From 1 October 2026, the right-to-work regime governed by the Immigration, Asylum and Nationality Act 2006 (sections 15 to 25) extends well beyond the PAYE workforce to cover workers on contracts for services, individual sub-contractors and people engaged through online matching platforms. The Home Office estimates that 3.75 million workers fall newly into scope, and the civil penalty for a first breach reaches up to £45,000 per worker. Critically, liability travels up the labour supply chain to the end-hiring client, not just the staffing intermediary. Research published by Stack Logic on 28 August 2026 found that one in five UK recruitment agencies had not yet heard of the changes, a readiness gap that has quietly become a board-level risk for any organisation relying on contingent or platform labour.

For HR Directors and CHROs, the instinct to treat this as a supplier compliance matter is understandable but strategically hazardous. When a supply-chain check fails, the Home Office penalty and the reputational consequence land on the client organisation at the same time as on the agency. The Recruitment and Employment Confederation (REC), the principal trade body for UK staffing businesses, has long maintained guidance on lawful hiring practices, but the Stack Logic data suggests that awareness of this specific reform has not penetrated evenly across the agency market, particularly among smaller, perm-focused firms.

What actually changes on 1 October

Until this autumn, statutory right-to-work obligations have applied to employees in the conventional sense. From 1 October, the regime extends to workers engaged on contracts for services, individual sub-contractors and people working through online matching platforms, bringing gig, umbrella and platform populations inside the same evidentiary standard that previously applied only to PAYE hires. The Immigration, Asylum and Nationality Act 2006 already establishes the civil penalty framework at section 15; what changes is the breadth of the workforce category to which that framework applies.

Two structural features make this materially different from a routine regulatory tightening. First, 3.75 million newly in-scope workers is a figure large enough to reshape how staffing businesses schedule and onboard assignments. Second, the upward liability chain means a compliance failure at the agency or umbrella level can manifest as a £45,000-per-worker penalty event at the client organisation. The Chartered Institute of Personnel and Development (CIPD), which tracks workforce compliance practice across its 160,000-strong membership, has previously identified contingent workforce governance as a persistently underinvested area of HR operations, and this reform tests exactly that gap.

The readiness gap, measured

Stack Logic surveyed 57 UK recruitment agencies and produced the first sector-wide readiness measurement for the October changes. The results reveal that awareness gaps, tooling gaps and audit gaps cluster together and run consistently along firm size. Of the 57 agencies, 33 track right-to-work status manually; 13 of those do so on spreadsheets. None of the 13 spreadsheet-based agencies could produce evidence of a compliant check for every worker on assignment on the same day the question was asked. Of the 13 firms using a dedicated digital checking tool, 11 could.

Jack Roberts, who directed the Stack Logic survey, described the pattern in these terms:

The Home Office's own research found 89% of employers were confident they do right to work checks correctly, and 80% of them then got a compliance question wrong. What we found in recruitment is that the confidence gap, the tooling gap and the audit gap are the same gap, and it runs along firm size.

The Home Office data referenced by Roberts points to a systemic control-design problem: 89% of employers assessed themselves as compliant, while 80% of that self-assessed-compliant cohort then failed a practical compliance question. For HR risk functions benchmarking their own exposure, the implication is that self-attestation from suppliers is not a reliable substitute for tested, same-day evidence capability.

Clients are already asking, but not evenly

Of the 57 agencies surveyed, 27 have already received formal requests from clients for contractual guarantees covering their right-to-work processes. The distribution is revealing: among temp and contract specialists, the figure is 18 of 22; among perm-focused firms, it is zero of 20. The clients applying commercial pressure are precisely those buying flexible, contingent labour - the category that comes into scope on 1 October.

For procurement and HR teams on the client side of that relationship, the 18-of-22 figure in temp markets functions as a peer benchmark. Firms that have not yet sought written assurances from their labour suppliers on right-to-work indemnity, evidence retention and audit rights are not adopting a conservative posture - they are trailing practice that is already standard in the temp and contract market. Under the Employment Rights Act 1996, the classification of a worker as an employee or a limb-(b) worker already carries legal weight; the October changes add a further layer of documentary obligation that master services agreements should now reflect explicitly.

