How the UK’s new illegal working rules will impact your commercial contracts

If your business sits anywhere between an end client and the people who actually deliver the work, this article is for you.

Why should commercial teams care about immigration rules?

Until now, right to work checks have been primarily an HR and recruitment issue. The obligation sat with direct employers (in the truest sense of the word): if you hired someone under a contract of employment, you needed to check their right to work before they started.

From October, that changes in two important ways.

• First, the definition of "employer" is getting much wider. The Border Security, Asylum and Immigration Act 2025 broadens who counts as an "employer" for right to work purposes well beyond traditional employment relationships. It now covers engagements under worker's contracts (e.g. agency workers, zero-hours workers, casual staff), individual sub-contractors and online matching services. This means many more businesses will need to carry out right to work checks directly on the individuals they engage.
• Second, a new "extended liability" regime reaches into supply chains and subcontracting arrangements. Where a business is contracted to provide services to a third party and subcontracts delivery to another employer, it may be treated as “employing” any individual who personally carries out the work – even if it has no direct relationship with that individual. Because the definition of "employer" is now wider, the concept of contracting with "another employer" in a supply chain is correspondingly wider, pulling more subcontracting arrangements into scope.

The penalties are serious: up to £60,000 per illegal worker for a repeat breach, potential criminal liability carrying up to five years' imprisonment, and reputational consequences including publication as a non-compliant employer.

For commercial contracts teams, the practical consequence is that certain subcontracts and supplier agreements will need to contain specific written terms before work starts, or the upstream business risks losing its statutory defence against extended liability (explained further below).

How the statutory excuse works: "guilty until proven innocent"

Under the new rules, when the Home Office identifies illegal working, it will work backwards up the contracting chain. If an individual is found to be working illegally, the Home Office will first look for the direct employer. But if that employer cannot be identified, other upstream parties may also be held liable.

The critical point is that liability is the starting position. If you are in scope and illegal working is identified somewhere in your supply chain, you will be deemed liable for a civil penalty unless you can demonstrate that you have established a statutory excuse by ticking the right boxes.

For businesses caught by the extended liability regime, establishing a statutory excuse requires compliance with prescribed requirements before the work starts. Which requirements apply depends on which of the three scenarios described below you fall into:

• Written contractual terms: for businesses in a subcontracting chain, or operating as an online matching service, specific prescribed terms must be in the contract with the downstream supplier or service provider (more on this below).
• Substitution controls: for businesses that directly employ an individual under a contract permitting substitution, you must have certain processes ensuring any substitute's right to work is checked before they start.
• Identity verification: this applies across all scenarios: you must maintain proportionate systems to ensure the individual doing the work is the same person whose right to work was checked.

Whichever requirements apply to your arrangement, contractual terms alone are not enough – the Home Office will look at whether the arrangements work and are being enforced in practice, not just on paper.

The extended liability regime: when does it apply?

The new rules introduce three scenarios in which liability for illegal working can extend beyond the direct employer of an individual worker:

1. Subcontracting delivery of services

Where a business is under a contract to provide work or services to a third party, and enters into a contract with another “employer” to provide or arrange for the delivery of that work or those services (including by providing workers to carry out the work), the upstream business may be treated as employing any individual who personally provides the work or services in the supply chain – even though it has no direct relationship with that individual.

Example: An events company is contracted by a corporate client to stage a product launch. The events company engages a catering company to service the event. The catering company agrees to provide catering services and in turn sources workers through various means – some are its own employees, some are agency workers, some are independent contractors. Under the extended liability regime, the events company may be caught by the extended liability regime (and treated as the “employer” of any individuals who personally carry out the catering work).

2. Online matching services

Where an “online matching service” (i.e. a platform) matches a corporate service provider with a client, and the service provider enters into a contract with that client, the platform may be treated as employing any individual who personally carries out the work.

Example: An online marketplace platform matches a brand with a corporate video production company. The production company contracts directly with the brand and sends members of its own crew to deliver the shoot. Because the production company is a business that engages its own workers, the platform may be treated as the “employer” of those workers for right to work purposes.

3. Substitution arrangements

Where a business (as “employer”) employs an individual worker under a contract that permits substitution – i.e. allows another person to carry out the work in the individual’s place – the business may be treated as employing the substitute as well as the original worker.

