CDM 2026 Guidelines: How to Start Compliance from Concept to Handover

CDM 2026 Series — Topic 1 of 52. This is general industry guidance and should be read with current legislation and DOSH directions.

Quick answer

Malaysia’s Guidelines for the Occupational Safety and Health (Construction Work) (Design and Management) Regulations 2024, 2026 Edition explain how industry should implement the CDM Regulations that came into force on 1 June 2024. The central change is that occupational safety and health can no longer be treated only as a site matter. Risks must be eliminated or reduced while the project scope, budget, programme, design, construction method and future maintenance can still be influenced. Clients, designers and contractors must coordinate their decisions and leave usable evidence for the next party in the project chain.

Why these guidelines matter to industry

The CDM Regulations place risk management across the project lifecycle. The pre-construction phase includes any period when design or preparatory work takes place—and it can continue during construction whenever the design changes. Design risk management therefore does not end when drawings are first approved.

The JKKP/DOSH 2026 guidelines have four main functions:

1. provide an implementation reference for the Occupational Safety and Health Act 1994 [Act 514] and the CDM Regulations;
2. assist enforcement officers in carrying out their duties;
3. help every duty holder understand and carry out their responsibilities; and
4. replace the 2017 and 2020 construction-industry management guidelines as the current reference.

The guidelines connect Pre-Construction Information (PCI), the Construction Phase Plan (CPP), Design Risk Assessment (DRA) and the Safety and Health File so that risk information moves with the project instead of being trapped in separate folders.

Figure 1: Four control gates and the compliance evidence that travels with the project.

Who must act

• The client influences the project outcome, time, funding and management arrangements. The client must ensure suitable parties are appointed and relevant information is available.
• The construction work designer (CWD) includes anyone who prepares or modifies drawings, specifications, bills of quantities, materials, plant requirements or design calculations. A contractor or client can also become a designer when making design decisions.
• The principal construction work designer (PCWD) coordinates safety and health during the pre-construction phase where more than one contractor is—or is reasonably expected to be—involved.
• The principal construction work contractor (PCWC) plans, manages, monitors and coordinates the construction phase.
• Construction work contractors (CWC) control risks created by their own work and cooperate with other parties.
• Workers and self-employed persons must receive information, instruction, training and meaningful opportunities to participate in decisions affecting their work.

An organisation’s job title does not determine its legal function by itself. Actual work and control must be mapped. For example, a design-and-build contractor that changes a steel connection is performing a design function as well as construction work.

Project compliance workflow

1. Determine CDM scope at the project idea stage

Record why the proposed work is or is not a project and construction work under the Regulations. Construction work is broadly defined and can include construction, alteration, installation, commissioning, refurbishment, specified maintenance, decommissioning, demolition, site preparation, installation of prefabricated elements and permanent mechanical or electrical services.

2. Map the duty holders

Prepare a one-page matrix identifying the organisation, its CDM function, the accountable person, decision authority and required deliverables. Review it whenever work packages, appointments or the design change.

3. Establish management arrangements that can be tested

Set decision gates rather than relying on a general policy. Useful gates include client-brief approval, PCI acceptance, closure of critical design risks, authorisation to start construction, post-change review and acceptance of the Safety and Health File.

4. Assemble and issue usable PCI

PCI must be relevant, sufficiently detailed and proportionate to the risk. It may cover utilities, ground conditions, existing structures, hazardous materials, operational constraints, access, traffic, design hazards and information from an existing Safety and Health File. A list of documents that does not identify information gaps is not enough.

5. Apply the General Principles of Prevention in design

Eliminate hazards first. Where elimination is not reasonably practicable, reduce risk at source and prioritise collective protection before procedures or personal protective equipment. Keep a concise record of the decision and rejected options so later teams can understand its basis.

6. Ensure the CPP is ready before construction starts

The CPP must be project-specific. It should describe contractor coordination, principal risks, welfare, induction, traffic, emergency arrangements and monitoring. It must evolve as the work sequence or hazards change.

7. Build the Safety and Health File throughout the project

Do not wait for handover. Identify the file owner, format, folder structure, naming convention, version control and acceptance process. Retain information useful for future construction or maintenance—not every project record without selection.

8. Treat design changes as a new pre-construction cycle

When the design changes during construction, reactivate the relevant PCI, DRA, PCWD–PCWC coordination, CPP and Safety and Health File reviews. A change should not reach the workface through an oral instruction alone.

Minimum evidence that should be available

Electronic documents are acceptable when they can be retrieved or reproduced when required and are protected from loss or unauthorised interference.

Practical example: a logistics warehouse in Selangor

Situation. A client plans a two-storey warehouse with offices, rooftop solar and a tight operational opening date. The original procurement programme allows detailed design and earthworks to overlap.

Early risks. The team identifies underground cables, soft ground, lorry movements near a public road, prefabricated structural installation, roof-edge work and future access to solar panels.

Design decision. The PCWD runs a DRA workshop with the structural engineer, architect, M&E designer and prospective PCWC. The solar service route is moved away from the edge, permanent maintenance anchors are specified, the lifting zone is separated from pedestrian routes, and space for excavation support is reserved in the logistics plan.

Client decision. The client adds mobilisation time for utility verification and temporary-works design. PCI is issued with an information-gap register rather than as an unstructured drawing folder. Excavation is not authorised until the CPP addresses support, water, access, inspection and post-rain response.

Change during construction. A supplier proposes heavier solar units. The change is not released directly for installation. The engineer verifies structural capacity, the PCWD updates the DRA, the PCWC revises the lifting and roof-control arrangements, and the load and access information enters the Safety and Health File.

Demonstrable result. The project has a decision trail from the client brief through drawings, the CPP and handover file. An audit can identify who made each decision, what risk changed, which control was selected and who received the information.

Common failures

1. Delegating all CDM activity to the site safety officer even though the client and designers made the earlier risk-shaping decisions.
2. Appointing the PCWD or PCWC after critical design and programme choices have already been fixed.
3. Assuming the pre-construction phase ends when physical construction begins.
4. Treating a site HIRARC as a substitute for design risk assessment.
5. Supplying PCI as a document dump without an index, priorities or information gaps.
6. Using a generic CPP that does not change with the work phase.
7. Compiling the Safety and Health File only during the final week.

A 30-minute review for your next project meeting

• Does the project and its work fall within the CDM Regulations?
• Who are the client, CWD, PCWD, CWC and PCWC based on the work actually performed?
• Does every party have sufficient time, resources, capability and authority?
• Which three risks can still be eliminated through design?
• What critical information is missing from PCI, and who will obtain it?
• Which conditions must be satisfied before construction starts?
• How are design changes received, assessed, approved and communicated?
• Who owns the Safety and Health File, and what has already been accepted?

Where the team cannot show an answer and supporting evidence, create a named action with an owner and closure date.

Compliance references

1. Department of Occupational Safety and Health Malaysia, Guidelines for the Occupational Safety and Health (Construction Work) (Design and Management) Regulations 2024, 2026 Edition, particularly Scope and Application, Regulations 1–3, Parts II–V and the First Schedule.
2. Occupational Safety and Health Act 1994 — Act 514, DOSH 2026 edition.
3. CDM Regulations 2024 — P.U. (A) 147/2024.
4. DOSH, Frequently Asked Questions on the CDM Regulations 2024, updated 29 August 2024.

This article provides general industry guidance. Project requirements must be verified against the legislation, current DOSH directions and project-specific conditions.