There is no single compliance checklist for every UK transport operator. The answer depends on the vehicle, service type, passenger capacity, route, jurisdiction, licence, staff, data processing, and contract. A home-to-school coach, a closed employee shuttle, and a registered local bus service can fall within different rules.
Use this page as a source map, not as legal advice or a certificate of compliance. Record the rule you believe applies, the primary source, the evidence held, the responsible person, and the next review date. Confirm uncertain cases with the relevant regulator or qualified adviser.
Sources reviewed: 29 July 2026.
Start with a scope record
Create one record for each materially different service:
| Question | Evidence to retain |
|---|---|
| Who is the legal operator? | Legal entity, licence number, named transport manager, operating centres |
| What service is being run? | Contract, route, timetable, stopping pattern, registration, passenger eligibility |
| Which vehicles are used? | Registration, capacity, first-use date, accessibility status, maintenance schedule |
| Where does it operate? | England, Scotland, Wales, Northern Ireland, Republic of Ireland, or cross-border |
| Who drives and manages it? | Licence and Driver CPC evidence where required, role records, training |
| What passenger and worker data is used? | Data inventory, purposes, lawful bases, notices, retention, processors |
| Which payment or concession scheme applies? | Scheme terms, transaction records, reimbursement evidence |
Do not copy one answer across the fleet without checking that the underlying service and vehicle facts are the same.
PSV operator licence and continuing duties
The public service vehicle operator licensing guide is the central current source for Great Britain. It covers licence types, transport managers, financial standing, operating centres, vehicle safety, and management duties.
For an internal review, confirm:
- the correct legal entity holds the appropriate licence;
- current discs, authorised vehicles, operating centres, conditions, and undertakings match the operation;
- responsibility for notifying the Traffic Commissioner is assigned;
- a maintenance planner covers preventive inspections and statutory testing;
- driver defect reports are made, reviewed, repaired, and retained; and
- vehicles that are not roadworthy are taken out of service.
The guide states that vehicle maintenance records must be kept for at least 15 months. It also requires relevant changes affecting the licence to be reported within 28 days. The separate licence change guidance lists examples, including changes to addresses, operating centres, trading name, transport managers, convictions, legal entity, directors, and shareholding.
Record the exact change, the date the organisation became aware of it, who notified the Traffic Commissioner, and the confirmation received. A calendar reminder cannot replace evidence of the notification.
Drivers and Driver CPC
Check the driver’s licence category, expiry, restrictions, medical requirements, and any route-specific or vehicle-specific training. Driver CPC requirements depend on the work and available exemptions.
For drivers in scope, GOV.UK states that 35 hours of periodic Driver CPC training are required every five years. National and International Driver CPC now have different consequences for where a person may drive professionally, so record the course type as well as the hours.
Do not turn a five-year requirement into a once-per-year assertion. Keep the evidence needed for the driver’s actual qualification period and operational territory.
Drivers’ hours and tachograph duties are separate. Use the current passenger vehicle drivers’ hours guidance for the service and route rather than relying on a generic reminder.
Vehicle accessibility and PSVAR
The Department for Transport’s PSVAR overview explains that the Public Service Vehicles Accessibility Regulations apply in England, Scotland, and Wales to in-scope buses and coaches carrying more than 22 passengers on local or scheduled services. Northern Ireland has separate regulations.
Do not reduce PSVAR to a short equipment list. Determine:
- whether the vehicle and service are in scope;
- whether an accessibility certificate is held;
- whether any exemption or special authorisation applies;
- which wheelchair, boarding, signage, and information provisions apply to that vehicle;
- which driver and conductor duties apply; and
- how defects or unavailable accessibility equipment are handled before service.
Home-to-school coach exemptions changed in 2026. Use the current medium-term exemption page for eligibility, dates, fleet conditions, evidence, and expiry. Do not rely on a copied deadline or an older exemption certificate.
Audible and visible information
The Public Service Vehicles (Accessible Information) Regulations 2023 are distinct from PSVAR. The current operator guidance covers audible and visible route, direction, stop, and diversion information for relevant local services in Great Britain.
