Right-to-work checks from 1 October 2026

Why the check matters at all

A right-to-work check is not paperwork for its own sake. Done correctly it establishes a statutory excuse, which is the thing that stands between an agency and a civil penalty for illegal working. That penalty runs up to £60,000 per worker at the repeat-breach level in force since 13 February 2024. Done incorrectly, the check exists and the excuse does not.

There are three routes that establish the excuse: a manual document check, an online check using the worker's share code, and a digital identity check through a certified provider. Anything else is a record of having looked, which is not the same thing.

What changes on 1 October 2026

Under SI 2026/700, laid 30 June 2026 and in force on 1 October 2026:

• IDSPs become RtW DVSPs. Identity service providers are renamed right-to-work digital verification service providers. The route is the same; the label on it changes, and so does the guidance wrapped around it.
• The scheme extends beyond employees to specified wider working arrangements. This is the part that matters most to an agency, because it is how contract work is engaged: the duty follows the arrangement rather than stopping at a contract of employment.

Checks already on file

A check correctly made under the rules in force at the time keeps the excuse it established. Nothing about the reform reaches backwards. What it does mean is that the date of a check is load-bearing: to know whether a given record is sound, you have to know which rules applied on the day it was made. An agency holding checks as a folder of scans, without dates and methods as data, cannot answer that question at all.

What the software has to do

• Record the route, not just the outcome. Which of the three ways established the excuse, because the new duties attach to one of them and not the others.
• Know what was owed on the day. The rules that applied when the check was made, held as dated configuration rather than as whatever the code happens to do today.
• Refuse an incomplete check rather than file it. A check missing what the rules in force actually required should not be accepted as complete. Recording it as done is worse than not recording it, because it tells the agency it is covered. The corollary matters just as much: the software must not refuse a lawful check on a rule nobody can cite.
• Chase the recheck. Time-limited permission means a date in the future, and a date in the future that nothing watches is a date that passes.