Digital Skills Passports: Portable, Verifiable Proof of Competence

Here is an unpopular view for a post about digital skills passports: a passport will never tell you whether someone is competent to do the job you are about to give them. It wasn't built to. It tells you who the person is, which schemes and qualifications they hold, and whether those are in date. Whether that adds up to competence for your task, on your site, is still your decision, and the law still expects you to make it.

That isn't an argument against passports. They are one of the most useful things to happen to workforce compliance in years. But almost every page written about them is written by an issuer or a vendor, and they all stop at the same place: the worker taps a phone, the gate goes green, job done. The interesting part starts after the tap.

A digital skills passport is a portable, verifiable record of a worker's identity, qualifications, training and card-scheme status that the worker holds and carries from employer to employer, usually in a phone app with a QR code the issuer can check in real time. It removes paper checks and makes fake cards harder to use. It does not replace the employer's legal duty to satisfy itself that a person is competent for a specific role. It is evidence for that decision, not the decision itself.

What a Digital Skills Passport Actually Holds

The best-known UK example is the construction industry's. CSCS describes the digital card in its My CSCS app plainly: “the digital card shows employers an individual's photograph, qualifications, training, occupation and the card's expiry date”, and every digital card can be checked through CSCS Smart Check “using a dynamic QR code or via manual entry”.

Alongside the card sits a section called My Skills. CSCS says My Skills is where workers “can upload any additional training or courses that sit outside of the card itself”: site management courses such as SMSTS and SSSTS, CPD certificates, toolbox talks and inductions. Card plus extras is what people mean when they say “passport”.

Other sectors have built their own. Rail has Network Rail's Sentinel, which offers “one card per person” with competences embedded and “automatic alerts when cards have expired or the individual is suspended”. Utilities has SkillGuard, run with EUSR, in which “each worker has their own up-to-date record, moving with them as they work across various locations”. The technical idea underneath many of these is what the W3C calls a verifiable credential: “a tamper-evident credential whose authorship can be cryptographically verified”.

Whatever the badge on it, a working passport should answer four questions about the person in front of you:

• Is this really the person the record belongs to?
• Which qualifications, tests and scheme cards do they hold, and who issued them?
• Are those still in date, and has anything been suspended or revoked?
• Which parts of the record has the issuer verified, and which has the worker simply uploaded?

Notice what isn't on that list: can they do this job here? That question belongs to someone else.

Passport, Card, Matrix, CPD Log: Four Records That Get Confused

Much of the confusion around passports comes from people using one word for four different records. They overlap, but they have different owners and different jobs.

• A scheme card (CSCS, CPCS, ECS and so on) is a threshold. CSCS itself says cards display a competency threshold that “in most cases… equates to a qualification and the appropriate level of health and safety test”.
• A skills passport wraps the card with extra certificates and makes the whole thing portable and checkable.
• A skills matrix is the employer's view: every role's requirements against every person's verified status. We've covered what a skills matrix is and how to lay one out separately.
• A CPD log records ongoing learning, usually to keep a professional registration. See CPD compliance tracking for how that differs again.

The passport belongs to the worker and travels. The matrix belongs to you and stays. You need both, and the mistake is treating the first as if it were the second.

The Duty That Doesn't Travel With the Worker

This is the part vendor pages skip, and it's the part your auditor or principal contractor cares about most.

Under CDM 2015, regulation 8(3) says anyone appointing a designer or contractor “must take reasonable steps to satisfy themselves” that they have “the skills, knowledge and experience” needed for the role. The Building Regulations competence provisions that came in with the Building Safety Act go further. Regulation 11F(1) requires anyone carrying out building or design work to have “the skills, knowledge, experience and behaviours necessary”, and regulation 11E(2) says that before permitting someone to work, the person in charge “must take all reasonable steps to satisfy themself” that they meet it, or that they are in training and supervised.

Read those two duties side by side and a pattern jumps out. The duty sits on the person doing the appointing. A passport is excellent evidence to put in front of that person, but nothing in the wording lets you hand the judgement to a card scheme. “They had a valid card” is a good start to an answer. It isn't the whole answer.

There's a second, quieter provision. Regulation 11I(1) says that where a person “ceases to satisfy the requirements in regulation 11F(1)” they must notify. Competence can lapse between scans. A passport shows the state of the record when you checked it. Your system has to catch what happens afterwards.

None of this is new, by the way. It is the principle behind HSE's own definition of competence, and the one we set out in our guide to skills compliance: training is an input, applied ability is the test. Passports make the inputs easier to check. They don't move the test.

