From today, 1st October 2026, the UK’s illegal working regime changes significantly. For HR, perhaps the biggest shift is that right to work compliance can no longer be viewed simply as an employee onboarding issue.

The rules will potentially capture a wider range of working relationships. And, in some circumstances, a business may face liability for illegal working by someone it does not employ or even engage directly. The stakes are high: fines can be levied of up to £45,000 per worker and, for persistent non-compliance, can reach £60,000 per worker.

So, what is changing and what should businesses be doing?

Employment status is no longer the dividing line

Historically, right to work compliance has largely focused on employees. From 1 October, the regime deliberately extends further, potentially capturing workers, casual staff and individual contractors providing work or services personally.

That creates an important distinction. Being caught by the right to work regime does not necessarily tell us anything about an individual’s employment status for other purposes.

Someone may require a right to work check without acquiring employee or worker status for rights such as unfair dismissal, holiday pay or the National Minimum Wage. Businesses should therefore resist simply importing familiar employment status tests into their right to work analysis.

Equally, not every commercial relationship will be caught. Genuinely independent businesses providing services to customers will generally remain outside the regime. Home Office guidance gives the examples of an independent plumber providing services to members of the public and a graphic designer providing services to a business through their own personal service company.

Contractual labels alone will not provide the answer. Businesses will need to look at the substance of the arrangement and consider whether it falls within the new statutory scheme.

Could you be liable for someone you don’t employ?

The second major development is the introduction of ‘extended liability’.

The organisation directly engaging an individual remains responsible for carrying out the right to work check. However, liability for illegal working can potentially now extend beyond that relationship.

They can now travel further up the contractual chain in some cases. Take a construction company which contracts to deliver a building project and subcontracts elements of the work to other businesses. If workers are supplied further down that chain to carry out services the construction company has itself promised to deliver, the construction company may potentially be liable for any illegal workers through the new concept of ‘extended liability’ (if they are unable to establish a statutory excuse).

There are important limits. Simply purchasing an outsourced service does not automatically make a business responsible for the supplier’s workforce. The Home Office guidance gives the example of a business engaging a cleaning company to clean its own offices. Ordinarily, it would not acquire extended liability for the cleaners.

Extended liability may also arise where a business contracts directly with an individual worker who is permitted to send a substitute.

Understanding the contractual chain therefore becomes critical: what services has your organisation promised to provide, what does it subcontract to others, who actually performs that work and where is substitution permitted?

Protecting the business: contracts are only the start

Businesses potentially exposed to extended liability do not necessarily have to carry out right to work checks themselves on everyone further down the chain. They can establish a statutory excuse by satisfying specified ‘prescribed requirements’.

These cover three main areas:

Contractual protection: relevant agreements should require appropriate right to work checks, control further subcontracting, provide audit rights, allow action where illegal working is identified and require cooperation with Home Office investigations.

Substitution: where an individual is permitted to provide a substitute, controls must ensure that the substitute undergoes a prescribed right to work check before starting. The individual must not be required to carry out the check themselves. Arrangements involving individuals with substitution rights therefore warrant particular attention.

Identity verification: businesses need proportionate systems to ensure that the person actually carrying out the work is the person whose right to work was checked. Depending on the organisation, this might involve access passes, attendance systems or other identity controls.

What should HR be doing now?

The practical message is that paper compliance will not be enough.

Businesses need to be able to demonstrate that their arrangements work in practice and that reasonable and proportionate steps have been taken to ensure right to work requirements are actually being met. That might include supplier certifications, spot checks, audits and clear escalation procedures.

For HR, this means working beyond the traditional boundaries of the HR function. Workforce mapping should include non-employees and individual contractors, while procurement and commercial colleagues may need to help identify relevant supply chains, review supplier contracts and establish appropriate compliance processes.