Why the check matters at all
A right-to-work check is not paperwork for its own sake. Done correctly it establishes a statutory excuse, which is the thing that stands between an agency and a civil penalty for illegal working. That penalty runs up to £60,000 per worker at the repeat-breach level in force since 13 February 2024. Done incorrectly, the check exists and the excuse does not.
There are three routes that establish the excuse: a manual document check, an online check using the worker's share code, and a digital identity check through a certified provider. Anything else is a record of having looked, which is not the same thing.
What changes on 1 October 2026
Under SI 2026/700, three things change together.
- IDSPs become RtW DVSPs. Identity service providers are renamed right-to-work digital verification service providers. The route is the same; the label on it changes, and so does the guidance wrapped around it.
- Facial-image records join the digital route. Where the check ran through a digital provider, a facial-image record forms part of what the agency holds.
- Supply-chain statements join the check. The check reaches beyond the immediate employer relationship into the chain the worker is supplied through, which for an agency is the whole business model.
Checks already on file
A check correctly made under the rules in force at the time keeps the excuse it established. Nothing about the reform reaches backwards. What it does mean is that the date of a check is load-bearing: to know whether a given record is sound, you have to know which rules applied on the day it was made. An agency holding checks as a folder of scans, without dates and methods as data, cannot answer that question at all.
What the software has to do
- Record the route, not just the outcome. Which of the three ways established the excuse, because the new duties attach to one of them and not the others.
- Know what was owed on the day. The rules that applied when the check was made, held as dated configuration rather than as whatever the code happens to do today.
- Refuse an incomplete check rather than file it. A digital check from 1 October without its facial-image record should not be accepted as complete. Recording it as done is worse than not recording it, because it tells the agency it is covered.
- Chase the recheck. Time-limited permission means a date in the future, and a date in the future that nothing watches is a date that passes.
BookKept already holds the October rules, dated
The right-to-work duties are a versioned rule pack carrying an effective date and the legislation that establishes it. The 1 October 2026 pack is in the product now and takes effect on that date, not on a deploy. From then a digital check that does not record its facial-image record and supply-chain statement is refused, and the refusal names the source rather than failing silently. Checks made before the date keep the position that applied when they were made, so the record stays true about the past.