Gig Economy and Construction Right to Work Rules Now in Force: What HR Must Do and Evidence

Key Takeaways

• The extended Right to Work Scheme has been in force since 1 October 2026. Section 48 of the Border Security, Asylum and Immigration Act 2025 was commenced by SI 2026/683, and the prescribed requirements in SI 2026/700 and both revised codes of practice took effect on the same day.
• Workers, individual sub-contractors and people matched with customers through online platforms now need a prescribed check before they start. For these new categories a civil penalty can only be imposed where the engagement began on or after 1 October 2026, and the final guide says the date that counts is when the contractual arrangement was entered into, not when the work starts.
• The final guide published on 1 October 2026 did not change the legal requirements in the 11 September draft. The Home Office lists three additions: a TUPE clarification, a sign-up for Scheme updates, and a new Annex C of 41 questions and answers.
• There is no grace period. Annex C states that the requirements apply from 1 October 2026 and that enforcement remains intelligence-led, so the first engagement contracted after that date already needs the full process.
• Contract labels, IR35 and employment status decisions do not settle scope. The guide puts a rider paid per delivery through an app inside the Scheme and a plumber running their own business outside it, and the difference is how the arrangement works in practice.
• A construction firm contracted to deliver a project can be liable for operatives several tiers down. Example 7 of the final guide places a housebuilder using a chain of subcontractors within extended liability, and its only defence is a written statement and controls in place before work starts.
• Every substitute needs a prescribed check before their first shift. The check cannot be delegated to the worker who is being replaced, and the Home Office recommends re-verifying identity at least once in any 24-hour period or shift of work.
• Digital checks are optional, but any provider you use must be a registered Right to Work DVSP. A RtW DVSP can check British and Irish passports, including those expired by up to six months, while eVisa holders can only prove their right to work through the Home Office online service.
• Penalties are set at £45,000 per worker for a first breach and £60,000 for a repeat breach within three years. Each mitigating factor reduces the figure by £5,000, and knowingly employing an illegal worker remains a crime carrying up to five years in prison and an unlimited fine.
• WPC HR keeps every check, substitute and identity re-verification in one dated audit trail. Our HR compliance software holds contractor and employee checks alongside written statements and supplier assurances, and our sponsor licence compliance audit tests whether your files would establish a statutory excuse.

Introduction

The extension of the Right to Work Scheme to contractors, sub-contractors and platform workers is now law in operation. Section 48 of the Border Security, Asylum and Immigration Act 2025 came into force on 1 October 2026 under SI 2026/683, and the prescribed requirements in SI 2026/700 took effect on the same day. At 09:30 UK time the Home Office published the final Employer's guide to right to work checks and both revised codes of practice as final versions in force from that day.

For construction firms and for gig and platform businesses, this turns a planning exercise into a live obligation. Anyone engaged under a worker's contract, as an individual sub-contractor, or matched with customers through an online platform on or after 1 October 2026 needs a prescribed check before they start work. Businesses further up a contractual chain need written terms, substitution controls and identity verification in place before the work begins if they want a defence to extended liability.

Everything in this guide is confirmed law or final Home Office guidance in force from 1 October 2026. Nothing here is a proposal. Where the final guide answers a question the legislation left open, we quote the guide's position and say so, and where we give our own view we label it as ours.

This post covers how the rules land in construction and the gig economy, and what HR must be able to evidence for each arrangement. For the classification test in detail, our sister firm WorkPermitCloud explains whether a self-employed contractor needs a right to work check. For the file-by-file record keeping, see our guide to right to work records for contractors, and for the wider programme, our right to work readiness guide for employers.

What the Final Guide Changed from the 11 September Draft

The legal requirements did not change. The final guide's own summary lists three updates made since the 11 September 2026 version, and the passages that matter most to engagers of contract and platform labour (scope, the assessment factors, the prescribed requirements, delegation and identity re-verification) read the same as the draft. Two of the three additions still matter in practice.

The Annex C answers that most affect construction and platform businesses are these.

• No grace period. The requirements apply from 1 October 2026, and enforcement continues to be intelligence-led.
• Not retrospective. The relevant date is when the contractual arrangement is entered into, not when the work starts or continues. An arrangement made before 1 October 2026 is not brought into scope only because work carries on afterwards, but whether a renewal, extension or variation creates a new arrangement depends on its legal effect, not on what it is called.
• Labels do not decide scope. An IR35 determination is a tax assessment, an employment-law status decision cannot automatically be relied on, and using a personal service company does not by itself put an arrangement in or out of scope.
• Standard agency supply is unchanged. Where an employment business supplies agency workers into a hirer's own operations, the employment business does the check and the hirer is not expected to duplicate it routinely.
• The written statement is mandatory. Existing vendor onboarding and due diligence cannot replace it, though they can form part of your evidence. No exact wording is prescribed, but pointing to equivalent clauses scattered through existing paperwork is not enough.
• One penalty per worker, normally. The Home Office would not normally expect to issue a civil penalty to more than one business in a chain for the same illegal worker.
• Repeat assignments. A worker engaged again by the same business does not need a fresh check before each assignment, provided the statutory excuse is still valid and any follow-up check is made before their permission expires.

