Right to Work Changes Are Coming 1st October. Here's What The Construction Industry Needs to Know.

From 1 October 2026, the rules on right to work checks in the UK are changing.

To find out what that actually means for the world of construction, we sat down with two people who know this better than most: Kevin Barker, an immigration expert and lawyer and Dean Tuhey, founder of PPAC.

What’s Changing?

The civil penalty regime itself isn't new. It's been around since 2008, with seven updates to the code of practice along the way. What makes October different is that, for the first time, the legislation itself is changing, not just the guidance underneath it.

For years, the whole regime has hinged on proving one thing: an employer-employee relationship. No relationship, no penalty. As gig work and subcontracting have grown, that's become an easier argument for businesses to make back to the Home Office. From October, two things are going to close that gap:

•  Responsibility for right to work checks widens beyond direct employees to cover other working arrangements, including subcontractors, self-employed workers, and anyone a business engages. 
• Liability widens too. Previously only the employer could be held accountable, but under the new "extended liability," the Home Office can reach further up the contractual chain.

Why Construction?

Construction isn't the only sector affected, but it's carrying more of the weight than most. Because it has such a diverse workforce, with supply chains that run several layers deep to work through, and that depth is exactly where oversight tends to slip. 

Who does it apply to and who’s liable?

So who does this actually apply to? In practice, everyone. Whether you're a main contractor, a subcontractor, or engaging labour anywhere in between, if you're bringing someone onto a UK site from October onwards, this now touches you.

And liability is now where most of the confusion sits. If a subcontractor hires someone illegally, who's liable? Them or the main contractor? The answer, according to Kevin, is potentially both. Only the end client won't be liable. Historically, liability has hinged on proving an employer-employee relationship, and subcontractors have long argued their workers are self-employed. That argument gets much harder to make from October.

"Similar to IR35; what if someone calls themselves self-employed? Or if this is in the contract? In many ways it's irrelevant, because it's down to what the Home Office understands the relationship to be. If that fits within the new legislation, they'll impose a penalty, and then it's for the company to challenge that”, said Kevin.

In other words, the paperwork label doesn't decide the outcome. The actual working relationship does, and that's assessed after the fact, not agreed in advance.

The risk beyond the numbers.

The headline numbers are significant. Penalties are rising from a cap of £20,000 per person to £45,000 and £60,000 for repeat breaches. Under these new changes, a single multi-worker breach can easily clear £1 million.

But the financial risk doesn't stop at the fine itself, and this is the part businesses tend to underestimate. Dean lays it out with a simple scenario: a business caught with 10 illegally working people could be looking at £400,000 in civil penalties. That hit doesn't stay contained to one project. It can affect the financial state of the whole business, which then affects delivery on other projects, which can trigger re-tendering, client-side penalty clauses, and delays that cost more than the original fine.

"It's not just about civil penalty fines. It's about whether businesses can sustain the risk... that can cause a financial loss rather than a penalty fine, because they need to revisit the packages", said Dean.

And the reputational side matters too. Businesses are increasingly named publicly when penalties are issued, and it's not just the Home Office watching. The Fair Work Agency, a newer division focused on labour exploitation, is now auditing pay and vetting practices in parallel.

Can I even check someone who isn't my employee?

It's a question a lot of businesses have quietly been sitting on. If someone isn't directly employed by you (a subcontractor's worker, someone further down the chain), do you actually have the right to check them, or are you overstepping?

The answer is yes, you can. The statutory duty to run a right to work check still belongs to the direct employer, but that doesn't stop a Principal Contractor from checking anyone coming onto its sites. That right sits under UK GDPR's Legitimate Interests basis, covering things like controlling site access, preventing illegal working, and being able to show due diligence was done. From 1 October, that reasoning only gets stronger. The new legislation ties this kind of verification directly to avoiding civil penalties, so there's less reason than ever to hold back from checking. 

Where the innDex and PPAC integration can help.

The innDex and PPAC integration is a direct link between innDex's site access platform and PPAC's identity and right to work verification, confirming a worker's status before that worker sets foot on site. The integration works through a validation code entered into innDex, which checks between the two businesses using unique references, backed by an on-site check that ties everything together. 

innDex’s facial recognition is matched against skill cards, right to work documentation, an online selfie, and a passport, closing the gap between a remote document check and confirming the actual person walking through the gate is the same person who was checked. The process is backed with further due diligence. As a bare minimum, all this evidence is vital for confirming the right person is in place, from checking visa conditions, to following up directly with universities on student visas, confirming sponsorship details, and accounting for the different document requirements for all workers.

Kevin and Dean will be unpacking this in full, with real scenarios and the chance to ask questions directly, at the joint innDex and PPAC event on 29 September in London.

Register your interest here.