Construction and project managers regularly certify practical completion on smart buildings that are, in practice, merely expensive automations. Under upcoming UK legislation, this handover blind spot is about to expose clients to a £17m statutory liability risk, not their contractors
Two major changes are impacting the UK built environment. First, the revision to BS EN ISO 19650 (currently heading into its second Draft International Standard ballot) proposes retiring the title of ‘BIM’ in favour of whole-life information management, where it merges Parts 2 and 3 to dissolve the artificial split between project delivery and asset operations.
Second, the government’s Cyber Security and Resilience Bill updates the Network and Information Systems (NIS) Regulations, expanding the scope of statutory ‘all-hazards’ duties. Additionally, it now spans critical suppliers, large load controllers and data centres of 1MW or greater, thus explicitly defining data centres to include physical HVAC, power and security systems.
This creates a dangerous handover disconnect between client, contractors and consultants. Under the Bill’s Relevant Managed Service Provider rules, specialists that only install or integrate operational technology (OT) and information systems without ongoing post-handover management fall outside of direct regulatory scope.
That means once practical completion is signed, the installer escapes the regulator’s net, and thus transfers up to £17m, or 10% of turnover, in statutory liability risk exposure onto the client on day one of operations. Naturally, that then puts the project and construction managers who certified the handover directly in the firing line.
Avoidable failure
It easily reads like a technology failure, yet my research into cyber-physical BIM governance and enterprise IoT integration confirms that it is actually a contract-administration and briefing failure. Across the sector, we persistently suffer from a standardisation paradox. Practitioners overwhelmingly endorse ISO 19650 principles, yet remain trapped in a circular governance gap where live sensor telemetry is never defined as a measurable deliverable within Exchange Information Requirements or the Information Production Plan.
While industrial sectors have long relied on ANSI/ISA-95 to govern safe, structured interfaces between physical control layers and enterprise systems, construction still frequently hands over static 3D geometry alongside disconnected building management system silos, which also cannot communicate with enterprise servers or a genuine digital twin.
In the UK, where 95% of critical national infrastructure organisations suffered a breach in 2024, cyber-physical blind spots are devastating – and the penalties affect virtually every project. When two data centres serving Guy’s and St Thomas’ NHS Foundation Trust failed during a heatwave, which knocked out clinical IT across three hospitals at a cost of £1.4m, it was not threat actors. It was an avoidable, predictable environmental cooling failure.
Bittersweet truth
Leading cyber-physical information governance across sovereign infrastructure has taught me a bittersweet truth: you cannot retrofit Secure by Design at RIBA Stage 6 and still hope to be safe or compliant. When consultants operate in fragmented silos, unverified sensor schemas and un-audited hardware become sunk-cost vulnerabilities baked into the structure.
Governing a common data environment as an operational workflow, and not a glorified shared local or cloud drive, means enforcing strict stage-gate validation processes across every layer, from physical sensors up to enterprise interfaces, alongside the construction process before practical completion is ever signed.
Don’t wait for the second ISO 19650 ballot to settle before fixing your blind spots, such as contracts. Construction managers and clients must stop treating smart telemetry as an MEP subcontractor afterthought and start governing sensor data as a high-value, auditable information commodity from RIBA Stage 0. If a system’s data architecture cannot survive a statutory resilience audit, it isn’t a smart building, and we have no business certifying it as complete.
Dirk Lourens CEng MIET PrArch is a UK chartered engineer and South African professional architect leading cyber-physical information governance for sovereign infrastructure, alongside postgraduate research in digital construction technology, digital twin configurations, smart building governance, enterprise IoT integration, and automated information management compliance.