Who Is Now in Scope, and Who Is Not

The check now follows the person who personally does the work, not the job title on the contract. The final guide's worked examples set out the main arrangements.

The guide asks you to judge substance over labels. It lists eight factors, including whether individuals personally do the work, who engages, supplies or replaces them, whether you are buying a defined service from an independent business or the provision of people, and whether substitution is permitted, expected or controlled. It states that no single factor is determinative. The classification guide from our sister firm WorkPermitCloud works through those factors. What HR needs is a dated record of the decision for each engagement type, showing who made it and on what facts.

Misclassification is still the biggest exposure. If you treat someone as outside the Scheme and the arrangement in fact operates as personal service under your direction, you have no statutory excuse, whatever the contract or the invoice says.

Construction: Liability Down the Subcontract Chain

Construction meets both new routes into liability. Individual operatives engaged directly on a labour-only or day-rate basis now fall within the Scheme as workers or individual sub-contractors, and the firm engaging them must check them before they start. Above them, a contractor that has agreed to deliver work for a client and brings in other businesses to supply the people is within extended liability.

The final guide uses this exact situation as its first example of extended liability. A construction company wins a contract to build new homes and engages other businesses through a chain of contracts to provide workers for the foundations and bricklaying. The guide says the construction company may be treated as the employer of anyone who personally does the work through that chain, and can establish a statutory excuse only by meeting the prescribed requirements for the contractual arrangements.

The Home Office's own evidence explains the focus on the sector. Research cited in the impact assessment for the section 48 extension found that 21 per cent of businesses thought illegal working was common in their sector, rising to around half of businesses in construction, food and accommodation.

Three construction points need a decision from HR.

• CIS registration does not settle scope. The final guide says an IR35 determination is a tax assessment that does not decide right to work responsibilities. In our view the same reasoning applies to the Construction Industry Scheme, which is also a tax status, so a CIS-registered subcontractor still needs a recorded substance assessment.
• Agency labour on a client project needs a deliberate call. The guide's agency example covers a hirer using temporary workers in its own operations, which is outside extended liability. A main contractor delivering a project for a client with agency operatives sits closer to the subcontracting example. The guide does not address that case directly, so our view is to treat it as in scope and put a written statement in place with the agency.
• The upstream contractor does not have to check everyone itself. Annex C confirms that an upstream party need not carry out a right to work check on every individual in the chain. It must hold the written statement, take reasonable steps before relying on assurances, and have proportionate identity verification, which it may run itself or rely on from another party in the chain.

Site access is the natural control point. An induction that matches each operative against a checked identity, and a gate or attendance system recording who was on site each day, gives you identity verification evidence with little extra work.

Gig and Platform Work: Substitution Is the Pressure Point

The final guide is direct about platform work. A person who signs up to a delivery platform, logs into the app when they want work and is paid per delivery is engaged as an individual sub-contractor, and the platform is responsible for the check. An app that matches a householder with a cleaner who does the work personally is an online matching service, and the service is responsible. Where a platform only provides ordering technology to a takeaway that uses its own delivery staff, the platform is not caught and the takeaway is the employer.

Online matching services also carry extended liability. In the guide's example, a homeowner uses a matching service to find an electrician, contracts directly with an electrical business, and that business sends one of its workers. The matching service may be treated as the employer of that worker and needs a written statement to establish a statutory excuse.

Substitution is where most platform models will be tested. The guide's example is a rider described as self-employed who is allowed to substitute and routinely asks a friend to make deliveries instead. The platform may be treated as the employer of the friend as well as the rider. To hold a statutory excuse, it must have processes in place before any work starts so that each substitute is checked and verified first.

Two Annex C answers matter here. A contract that is silent on substitution is not necessarily one that permits it, because that depends on the contractual arrangements. And where substitution is forbidden but happens anyway, the Home Office looks at whether the directly engaged worker was properly checked, which makes impersonation controls on the account holder your real protection.

For high-volume platforms, the practical answer is to build the right to work check and identity verification into onboarding and into each login or shift, for account holders and registered substitutes alike, rather than adding them afterwards.

What HR Must Do and Be Able to Evidence Now

The statutory excuse is documentary. The final guide says a business relying on it "should not rely on contractual terms alone" and must show that its arrangements are operating effectively in practice. The four areas below need to be in place for every engagement contracted on or after 1 October 2026. Our guide to right to work records for contractors sets out the files behind each one.

Contract terms: the written statement

Where you are contracted to provide work or services to a third party and engage another business to deliver them, or you operate an online matching service, you must have a written statement in place before the work starts. It sets out the terms that must be included in your contract with that business.

You may rely on assurances from the business you contract with, provided you have taken reasonable steps to satisfy yourself that they are reliable. The obligations are not limited to the first tier, so they must flow down the whole chain. There is no prescribed audit frequency; the guide ties it to the risk and to the size and complexity of the chain.

