New right-to-work rules confirmed from 1 October 2026: What employers should do now

The Home Office has published its draft Code of Practice on preventing illegal working, confirming that a wider right-to-work regime will apply from 1 October 2026. If your business relies on contractors, freelancers, agency staff or gig workers, now is the time to start thinking about how these changes could impact your current arrangements.

What's happening?

Under the Border Security, Asylum and Immigration Act 2025, the legal definition of ‘employer’ for right to work purposes is being expanded beyond the traditional employment relationship.

From 1 October 2026, the regime will extend beyond employees to people engaged under worker contracts, individual subcontractors and certain individuals obtaining work through online matching services. Whether a contractor or freelancer is covered will depend on the contractual relationship and how the arrangement operates in practice.

The draft Code and updated Employer’s Guide set out how the Home Office expects businesses to meet these obligations. Both documents may still change before the new regime takes effect, so businesses will need to check the final versions once published.

Why does it matter for your business?

This is one of the most significant expansions of right-to-work compliance in recent years. Some worker, subcontractor and platform arrangements that previously sat outside the statutory civil penalty regime will now be brought within it.

The penalty for getting it wrong remains significant, with civil penalties of up to £60,000 per illegal worker. The starting point is £45,000 per worker for a first breach and £60,000 for a repeat breach within three years, before any relevant reductions are applied.

The changes may also create liability further up a contractual chain in certain arrangements. This is most relevant where a business has agreed to provide work or services to a third party and uses another employer or subcontractor to deliver some or all of that work.

The employer with the direct contractual relationship remains responsible for carrying out the right-to-work check. The new rules don’t automatically transfer that responsibility to every other business in the chain or make them liable simply because the direct employer failed to complete a check.

However, where the extended-liability provisions apply, businesses further up the chain may need written contractual protections, audit rights and verification processes to establish their own statutory excuse.

The rules don’t generally apply to a business simply purchasing services or agency labour for its own internal operations. For example, the draft guidance indicates that a company using temporary agency workers within its own workforce wouldn’t ordinarily take on responsibility for their checks. That responsibility would remain with the employment business that engages them.

What about substitution clauses?

Where a contract allows a worker to send someone else in their place, businesses shouldn’t treat the right-to-work check as a one-off exercise involving only the original contractor.

To establish a statutory excuse, the business will need processes ensuring that:

• a prescribed right-to-work check is completed for every substitute
• no substitute starts work before their right to work has been verified
• responsibility for the check isn’t delegated to the original worker
• the person carrying out the work is the individual whose right to work was checked
• the contract allows appropriate action where illegal working is identified

In practice, businesses may need to require advance approval of substitutes and introduce proportionate identity checks to confirm who is actually carrying out the work.

What about existing arrangements?

For the newly covered categories, a civil penalty can only be imposed where the relevant worker, subcontractor or online-platform engagement begins on or after 1 October 2026.

That gives businesses time to focus on their future onboarding processes and any new engagements beginning from that date. It will still be sensible to map existing working arrangements so that responsibility is clear before new people are engaged.

What should businesses do now?

Businesses should use the time before 1 October 2026 to:

• map how work is delivered across the business, including through workers, individual subcontractors, employment businesses, service providers and online platforms

• identify which party has the direct contractual relationship with each individual and responsibility for completing the check and review of contracts with agencies, subcontractors and platforms, so they include appropriate checks, audit rights and cooperation obligations where the extended-liability rules apply.
• review any substitution clauses and introduce a process for approving and checking substitutes before they begin work.
• check that any provider used for digital right-to-work checks is registered on the statutory digital verification services register and is approved for Right to Work services.
• brief HR, procurement and hiring teams, so everyone understands what is changing and where responsibility sits.
• monitor the final Code of Practice and Employer’s Guide for any changes to the draft requirements.

The new regime won’t affect every contractor, agency or outsourced service arrangement in the same way. Understanding the contractual structure will be the first step in deciding whether checks are required and which business needs to carry them out.

Preparing now can help avoid rushed contract changes, gaps in onboarding and uncertainty over responsibility as October approaches.

Our business immigration solicitors can review your workforce and supply-chain arrangements, identify which relationships are likely to fall within the expanded regime, and help you update contracts and checking processes before the new rules take effect.