THE McLAREN WAY: BUILDING BEST PRACTICE BEFORE IT WAS REQUIRED.

Tom Gothard, Senior Digital Implementation Manager at McLaren, has spent three years at the business and over two of them working with innDex. As the principal contact for the relationship, he's been at the centre of how the platform, together with PPAC's identity and right to work verification, has been rolled out across McLaren's projects.

“It's part of a response to the Building Safety Act,” Tom explains, “and having that better oversight of competencies across our whole supply chain.” Before innDex and PPAC, McLaren, like much of the industry, relied on a mix of suppliers and mostly online inductions, without the same level of scrutiny of data at a group level. Getting the details right, matching a worker's competency to their job role, could mean a corrective process that ate into the morning induction and delayed people getting to work.

The decision to expand PPAC's use across the whole business came from what the data showed McLaren, rather than any failing. As the team puts it, the exercise gave McLaren real visibility of its supply chain for the first time and let it make a positive, informed decision to broaden its use of the tool everywhere. It's a subtle but important distinction, and one that captures what proactive best practice actually looks like in construction: not waiting to be told something needs fixing, but using the information available to build something better.

FROM TRIAL TO COMPANY WIDE: SCALING WITH PURPOSE.

PPAC was first trialled at a single site in 2024, running as a standalone tool alongside innDex. Once the trial had proven itself and the lessons had been learned, McLaren made the call to roll it out across the business. The scale of that expansion is one of the more striking parts of the story: in around six months, the project went from 10 trial sites to close to 40.

That kind of growth could easily have been chaotic, but McLaren's rollout wasn’t. The team built a structured, three phase approach: preparation, communication and deployment. Preparation meant understanding the size, client, access and culture of each project. Communication meant supply chain briefings, DABS meetings and site inductions, with every site spoken to twice before deployment began. Deployment itself was tailored to each project, based on its start date and how long it had already been running.

Switching a project on took no time at all technically, but bringing the whole team along took longer and mattered more. Across a full project rollout, the deployment itself took around 4 weeks, while the wider education process, embedding the habit and understanding across the business, took closer to 12 months. Today, that work is done. PPAC and innDex are switched on by default on every new McLaren project, no conversation needed about whether to include it.

HOW THE PROCESS WORKS.

For workers, the process is straightforward. During their induction, they're asked for their PPAC code. If they don't have one, they're guided to PPAC, where their identity and right to work are verified through a combination of document authenticity checks, a face match, and validation of visas or share codes, including working with third parties for student and sponsorship visas where needed. Once verified, a code is passed back into innDex to complete the site specific induction, and the process ends with a final face check when the worker arrives on site.

Crucially, very little data actually moves between the two systems. innDex never holds documents or biometric information, only the verification code that confirms someone has been through the process. McLaren chose to add an extra layer on top, using on-site facial recognition against the uploaded documents, closing the loop between a worker's identity, their right to work, and their competency to be on site. Workers only need to complete PPAC once to work across every McLaren project and site.

The scale of what's now running through the system speaks for itself. To date, more than 27,000 submissions have gone through PPAC for McLaren, with around 2,300 in the last month alone, typically the quietest time of year for construction.

A COLLABORATIVE FEEDBACK LOOP.

Part of what made this possible in the timeframe was the fact that neither innDex nor PPAC needed to build something from scratch. Both are already established, proven products, and because innDex runs on modern, current code rather than legacy systems, changes could be made quickly in response to real feedback from site. That agility, and the working groups set up between McLaren, innDex and PPAC, meant the worker experience kept improving throughout the rollout.

That confidence has filtered down to project teams too. Where once there might have been uncertainty about enforcing the process, teams now feel fully backed to hold the line. If someone hasn't completed their PPAC check, the answer is simple: come back when you have.

BRINGING THEIR SUPPLY CHAIN ON THE JOURNEY.

No change of this scale happens without a bit of friction along the way, and McLaren was upfront about where it came from. The main resistance wasn't from business owners, who largely got behind the process quickly, but cultural, particularly among British workers who weren't used to digital identity checks and worried about what the data was being used for.

McLaren met that head on with education, explaining clearly why the checks mattered, the legal basis behind them, and the safeguards in place to protect people's data. The team worked closely with McLaren's information security and data protection manager to make sure every question was answered properly and consistently. On the supply chain side, around 90% of subcontractors were supportive from early on, recognising it as a process that needed to happen rather than something being imposed on them.

A large part of that smooth adoption comes down to having the right person driving it internally. Having someone like Tom, who owns the process, understands it inside out, and can answer questions from site teams and subcontractors alike, has made a measurable difference to how quickly the business has been able to move.

THE BUCK STOPS AT McLAREN.

One of the clearest pieces of thinking behind McLaren's approach is a simple one: whatever happens on a McLaren project reflects on McLaren, not on the individual subcontractor involved. That sense of ownership over the whole supply chain, not just direct employees, is what pushed the business to take responsibility for right to work and identity verification so far upstream.

It also ties neatly into the wider purpose of the Building Safety Act. Verifying someone's identity isn't just a right to work exercise, it's the foundation for knowing that the person turning up to do a job is genuinely the person qualified to do it, with the competencies they say they have. For McLaren, PPAC and innDex together aren't a tick box exercise. They're a genuine deterrent against poor practice and identity fraud across the industry, built into the way the business runs every single project.

READY FOR WHAT'S NEXT.

With the right to work changes landing on 1st October 2026, a lot of the construction industry will be rushing to catch up. McLaren won't be. The business built its approach well over a year ahead of the deadline and before the news of these updates had even been announced, driven not by a looming compliance date, but by a genuine desire to do things properly and protect the people working on its sites.

For McLaren, the changes coming this autumn are simply business as usual. The structure, the education and the McLaren way of methodical, well communicated deployment mean the business is just as compliant today as it will be after the deadline passes. Proactive beats reactive, every time.