If your business sits anywhere between an end client and the people who actually deliver the work, this article is for you. For the full technical detail on the underlying legislation, see our Immigration team's articles on the draft Code of Practice and the draft Employer's Guide.

Why should commercial teams care about immigration rules?

Until now, right to work checks have been primarily an HR and recruitment issue. The obligation sat with direct employers (in the truest sense of the word): if you hired someone under a contract of employment, you needed to check their right to work before they started.

From October, that changes in two important ways.

• First, the definition of "employer" is getting much wider. The Border Security, Asylum and Immigration Act 2025 broadens who counts as an "employer" for right to work purposes well beyond traditional employment relationships. It now covers engagements under worker's contracts (e.g. agency workers, zero-hours workers, casual staff), individual sub-contractors and online matching services. This means many more businesses will need to carry out right to work checks directly on the individuals they engage.

• Second, a new "extended liability" regime reaches into supply chains and subcontracting arrangements. Where a business is contracted to provide services to a third party and subcontracts delivery to another employer, it may be treated as “employing” any individual who personally carries out the work – even if it has no direct relationship with that individual. Because the definition of "employer" is now wider, the concept of contracting with "another employer" in a supply chain is correspondingly wider, pulling more subcontracting arrangements into scope.

The penalties are serious: up to £60,000 per illegal worker for a repeat breach, potential criminal liability carrying up to five years' imprisonment, and reputational consequences including publication as a non-compliant employer.

For commercial contracts teams, the practical consequence is that certain subcontracts and supplier agreements will need to contain specific written terms before work starts, or the upstream business risks losing its statutory defence against extended liability (explained further below).

How the statutory excuse works: "guilty until proven innocent"

Under the new rules, when the Home Office identifies illegal working, it will work backwards up the contracting chain. If an individual is found to be working illegally, the Home Office will first look for the direct employer. But if that employer cannot be identified, other upstream parties may also be held liable.

The critical point is that liability is the starting position. If you are in scope and illegal working is identified somewhere in your supply chain, you will be deemed liable for a civil penalty unless you can demonstrate that you have established a statutory excuse by ticking the right boxes.

For businesses caught by the extended liability regime, establishing a statutory excuse requires compliance with prescribed requirements before the work starts. Which requirements apply depends on which of the three scenarios described below you fall into:

• Written contractual terms: for businesses in a subcontracting chain, or operating as an online matching service, specific prescribed terms must be in the contract with the downstream supplier or service provider (more on this below).
• Substitution controls: for businesses that directly employ an individual under a contract permitting substitution, you must have certain processes ensuring any substitute's right to work is checked before they start.
• Identity verification: this applies across all scenarios: you must maintain proportionate systems to ensure the individual doing the work is the same person whose right to work was checked.

Whichever requirements apply to your arrangement, contractual terms alone are not enough – the Home Office will look at whether the arrangements work and are being enforced in practice, not just on paper.

The extended liability regime: when does it apply?

The new rules introduce three scenarios in which liability for illegal working can extend beyond the direct employer of an individual worker:

1. Subcontracting delivery of services

Where a business is under a contract to provide work or services to a third party, and enters into a contract with another “employer” to provide or arrange workers to carry out that work, the upstream business may be treated as employing any individual who personally provides the work or services in the supply chain – even though it has no direct relationship with that individual.

Example: An events company is contracted by a corporate client to stage a product launch. The events company engages a catering company to service the event. The catering company in turn sources workers through various means – some are its own employees, some are agency workers, some are independent contractors. Under the extended liability regime, the events company may be caught by the extended liability regime (and treated as the “employer” of any individuals who personally carry out the catering work).

2. Online matching services

Where an “online matching service” (i.e. a platform) matches a corporate service provider with a client, and the service provider enters into a contract with that client, the platform may be treated as employing any individual who personally carries out the work.

Example: An online marketplace platform matches a brand with a corporate video production company. The production company contracts directly with the brand and sends members of its own crew to deliver the shoot. Because the production company is a business that engages its own workers, the platform may be treated as the “employer” of those workers for right to work purposes.

