The compliance chain just got longer

The person doing the work may not be the person your contract names. That gap is now a UK compliance question.

On 1 October 2026, expanded Right to Work rules took effect for relevant arrangements and contracts entered into from that date. HRReview reported on 2 October 2026 that the changes extend beyond conventional employment to worker contracts, individual subcontractors, and certain online matching services. They also introduce potential civil penalty liability further along some contractual chains where illegal working is identified (https://hrreview.co.uk/hr-news/recruitment/new-right-to-work-rules-risk-slowing-recruitment-rec-warns/390740).

The detail that matters: the Home Office says the employer with the direct contractual relationship with a worker remains responsible for carrying out the prescribed Right to Work check. But extended liability can apply elsewhere in certain arrangements. That includes some situations where a business contracted to provide work or services uses another employer to supply workers, and arrangements involving online matching services or contracts allowing workers to provide substitutes. Contract wording alone is not enough.

My read: the operational risk is not the check itself. It is assuming the check stops at the employment contract. If you use subcontractors, substitutes, or platform-matched workers, trace who holds the direct contract, who performs the work, and where the Right to Work record sits. If those answers differ, your process may need to cover more than payroll.

The REC warns this could slow recruitment and make firms more cautious about candidates whose immigration status requires extra verification. It also warns some businesses may favor people whose documentation is simpler to check. Those are risks the REC is raising, not outcomes this report proves. The report does not show a market-wide slowdown, employer motives, or a selection trend. Home Office guidance says employers should apply Right to Work procedures consistently to all workers, including British citizens.

Today's Job Index still shows capability demand moving under that compliance noise: Ruby is the public lead at 25 roles in the crawl window, while Cybersecurity sits loudest at 41. Those are skill-mention counts inside the window, not hires and not proof that the Right to Work change moved any posting volume.

For now, the useful move is narrower: map the chain before you sign. Know where the check obligation actually sits, and keep the records that support your process. The rules changed; the evidence on hiring effects is still open.