Right To Work Checks Are Changing: What Organisations Should Do Now

The person creating your next right to work risk may not be on your payroll. From 1 October 2026, the UK’s regime is due to expand beyond traditional employment relationships and into a wider range of working arrangements. If someone is carrying out work for you, or within your supply chain, you may need to know who verified their status, when this happened and where the record is kept. Here are the practical steps to take now.

1. Look beyond employment

The expanded regime is likely to affect more than recruitment and onboarding. Organisations using agencies, subcontractors, consultants, casual staff, substitutes, outsourced providers or online platforms should involve HR, procurement, legal, operations, contract managers and service leads now.

A process that works well for employees may not protect the organisation if labour or services are arranged through another route. The key question is simple: can you show that the correct verification was completed before the individual started?

2. Map the workforce

Start by building a clear picture of who is actually carrying out work across the organisation. Include employees, casual staff, agency workers, individual subcontractors, consultants, locums, secondees, substitutes and anyone introduced through an online matching platform.

Do not rely on labels alone. A “consultant”, “contractor” or “business to business” arrangement may still create right to work risk if an individual is personally providing services.

3. Follow the supply chain

Visibility is often the weak point. Where delivery depends on agencies, suppliers, subcontractors or outsourced providers, the organisation needs to understand where responsibility sits and how compliance will be evidenced.

Ask the questions now, not during a Home Office visit: who is doing the work, who engaged them, who controls substitution, who verified their status, where is the record and can it be produced quickly?

4. Update contracts early

Contracts are a practical first line of defence. Review agreements with agencies, suppliers, subcontractors, service providers and platform operators so they allocate responsibility, set deadlines, specify record-keeping requirements and confirm when information must be shared.

Consider adding restrictions on unauthorised subcontracting, controls around substitution, audit rights, cooperation duties, escalation requirements and rights to suspend or terminate where compliance cannot be demonstrated.

5. Keep checks disciplined

The checking methods may be familiar, but small mistakes can undermine protection. Verification should be completed before work or services start, the person’s identity must match the evidence reviewed, and the outcome must confirm that the individual can perform the role or assignment required.

For online status, do not rely on screenshots, expired biometric residence permits, previous checks or a share code alone. Use the Home Office online service, check the photograph and any restrictions, retain the result page, and diarise a follow-up where permission is time limited.

6. Train risk owners

Compliance risk does not always sit with the formal onboarding team. It often arises with the people making quick, operational decisions about who can start work, cover a shift, attend site or deliver services — so training needs to reach them too.

For example, site and project managers may need to understand what is required before subcontracted labour starts. Hospitality, events and care teams may need a clear “no check, no work” approach for last-minute cover. Organisations using platforms, consultants, locums or secondees should focus on what people actually do, not just their contractual title.

7. Build an evidence pack

If challenged, organisations will need more than reassurance that a check was done. A clear evidence pack will make it easier to respond to queries, audits or Home Office scrutiny.

At a minimum, retain proof of the correct Home Office check, clear contract terms covering duties, audit rights and escalation steps, operational records such as onboarding, site access and supplier confirmations, and follow-up notes showing repeat checks, changes or concerns raised.

8. Run a dry audit

Before the new rules take effect, test the process in real life. Select a sample of employees, agency workers, contractors, subcontractors, consultants, substitutes and platform-based workers. Can you show who carried out the activity, who verified their status, when this was done and whether any restrictions or follow-up dates were identified?

A short review now could help avoid difficult questions later. If your organisation uses agency labour, contractors, consultants, subcontractors or platform-based workers, our Immigration team can help assess your right to work arrangements before the new regime takes effect.