Reading a Passport at the Gate: Five Checks

If you're the one accepting passports, from your own people, agency staff or subcontractors, this is the sequence that turns portable evidence into a decision you can defend.

1. Verify through the issuer, don't just look

A card on a phone screen can be faked as easily as a plastic one. CSCS is blunt about this: “visual checks aren't enough to spot fake, fraudulently obtained, or revoked cards”. Use the scheme's own checker every time. Take-up is growing: CSCS reports more than 11 million card checks across 440,000 individual cards in the first half of 2026.

2. Separate what's verified from what's uploaded

A scheme-issued qualification and a photo of a certificate the worker added themselves are not the same kind of evidence. Treat self-uploaded entries the way you'd treat a CV: useful, worth checking at source before you rely on them for anything safety-critical.

3. Map the passport to the role, line by line

Hold the record up against the role's requirements. Where the role needs a card, a plant category, a site-specific induction and a client's own permit training, tick off what the passport covers and list what it doesn't. The gaps are usually local: the things no national scheme could know about.

4. Close the gaps before work starts

Deliver the induction, assess the plant skill, arrange supervision for anyone still in training (which regulation 11E(2) explicitly allows for). Record each one against the person, not in a sign-in book that nobody will find at audit.

5. Record the decision and set a recheck date

Who checked, when, against which requirement, and what you decided. Then set the date you'll look again, based on the earliest expiry in the passport or your own revalidation cycle, whichever comes first.

Where Passports Let You Down

Almost every passport problem I've seen falls into one of five patterns. None of them is a reason to avoid passports. All of them are reasons to keep your own record.

The scheme changes, or disappears

Schemes aren't permanent. The NHS Digital Staff Passport, which moved identity, right-to-work, DBS, training and occupational health information between trusts, “was retired on 5 December 2025 and is no longer in use”. Rules change too: Build UK reported that the initial validity of the CSCS Labourer card “will be reduced from five to two years”. If your only record of someone's status lived in a scheme's app, you'd be rebuilding it.

Competence lapses between scans

A green result at 7am says nothing about 2pm next Thursday. Sentinel pushes expiry and suspension alerts; not every scheme does, and your own internal authorisations won't be in any scheme at all.

Agency and subcontract workers fall between two records

In SkillGuard, “employers and other authorised third parties populate the system”. That works while everyone knows who the third party is. With agency labour and two or three tiers of subcontract, it's easy for everyone to assume someone else kept the record up to date. Our piece on how tier-one contractors audit supply-chain competence covers what principal contractors now ask for.

Not everyone has a smartphone to hand

A digital passport assumes a phone, a signal and a charged battery at the gate. Physical cards are still being verified alongside digital ones, and any process you design should work for the worker who turns up with plastic.

“It travels with me” is not a legal guarantee

People sometimes assume data protection law makes all their competence records portable. It doesn't, quite. The ICO explains that the right to data portability covers “personal data they have provided to a controller”, and only applies where the lawful basis is consent or contract and processing is automated. It also notes that data you use to create a profile is not in scope. My reading: the certificates a worker uploads may travel; your assessments of them usually won't. That's another reason the employer's record matters.

Beyond Construction

Construction has the most visible passports, but the idea is spreading. Rail and utilities already run passport-style schemes. Healthcare tried and stepped back. And the government has signalled interest: the October 2025 Post-16 Education and Skills White Paper says Skills England will “explore the development of skills passports”, including testing them in Jobs and Careers Service pathfinder areas.

So if you employ people in care, manufacturing, logistics or engineering, expect workers to arrive with some form of portable record sooner or later. The five checks above apply whichever scheme it comes from.

Your First 30 Days of Accepting Passports

You don't need a big programme. You need a clear rule for what a passport is allowed to prove, and a place to record everything it can't.

• Week 1: list the schemes you'll accept. For each, note what the issuer verifies and how you'll check it (app, API, manual lookup).
• Week 2: write role requirements that separate “scheme” from “local”. For every role, mark which requirements a passport can satisfy and which only you can: site inductions, equipment authorisations, client rules, supervised sign-offs. A mandatory training matrix is the natural home for this.
• Week 3: run the five checks on one site or team. Record every decision against the person. Time it. Note where the passport saved effort and where it didn't.
• Week 4: set recheck rules. Earliest expiry wins. Add triggers for suspension alerts, role changes and new equipment. Our guide to validation and revalidation at scale covers the triggers in detail.

At the end of the month you should be able to answer, for anyone on site: what their passport showed, what you added, who decided they were fit to work, and when you'll look again.

