WhatsApp subcontractor compliance: fast setup that checks CSCS, right to work and insurance automatically

Category: Case Studies & Playbooks • Niche: subcontractor compliance, WhatsApp, CSCS checks, right to work, OCR, expiry reminders

Contents

• Quick answer
• Who this is for
• How it works (at a glance)
• Step-by-step setup
• Policy and GDPR notes (simple and practical)
• What good looks like on site
• Troubleshooting and edge cases
• FAQs

Quick answer

You can collect and verify subcontractor compliance in minutes over WhatsApp. Subs send photos or PDFs of:

• CSCS or affiliated scheme card
• Right to work evidence
• Insurance certificates (PL, EL where relevant, and PI if they design)

An automation reads the images (OCR), extracts key fields and runs checks:

• CSCS Smart Check for card validity
• Right to work rules from the Home Office guide
• Insurance limits and expiry dates

Results land in a simple dashboard with green/amber/red statuses and automatic expiry reminders. Typical outcome: admin chasing cut by 50 to 70 percent, fewer refused site entries, and a clean audit trail.

Who this is for

• Main contractors and specialist subcontractors who onboard lots of bona fide subs
• Site managers who need a fast way to gate access each morning
• Office admins who want less back-and-forth on missing documents

How it works (at a glance)

1. WhatsApp intake: your sub sends photos of their CSCS card, right to work doc and insurance.
2. OCR + AI: the flow reads name, card type, numbers and expiry dates.
3. Checks: CSCS verification, right to work rules, PL/EL/PI limits and dates.
4. Dashboard: shows pass/fail and what’s missing; sends reminder messages before expiry.

Step-by-step setup

1) Set up a WhatsApp intake that works on any phone

• Use a WhatsApp Business number and a shared inbox so the office and site can see the same thread. If you need automation, use the WhatsApp Business Platform via a BSP like Twilio or 360dialog.
• Create a canned message: “Please send clear photos of your CSCS card (front and back), right to work evidence, and insurance certificate pages showing entity name, dates and limits.”
• Add a QR code to your site induction poster that opens WhatsApp with a pre-filled message.

Helpful context:

• UK courts have confirmed that WhatsApp messages can form binding contracts if the core elements are present. If you’re negotiating terms over WhatsApp, add “Subject to contract” until your formal document is signed. See the High Court ruling in Jaevee Homes v Fincham for why this matters in construction. Construction Management Magazine, Osborne Clarke.

2) OCR the images and map the fields

• Use an OCR service (e.g., Google Vision, Azure AI Vision or an off‑the‑shelf OCR bot) to read:
  • Names and IDs on CSCS or affiliated scheme cards
  • Document titles and expiry dates on insurance certificates
  • Document types for right to work (passport, share code result, etc.)
• Store the extracted fields in a simple table (Google Sheets or Airtable works to start).

3) Verify CSCS and affiliated scheme cards properly

• Use the official CSCS Smart Check app or desktop portal to validate cards across schemes in the CSCS Alliance. Methods: scan QR, read NFC or enter details manually depending on the scheme. CSCS Smart Check. App downloads: App Store, Google Play.
• Note: The old Go Smart system has been withdrawn; Smart Check replaces it. CSCS news.

4) Right to work checks (keep it to the official list)

Follow the Home Office guide and checklist. Key points most teams miss:

• Conduct a manual document check, a share code check, or use a certified IDVT provider. Keep clear copies and the check date.
• Expired physical BRPs are not acceptable proof; use an online share code. See: Employer’s guide and checklist on GOV.UK.
  • Employer’s guide to right to work checks (2025): GOV.UK
  • Right to work checklist: GOV.UK

5) Insurance: what to capture and auto‑flag

• Public Liability (PL): usually contractually required; typical limits £1m to £10m. Check the schedule shows the correct trade description, limit, dates and territorial scope.
• Employers’ Liability (EL): legally compulsory if the sub employs anyone; minimum £5m with an FCA‑authorised insurer; certificate must be available on request. GOV.UK
• Professional Indemnity (PI): needed if the sub designs/specifies. Capture the limit and renewal date.
• Record whether “indemnity to principals” is included on PL if your contract requires it.

6) Build a simple status board with expiry reminders

• Minimum viable stack: WhatsApp intake → Make/Zapier → Google Vision OCR → Google Sheets/Airtable dashboard → email/WhatsApp reminders.
• Colour logic:
  • Green: all three areas valid and in date
  • Amber: valid but expiring within 30 days
  • Red: missing or failed
• Send auto reminders 30, 14 and 7 days before expiry with a WhatsApp deep link back to upload.

7) Site access flow that saves time

• Gate the site: supervisors check the dashboard at the start of shift. Only green/amber get access; red must resolve on the spot.
• Keep a fallback: if the app or data is down, scan CSCS via the Smart Check app and visually check paper insurance right at the gate, then update the dashboard later.

Policy and GDPR notes (simple and practical)

• Use a business WhatsApp channel and a shared inbox so messages aren’t stuck on one phone.
• Do a short DPIA covering WhatsApp use, retention and exports. The ICO expects proportionate controls for messaging apps. See ICO guidance on security outcomes and BYOD if staff use personal devices. ICO security outcomes, ICO BYOD.
• Records: export decisions/evidence into your official system. Public bodies also need to consider FOI rules for non‑corporate channels. ICO FOI and messaging apps.
• International transfers: if your provider processes outside the UK, rely on the UK‑US Data Bridge or use the IDTA/Addendum where needed. ICO international transfers.

What good looks like on site

• Induction poster with a QR to the WhatsApp intake and a one‑page checklist of what to send.
• Supervisors brief: how to scan with CSCS Smart Check and what “green/amber/red” means.
• A3 print‑out of the week’s expiries on the noticeboard.
• Random spot checks once a week using the Smart Check app and visual insurance review.

Troubleshooting and edge cases

• No signal at the gate: take photos and complete checks once connected; use the Smart Check desktop portal in the office.
• Card won’t scan: try NFC, then manual entry. Some schemes require manual lookup.
• Right to work is complex: if in doubt, escalate to HR with the official GOV.UK checklist and keep the worker off site until cleared.
• Insurance schedule doesn’t match the trade or has a low limit: reject and request a corrected schedule or broker letter.

FAQs

• Can WhatsApp messages be binding for construction jobs? Yes, UK courts have said WhatsApp exchanges can form contracts if the core elements are present. Add “Subject to contract” when negotiating to avoid accidental agreements. See Jaevee Homes v Fincham coverage at Construction Management and analysis by Osborne Clarke.
• Which app should I use to check CSCS cards? Use the CSCS Smart Check app or the desktop portal. It covers CSCS‑logoed schemes. CSCS Smart Check.
• What right to work documents are acceptable? Follow the Home Office employer’s guide and checklist. Guide and Checklist.
• Do subs legally need Public Liability insurance? It’s not a legal requiremen…