If you employ people, you already know the drill: see the passport, take a copy, write the date on it. What surprises most contractors is how little of that has applied to subcontractors. The duty attached to a contract of employment, so where someone was genuinely engaged on a contract for services it generally sat outside the regime — which is not the same as saying nobody on your sites ever needed one.
That changes on 1 October 2026. Section 48 of the Border Security, Asylum and Immigration Act 2025 extends the illegal working regime beyond contracts of employment, and the date is fixed in law rather than expected — S.I. 2026/683, made on 24 June 2026, states that section 48 comes into force on 1st October 2026. The Minister for Border Security described the reforms to Parliament as covering “companies who contract workers or individual sub-contractors to provide services under their company name”.
The Home Office has named construction as a high-risk sector, and the reason is arithmetic rather than suspicion. So much of the industry’s workforce is self-employed through CIS that the change is estimated to create around 2.7 million additional checks — more than any other sector.
It is not retrospective. The new scope applies to engagements starting on or after 1 October 2026. Arrangements already running are outside it, though a repeat check falling due after that date is caught.
This is the part worth reading even if you thought you knew this subject.
Not all right to work evidence is equal. The Home Office splits it into two lists, and they behave completely differently.
A British or Irish passport, or settled status. One check, done properly, and you are covered for as long as the engagement lasts. Nothing expires. Nothing to diarise.
A time-limited visa, or a biometric residence permit showing time-limited leave. Your protection — the statutory excuse — runs out when their permission does. A follow-up check must happen before that date.
Here is what makes that sharper than it first sounds. The protection lapses from the date the permission ended, not from the date anybody noticed. So if someone’s leave ran out on the 15th and the follow-up happened on the 20th, the gap is not nothing — it is five days during which the check was not in place.
So a subcontractor whose paperwork was perfect at the start of a job can quietly stop being covered halfway through it, without anybody doing anything wrong. That is not a filing problem. It is a diary problem.
Someone genuinely in business on their own account, contracting directly with their own clients, is not caught. A one-person plastering company that quotes for its own work, carries its own insurance and sends its own invoices is doing something different from a labourer engaged on day rate under your name.
The commentary is consistent that the real exposure is not the obvious case. It is misclassification — treating someone as genuinely self-employed when the working relationship says otherwise. That question long predates this change, and it is one for you and your accountant rather than for a software company.
Throughout this page, “you” means the business engaging the individual to do the work under its own name. That is where the duty sits, and for most contractors reading this it is the relevant position: you take on a subcontractor, you make the check.
It can reach further. The rules also contemplate businesses that subcontract to another organisation supplying labour, and platforms matching workers to jobs. Where that happens, liability can travel up the chain. The Home Office has said it will look first to whoever holds the direct contractual relationship with the worker, so the question of who checks is usually answered by asking who engaged them — but if you are two steps removed from the person on site, it is worth establishing which party in the chain is doing it rather than assuming somebody is.
Civil penalties start at £45,000 per worker for a first breach and rise to £60,000 for repeats, per worker.
The Act and its commencement date are settled. The detailed guidance is not quite: the Home Office’s Employer’s Guide and the Code of Practice were both still in draft over the summer, intended to take effect alongside section 48. One point they make that is worth knowing early: if you use a digital identity provider, it must be on the OfDIA register and specifically approved for right to work. Not every identity service is.
Right to Work is already one of the documents we ask every worker for, through a link they open on their phone — no account, no app. What we added for this change is the expiry: a passport holder leaves it blank, a visa holder puts the date in, and we chase the follow-up before the excuse lapses rather than after.
We do not tell you whether a particular person is inside or outside the scheme. That depends on the working relationship, and it is not a judgement software should be making on your behalf.
Free for 30 days, no card. If you are taking on subcontractors after 1 October, the useful thing is having somewhere the dates live.
Start free
Sources: Border Security, Asylum and Immigration Act 2025, s.48; the Border
Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026
(S.I. 2026/683); Home Office draft Employer’s Guide to Right to Work
Checks (July 2026); draft Code of Practice on preventing illegal working
(June 2026); ministerial statement to Parliament.
This page explains what the rules say, as they stood in September 2026. It is
not legal advice. In particular it does not tell you whether any given worker is
inside or outside the scheme — that turns on the working relationship, and
it is a question for you and your adviser.