The changes may affect organisations that work with subcontractors, self-employed service providers, substitute workers or certain online platforms. They will also bring new requirements around contracts, identity checks and digital compliance.
As a result, many businesses may find that their current right to work procedures and standard commercial agreements are no longer sufficient.
What is changing on 1 October 2026?
Under the current system, employers must check that their employees have permission to work in the UK. When carried out correctly, a right to work check can give the employer a statutory excuse against a civil penalty if the individual is later found to have been working illegally.
The Border Security, Asylum and Immigration Act 2025 extends this framework beyond conventional employment. The relevant provisions are expected to come into force on 1 October 2026, following the publication of a draft Code of Practice on 1 July 2026.
The central change is a broader definition of employment for the purposes of right to work checks. From October, the rules may also cover some individuals providing services under other types of agreement. This may include individual subcontractors and people introduced to clients through certain online matching platforms.
In practice, businesses will need to look beyond their payroll and employment contracts. It will no longer be enough to ask who the organisation employs. They will also need to consider who is personally carrying out work for the business, or through its systems and platforms.
Which working arrangements will be affected?
Traditional employment will remain within the right to work regime, but the rules will extend much further than they do now.
Workers providing services
The new framework may apply where an individual agrees to carry out work or provide services personally, even if they are not formally treated as an employee.
The legal nature of the arrangement will be important. Describing someone as self-employed, a consultant or a freelancer will not automatically place them outside the right to work regime. What matters is how the relationship works in practice and whether the individual is expected to carry out the work themselves.
Individual subcontractors
Certain subcontracting arrangements will also fall within the expanded framework. For example, a company may be hired by a client to provide a service and then engage an individual to carry out some or all of the work. Depending on how the arrangement is structured, that individual may be covered by the new right to work rules.
This will be especially relevant in sectors where subcontracting is common, including construction, cleaning, care, logistics, hospitality, consultancy and facilities management. However, the changes are not confined to particular industries. Any organisation that relies on individual subcontractors should review how those relationships are set up.
Online matching services
Some online platforms may also be treated as employers for the purposes of the right to work scheme. This may apply where a platform connects individual service providers with potential clients or customers. Under the draft Code of Practice, providing an individual’s details through a qualifying online matching service may be enough to bring the platform within the regime.
The change is likely to be particularly significant for gig economy businesses and digital marketplaces that connect customers with drivers, carers, cleaners, tradespeople, tutors, consultants and other service providers.
Liability may extend through the contracting chain
One of the most important changes is the extension of civil penalty liability. Under the new regime, a company could face a penalty even if it has no direct contract with the person who carried out the work.
Take a typical subcontracting arrangement. Company A contracts with a client and appoints Company B to deliver the service. Company B then engages its own workers. If one of those workers does not have permission to work in the UK, both companies could be liable, depending on the circumstances. Where there are further subcontractors, that risk may extend down the supply chain.
Similar rules may apply to online matching services. A platform, as well as the service provider using it, could be exposed if someone working under the arrangement does not have the required immigration status.
Civil penalties can reach £60,000 for each illegal worker. Businesses may also face criminal prosecution, closure orders or the loss of their sponsor licence. For sponsor licence holders, the consequences could be particularly serious. A breach involving a subcontractor or substitute worker may not be treated as a standalone issue. It could also affect the Home Office’s wider assessment of the organisation’s compliance.
Goldman Solutions can review complex supply chains, identify where liability may arise and recommend practical changes before the new rules come into force.
The risk created by substitute workers
The new rules will also have important implications for contracts that include a right of substitution. A substitution clause allows a contractor or self-employed service provider to send someone else to carry out the work on their behalf. From a right to work perspective, this creates an obvious gap: the business may have checked the original contractor but know nothing about the person who actually turns up to do the job.
Under the new framework, a company could be liable if a substitute does not have permission to work in the UK, even where there is no direct contract between the company and that individual. Businesses will therefore need a clear process for approving substitutes and checking their right to work before they start. It may not be enough to leave this entirely to the original contractor. The draft Code of Practice suggests that organisations should have reasonable and proportionate safeguards in place to prevent an unchecked substitute from beginning work.
This will require a review of both the contract and the way substitutions are handled in practice. Businesses should be clear about who must give notice of a proposed substitute, who approves them, who carries out the check, where the evidence is stored and how access to premises or systems is controlled. Where these responsibilities are unclear, the process may need to be revised before October.
Contracts will become a central part of right to work compliance
Under the new regime, carrying out a check may not be enough to protect a company from extended liability. To establish the relevant statutory excuse, businesses may need written contractual terms in place before the work begins.