Where StaffCircle Fits

StaffCircle isn't a passport scheme and doesn't try to be. It's the employer-side record that the passport feeds into. What follows describes our own product pages, so check it against your own rollout.

Role requirements the passport can be checked against

Our training compliance product defines skills, knowledge, experience and behaviours per role across five competence levels, which gives you the list to hold a passport up against in check three. The competency framework tools help build those role standards in the first place.

A point-in-time record of who checked what

The product is designed to keep a retrievable record of who is trained, to what level, when it expires and who signed it off. That is the regulation 11E “reasonable steps” trail in one place, rather than scattered across gate logs and inboxes.

Expiry and revalidation alerts, including for local requirements

Automatic revalidation reminders and high-risk role flagging cover the requirements no national scheme holds: your inductions, your authorisations, your client's rules. For frontline teams, the mobile app puts records in front of people who never sit at a desk.

Final Thoughts

Digital skills passports are worth embracing. They make fraud harder, cut repeat paperwork and give workers ownership of their own record. Just be clear about the division of labour. The passport proves the person. You prove the fit, and you keep proving it after the gate.

If you'd like to see how StaffCircle holds the employer side of that record, book a demo.

FAQ

What is a digital skills passport?

A digital skills passport is a portable, verifiable record of a worker's identity, qualifications, training and scheme card status, usually held in a phone app with a QR code the issuer can check. The worker owns it and takes it between employers. It is evidence of competence, not a substitute for the employer's own competence check.

How does the CSCS digital skills passport work?

Workers hold a digital CSCS card in the My CSCS app, showing their photograph, qualifications, training, occupation and card expiry. A My Skills section lets them upload extra courses such as SMSTS, CPD and inductions. Employers verify the card through CSCS Smart Check using a dynamic QR code or manual entry.

Is a digital skills passport the same as a CSCS card?

Not quite. The CSCS card is the scheme credential and shows a competency threshold, usually a qualification plus the right health and safety test. The passport is the wider digital record that holds the card plus additional training and certificates the worker adds.

Does a skills passport prove competence?

No. It proves identity and holdings: qualifications, tests and cards that are in date. Competence under CDM 2015 and the Building Regulations means the skills, knowledge, experience and behaviours needed for a specific role, and the person appointing must take reasonable steps to satisfy themselves of it.

What is the difference between a skills passport and a skills matrix?

A skills passport belongs to the worker and travels between employers. A skills matrix belongs to the employer and maps every role's requirements against every person's verified status. You use the passport as evidence and the matrix to see whether that evidence covers the role.

Can employers verify a skills passport?

Yes, and they should verify it rather than just look at it. CSCS says visual checks are not enough to spot fake, fraudulently obtained or revoked cards. Use the issuing scheme's own checker, such as CSCS Smart Check or Sentinel for rail, every time.

Are self-uploaded certificates in a passport verified?

Treat them as unverified unless the scheme says otherwise. Scheme-issued qualifications and tests are checkable by the issuer; a photo of a certificate a worker uploads is closer to a CV entry. Check it at source before relying on it for safety-critical work.

Is a digital skills passport mandatory in the UK?

There is no general legal requirement to hold one. Individual sites and clients may require a particular scheme card or passport as a condition of access, and the October 2025 Post-16 Education and Skills White Paper says Skills England will explore the development of skills passports.

Who owns a skills passport, the worker or the employer?

Most schemes are designed around the worker holding their own record. The employer still keeps its own records of checks, inductions and assessments, and those do not automatically travel with the worker when they leave.

Does GDPR mean my competence records move with me?

Only partly. The ICO says the right to data portability covers personal data an individual has provided, where processing is based on consent or contract and carried out by automated means. Data used to create a profile is not in scope, so an employer's own assessments usually stay with the employer.

Does the NHS still use a digital staff passport?

No. NHS England's Digital Staff Passport, which moved pre-employment checks, core skills training and occupational health information between trusts, was retired on 5 December 2025 and is no longer in use.

Which other industries use skills passports?

Rail uses Network Rail's Sentinel, with one card per person and alerts for expiry or suspension. Utilities uses SkillGuard with EUSR, where each worker's record moves with them across locations. Healthcare, care and other sectors are exploring similar approaches.

What should happen when a passport credential expires?

The worker should not carry out work that depends on it until it is renewed or an alternative is in place. Set your recheck date from the earliest expiry in the passport or your own revalidation cycle, whichever comes first, and act on scheme suspension alerts.

---