Right to Work Check Changes From 1st October 2026: What Small Businesses Need to Know
Right to work checks are one of those HR tasks most of us could do in our sleep. Someone new starts, you check their documents or their share code, you take a copy, you file it and you move on.
From 1st October, that changes. And I don't think it's had anywhere near the attention it deserves, probably because the Employment Rights Act has been taking up most of the space in everyone's inbox.
So this week I want to go through what's changing, who it affects and what I'd be doing now if I were running HR in a small or medium-sized business. It's next Thursday, so there isn't a lot of time.
What's changing on 1st October 2026?
Until now, the legal duty to carry out right to work checks has applied to employees. If you engaged someone as a contractor, a freelancer or through a platform, strictly speaking the check wasn't your responsibility.
From 1st October 2026, section 48 of the Border Security, Asylum and Immigration Act 2025 widens that. The duty to check, and the risk of a civil penalty if you don't, will cover people you engage under:
a contract of employment (as now)
a worker's contract
an individual subcontracting arrangement
an online matching service, where a platform matches service providers with clients
The Home Office has published a draft employer's guide, most recently revised on 11th September, if you want the full detail.
Who does this actually affect?
This is the part I think a lot of small businesses will miss. The guidance is clear that the label on the contract doesn't decide it. Calling someone "self-employed" or "a contractor" won't take them out of scope if, in reality, they're personally doing the work for you rather than running their own independent business.
In practice, I'd be looking closely at:
casual and zero-hours staff who aren't on your payroll as employees
freelancers and consultants who work for you personally
agency staff, depending on how the supply chain is set up
subcontractors, particularly where it's one person rather than a company
anyone you find and book through an app or online platform
Having spent most of my career in contract catering, hospitality and travel, I know how much of the workforce sits outside the traditional employee box. Agency chefs, casual event staff, cleaners supplied by a subcontractor. If that sounds like your business, these changes are aimed squarely at you.
Genuinely independent businesses are still outside the scope. If you're buying a service from a company, rather than engaging a person to do the work themselves, the new duty shouldn't apply. But that line isn't always obvious, and it's worth getting advice if you're not sure where your arrangements sit.
The part that worries me most: liability up the chain
There's a new concept called extended liability. In simple terms, if the business that directly engaged someone can't be identified, or hasn't met the prescribed requirements, the liability can move up the contractual chain. That could mean you, as the client at the top.
To protect yourself, you'll need what's called a statutory excuse. Under the draft guidance, that's no longer just about checking documents. It includes:
Contract terms. Written terms with your suppliers requiring them to carry out right to work checks, not to subcontract without your consent, to let you audit their compliance and to cooperate with the Home Office. You also need the right to act if illegal working is found.
Substitution controls. If someone is allowed to send a substitute, that substitute needs to be checked before they start. And the check can't be left to the worker to sort out themselves.
Identity checks on the day. You need proportionate systems to make sure the person who turns up is the person who was checked. The guidance mentions things like ID cards or workplace passes, facial verification and biometric systems.
That last point is a real shift. Right to work used to be a one-off check at the start. Now there's an ongoing element to it.
What are the penalties?
The civil penalty is up to £45,000 per worker for a first breach, and up to £60,000 per worker for a repeat breach. For a small business, one slip with a couple of casual workers could be a very expensive mistake.
The rules for these new groups only apply to arrangements that start on or after 1st October 2026. So legally, you don't have to go back and check the contractors and casual workers you already use.
But that isn't a free pass. If you find out, or have good reason to believe, that someone working for you doesn't have the right to work in the UK, you can't just carry on as normal. Knowingly employing someone illegally is a criminal offence, with up to five years in prison and an unlimited fine. So while you don't have to re-check existing contractors, I think it's good practice to, especially anyone you use regularly or are planning to keep on. It's far better to find out now than when the Home Office gets in touch.
And any new engagement, or new contract with a supplier, from next Thursday will fall under the new rules.
What about digital checks?
You'll still have three ways to carry out a check: a manual document check, the Home Office online service using a share code, or a digital check through a Right to Work Digital Verification Service Provider (you might have seen these called IDSPs or DVSPs).
If you use a digital provider, check they're on the government's register. From 1st October, providers need to be registered on the Office for Digital Identities and Attributes register, with a note confirming they can carry out right to work checks. It's worth a quick email to your provider to confirm.
What I'd be doing now
If I were back in an in-house role, this is what I'd be working through over the next week:
Map who you actually use. Not just your payroll. List everyone who does work for you: agency staff, freelancers, casuals, subcontractors and anyone booked through a platform.
Decide what's in scope. For each group, ask whether they're personally doing the work, or whether you're buying a service from a genuine independent business.
Update your process. Make sure your onboarding checklist covers the new groups, and that someone owns the check before anyone starts.
Look at your supplier contracts. Agencies, cleaning companies, security firms, subcontractors. Do your contracts cover right to work checks, subcontracting, audit rights and cooperation? If not, new agreements from 1st October should.
Think about substitution. If anyone you use can send a substitute, how would you know, and who checks them?
Tell your managers. Line managers and whoever books temporary cover need to know that "just get someone in" now carries a real risk.
Keep your records. If the Home Office asks, you'll need to show what you checked, when and how.
Where AI can help, and where it can't
AI can be useful for the admin side: pulling together a list of who you engage from invoices and rotas, drafting a first version of a supplier contract clause for your solicitor to review, or turning the guidance into a simple checklist for managers.
What it shouldn't do is make the call on whether someone is in scope, or whether a document is genuine. That decision needs a person, and in the more complicated cases, proper legal advice.
One last thing
I don't think most small businesses realise this is coming, and I suspect the first some of them will hear of it is when something goes wrong. If you do one thing this week, make a list of everyone who works for you who isn't an employee. That alone will tell you how much this affects you.
If you'd like a hand working through it, whether that's reviewing your process, updating your onboarding or getting your managers up to speed, I'm happy to have an informal chat. Just get in touch.
This article is general information based on the draft Home Office guidance available at the time of writing, not legal advice. If your contracting arrangements are complex, speak to an employment or immigration solicitor.
Comments