For nearly two decades, the UK’s right-to-work regime rested on a single organising line: the employment contract. If you employed someone, you checked their permission to work before they started, kept the evidence, and earned the statutory excuse that protects a compliant employer from penalties. If the person working for you was not your employee, the courier on a platform, the temp from an agency, the self-employed subcontractor on your site, the duty generally sat somewhere else, or nowhere.
On 1 October 2026, that line disappears. Section 48 of the Border Security, Asylum and Immigration Act 2025 comes into force, and with it an updated code of practice that extends right-to-work checking to gig workers, zero-hours arrangements, agency staff, and individual subcontractors, reaching even the platforms that match freelancers to clients. The civil penalty regime, up to £45,000 per worker for a first breach and £60,000 for repeats, follows the duty into all of it, with criminal liability of up to five years’ imprisonment and an unlimited fine in serious cases.
It is the largest redrawing of the right-to-work perimeter since the regime was created, it lands in a matter of weeks, and it arrives on top of a checking system that has already changed more in the last two years than in the previous fifteen. Understanding how it fits together is now urgent work for anyone with a UK workforce, and instructive reading for everyone else, because the UK has just written into statute an argument this newsletter has been making all year.
What Actually Changes on October 1
The mechanics first, because they are blunt.
Until now, the illegal working civil penalty regime attached mainly to people working under a contract of employment. From 1 October, the checking duty and the penalties behind it reach deep into contingent arrangements: gig and platform work, zero-hours engagements, agency supply, and individual subcontractors. Companies operating platforms that connect freelancers to clients are required to carry out checks themselves. The change comes through Section 48 of the 2025 Act and the accompanying code of practice, and legal commentators note that even a shift in political leadership since the Act passed has produced no indication that the commencement will be delayed.
For employers, the significance is less the paperwork than the death of a defence. “They’re not our employees” has been the load-bearing wall of contingent workforce compliance. In ten weeks it stops bearing load.
How the Perimeter Got Here
The extension is the final move in a sequence that has been accelerating since early 2024, and it helps to see the whole board.
First came the money. In February 2024, civil penalties tripled, to £45,000 per illegal worker for a first breach and £60,000 for repeats, converting right-to-work failure from an irritant into a balance-sheet event. Then came the documents. Biometric Residence Permits were decommissioned at the end of 2024, moving the entire visa-holding workforce onto digital-only eVisas, proven through online share codes rather than cards, a transition that has tripped up HR teams still trained to accept plastic that looks official. Then came the pressure: enforcement activity has surged, with illegal working visits and arrests up 38 percent since July 2024, and government messaging naming food delivery and construction as priority sectors.
The gig extension itself was signalled in government announcements from March 2025, aimed at a problem enforcement kept finding: substitution. Reporting around delivery platforms had exposed account-sharing at scale, checked account holders renting their identities to people who had never been checked at all. The person verified and the person working were different people, and the legal architecture had no way to reach the gap. October 1 is the state’s answer.
The Substitution Problem the Law Is Aimed At
It is worth dwelling on substitution, because it explains both why the reform targets the gig economy and why compliance will be harder than a documents exercise.
Platform work industrialised a specific weakness: the check happens once, digitally, at onboarding, and the work happens indefinitely, remotely, afterwards. An account, once approved, becomes an asset that can be lent, rented, or sold to someone who could never pass the check himself. Readers of this newsletter’s recent series on hiring fraud will recognise the shape immediately. It is the proxy problem again, identity verified at one gate and never reconciled at the next, playing out across courier fleets instead of interview calls.
That is why the serious end of October compliance is not really about collecting more documents. It is about identity continuity: confidence that the person doing the work tonight is the person whose right to work was checked, a standard that pure paperwork has never met and was never designed to meet.
Why Compliance Fails in Practice
Here is the finding that should calibrate everyone’s preparation: the employers who get penalised are rarely the ones trying to hire illegally.
Immigration practitioners are consistent on this. Most breaches arise from process failure: outdated checklists, poor record keeping, and misunderstanding which verification route applies to which worker. An HR officer accepts a Biometric Residence Permit because it looks official, not knowing the card ceased to prove anything. A time-limited worker’s follow-up check never happens because no one diarised it. A manager checks the EU passport but not the British one, forgetting that the duty applies to everyone, British and Irish citizens included, and that selective checking creates its own discrimination exposure.
The digital layer has added a new failure mode with sharp edges. Where employers use identity verification technology for eligible workers, the provider must be certified on the government’s OfDIA register for right-to-work purposes. An uncertified tool can perform flawlessly and still deliver nothing, because a check without the prescribed method earns no statutory excuse. Compliance, in other words, is not “did you check” but “did you check in exactly the manner prescribed, with the evidence to prove it, on the date recorded.” The excuse is procedural, and so are the failures.
The Supply Chain Becomes the Compliance Unit
The October extension does something subtler than adding workers to a list: it turns right-to-work compliance from an HR process into a supply-chain design problem.
For directly engaged contingent workers, the duty is clear enough. But most extended workforces arrive through intermediaries, agencies, umbrella arrangements, platforms, subcontract chains, and who must check whom will turn on how those arrangements are structured. Employment lawyers are already advising end-users to do two things before October: audit the real composition of the workforce, employee, worker, individual subcontractor, gig, genuinely self-employed, since each category lands differently, and write express contractual terms requiring agencies and suppliers to conduct checks on everyone they supply and to evidence them on request.
Readers will recognise that advice too. It is the flow-down principle this newsletter set out for extended-workforce screening generally: a standard you cannot inspect is not a standard, it is a hope. The difference after October is that the hope now carries a £60,000 price per disappointment, multiplied across a workforce, and for licensed sponsors an illegal working finding endangers the sponsor licence itself, which for many firms is the business.
The Label Stops Working
Step back and the reform’s real meaning comes into focus. For years, the design flaw in workforce compliance, screening included, has been that duties followed the label rather than the work. Employees were checked because they were employees; everyone else slipped through a definitional gap while holding the same access, wearing the same uniform, and representing the same brand.
This newsletter argued months ago that organisations should close that gap voluntarily, screening by access and risk rather than contract type. The UK has now closed part of it by statute, with a commencement date, a penalty schedule, and an enforcement arm that has already increased its tempo by more than a third. It will not be the last jurisdiction to do so; work-authorisation regimes tend to converge, and every government watching the UK’s delivery apps has the same substitution problem in its own market.
For employers, the deadline is the deadline. But the wiser response is to treat October 1 not as a British peculiarity to be patched, but as the direction of travel finally announced: the era in which “not our employee” excused not knowing who was working for you is ending, one jurisdiction at a time. The companion playbook sets out how to be ready, in the weeks actually available.