Example: A food delivery platform engages couriers as independent contractors. The contract permits a courier to ask a friend to complete deliveries on their behalf. Under the new rules, the platform may be treated as the “employer” of any substitute who personally carries out deliveries, not just the originally registered courier.

The written T&Cs: what must your contracts include?

For businesses falling into scenarios 1 and 2 above (subcontracting delivery of services / online matching services), the prescribed requirements include having a written statement in place with the downstream supplier/employer before the work commences. That statement must include terms requiring the downstream supplier to:

1. Carry out prescribed right to work checks on any individual employed to perform the relevant work or services.
2. Carry out follow-up checks on personnel that have time-limited permission to work in the United Kingdom.
3. Not further subcontract the work or services without the upstream business's prior written consent, and replicate equivalent right to work obligations in any permitted subcontracting.
4. Permit audits of the supplier's compliance with right to work checks.
5. Accept enforcement action – including suspension or termination of the contract – where illegal working is identified and a statutory excuse has not been established.
6. Cooperate with Home Office investigations, including by providing information about the contractual chain, details of each employer or service provider involved, and any other information the Home Office considers relevant.

For businesses falling into scenario 3 above (substitution arrangements) – whilst the full written statement above is not required, among the “substitution controls” is a requirement that the upstream employer must have contractual provisions in place between it and the worker (which may include, but are not limited to, suspension or termination of the contract) for use where the employer or the worker knows, or has reasonable cause to believe, that a substitute is working illegally, including where the substitute has failed to comply with a request to complete a right to work check.

These are not optional best-practice clauses. They are prescribed contractual requirements from the Home Office. If they are not in place before the work starts, the upstream business will not be able to rely on a statutory excuse.

What about existing contracts?

The new provisions come into force on 1 October 2026. At the time of writing, the Home Office’s position – as set out in the new Employer’s Guide to Right to Work Checks (11 September 2026) – is that the prescribed requirements relating to the contractual arrangements apply only where the relevant contractual arrangements were entered into on or after 1 October 2026. On this reading, existing contracts entered into before that date may not strictly need to be updated to contain the mandatory prescribed terms in order for the upstream business to establish a statutory excuse.

However, there is a tension between this guidance and the statute itself. Section 15A of the Immigration, Asylum and Nationality Act 2006 does not contain a clear temporal carve-out for pre-existing contracts, and the Code of Practice frames the threshold differently (by reference to when employment commenced, rather than when the upstream contract was entered into). The Home Office has also shown a willingness to revise its position between guidance iterations, and there is no guarantee that this more permissive reading will be maintained.

Who is NOT caught?

The Employer’s Guide to Right to Work Checks (11 September 2026) gives a few examples of arrangements that fall outside the extended liability regime:

• Purchasing services or workers for your own operations. This is logically outside the regime, because there is no third party benefiting from an onward services contract, and therefore no "subcontracting chain" for extended liability to bite on.
• Supply of finished goods. Where a business is only supplying “finished goods” rather than work or services, the regime does not apply, even if the supplier used an employment business or subcontracted labour somewhere in its own production process. The Guidance's example is a food producer supplying sandwiches to a retailer, although it is unclear how far "finished goods" is meant to stretch, particularly for digital goods, software, or other product-based deliverables that do not sit as comfortably within a traditional goods/services distinction.
• Providing technology or ordering services only. A platform that merely provides the technology or ordering infrastructure, without itself engaging the workers (e.g. couriers / delivery drivers) who carry out the underlying work, falls outside the regime.

Labour supply vs services supply

An important preliminary question arises where the arrangement involves an employment business, staffing agency, managed service provider (MSP), or other temporary worker supplier. The extended liability provisions apply only to the provision of work or services – they do not apply where an employment business is solely supplying workers (i.e. labour) directly to a hirer and is not itself contracted to deliver the work or services. Whether an arrangement is one for the supply of labour or the supply of services is a nuanced, fact-sensitive determination, and the contractual label adopted by the parties will not by itself determine the position. Specialist advice is recommended on this point to determine whether a staffing arrangement falls inside or outside scope of the extended liability regime.

What about individual freelancers who contract via PSCs?

