Right to work checks are about to change for every business that hires anyone in the UK, and the date to have this sorted by is 1 October 2026, which by the time you read this is probably closer than you would like. Most of the coverage this year has been about BritCard, the mandatory digital ID scheme the government floated and then quietly scaled back after a fairly loud public backlash. That story ran and ran, but underneath it a much more boring and much more immediate change has been working its way through Parliament, and it is the one that actually affects your hiring process this autumn.
I run and advise several businesses that hire developers, consultants and contractors, so this one landed directly on my desk rather than as background policy noise. If you take on staff, contractors, subcontractors or anyone through a platform or agency, you need to understand what changes on 1 October, because the penalties for getting it wrong just went up sharply.
What Actually Happened to BritCard
The mandatory digital ID card was pitched last year as the long term answer to illegal working, a single app based identity that everyone would eventually need to prove who they are and their right to work. It ran into exactly the reaction you would expect from a country that has resisted ID cards for decades, and by January this year the Chancellor was conceding the policy needed to carry the confidence of the public before it went any further. That is politician language for shelved, at least in its original mandatory form.
What has not gone away is the government's stated intention to digitise right to work checks by 2029. BritCard as a single flagship product may be dead or dormant, but the direction of travel toward digital verification for employment purposes is still very much government policy. The retreat was about the mandatory national ID card, not about employers checking who they hire.
The Change That Actually Lands on 1 October
A revised Code of Practice on preventing illegal working comes into force on 1 October 2026, and it applies to any employment, engagement or arrangement starting on or after that date. This is not a future roadmap item. It is a rule change for your very next hire.
The headline shift is scope. Right to work checks have always applied to employees, but from 1 October the duty extends to workers on worker contracts, individual subcontractors inside a contracting chain, and online matching services, which in plain English means gig economy platforms connecting people with clients. If your business engages anyone who is not a straightforward employee, and a huge number of small businesses do, you are now caught in a way you may not have been before.
Why This Matters If You Use Contractors
I have written before about how IR35 already reshaped the way tech businesses engage contractors, and this is another layer on top of that same relationship. A lot of small software and consultancy businesses lean on freelance developers, subcontractors and agency staff precisely because it gives them flexibility that a full time headcount does not. That flexibility now comes with an explicit right to work obligation attached to it, whatever the label on the contract says. Checking only the people you assume might need checking, rather than everyone, is no longer a defensible position and was arguably never a safe one.
The Penalties Are Not Trivial
Civil penalties for illegal working can reach £45,000 per worker for a first breach and £60,000 per worker for a repeat breach. Those numbers apply per worker, not per business, so a small business with a handful of unchecked contractors is looking at a figure that could genuinely threaten the company, not just an uncomfortable fine. The changes are not retrospective, so they only bite on arrangements starting on or after 1 October, but that is exactly why the timing matters. Every hire, engagement or contractor onboarding from that date needs the check done properly and on record.
There is also a technical wrinkle worth knowing about. From 1 October, a valid British or Irish passport, or an Irish passport card, will be treated as valid for up to six months past its expiry date for the purposes of a digital verification check, which is a small mercy compared with the rigidity of the current system. If you use a digital identity verification provider for checks, it also needs to be registered on the Office for Digital Identities and Attributes register and specifically authorised for right to work purposes. Registration on its own is not enough, and I would not assume your current provider has ticked that second box without asking them directly.
What To Actually Do Before 1 October
Start by mapping everyone your business engages who is not a conventional payrolled employee. Contractors, subcontractors, workers on flexible arrangements, anyone sourced through a platform. If your current onboarding process only runs a right to work check for people on an employment contract, it has a gap that the new Code of practice closes.
Check whatever digital verification tool you use, or plan to use, is actually on the OFDIA register for the right to work purpose specifically, not just registered generally. Update your onboarding checklist so a check happens before anyone starts, not as a formality completed after the fact once someone is already working, which is a habit I have seen more than once in businesses moving fast to fill a role. And keep the evidence. A civil penalty defence in this area rests almost entirely on being able to show a proper check was done and recorded at the right time.
My Honest Take
I think the government handled the politics of this badly and the substance of it reasonably. Trying to sell a mandatory national identity app to a public that has never wanted one was always going to run into trouble, and the retreat in January was predictable in hindsight. But the underlying problem the policy was aimed at, employers quietly not bothering to check people properly, particularly in supply chains with several layers of subcontracting, is a real one, and closing the loophole around workers and gig platforms rather than just employees is a sensible piece of tightening.
What frustrates me is the same thing that frustrates me about a lot of UK employment policy, which is that the compliance burden lands hardest on small businesses without a dedicated HR or legal team to catch a change like this before it bites. A larger company has someone whose job is to read the Code of practice the week it is published. A five person consultancy taking on its first subcontractor this autumn probably does not, and finds out about the £60,000 number the hard way.
If you are building or running a small business and this kind of compliance change keeps catching you off guard, it is worth building the discipline of checking these things properly rather than reactively, which is exactly the kind of unglamorous groundwork I write about in The 28 Day Startup. Get your onboarding checklist updated before 1 October, not after someone has already started work under the old assumptions.