Substitution checks

Where a contract allows a worker to substitute, your statutory excuse depends on processes, implemented before the work begins, that ensure:

• a prescribed right to work check is carried out on any substitute;
• responsibility for that check is not delegated to the individuals doing the work, even where the contract describes them as in business on their own account;
• no substitute starts work before their right to work has been verified;
• the contract with the worker contains enforcement provisions, such as suspension or termination, where you or the worker know or have reasonable cause to believe a substitute is working illegally, including where a substitute refuses a check; and
• for the length of the engagement, the worker and their registered substitute are the same individuals who were checked.

The evidence the guide lists is the substitution terms, records of checks on substitutes, records that each substitution was authorised through your process, records of who did the work and when, identity verification evidence, audit records, and proof of the action you took when substitution happened outside the process.

Identity verification

Engagers in a chain, online matching services and employers with substitution clauses must have proportionate systems to make sure the person doing the work is the person who was checked. The guide's examples are identity cards or workplace passes, facial recognition through a registered RtW DVSP, biometric or attendance systems, checks against training records, qualifications or licences for the role, and re-verification at set intervals. The Home Office recommends re-verification at least once in any 24-hour period or shift of work, proportionate to the nature of the work and the risk of substitution.

You may rely on another party's identity systems, or on a third-party provider, provided you have taken reasonable steps to satisfy yourself that they are effective. Where you depart from the 24-hour benchmark, record why.

Records

Checks may be delegated to staff, workers or agency workers acting under your control and direction, but the business remains liable if a check was not done as prescribed. Apart from a registered RtW DVSP, a check carried out independently by an outside party, such as a recruitment agency or adviser, does not give you a statutory excuse. Training records for the people who run checks are therefore part of your evidence, and the Home Office right to work checklist is a sensible standard to train against. Our compliance visit checklist sets out how a request for these records usually arrives.

Digital Identity Checks from 1 October: What the Final Guide Says

From 1 October 2026 the legislation calls a digital provider a Right to Work digital verification service provider (RtW DVSP), replacing the older terms "identity service provider" (IDSP) and "identity document validation technology" (IDVT). Using one remains optional. If you choose to, it must appear on the register of digital verification services with a note that it provides right to work checks under the supplementary code for digital right to work checks. A provider certified only for general identity checks is not enough, and the code of practice lists using an unregistered or non-right-to-work provider among the situations in which you will have no statutory excuse.

The final guide adds five points that HR needs to build into the process.

• You remain responsible for the check even when a RtW DVSP carries it out.
• A screening or onboarding company that is not itself certified must name the registered provider it uses, and the output must identify that provider.
• Facial recognition, where used, must come from a RtW DVSP. You must keep the comparison securely for at least two years after the engagement ends, and offer the worker another way to verify their identity if the technology fails.
• You cannot insist on a digital check. Anyone who does not want one, or does not hold a passport, must be offered a manual check, and the code of practice on avoiding discrimination says employers cannot mandate online or digital checks except for eVisa holders.
• Existing certificates carry over. Certificates issued under the previous supplementary code remain valid under its transitional provisions. A clipped passport is a cancelled document and is never acceptable.

For the share code route step by step, see our share code right to work checks guide, and for the three methods side by side, our complete guide to right to work checks for HR teams.

Penalties and Enforcement

The civil penalty levels in the Code of practice on preventing illegal working, in force from 1 October 2026, are the same as before. What has changed is the number of working arrangements they now reach.

A Warning Notice counts for three years when the Home Office decides whether a later breach is a repeat. The penalty level is set by the code in force on the date of the breach, while your checks are judged against the code in force when each check was made. Knowingly employing an illegal worker, or having reasonable cause to believe it, is a criminal offence under section 21 of the Immigration, Asylum and Nationality Act 2006, carrying up to five years' imprisonment and an unlimited fine. Further sanctions can include closure notices, director disqualification, loss of the ability to sponsor workers and publication on GOV.UK.

There is no grace period, and enforcement remains intelligence-led. The full framework is on GOV.UK under penalties for employing illegal workers, and our guide to illegal working civil penalties explains the objection and appeal stages. If a notice has already arrived, our sister firm WorkPermitCloud explains how to challenge an illegal working civil penalty notice.

How Can WPC HR Help?

Since 1 October 2026, a right to work file for a construction or platform business is no longer one check per employee. It is a check per operative or rider, a written statement per supplier, a log of substitutes, and a daily record of who actually did the work. WPC HR's HR compliance software holds all of it in one dated, tamper-evident record, tracks every time-limited permission with follow-up alerts, and applies the same process to every engagement so the discrimination risk stays low.

If you want to know whether your current arrangements would establish a statutory excuse today, our sponsor licence compliance audit reviews how labour actually reaches your business, tests a live contract chain against the final guide, and gives you a prioritised list of gaps to close.

Conclusion

The rules that were a deadline are now the standard. For engagements contracted on or after 1 October 2026, a construction firm or platform that cannot produce a check, a written statement, its substitution records and its identity logs has no statutory excuse, and the Home Office has said there will be no grace period.

The final guide has not moved the target. It has filled in the detail, most usefully on when an arrangement starts, how agency supply works, and how far an upstream business can rely on others in the chain. Start with the arrangements you are entering into this month, record each decision, and keep the evidence where you can produce it within a day.

Glossary