3. Substitution arrangements

Where a business employs an individual under a contract that permits substitution – i.e. allows another person to carry out the work in their place – the business may be treated as employing the substitute as well as the original worker.

Example: A food delivery platform engages couriers as independent contractors. The contract permits a courier to ask a friend to complete deliveries on their behalf. Under the new rules, the platform may be treated as the “employer” of any substitute who personally carries out deliveries, not just the originally registered courier.

The written T&Cs: what must your contracts include?

For businesses falling into scenarios 1 and 2 above (subcontracting delivery of services / online matching services), the prescribed requirements include having a written statement in place with the downstream supplier/employer before the work commences. That statement must include terms requiring the downstream supplier to:

1. Carry out prescribed right to work checks on any individual employed to perform the relevant work or services.
2. Not further subcontract the work or services without the upstream business's prior written consent, and replicate equivalent right to work obligations in any permitted subcontracting.
3. Permit audits of the supplier's compliance with right to work checks.
4. Accept enforcement action – including suspension or termination of the contract – where illegal working is identified and a statutory excuse has not been established.
5. Cooperate with Home Office investigations, including by providing information about the contractual chain, details of each employer or service provider involved, and any other information the Home Office considers relevant.

For businesses falling into scenario 3 above (substitution arrangements) – whilst the full written statement above is not required, among the “substitution controls” is a requirement that the upstream employer must have contractual provisions in place between it and the worker (which may include, but are not limited to, suspension or termination of the contract) for use where the employer or the worker knows, or has reasonable cause to believe, that a substitute is working illegally, including where the substitute has failed to comply with a request to complete a right to work check.

These are not optional best-practice clauses. They are prescribed contractual requirements from the Home Office. If they are not in place before the work starts, the upstream business will not be able to rely on a statutory excuse.

Existing contracts will need updating – not just new ones

The new provisions come into force on 1 October 2026 without any stated transitional arrangements. The Home Office has indicated that civil penalties under the extended liability regime may be imposed where the "employment" of a worker commences on or after 1 October 2026. This means that the prescribed written terms must be in place to cover any worker whose engagement starts on or after that date – even if the overarching contract between the upstream business and its supplier was entered into well before October.

In practice, this means it will not be sufficient to include the prescribed wording only in contracts concluded from 1 October 2026 onwards. Existing contracts that will still be in force on or after that date, and under which new workers may be engaged or new assignments may commence, will also need to be updated. This could be done through an addendum to the existing contract, a side letter, or by entering into a new version of the contract that supersedes the current one and includes the required terms.

Businesses with large numbers of supplier and subcontractor relationships should factor this into their planning now, as the volume of contract amendments required before the go-live date could be significant.

Who is NOT caught?

The draft Employer's Guide gives a few examples of arrangements that fall outside the extended liability regime:

• Purchasing services or workers for your own operations. This is logically outside the regime, because there is no third party benefiting from an onward services contract, and therefore no "subcontracting chain" for extended liability to bite on.
• Supply of finished goods. Where a business is only supplying “finished goods” rather than work or services, the regime does not apply, even if the supplier used an employment business or subcontracted labour somewhere in its own production process. The Guidance's example is a food producer supplying sandwiches to a retailer, although it is unclear how far "finished goods" is meant to stretch, particularly for digital goods, software, or other product-based deliverables that do not sit as comfortably within a traditional goods/services distinction.
• Providing technology or ordering services only. A platform that merely provides the technology or ordering infrastructure, without itself engaging the workers (e.g. couriers / delivery drivers) who carry out the underlying work, falls outside the regime.

What about individual freelancers who contract via PSCs?

Personal service companies (PSCs) are common across the creative, technology and professional services sectors. Many freelancers, consultants, influencers and contractors provide their services through their own limited company rather than contracting personally as a sole trader. How do the new rules apply to them?

