Right to Work is changing on 1 October.
If you engage agency labour, you have probably had an email this month warning that liability for Right to Work compliance is moving up your supply chain and that your business is newly exposed to penalties of up to £60,000 per worker.
For a large number of businesses, that is not what the guidance says.
The rules genuinely are changing on 1 October 2026, and some organisations do need to act before then. But the change is narrower and more specific than most of the commentary suggests, and the Home Office added a significant amount of clarification on 11 September that a lot of that commentary predates. Knowing which side of the line your business sits on is the whole exercise.
What actually changes
Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force on 1 October 2026. It does two things.
First, it widens who counts as an employer for Right to Work purposes. Alongside contracts of employment, the scheme now covers people engaged under a worker's contract, individual subcontractors within a contracting chain, and online matching services that connect individual service providers with clients. Temporary agency workers, gig platform workers and individual subcontractors are inside the regime for the first time.
Second, it creates what the guidance calls extended liability. In certain contractual arrangements, civil penalty liability can reach a business that has no direct contractual relationship with the worker at all.
The mechanics of a compliant check are broadly unchanged. What has changed is who has to do them and who can be penalised.
The distinction that decides whether this affects you
Extended liability does not apply to every business that buys work or services from another business. The guidance states plainly that it does not apply to a client, customer or end user purchasing work or services for their own internal operations.
The test is whether you have promised work or services onwards to somebody else, and then relied on another business to deliver them.
The Home Office guidance works this through with examples, and several of them describe very familiar operations.
Out of scope
A manufacturing company takes temporary production workers from an employment business to cover a demand spike, and those workers are integrated into its own production. The guidance is explicit that extended liability does not apply to the manufacturing company, and that responsibility for preventing illegal working sits with the employment business as the workers' employer.
The same conclusion applies to a food producer using agency workers to make goods it sells to a retailer, and to a retailer buying cleaning services for its own premises from a facilities management company.
In scope
A property developer that wins a contract to build homes and delivers it through a chain of subcontracts. A logistics company contracted by a retailer to run its warehousing and distribution, which then outsources the operation of those warehouses to another business. In both cases the business in the middle has sold a service to a third party and relied on another business to deliver it. That business may be treated as the employer of anyone working through the chain, and must meet the prescribed requirements to establish a statutory excuse.
If your organisation buys labour or services for its own operations, the change is much smaller than the headlines suggest. If your organisation delivers a contracted service to a customer and subcontracts any part of it, you have work to do before 1 October.
There is a further point worth taking advice on. The trigger in the guidance covers a business that is under a contract to provide work or services to a third party and enters into a contract with another employer whose workers carry out that work. Read on its face, that may capture a contracted service provider that engages agency workers directly, even though a manufacturer engaging the same workers is out of scope. If you deliver an outsourced or managed service, that is a specific question for your legal adviser.
What it does not do
It is not retrospective. Civil penalty liability for engagements under a worker's contract, as an individual subcontractor, or through an online matching service applies only where the engagement commenced on or after 1 October 2026. The prescribed requirements supporting a statutory excuse against extended liability apply where the relevant contractual arrangements were entered into on or after that date.
It also does not move the checking duty. The employer in the direct contractual relationship with the worker remains responsible for carrying out the check. Extended liability does not transfer that responsibility, and it does not make an upstream business liable for another employer's failure to check.
And the guidance sets out that the Home Office will ordinarily seek to identify the person responsible for the relevant contractual arrangements and assess whether they have a statutory excuse, rather than treating every party in a chain as liable.
Where the real risk sits
Extended liability bites hardest where the Home Office cannot work out who employs the worker. The guidance lists the circumstances: the worker cannot clearly identify who employs them, there are multiple intermediaries in a chain of contracts, records or contractual arrangements are not readily available, or substitution means the individual doing the work is not clearly linked to a specific employer.
That is a traceability problem before it is a legal one. The businesses most exposed are the ones that cannot say, quickly and with evidence, who checked the person standing on their site and when.
Five questions worth asking your labour supplier
Whether or not extended liability applies to you, these are fair questions of any agency from 1 October.
- Who carries out your Right to Work checks, and at what point in the process?
- If you use a digital verification provider, is it registered on the Office for Digital Identities and Attributes register and able to carry out Right to Work checks specifically, rather than general identity verification only?
- How do you confirm that the person who turns up is the person you checked?
- Do you use second tier suppliers, and if so what obligations flow down to them?
- If we asked you to evidence the check for a named worker tomorrow, how long would it take?
The last one is the most revealing.
Where PROMAN sits
As an employment business, we are the employer for Right to Work purposes for the temporary workers we supply. From 1 October, that responsibility is squarely within the civil penalty regime. For clients taking our workers into their own operations, the guidance is clear that the duty sits with us, and that is the right place for it.
If you would like a conversation about where your own arrangements sit, we are happy to talk it through.
This article is general information based on the draft Home Office guidance as at 17 September 2026 and does not constitute legal advice. The guidance remains in draft until it comes into force on 1 October 2026. Organisations should take their own advice on their specific contractual arrangements.
