Construction Site Access Control: ACS and Law 2026

Main text

In short: construction site access control relies on three mandatory elements.
First - permit-to-work before starting work (Order
Ministry of Labor Order No. 883n, rev. 29/04/2025): without it, there are regulatory orders and criminal liability in the event of an incident.
The second is a fenced site with a checkpoint and access tracking (SP 48.13330.2019, rev. 21.04.2025).
Third - ACS, connected to 1C and ERP so every entry is automatically recorded in the timesheet.
If you deploy biometrics with face recognition, since June 1, 2023 you cannot store original facial data locally: only an encrypted buffer for up to 24 hours and transfer to EBS under 572-FZ - otherwise the fine for a legal entity is 3-18 million RUB.
The cost of inaction is losses of 3-7% of the project budget to theft and false reporting.

Key point

The permit-to-work act is mandatory (Order No. 883n, 2025 version): without it, fines of up to 1 million RUB under Article 9.4 of the Administrative Code for repeat violations and work stoppage apply. Issue it before people enter the site.
Biometrics: local storage of facial data has been prohibited since 01.06.2023 (572-FZ) - fines of 3-18 million RUB for a legal entity, and up to 500 million RUB for a leak (420-FZ); faces are kept in a buffer for up to 24 hours and transferred to EBS.
ACS connected to 1C and ERP reconciles timesheets with actual attendance: entries are recorded automatically, payroll does not grow pointlessly, and manual input disappears.
The ACS market in CIS was worth 16.35 billion rubles in 2024 and is projected to reach 170 billion rubles by 2030: the technology is getting cheaper and is becoming standard, so it is more cost-effective to implement now.

16.35 billion RUBACS market in CIS in 2024; up to 170 billion rubles by 2030 (Securika Moscow forecast)

3–7%of the project budget is lost to theft and padding without access control (2021 estimate)

>300 billion RUBlosses in CIS's construction industry in H1 2025 - an industry benchmark for the cost of inefficiency

What the law requires

Before work begins at an operating facility, a permit-to-work must be issued - this is a direct requirement of occupational safety rules (Order
Ministry of Labor Order No. 883n, recommended form is in the annex to the Rules).
Without it, the company receives orders to correct violations, faces inspection risks, and is liable for the consequences of accidents.
Without access control, money leaks straight out: theft, timesheet padding, fines, and the risk of a work stoppage.
Penalties can reach 1 million rubles under Article 9.4 of the Administrative Offenses Code for repeated violations, including suspension of work for up to 90 days.

Three tasks of access control

Restrict access

Unauthorized people are kept out. The system shows who is on site right now, reducing theft and incidents.

Track working time

You can see who came on shift, when they entered, and when they left. The timesheet no longer diverges from reality.

Control assets

Entry and exit of people and vehicles are recorded, reducing losses of materials and equipment.

2026 regulatory framework: what is required and what it risks

Construction site access control is governed by several documents at once, from occupational safety to fire safety rules. Below are the current 2025 versions and penalties for violations.

Document	What needs to be done	Penalty
Ministry of Labor Order No. 883n (revised 29.04.2025)	Complete the permit-to-work before starting, do not allow people without PPE and safety briefing, and control site entry	Fine for a legal entity: 50,000-80,000 RUB, up to 200,000 RUB for repeat violations; criminal liability in case of injury
SP 48.13330.2019 (rev. 2025-04-21)	Fence the site, set up a checkpoint, keep access logs, and provide vehicle entry and site visibility	Fine of 100,000-300,000 RUB; for endangerment, up to 600,000 RUB or work stoppage for up to 60 days
Fire Safety Rules, Government Decree No. 1479 of 16.09.2020 (revised 03.02.2025)	Site layout at the entrance, fire vehicle access, and for large sites at least two entrances	Fine of 300,000-400,000 RUB, up to 800,000 RUB under a special regime; criminal liability if damage is caused
Article 9.4 of the Code of Administrative Offenses of the CIS	Comply with building codes and design documentation	Fine of up to 600,000 RUB; for repeat violations, up to 1 million RUB or work stoppage for up to 90 days
Article 216 of the Criminal Code of the CIS	Follow construction site safety rules	If there is damage or injury - a fine, forced labor, or imprisonment for up to 7 years
572-FZ (for biometrics)	Do not store original faces locally: buffer for up to 24 hours and transfer to the UBS	Fine for a legal entity: 3-18 million RUB; for biometric data leakage, up to 500 million RUB (Law 420-FZ)

Pass types and access levels

When access control is set up correctly, there is no confusion at the checkpoint: the system records personnel arrivals and departures and controls material movement. Let’s look at the main types of passes on a construction site.