The rulebook has a blind spot

The Stack Logic research surfaces a structural problem in the regulatory guidance itself. Roberts noted:

The draft Code of Practice does not mention employment businesses, agency workers, umbrellas or labour supply anywhere. The sector carrying the operational load of this change is invisible in the rulebook written for it.

For HR leaders, the practical consequence is that interpretive questions - which party conducts the check, at what point in the assignment lifecycle, with what documentary evidence, and how liability is apportioned between agency, umbrella and client - are being resolved through contract drafting and internal policy rather than through the Code. That places substantially more weight on supplier due diligence than a settled regulatory framework would normally require. ACAS (the Advisory, Conciliation and Arbitration Service) provides general guidance on worker status and employment documentation, but the October changes fall within Home Office immigration compliance territory rather than employment dispute resolution, meaning the standard HR compliance toolkit does not fully cover the gap.

What HR should have in motion this month

Four measures are proportionate to the exposure and the timeline:

• Map your contingent workforce against the new scope. Anyone engaged via a contract for services, sub-contract arrangement or online matching platform is now inside the right-to-work regime. If your HR systems distinguish only between employee and contractor, that classification is no longer granular enough for the liability you carry from 1 October.
• Put a same-day evidence question to each labour supplier. Can they produce a compliant right-to-work record for every worker currently on assignment, today? The Stack Logic data indicates that spreadsheet-based agencies consistently cannot. That single answer, rather than any policy document, tells you where your firm's exposure is concentrated.
• Update contractual guarantees across master services agreements. The 27 of 57 agencies already receiving client requests for written assurances represent the leading edge of market practice. Right-to-work indemnity, evidence retention periods and client audit rights belong in the core services agreement, not a side letter appended after an enforcement notice arrives.
• Treat confidence as a risk indicator, not a control. The Home Office delta - 89% self-assessed as compliant, 80% of that group failing a compliance question - is a control-design warning. Sample-auditing your own checks and your suppliers' checks before the 1 October deadline, rather than after the first enforcement event, is the proportionate response.

The workforce-planning read

There is a second-order operational effect that workforce planners should factor into Q4 resourcing assumptions. If a significant proportion of smaller staffing suppliers cannot evidence compliant checks by 1 October, the rational response inside those businesses will be to slow new onboarding for gig, umbrella and platform assignments while they upgrade their processes. Fill rates on flexible roles may soften in Q4 not because the supply of available workers has contracted, but because the supply of compliant checking capacity has.

For workforce planners, this argues for two adjustments: widening the time-to-fill buffer on contingent roles for the next quarter, and stress-testing the supplier panel for concentration risk. A single mid-sized agency that cannot evidence checks on demand is a scheduling inconvenience; several within the same skills cluster or sector is a delivery risk that requires escalation to the CHRO level rather than management at the hiring-manager tier. The REC has issued sector guidance on agency compliance obligations, and HR functions with substantial contingent labour spend should be reviewing that guidance alongside their supplier contracts before the end of September 2026.

Key takeaways for HR leaders

• From 1 October 2026, right-to-work obligations under the Immigration, Asylum and Nationality Act 2006 cover 3.75 million additional workers across gig, umbrella, sub-contract and platform arrangements, with liability travelling up the supply chain to the end-hiring client.
• First-breach penalties reach £45,000 per worker. Stack Logic's survey found that all 13 agencies using spreadsheets for tracking could not evidence a compliant check for every worker on the same day the question was asked.
• Commercial pressure for contractual guarantees is already established in temp and contract markets - 18 of 22 specialist agencies have received such requests - but is effectively absent in perm markets, where none of 20 agencies have. Closing that gap before the deadline is a procurement and HR priority, not a post-enforcement adjustment.
• Confidence is not a control. The CIPD's ongoing work on contingent workforce governance, combined with the Home Office's own finding that 80% of self-assessed-compliant employers failed a compliance question, makes sample-auditing before 1 October the baseline expectation for any HR function with meaningful contingent labour spend.