The Security of Payment Ordinance is a document management problem.

The Construction Industry Security of Payment Ordinance (Cap. 652) came into force on 28 August 2025. It applies to construction contracts with a main contract value of HK$5 million or more, and supply contracts of HK$500,000 or more, entered into on or after that date.

Two things in it matter more than the rest.

Pay-when-paid is gone. Conditional payment clauses of that kind are no longer enforceable. The cash-flow habit a lot of the market was built on has stopped working.

There is now a clock, and it is short. A payment response is due on the earlier of the payment deadline or 30 days after the payment claim is served. Once a payment dispute arises, the claiming party has 28 days to start adjudication. Once the adjudication notice is served, the nominating body appoints an adjudicator within seven working days.

Why that is a records problem rather than a legal one

Adjudication is documentary. There is no long discovery process and no comfortable adjournment while somebody goes and finds the file. You produce the record you have, in the time you are given, or you argue without it.

So the question stops being do we have the documents and becomes can we produce them, in order, inside a fortnight, without pulling three people off live jobs.

Those are different questions. Most contractors I look at can answer yes to the first and no to the second.

What actually goes wrong

The pattern is consistent enough to be boring.

• Instructions arrive verbally on site and get confirmed by message, which means the confirmation lives on somebody's personal phone
• Drawing revisions are issued by email, so the current set is whatever the last person to look happened to download
• Variations are tracked in a spreadsheet owned by one QS, who is on another job by the time the claim matters
• Site photographs — the best contemporaneous evidence anyone has — sit in a camera roll, undated against any job reference
• Nobody can say with confidence which instructions were issued but never converted into a variation, or how much money is sitting in them

None of that is negligence. It is what happens when the record-keeping was designed for an environment where disputes moved slowly.

The legacy problem underneath it

There is usually a second layer. The register that matters is in an application somebody built years ago, or a spreadsheet with twenty years of history in it, and nobody wants to touch it in case it breaks.

That is a solvable problem and it does not always mean replacement. Often the old thing can be made safe, controlled and able to feed a modern system alongside it. But it has to be dealt with deliberately rather than worked around for another two years.

What good looks like

You do not need a new platform for most of this. You need the one you already have set up so the rules are enforced rather than asked for. I do this work on Egnyte^®, as a Value-Added Reseller in their partner programme — and a fair share of the time the licence is already sitting there unused.

Controls at folder level rather than in a procedure document nobody reads. Permissions by group. The registers that matter for your jobs kept as the actual system of record rather than a summary of it. Site staff uploading photographs straight into the job folder from a phone, because they will not do it any other way. External parties sending documents back through upload links, so nothing important arrives as an email attachment.

And a monthly view that puts the money quietly at risk in front of a director, instead of leaving it to surface in a dispute.

Once that structure holds, an AI layer on top earns its keep — search that answers a question rather than matching a filename, classification applied on upload, and contracts or submittals read in bulk with only the exceptions coming to a human. Before the structure holds it is close to worthless, which is why I will usually insist on that order.

The honest bit

This is unglamorous work and it does not photograph well. Nobody has ever been promoted for tidying up a transmittal register.

But the ordinance has changed what slow retrieval costs. It used to be an irritation that surfaced in an audit once a year. It is now a cash problem that surfaces on a 28-day clock, at exactly the moment you are least able to spare the people.

If you are not sure which side of that line you are on, the test is simple enough. Pick a job from eighteen months ago and ask for every instruction issued in one particular month, with the drawing revision current at the time and the transmittal that sent it. Time how long it takes.

If the answer is more than a day, that is the finding.

---

Adam Bell runs Innov8 in Hong Kong. He reviews and rebuilds document management for contractors, and builds secure data rooms for capital and advisory firms — two weeks to findings, roughly ten weeks to implementation.