On 17 September 2026, Giant Group co-hosted a webinar with Brabners LLP on the biggest expansion of the UK's Right to Work regime in years. Here is what recruitment agencies, MSPs, enterprise hirers and anyone managing a contingent workforce need to take away, before the rules change on 1 October.
From 1 October 2026, the definition of "employer" for Right to Work purposes gets a lot wider, and for the first time, organisations that never directly engage a worker could still find themselves exposed if something goes wrong further down their supply chain.
That is the headline from The Right to Work Reset: New Rules, Wider Net, Higher Stakes, a webinar Giant Group ran alongside immigration and employment specialists from Brabners LLP. Dan Haslam (Chief Business Development Officer, Giant Group) hosted, Rachel Holland (Senior Screening Consultant, Giant Screening) covered what good compliance looks like in practice, and Brabners partners Brendan McAleese and Hannah Morrison walked through the legal detail. Nearly 130 people joined live, a fair signal that this is on more compliance, procurement and talent leaders' radars than the "very confident" poll numbers below might suggest.
If your organisation touches contractors, agency workers, subcontractors or umbrella workers anywhere in its supply chain, this is worth ten minutes of your time.
What our audience told us
Two live polls during the session gave a useful temperature check, and exposed the exact gap the new rules are designed to close. 
Read together, these tell a familiar story. Most organisations feel solid on direct employees, but confidence drops the moment you move to contractors, agency workers and subcontractors, and around a quarter of attendees could not say with certainty who is actually responsible for checking that wider population today. That is precisely the blind spot the new legislation targets, and precisely why "fairly confident" will not be good enough after 1 October.
What is actually changing
The starting point is Section 48 of the Border Security, Asylum and Immigration Act 2025 . It broadens the Right to Work scheme beyond the traditional contract of employment and introduces a new extended liability framework.
For Right to Work purposes, "employer" now has a wider meaning. It still includes anyone who employs someone under a contract of employment, but it also captures anyone who engages an individual under a worker's contract, engages an individual subcontractor, or operates an online matching service that puts an individual service provider in front of clients or customers.
There are two distinct changes worth separating out:
- Direct contractual relationships. Where an organisation directly engages an in-scope individual, it will need to carry out a prescribed Right to Work check before work begins, to establish a statutory excuse.
- Extended liability. In specified non-direct arrangements, an organisation further up the supply chain, one that never physically checked the worker, can still be exposed if it has not met its own prescribed requirements.
A direct employer's responsibility for the check does not automatically transfer up a chain. Equally, an organisation outside the direct relationship may need its own protection if the arrangement falls within extended liability. As Hannah Morrison put it on the day: "Labels are not decisive, so map the contractual reality."
Genuinely out of scope: independent businesses contracting in their own name (the Home Office's own example is a graphic designer working through their personal service company), and end users simply buying a service for their own internal operations, such as a retailer buying in cleaning for its own stores rather than supplying that labour onward to someone else.
When it applies
The expanded direct check obligation applies where employment or engagement commences on or after 1 October 2026. For extended liability, the prescribed requirements apply where the relevant contractual arrangements are entered into on or after that date, so a new assignment starting on or after 1 October brings the extended regime into play for the parties in that chain. Existing employees and existing time limited permissions stay under the current rules, including existing follow up check requirements.
Where the exposure is greatest
Brabners flagged hospitality, retail, logistics, warehousing, construction, care, facilities management, housing repairs, recruitment and platform based services as the sectors most likely to have work to do, not because every arrangement in those industries is caught, but because they are more likely to combine direct engagements, individual subcontractors, temporary labour, outsourcing, multiple contractual tiers and substitution rights, all at once.
The numbers behind getting it wrong have not softened: a starting civil penalty of £45,000 per illegal worker for a first breach, rising to £60,000 per illegal worker for a repeat breach within three years, plus, in serious cases, criminal, sponsor licence, operational and reputational consequences. As Brendan McAleese summed it up: it is not that flexible labour creates liability by default, it is that complexity creates more points where responsibility, identity and evidence can become unclear.
Two routes to a statutory excuse
This is the bit worth pinning above your desk. A "statutory excuse" is the Home Office's term for the protection an organisation earns by doing the right things, and there are two separate routes to it.
