If you run an AOR, an umbrella, an agency, or you otherwise outsource contractors into UK businesses, the right to work changes arriving on 1 October 2026 are aimed at you.

The new Section 48 of the Border Security, Asylum and Immigration Act 2025 extends checking duties beyond employees to certain non-employee engagements.

Until now, the rules only applied to direct employees. Hirers had no legal duty to check the right to work of contractors or other non-employees, although many did anyway as good practice, and those businesses will find the transition far easier. From October, what was sensible housekeeping becomes a legal requirement, and that quiet carve-out for the flexible labour market disappears.

THE LAW IS AIMED AT CATCHING INTERMEDIARIES

The new rules carve out the genuinely self-employed. Someone in business on their own account, contracting directly with their own clients, stays outside the regime. The Home Office's examples are a plumber with their own customer base and a graphic designer engaged through their own company on a genuine business-to-business project.

That carve out protects the contractor's end client. It does not protect the business supplying the contractor. The statute is built for the triangle. An engagement is caught where the individual performs the work personally, even where the work is done for someone other than the business engaging them, and where they get the work through an intermediary the carve-out is tested against the end relationship, not against you. The draft code confirms the position. The exclusion does not cover people who obtain work through an intermediary, platform or similar arrangement, and engagements where individuals get work through an agency or intermediary are included.

LIMITED COMPANY CONTRACTORS ARE IN SCOPE TOO

Where you engage a contractor through their own limited company and place them with your clients, the arrangement runs through an intermediary, which is exactly what the regime is designed to reach. Describing someone as self-employed is not conclusive, and the same goes for the company wrapper around the engagement. How the work is arranged, supplied and performed matters more.

The one place independence still matters is the pay agency only arrangement. If the contractor found the client themselves and you're in the middle purely to run payments, the relationship being tested is theirs with the client, not theirs with you, and a contractor genuinely in business on their own account may fall outside the definition. That describes a slice of some AOR models. It does not describe placements you sourced, and it does not survive you contracting with the client to provide the contractor, since promising the work onwards brings its own limb of the regime with no self-employed carve-out at all. So the practical split is simple. Engagements you sourced or promised, assume the contractor is caught and check them. Engagements where the client relationship is genuinely the contractor's own and you only administer it, take advice before assuming anything.

Your contract with the end client deserves the same scrutiny. The regime catches businesses that have promised to provide the work, or to arrange for it to be provided, and that second half is wide. A contract that has you acting as agent on the client's behalf, introducing the contractor and administering the arrangement while the work obligation runs directly between contractor and client, leaves you out of that limb. A contract that makes you the intermediary responsible for the supply of contractors will likely put you in it. What decides it is the structure of the obligations, not the name at the top of the agreement, and the label agency means little if the substance says provider.

WHAT COMPLIANCE ACTUALLY LOOKS LIKE

Your position depends on who holds the engagement, so start there.

Where you engage the contractor directly, whether as sole trader or through their PSC, you are the employer for these purposes. Your protection is the prescribed right to work check, done before the engagement starts, exactly as you'd run it for an employee.

Where someone else holds the engagement, say you're an agency placing through an umbrella, or work flows through a sub-vendor before it reaches the individual, the extended rules can treat you as employing whoever actually does the work, even with no contract between you and no knowledge of who they are. Here the protection is contractual and operational. Your contract with the party between you and the worker needs five areas covered, including their right to work obligations, flow-down to anyone below them, audit rights, enforcement, and cooperation with Home Office investigations. You also need controls on substitution and identity verification confirming the person doing the work is the person who was checked. The draft code points to site passes, facial verification and periodic reverification, and an assurance clause may not be enough if nobody checks the agreed controls actually operate.

Many of your engagements will put you in the first position, some in both at once across different placements. The mapping exercise is knowing which is which.

TIMING

The rules apply from 1 October 2026 and will likely only catch new engagements starting from that date, though the point is not beyond debate until the guidance is final. Existing agreements still need updating, because new placements under them will be caught.

So the sequence between now and then is to map your contractor population against the new definitions, update the master agreements that will govern new placements first, and get verification working on the ground rather than on paper. Do that and you'll spend the autumn as the intermediary explaining the rules to clients, instead of the one being asked awkward questions by them.

‍