October 2026 Right to Work Changes: Liability Extends to Subcontractors, Gig Workers and Supply Chains

From 1 October, four working arrangements are deemed “employment” for right to work purposes:

1. Contracts of employment: The regime continues unchanged for permanent and fixed-term employees (and those under a contract of apprenticeship)
2. Worker’s contracts: An individual agrees to perform work or services personally for a business that is not a client or customer of the individual’s own business, capturing many casual, zero-hours and temp arrangements. The Home Office’s example is an agency supplying temporary bar and restaurant staff: the agency must carry out the checks
3. Individual subcontractors: An individual contracts with a business that has itself been contracted by a third party to provide the work, with no direct relationship between individual and third party. The Home Office’s example is a delivery rider accepting jobs through an app: the platform is treated as the employer
4. Online matching services: Platforms that keep a register of workers, match them with clients through an online service and charge a fee or commission. The matching service, not a person or organisation using it to find a worker, is treated as the employer

Genuinely self-employed individuals operating an independent business in their own right, such as a plumber advertising directly to the public, remain out of scope. The Home Office will, however, look at how work is arranged, supplied and performed in practice: the label “self-employed” is not in itself enough.

From 1 October, a business can be treated as employing whoever performs work, even with no contractual relationship with, or knowledge of them in three situations:

1. Subcontracting chains: Where a business is contracted to provide work or services and subcontracts any part of it, every business in the chain below the end user can be liable for illegal workers anywhere further down. The end user at the top of the chain is not liable
2. Online matching: A matching service has extended liability for the right to work of the workers of the service providers it matches with clients, alongside those businesses’ own direct liability. The client is not liable
3. Substitution: Where a contract permits a worker to send a substitute, the engaging business will be liable if the substitute lacks the right to work

The draft code states the Home Office will act under extended liability only where it cannot otherwise identify the party with a direct contractual relationship with the worker. Yet the statutory position permits action against all parties in a chain of subcontracts. The Home Office also states that extended liability may apply where the new “prescribed requirements” have not been carried out (see ‘How Can Organisations Protect Themselves’ for more information on the prescribed requirements). Understanding and implementing those requirements in full in advance of the changes will be important to help mitigate liability. Businesses in sectors from construction and logistics to film and TV may have subcontracting chains and working relationships that bring them into scope.

Extended liability does not catch every purchaser of services: it does not apply to end users buying services for their own operations, and contracts that are not for the supply of work or services – a supply of goods, or a pure supply of workers – should also be out of scope. The draft guidance currently gives four examples:

1. Purchasing a service for your own use: A retailer engaging a facilities management company to clean its supermarkets is not passing the work onward, so extended liability does not apply to it; responsibility rests with the facilities company as employer of the cleaners
2. Purchasing labour rather than work or services: A manufacturer taking temporary production workers from an employment business obtains workers for its own operations rather than providing work onwards in a chain – neither party has extended liability, and the employment business is directly liable as employer and must carry out compliant checks
3. Supply of goods: A food producer supplying sandwiches to a retailer supplies finished goods, not work or services. Extended liability applies to neither, and direct responsibility remains with the employment business staffing the producer’s factory
4. A food ordering platform: A platform providing only technology and ordering services to a takeaway that uses its own delivery staff is not engaging the workers; the takeaway remains the direct employer

If an employer is found to be employing someone illegally and they have not carried out the prescribed checks, they may face sanctions including:

• Civil penalty of up to £60,000 per worker working without permission
• Where a business knew or had reasonable cause to believe a worker lacked the right to work, criminal liability carrying an unlimited fine and up to five years’ imprisonment
• Potential sponsor licence revocation, with the loss of sponsored workers that follows
• Immigration officers can issue an illegal working closure notice shutting premises for up to 48 hours, extendable by court order for up to 12 months

Compliant right to work checks continue to give employers a statutory excuse against civil penalties for direct employment. A statutory excuse against extended liability requires certain “prescribed requirements” to be met in full before work commences, across three areas:

1. Contractual terms obliging the down-chain party to carry out compliant checks; prohibiting further subcontracting without prior written consent, with obligations flowed down into any permitted subcontract; conferring audit rights; enabling suspension or termination where illegal working is identified and requiring cooperation with Home Office investigations
2. Substitution controls ensuring every substitute is checked before starting work; that responsibility for checks is never delegated to the workers themselves and that contractual sanctions apply if a substitute works illegally
3. Identity verification systems confirming the worker is the person who was checked, with re-verification at set intervals (the Home Office recommends at least once in any 24-hour period or shift of work)

Contractual drafting alone will not suffice. Organisations must show these arrangements operate in practice and take reasonable steps, supported by records of contracts, audits, assurances and remedial action, to satisfy themselves that requirements are met.

From 1 October 2026 it is mandatory – not merely recommended – that any digital identity verification provider relied on for a statutory excuse is registered and specifically authorised for right to work checks (a ‘RtW DVSP‘) on the Office for Digital Identities and Attributes (OfDIA) register. Two helpful changes accompany this:

1. A RtW DVSP may verify an expired British or Irish passport up to six months past expiry by validating the document chip
2. Official digital evidence of a name and National Insurance number may be accepted alongside an acceptable List A or B document