Direct employer route: carry out a prescribed Right to Work check before the engagement begins, plus any required follow up check where permission is time limited.
Extended liability route: meet, in full, the prescribed requirements relevant to your position in the contractual arrangement, and be able to evidence that compliance.
Crucially, these are separate excuses. Completing the direct worker's check does not automatically establish the excuse another organisation needs under extended liability. If you are operating within a service chain, a substitution model or an online matching arrangement, do not assume the analysis stops at "someone, somewhere, did a check."
The three prescribed requirements, in brief
For organisations that fall within extended liability, Brabners outlined three areas the Home Office's draft guidance expects you to have covered.
Written contractual terms. A written statement in place before work starts, requiring prescribed checks, restricting further subcontracting without consent, permitting audits, enabling enforcement action, and requiring cooperation with any Home Office investigation. A generic "the supplier will comply with immigration law" warranty is unlikely to be enough on its own.
Substitution controls. Where a contract permits a worker to send a substitute, checking the original named individual does not protect you if an unchecked substitute turns up instead. The excuse depends on having a propose, check, verify and approve process for any substitute, and evidence of who actually did the work and when.
Identity verification. Confirming that the person who was checked is the person who shows up. The draft September guidance recommends re-verification at least once in any 24 hour shift, scaled to the risk of substitution or impersonation, not a fresh full Right to Work check every day.
What good workforce compliance looks like
Rachel Holland's practical framing: Right to Work should not be treated as a single standalone check at the start of employment, it is part of a broader compliance picture that also includes things like criminal record checks, qualification and credential verification, and sanctions screening, depending on role and risk. Organisations that manage this well tend to share five characteristics.
- Assess: an accurate picture of everyone actually working for or providing services to you, not just who is on payroll.
- Verify: the right checks, completed before work starts, properly recorded.
- Monitor: expiry dates visible, follow up triggered, role and circumstance changes captured.
- Govern: clear ownership of who initiates, completes, reviews exceptions and chases gaps.
- Evidence: records that can actually be located and produced, not just a belief that the process was followed.
The common thread across all five is visibility. Without a complete view of who is working for you, it is hard to verify, monitor, govern or evidence anything consistently.
Six practical actions before 1 October
- Map your workforce: everyone providing labour or services, not only employees, across engagement models, business areas, locations and systems.
- Review your contractor population: how they are engaged, whether the work is personal, what checks currently apply.
- Review your suppliers: which agencies, subcontractors and service providers supply people in, what they check, what evidence they hold, and how you get assurance those controls actually operate.
- Review monitoring: how time limited permissions are tracked and follow up triggered, beyond just the core HR system.
- Assess your evidence: could you produce the relevant records for every worker today, if asked?
- Close the gaps: ownership, supplier oversight, disconnected systems, or worker groups that have historically sat outside standard screening.
The reassuring part: for most organisations this is not a from scratch exercise. It is extending a framework you likely already have to the worker groups it has not reached yet, and prioritising the areas where visibility is currently weakest.
The key takeaways
Hannah Morrison, Partner, Brabners: "Start with scope. The wider definition catches direct worker contracts, individual subcontractors and online matching services, but genuine independent businesses and ordinary end user purchasing arrangements can remain outside. Labels are not decisive, so map the contractual reality. For extended liability, apply the prescribed requirements to the correct arrangement, contractual terms alone are not enough."
Rachel Holland, Senior Screening Consultant, Giant Screening: "It is all about compliance becoming an ongoing obligation. Identity and Right to Work should be considered together. Workforce visibility is critical, and so is the need to evidence that compliance."
Where to go from here
This article is a summary for general information only and does not constitute legal, regulatory, compliance or financial advice. The Home Office's Employer's Guide and Code of Practice were still in draft form at the time of the webinar, so specific cases warrant your own legal advice.
If reading the six actions above left you unsure where your organisation actually stands, that is normal, it is exactly the gap the polls above point to. Giant Screening works with recruitment agencies, MSPs and enterprise hirers to map contingent workforces, run Right to Work and background screening at scale, and build the auditable evidence trail this regime now expects. Get in touch with the Giant Screening team to talk through where your gaps might be before 1 October.