Right to work checks have been an employee problem for a decade. If someone was engaged through an agency, a platform, or as a self-employed subcontractor, the duty to check usually sat elsewhere, or nowhere at all. On 1 October 2026 that stops.
Section 48 of the Border Security, Asylum and Immigration Act 2025 amends the Immigration, Asylum and Nationality Act 2006 and pulls a much wider range of working arrangements into the illegal working regime. The commencement regulations were made on 24 June, so unlike much of the employment legislation arriving this autumn, this date is settled.
Who comes into scope
Anyone engaged under a worker's contract rather than a contract of employment. Individual contractors. Agency workers and labour supplied through contractual chains. Gig and platform workers, including any substitutes they send. Casual, temporary and zero-hours staff.
Genuinely self-employed people who are in business on their own account and contract directly with their own clients remain outside the scheme. That sounds like a comfortable exemption until you consider how many businesses have people they describe as self-employed who would not survive a status test. Misclassification is where most of the exposure sits.
The part that catches people out
Section 48 does not only widen who you check. It introduces liability for illegal working that happens below you in a chain you did not directly engage.
Civil penalties reach £60,000 per worker. Under the extended liability regime, that penalty can attach where you have subcontracted work or services to a third party and illegal working occurs further down the chain of subcontracts. Deliberate breaches carry criminal liability.
For a business that engages one contractor who engages three of their own, this is a material change in risk. The commercial contract you signed eighteen months ago probably says nothing about it.
What the numbers suggest
The Home Office consultation found that of 145 employers sampled, 46% carried out right to work checks only on direct employees during onboarding. On 1 October, roughly half of those businesses move from compliant to exposed without changing anything about how they operate.
Construction is the most affected sector, facing an estimated 2.7 million additional checks because so much of its workforce is engaged through CIS. Hospitality, logistics, warehousing, courier services and beauty are also flagged as high risk.
Digital checks are tightening too
If you use an Identity Service Provider for digital checks on British and Irish citizens, that provider must be registered with the Office for Digital Identities and Attributes and specifically approved for right to work checks. Expired British and Irish passports can be accepted for digital checks for up to six months after expiry.
What to do before October
Start by mapping every way your business gets work done by someone who is not on the payroll. Agency staff, subcontractors, casual cover, anyone found through a platform. In most businesses this is not an HR list, because HR did not engage them. Operations, site management and whoever signs off invoices will know things the personnel file does not.
Then work out who is currently responsible for checking each of those groups, and whether anybody actually is. Where the answer is an agency or a subcontractor, get that in writing rather than assuming it.
Finally, review the commercial contracts that expose you to the chain. Right to work warranties, audit rights and indemnities are worth having in place before the regime starts rather than after a penalty notice arrives.
A compliant check carried out before work begins gives you a statutory excuse against the civil penalty. That has always been the point of doing them properly, and from October it applies to a great many more people.