Where a business engages a PSC for its own benefit, the position is relatively clear. The Home Office guidance gives the example of a graphic designer engaged through their own PSC to work on a specific project: where the PSC contracts with the client company and invoices in its own name, no right to work check is required by the client. The client is contracting with a separate business, not “employing” an individual within the scope of the Right to Work Scheme.

But where the PSC is engaged as part of a subcontracting chain – i.e. the engaging business is itself under a contract to provide services to a third party client, and engages the PSC to deliver part of that work – the position is less straightforward.

On a plain reading of the extended liability regime, if the engaging business contracts with the PSC to provide or arrange workers to carry out work that fulfils a third-party contract, the prescribed written terms may still be needed in the contract between the engaging business and the PSC. The PSC is, after all, an "employer" under the broadened definition (it employs the individual who performs the work, even if that individual is also its sole owner and director).

This creates a slightly odd scenario: the prescribed terms would require the PSC to carry out right to work checks on individuals it employs to perform the relevant work – which, in many cases, means the PSC checking the right to work of its own sole director-shareholder. It would also need to comply with the other prescribed requirements (no further subcontracting without consent, audit rights, enforcement provisions and cooperation obligations).

Whether the Home Office intends this result or would apply the regime pragmatically to owner-managed PSCs is not entirely clear from the current guidance. For now, businesses engaging PSC freelancers as part of a supply chain delivering third-party client work should be aware that the extended liability provisions may apply, and should consider including the prescribed terms in their contracts with PSCs as a precautionary measure – even if the practical effect feels somewhat circular.

This is an area where we expect further clarity as the regime beds in. In the meantime, we would recommend erring on the side of inclusion rather than assuming a PSC structure takes an arrangement outside scope.

What should you do now?

1. Map your subcontracting arrangements. Identify where your business is contracted to provide services to a third party and then subcontracts delivery.
2. Prioritise high-volume or high-risk supplier relationships – particularly those involving individuals rather than large corporate suppliers with established compliance programmes.
3. Review and update contracts to include the five prescribed terms before 1 October 2026. Remember: this includes existing contracts that will still be in force on or after that date, not just new ones. An addendum, side letter or superseding agreement may be needed.
4. Consider template clauses for standard supplier and subcontractor agreements that can be rolled out at scale.
5. Coordinate across teams. This is not just an HR or immigration issue. Procurement, legal, business affairs, operations and contract management all need to understand the new requirements.
6. Strengthen procurement due diligence. Enhanced due diligence should be built into onboarding and renewal processes for any subcontractor, employment business or other supplier that provides individuals to carry out work. This means asking the right questions upfront: how the supplier checks right to work, how it evidences and retains those checks, whether it uses further subcontractors or substitutes, and how it would respond to a Home Office information request. A procurement checklist geared to these questions is often the most efficient way to surface risk before a contract is signed, rather than relying on the written statement terms alone.
7. Take legal advice early, particularly for complex supply chains, platform models, arrangements involving substitution, freelancer and influencer engagements, and any situation where it is not clear whether an arrangement falls inside or outside scope. The boundary between a genuine business-to-business services arrangement and an engagement that is "in substance" personal service is fact-sensitive and may require careful analysis.

How we can help

We are working closely with our Immigration and Employment teams to support clients through these changes. We can assist with:

• Identifying which of your existing contracts and supplier relationships fall within scope of the extended liability regime.
• Reviewing existing agreements and advising on the most efficient route to compliance – whether through addendums, side letters or replacement terms.
• Drafting template right to work clauses for standard supplier and subcontractor agreements that can be rolled out at scale.
• Building or enhancing procurement due diligence checklists for onboarding and renewing subcontractors and employment businesses, geared to the right questions on right to work compliance.
• Advising on borderline cases, including PSC arrangements, platform models, influencer engagements and complex supply chains.
• Developing compliance toolkits and training for procurement, contract management and business affairs teams.

With the 1 October 2026 deadline approaching and no transitional arrangements, businesses with significant supplier networks should be starting this work now. Please get in touch with JJ Shaw or another member of our Digital, Commerce & Creative team to discuss how these changes may affect your commercial contracts.