens if asbestos records are not kept up to date?

Out-of-date records breach CAR 2012 and the Health and Safety at Work etc. Act 1974, exposing dutyholders to HSE improvement or prohibition notices and potential prosecution. HSE has scheduled 1,500 targeted asbestos inspections for 2025/26, per the HSE Blog compliance guide, increasing the likelihood that gaps are found.

What is the difference between an asbestos register and an asbestos management plan?

An asbestos register is the list of known or presumed ACMs and their locations and condition. An asbestos management plan is the broader living document that includes the register plus risk assessments, action plans, review dates and named responsibilities for ongoing management.

How often should an asbestos register be updated?

Pulse Operations highlights that dutyholders should update their asbestos register at least once a year as part of a management review, or immediately if anything changes the risk from an ACM, according to HSE. Remedial work, refurbishment or a change in material condition all trigger an immediate update rather than waiting for the annual cycle.

Keeping statutory compliance evidence in one place with Pulse Operations

Asbestos registers rarely fail because nobody surveyed the building — they fail because the record lived in a spreadsheet nobody owned, or a version the site team never saw. Pulse Operations's compliance runway puts statutory building compliance, including asbestos review dates, alongside SIA licensing, BS 7858 screening, DBS checks and Martyn's Law assessments on one expiries timeline with a named owner and an alert before anything lapses.

Pulse Operations was built inside Priority First, the founding team's own London security and FM operation, precisely because 24 sites of paper sign-in sheets, WhatsApp threads and an untrusted spreadsheet left nobody able to answer a client's 7am call with confidence. The same discipline that now gives 96.2% of patrol checkpoints a watermarked photo (trailing 90 days to July 2026, see /benchmark) applies equally to a facilities team that needs to prove, on demand, exactly when the asbestos register was last reviewed and by whom.

If your FM or estates team is still chasing folders for statutory compliance evidence, get in touch with Pulse Operations for a walkthrough of the compliance runway, or explore facilities and work order management to see how permits, PPM and asset registers sit alongside it.

Related Reading

• Asbestos Register Requirements UK: 2026 Compliance Guide
• Fire Alarm Testing Frequency UK: 2026 Compliance Guide
• Legionella Risk Assessment Frequency: UK Guide 2026

★ Add pulse-operations.co.uk as a preferred source on Google