Type	For whom	Medium	Timing and speed
Permanent	General contractor, engineers, key specialists	Card, mobile pass, or face	Indefinite; passage 1-2 sec
Temporary	Subcontractor employees	Card or QR code	For a task (2 weeks to a month); access is closed automatically
One-time	Visitors, inspectors, suppliers	System entry, support	Hours to one day; only with an escort
Material	Import and export of materials and equipment	Plan/actual request	For movement; stock reconciliation without losses
Transport	Specific vehicle	License plate recognition	For entry; passing the checkpoint takes 5-7 sec

Technical means for access control

An access control and management system (ACS) combines employee tracking, access control, and site data. The key is not the turnstiles and cameras themselves, but how they pass events to other programs: connected to 1C and ERP ACS records working time, updates access rights, and removes manual entry.

How a pass becomes a timesheet entry

The path of one entry: from card to timesheet

Event

Presented a card or face1-2 seconds, the turnstile opened

Logging

Checkpoint controllertime and employee ID

ACSaccess and briefing check

Accounting

1C / ERPtimesheet entry automatically

Managerhow many people are on site right now

One entry, and the data flows straight into the timesheet: security does not enter anything manually, and managers see the site's actual workload.

ACS as the integration core, not a set of devices

Value comes not from hardware, but from connected systems: access events from ACS flow into 1C and ERP, video surveillance, the construction management platform, and the national biometrics system EBS.

Biometrics on site: where to legally store facial data

A card or QR code can be easily handed to someone else, but a face cannot: the system identifies an employee in 1-2 seconds, and with helmets and gloves it is also more convenient than a card.

But biometrics have a separate legal framework

Since June 1, 2023, commercial operators have been prohibited from storing original biometric data locally: face data may be kept in an encrypted buffer for no longer than 24 hours and transferred to

the Unified Biometric System (EBS).

A local ACS with face recognition without transmission to the UBS is already a violation.

Before enabling biometrics, determine which fields in the process are personal data and complete the required documentation personal data processing and technical information protection to meet legal requirements.

No local storage - only buffer and UBS

The face image cannot be stored on site: the law allows only a short encrypted buffer and transfer to the EBS.

The cost of a biometrics mistake

Local storage of faces without transmission to the UBS violates 572-FZ: the law allows only an encrypted buffer for up to 24 hours and exchange with the state biometric system.

3-18 million RUB · up to 500 million RUB fine for a legal entity for violations in handling biometrics (from 30.05.2025) · liability for biometric data leakage under Law 420-FZ

Since June 1, 2023, commercial operators have been prohibited from storing original biometric data locally - the data must be sent to the Unified Biometric System; only an encrypted buffer for up to 24 hours is allowed.
For a repeat violation, the fine can reach 20 million RUB and operations may be suspended for up to 90 days.
The fines apply to the handling and leakage of biometric data (Law 572-FZ, 420-FZ), not to access control itself - but biometrics at the entrance makes the construction site the operator of that data.

Five steps to launch access control

01
Site audit and flow calculation
Mark entrances, driveways, and equipment zones, assess peak load, and set access levels. Accurate site audit determines the number of turnstiles, passage width, and server capacity.
02
Access control regulations
Approve local rules: which passes are issued and how they are revoked, how people and vehicles enter, and how materials are accounted for. For biometrics, obtain consent to process personal data.
03
Choosing equipment and a contractor
Choose outdoor-rated equipment (dust, vibration, temperature swings) and a contractor with experience integrating ACS, 1C, and construction management platforms.
04
Installation and integration
Install the equipment together with the fencing, connect the ACS to HR records and video surveillance, and run a 3-5 day pilot.
05
Training and launch
Train gatehouse operators and administrators, appoint a responsible person for oversight, and conduct regular rule audits.

