New right-to-work rules in force from 1 October 2026: What employers should do now

The Home Office has published its final Code of Practice on preventing illegal working, and a wider right-to-work regime has applied since 1 October 2026. If your business relies on contractors, freelancers, agency staff or gig workers, now is the time to check how these changes affect your current arrangements.

What's happening?

Under the Border Security, Asylum and Immigration Act 2025, the legal definition of ‘employer’ for right to work purposes has been expanded beyond the traditional employment relationship.

Since 1 October 2026, the regime has extended beyond employees to people engaged under worker contracts, individual subcontractors and certain individuals obtaining work through online matching services. Whether a contractor or freelancer is covered depends on the contractual relationship and how the arrangement operates in practice.

The final Code of Practice on preventing illegal working and Employer’s Guide, in force since 1 October 2026, set out how the Home Office expects businesses to meet these obligations. The Home Office has also published its final Code of Practice on avoiding unlawful discrimination and updated right-to-work checklist.

Why does it matter for your business?

This is one of the most significant expansions of right-to-work compliance in recent years. Some worker, subcontractor and platform arrangements that previously sat outside the statutory civil penalty regime are now covered.

The penalty for getting it wrong remains significant, with civil penalties of up to £60,000 per illegal worker. The starting point is £45,000 per worker for a first breach and £60,000 for a repeat breach within three years, before any relevant reductions are applied.

The changes can also create liability further up a contractual chain in certain arrangements. This is most relevant where a business has agreed to provide work or services to a third party and uses another employer or subcontractor to deliver some or all of that work.

The employer with the direct contractual relationship remains responsible for carrying out the right-to-work check. The new rules don’t automatically transfer that responsibility to every other business in the chain or make them liable simply because the direct employer failed to complete a check.

However, where the extended-liability provisions apply, businesses further up the chain may need written contractual protections, audit rights and verification processes to establish their own statutory excuse.

The rules don’t generally apply to a business simply purchasing services or agency labour for its own internal operations. For example, the final guidance indicates that a company using temporary agency workers within its own workforce wouldn’t ordinarily take on responsibility for their checks. That responsibility would remain with the employment business that engages them.

The final guidance also confirms that genuine independent businesses - including individuals operating in their own name or through their own company and entering into typical business-to-business contracts to provide goods or services - are outside the scheme. The contractual label is not conclusive, however; businesses should consider how the arrangement operates in practice.

What about substitution clauses?

Where a contract allows a worker to send someone else in their place, businesses shouldn’t treat the right-to-work check as a one-off exercise involving only the original contractor.

To establish a statutory excuse, the business needs processes ensuring that:

• a prescribed right-to-work check is completed for every substitute
• no substitute starts work before their right to work has been verified
• responsibility for the check isn’t delegated to the original worker
• the person carrying out the work is the individual whose right to work was checked
• the contract allows appropriate action where illegal working is identified

In practice, businesses may need to require advance approval of substitutes and introduce proportionate identity checks to confirm who is actually carrying out the work.

What about existing arrangements?

The transitional rules differ depending on the type of liability involved. For workers engaged under a worker’s contract, individual subcontractors and individuals obtaining work through an online matching service, the expanded civil penalty regime applies where the relevant employment or engagement begins on or after 1 October 2026.

For businesses potentially caught by the extended-liability rules further up a contractual chain, the prescribed requirements for establishing a statutory excuse apply where the relevant contractual arrangements are entered into on or after 1 October 2026. Businesses should therefore review onboarding for engagements beginning on or after that date and any new or renewed contractual arrangements, as well as mapping existing supply chains so responsibility is clear before further contracts or engagements begin.

What should businesses do now?

With the new rules now in force, businesses should:

• map how work is delivered across the business, including through workers, individual subcontractors, employment businesses, service providers and online platforms
• identify which party has the direct contractual relationship with each individual and responsibility for completing the check, and review contracts with agencies, subcontractors and platforms where the extended-liability rules may apply. The prescribed terms may need to cover right-to-work obligations, prior written consent to further subcontracting, equivalent obligations further down the chain, audit and enforcement rights, and cooperation with any Home Office investigation.
• review any substitution clauses and introduce a process for approving and checking substitutes before they begin work.
• check that any provider used for digital right-to-work checks is registered on the statutory digital verification services register and is approved for Right to Work services.
• brief HR, procurement and hiring teams, so everyone understands the new requirements and where responsibility sits.
• check their processes against the final Code of Practice, Employer’s Guide and right-to-work checklist.

The new regime doesn’t affect every contractor, agency or outsourced service arrangement in the same way. Understanding the contractual structure is the first step in deciding whether checks are required and which business needs to carry them out.

Reviewing arrangements now can help avoid rushed contract changes, gaps in onboarding and uncertainty over responsibility.

Our business immigration solicitors can review your workforce and supply-chain arrangements, identify which relationships fall within the expanded regime, and help you update contracts and checking processes under the rules now in force.