Application is phased according to when the vehicle was first used on local services. The guidance states:
- vehicles first used on or after 1 October 2019 must comply from 1 October 2024;
- vehicles first used between 1 October 2014 and 30 September 2019 must comply from 1 October 2025;
- vehicles first used between 1 January 1973 and 30 September 2014 must comply from 1 October 2026; and
- qualifying partially compliant vehicles have a separate 2031 date.
Check the detailed conditions, exemptions, and first-use evidence before assigning a date. The guidance also expects management procedures, staff training, consistent stop names, equipment monitoring, prompt repair, and an audit trail. Installing a screen and speaker is not the complete duty.
Bus Open Data Service
BODS applies to local bus services with stopping places in England, not automatically to every private, school, workplace, or contracted service. The local service operating guide states that in-scope operators must provide:
- timetable data;
- fares data;
- vehicle-location data; and
- historic performance data.
The formats and validation processes differ. Use the BODS implementation guide and the SIRI-VM location guidance when specifying a supplier.
A passenger list, QR pass, private scan log, dashboard, or generic CSV export does not by itself meet these open-data requirements. Require a working feed, current identifiers, validation results, monitoring responsibility, and a correction process.
Passenger and worker data
Transport records can identify passengers, children, parents, drivers, stops, journeys, and boarding times. Start with the ICO’s UK GDPR guidance and resources.
For each processing purpose, record:
- controller and processor roles;
- the information used and why it is necessary;
- the lawful basis and any additional condition for special-category data;
- the privacy information given to each affected group;
- role-based access and supplier access;
- accuracy, correction, retention, deletion, and export;
- security and personal-data-breach procedures; and
- how individual rights requests are recognised and handled.
The ICO’s lawful basis guide states that a valid basis must be selected and documented before processing starts, and explained in the privacy information. Do not state that software is “GDPR compliant” as a substitute for the operator’s own decisions and controls.
If vehicle monitoring can identify a worker, review the ICO’s work-vehicle monitoring guidance. Workers and passengers must be informed, and monitoring during permitted private use will rarely be justified.
Incidents and RIDDOR
Maintain an operational incident process, but do not label every accident as RIDDOR-reportable. HSE’s RIDDOR overview explains who must report and the categories covered. Its reportable incident guidance distinguishes reportable injuries, occupational diseases, and specified dangerous occurrences.
For each incident, record the facts, people involved, immediate controls, investigation, corrective actions, and the basis for the reporting decision. Route an uncertain RIDDOR classification to a competent person rather than relying on a generic checklist.
Concessionary travel and contract-specific evidence
Concessionary reimbursement rules and evidence depend on the scheme and authority. The Department for Transport publishes current English National Concessionary Travel Scheme reimbursement guidance, but it is addressed to travel concession authorities and updated by financial year.
Operators should retain the scheme terms, authority instructions, transaction evidence, reconciliation, claim calculations, correspondence, and correction history that apply to them. Apply the same principle to school, employer, local-authority, and tender contracts: extract the actual reporting and retention obligations instead of assuming a standard passenger-count requirement.
Build an evidence register
Use a register with these fields:
| Field | Example |
|---|---|
| Requirement | Notify relevant operator-licence change |
| Scope decision | Applies to the named licence and legal-entity change |
| Primary source | Current GOV.UK licence guidance and source section |
| Owner | Named role |
| Evidence | Notification, submission date, confirmation |
| Review trigger | Legal-entity, director, address, manager, conviction, or licence-condition change |
| Next review | Date or event |
An effective review ends with an owner and evidence, not a row of untimed check marks.
What MoveCore does and does not cover
MoveCore records QR pass validations with result, time, passenger, and service context for authorised operators. Those records may support an operator’s own boarding review.
MoveCore does not determine whether a service needs a PSV operator licence, satisfy vehicle-maintenance or Driver CPC duties, certify PSVAR compliance, provide audible or visible onboard information, publish BODS data, decide a lawful basis, manage RIDDOR reporting, calculate concessionary reimbursement, or provide legal advice. Its scan log should be treated as one operational record, not a compliance certificate.
If that narrower record is useful to your operation, test MoveCore with one service. Keep the legal and contractual evidence register separate.