Five common mistakes

Starting with equipment purchases without an audit. First analyze the site and calculate traffic flows, then determine the number of turnstiles, passage width, and server capacity.
No integration with accounting systems. Integration with 1C, ERP, or a construction platform eliminates manual transfers: the system closes timesheets automatically and prepares amounts for payment.
No procedure with subcontractors. Require up-to-date lists 48 hours before the shift so you can open and block access on time.
Savings on servers and connectivity. A server with backup power, stable internet, and local caching in case of connection loss.
Untrained checkpoint staff. Practice routine and emergency scenarios and cross-check them with CCTV recordings.

Digital construction site pass: the Samolet Group experience

The Samolet Group has dozens of sites and thousands of workers.
Passes used to be issued manually, taking up to 15 minutes per person; when contractors changed, access was not closed on time, and payroll grew without actual workload.
The developer implemented the 10D Pass module from the 10D Platform ecosystem: online requests, instant access approval, QR-code passes, and an online headcount tracker on site.
Loading employee data into a single database, document verification, and automatic access deactivation after contract expiration eliminated manual routine work. In July 2025, "10D Pass" was moved to OVISION biometrics with Face ID and integrated with
by the regional segment of the Unified Biometric System (RS EBS) and
the AIS Digital Twin builders registry - with declared compliance with 572-FZ and the requirements
The system recognizes a face and blocks entry with someone else's badge.

15 -> 5 minprocessing: previously one person at a time, now one request for up to 50 at once

−90%office workload

3 days -> 4 htime to close access tasks

Sources

Verified on 08.07.2026.

Topic	Source
ACS market and forecast	ru-bezh.ru/infografika/skud-dokazyvaet-svoyu-sostoyatelnost
Forecast up to 170 billion RUB (Securika Moscow 2025)	ru-bezh.ru/meropriyatiya/news/25/04/25/rost-do-170-mlrd-rubley-na-securika-moscow-sdelali-prognoz-razvi
ACS trends, biometrics, cloud	securtec.ru/company/news/2025/budushchee-skud-tsifrovizatsiya-biometriya-i-oblachnye-tekhnologii/
Fire Safety Rules, Government Decree No. 1479	consultant.ru/document/cons_doc_LAW_363263/
Repeal of Government Decree No. 390 since 01.01.2021	kritery.ru/news/39
Ministry of Labor Order No. 883n (revised 29.04.2025)	consultant.ru/document/cons_doc_LAW_372506/
SP 48.13330.2019 (rev. 2025-04-21)	base.garant.ru/73866924/
SP 48.13330.2019, 2025 update	meganorm.ru/mega_doc/norm_update_05072025/akt_forma/0/sp_48_13330_2019_svod_pravil_organizatsiya_stroitelstva_snip.html
GOST 21.205 - symbols, not a permit-to-work act	docs.cntd.ru/document/gost-21-205-93-spds
572-FZ: Working with biometrics without fines	itgsecurity.ru/blog/how-to-avoid-fines-under-federal-law-no-572-when-working-with-biometrics
Personal data processing in the UBS	b-152.ru/regulirovanie-obrabotki-personalnyh-dannyh-v-ebs
Biometrics fines 2025-2026	vitvet.com/about/news/biometricheskie-dannye-biznes-shtraf-ebs-2026/
OVISION case on construction sites	ovision.ru/tpost/mcz7e0a4y1-biometricheskii-skud-na-stroiploschadkah
Access to Construction Sites, 10D Pass + RS EBS (July 2025)	cnews.ru/news/line/2025-07-29_prohod_na_strojploshchadki
Losses in CIS's construction industry in H1 2025	gd.ru/news/21979-ubytki-stroitelnoy-otrasli-rossii-za-pervoe-polugodie-2025-goda-prevysili-300-mlrd-rubley

Site access control: physical access systems, the law, and biometrics in 2026

Main text

What the law requires