Personal service companies (PSCs) are common across the creative, technology and professional services sectors. Many freelancers, consultants, influencers and contractors provide their services through their own limited company rather than contracting personally as a sole trader. How do the new rules apply to them?

Where a business engages a PSC for its own benefit, the position is relatively clear. The Home Office guidance gives the example of a graphic designer engaged through their own PSC to work on a specific project: where the PSC contracts with the client company and invoices in its own name, no right to work check is required by the client. The client is contracting with a separate business, not “employing” an individual within the scope of the Right to Work Scheme.

But where the PSC is engaged as part of a subcontracting chain – i.e. the engaging business is itself under a contract to provide services to a third party client, and engages the PSC to deliver part of that work – the position is less straightforward.

On a plain reading of the extended liability regime, if the engaging business contracts with the PSC to provide or arrange workers to carry out work that fulfils a third-party contract, the prescribed written terms may still be needed in the contract between the engaging business and the PSC. The PSC is, after all, an "employer" under the broadened definition (it employs the individual who performs the work, even if that individual is also its sole owner and director).

This creates a slightly odd scenario: the prescribed terms would require the PSC to carry out right to work checks on individuals it employs to perform the relevant work – which, in many cases, means the PSC checking the right to work of its own sole director-shareholder. It would also need to comply with the other prescribed requirements (no further subcontracting without consent, audit rights, enforcement provisions and cooperation obligations).

Whether the Home Office intends this result or would apply the regime pragmatically to owner-managed PSCs is not entirely clear from the current guidance. For now, businesses engaging PSC freelancers as part of a supply chain delivering third-party client work should be aware that the extended liability provisions may apply, and should consider including the prescribed terms in their contracts with PSCs as a precautionary measure – even if the practical effect feels somewhat circular.

This is an area where we expect further clarity as the regime beds in. In the meantime, we would recommend erring on the side of inclusion rather than assuming a PSC structure takes an arrangement outside scope.

What should you do now?

1. Map your subcontracting arrangements. Identify where your business is either contracted to provide services to a third party and then subcontracts delivery of those services, or where you are engaging individual workers under contracts that allow substitution.
2. Assess existing supplier contracts to identify where mandatory prescribed terms are likely to be needed on renewal on or after 1 October, and consider updating priority existing contracts via addendums or side letters.
3. Consider template clauses for standard supplier and subcontractor agreements that can be rolled out at scale.
4. Coordinate across teams. This is not just an HR or immigration issue. Procurement, legal, business affairs, operations and contract management all need to understand the new requirements.
5. Strengthen procurement due diligence. Enhanced due diligence should be built into onboarding and renewal processes for any subcontractor, employment business or other supplier that provides individuals to carry out work. This means asking the right questions upfront: how the supplier checks right to work, how it evidences and retains those checks, whether it uses further subcontractors or substitutes, and how it would respond to a Home Office information request. A procurement checklist geared to these questions is often the most efficient way to surface risk before a contract is signed, rather than relying on the written statement terms alone.
6. Take legal advice early, particularly for complex supply chains, platform models, arrangements involving substitution, freelancer and influencer engagements, and any situation where it is not clear whether an arrangement falls inside or outside scope. The boundary between a genuine business-to-business services arrangement and an engagement that is "in substance" personal service is fact-sensitive and may require careful analysis.

How we can help

We are working closely with our immigration and employment teams to support clients through these changes. We can assist with:

• Identifying which of your existing contracts and supplier relationships fall within scope of the extended liability regime.
• Reviewing existing agreements and advising on the most efficient route to compliance – whether through updating live contract via addendums or flagging these contracts for update at the next renewal date post-1 October 2026.
• Drafting template right to work clauses for standard supplier and subcontractor agreements that can be rolled out at scale.
• Building or enhancing procurement due diligence checklists for onboarding and renewing subcontractors and employment businesses, geared to the right questions on right to work compliance.
• Advising on borderline cases, including PSC arrangements, platform models, influencer engagements and complex supply chains.
• Developing compliance toolkits and training for procurement, contract management and business affairs teams.

With the 1 October 2026 deadline approaching and no transitional arrangements, businesses with significant supplier networks should be starting this work now. Please get in touch with JJ Shaw or a member of our Digital, Commerce & Creative team to discuss how these changes may affect your commercial contracts.