These terms should address responsibility for conducting right-to-work checks and restrict further subcontracting unless written permission has been obtained. Where further subcontracting is allowed, the same right to work obligations may need to be passed down through each level of the contractual chain.
This is an important point. A general clause requiring a contractor to comply with immigration law may not provide sufficient protection.
Businesses should review contracts with:
- service providers;
- agencies;
- contractors and subcontractors;
- outsourced suppliers;
- online platforms;
- consultants and freelancers;
- organisations permitted to provide substitute personnel.
The contractual position must also reflect what happens in practice. A carefully drafted agreement will be of limited value if the organisation does not monitor compliance or allows workers to be substituted informally.
Employers must confirm who is actually doing the work
The draft Code of Practice gives greater weight to identity verification. Checking that an individual has the right to work will not be enough if someone else ultimately carries out the work. Businesses will need reasonable and proportionate measures to confirm that the person doing the job is the same person whose immigration status was checked.
Depending on the nature of the work, this could involve identity cards, workplace passes, access controls, periodic checks or facial verification technology. The right approach will vary from one organisation to another. A small professional services firm is unlikely to need the same system as a large logistics business or an online platform managing thousands of workers.
The underlying requirement is the same: the organisation must be able to link the right to work check to the person who is actually providing the service.
This may be more difficult where work is carried out remotely. In those cases, businesses should consider how identity will be confirmed after onboarding and what safeguards are needed to prevent account sharing or unauthorised substitution.
New rules for digital right to work checks
Businesses that use digital verification services should also review their current providers. From 1 October 2026, a company relying on a digital verification service to establish or maintain a statutory excuse will need to use a provider listed on the Office for Digital Identities and Attributes register. The provider must also be specifically authorised to carry out right to work checks.
This means that approval for general identity verification will not necessarily make a service suitable for right to work purposes. The position may be less clear where an employer uses a wider background screening company that outsources the identity check to another provider. Businesses should confirm which organisation is actually carrying out the check and whether it has the required authorisation.
The draft Code also introduces greater flexibility for British and Irish identity documents. For digital checks, a British or Irish passport, or an Irish passport card, may be accepted for up to six months after it expires. This may make some remote checks easier, but the process will still need to be completed through an authorised provider.
Goldman Solutions can review your digital checking process, confirm whether your provider meets the new requirements and help update your internal guidance before 1 October 2026.
What should employers do before October 2026?
The first step is to identify every way in which individuals carry out work for the organisation. This exercise should cover more than employees. It should include contractors, individual service providers, workers supplied through agencies, subcontractors, substitutes and individuals introduced through online platforms.
Once the organisation understands its workforce structure, it should assess which arrangements fall within the expanded rules. Contracts should then be reviewed. Businesses should identify whether existing agreements clearly allocate responsibility for right to work checks, control further subcontracting and deal with substitute workers.
Internal policies will also need to be updated. The organisation should decide:
- who conducts each type of check;
- when the check must take place;
- how evidence is recorded and retained;
- who approves subcontractors and substitutes;
- how the identity of the person working is confirmed;
- what happens if a check cannot be completed.
Training should extend beyond the HR team. Procurement staff, contract managers, operations teams, site managers and anyone controlling access to work should understand the new requirements. Finally, employers using digital identity services should confirm that their provider is registered and specifically authorised for right to work checks.
This work should not be left until the end of September. Contract negotiations, supplier reviews, policy updates and staff training can take time, particularly where a business relies on several levels of subcontracting.
Right to work compliance is becoming a business-wide responsibility
Many organisations have traditionally treated right to work checks as part of the HR onboarding process. The changes taking effect in October 2026 will require a much broader approach.
HR may carry out the initial check, but other teams will shape how the arrangement works in practice. Procurement chooses suppliers, legal drafts the contracts, operations controls access to sites and systems, managers may approve substitute workers, and external providers may handle identity verification.
A weakness at any stage can leave the organisation exposed. Businesses should therefore treat the new rules as a company-wide compliance issue rather than a small update to an HR policy. Organisations need to understand who is carrying out work on their behalf, how that person entered the contractual chain and whether their right to work was properly verified.
How Goldman Solutions can help
Goldman Solutions advises UK employers and sponsor licence holders on right to work and immigration compliance.
We can review your workforce arrangements, commercial contracts, internal procedures and digital checking systems. We can also help identify gaps, prepare updated policies and train the employees responsible for implementing the new framework.
The draft Code of Practice may still be refined before October. However, the direction of the reforms is already clear. Businesses will be expected to take greater responsibility for workers across their wider contractual and operational structures.
Waiting until a Home Office inspection or civil penalty notice is received is likely to be too late.
Contact Goldman Solutions to arrange a right to work compliance review and prepare your organisation for the changes taking effect on 1 October 2026.
