The quality system covers the building site, but not always privacy, information security, suppliers and AI use. See what is often missing.
The quality system covers the building site. Who covers the rest?
Most construction companies have checklists, deviations and job safety analyses in order. But the requirements don't stop at the site fence. Privacy, information security, suppliers and AI use are also required by law – and a quality system rarely covers them.
A common misunderstanding
A quality system is built for projects and the building site: internal control, building applications and HSE.
Regulations that apply to the business as a whole often fall outside it.
What the quality system usually covers
Checklists and self-inspection
Deviations and site inspections
Job safety analysis and risk assessment on site
Procedures under internal control regulations
Documentation for building applications and central approval
What often falls outside
Privacy
records of processing, privacy notice and data processing agreements with system suppliers
Information security
who has access to what, and what happens in a cyber attack
Suppliers
which digital suppliers process your data, and have they been assessed
Transparency Act
due diligence in the supply chain for larger businesses
which AI tools employees use, and which rules apply
Comparison
Area
Quality system (QA/HSE)
Mynder
Checklists, deviations, site inspections
✅ Core
❌ Not the purpose
HSE on site (job safety analysis, risk assessment)
✅ Covered
➖ Working environment at business level
Building applications, construction client regulations, central approval
❌ Not covered
Eco-Lighthouse
Privacy/GDPR (records of processing, data processors)
⚪ Usually not addressed
Information security (ISO 27001, NIS2)
Digital suppliers and data processors
⚪ Subcontractor follow-up concerns quality
✅ Supplier module
Transparency Act (larger businesses)
AI use (AI Act)
Sharing documented status with clients
➖ Per project
✅ Trust Profile for the whole business
Mynder and the quality system work together
Keep the quality system on the building site.
Use Mynder for the business level.
Document once in a Trust Profile, and share it with the client, contractor or auditor when they ask.
Three typical situations
A client asks for documentation on information security in a prequalification.
A customer asks for a data processing agreement or privacy notice.
Employees have started using AI tools without anyone assessing it.
See what you're missing
Frequently asked questions
Does a quality system cover GDPR?
A construction quality system is made for projects and the building site – internal control, building applications and HSE. Privacy, such as records of processing and data processing agreements, usually falls outside and must be documented separately.
Does a construction company need to think about NIS2 and information security?
Every business that uses digital systems needs control of access, suppliers and what happens in a cyber attack. Clients increasingly ask for this in prequalification. Whether NIS2 applies directly depends on the size and sector of the business.
What is the difference between QA/HSE and compliance?
QA/HSE is about quality and safety in the project and on the building site. Compliance at business level concerns regulations that apply to the whole business, such as privacy, information security, supplier follow-up, the Transparency Act and AI use.
Do we have to replace the quality system?
No. Mynder comes in addition to the quality system and covers what applies to the business as a whole.