Right to work checks for small businesses: what the 1 October 2026 update means

If you hire anyone, even one part-timer, you are responsible for checking they are allowed to work in the UK before they start. This month the Home Office published final guidance for employers, and commentary from law firms says the wider right to work regime expands from 1 October 2026. This post explains what the official pages say, what is still being worked out, and what a small business should do this week.

What the rules are today

The GOV.UK guidance for employers sets out three ways to check someone's right to work:

• An online check using the applicant's share code and date of birth, through the government's right to work service.
• A manual check of original documents, with the applicant present, confirming they are genuine, unchanged and belong to the holder.
• A check through an identity service provider (IDSP), using a provider that offers identity document validation technology.

There is one catch worth knowing. According to GOV.UK, British and Irish citizens cannot get a share code. For them you either check their original documents yourself or use an IDSP. Many owners assume the online check works for everybody, and it does not.

You must check before you employ someone, and again when a time-limited right to work is due to expire. GOV.UK also says biometric residence cards and permits are no longer accepted as proof, so an old plastic card is not enough on its own.

How an online check works

The online route is the quickest for most non-British applicants. You start from the GOV.UK service, then enter two things: the applicant's date of birth and their right to work share code. The result shows what kind of work the person can do and for how long, if there is a time limit. If the applicant has no share code, GOV.UK says you can check their original documents instead.

Commentary from the law firm Morgan Lewis adds that share codes for these checks begin with a "W" and are valid for 90 calendar days. Treat that as a useful detail from a secondary source rather than a rule you should rely on without reading the final guide.

What is changing from 1 October 2026

The GOV.UK employer's guide page shows its most recent update on 1 October 2026, described as final employer guidance added for 1 October. The related code of practice page was also updated on 1 October 2026, with the word "draft" removed from the title to reflect a legislation change.

An August 2026 note from Morgan Lewis, written while the guidance was still in draft, says the expanded regime moves beyond employees towards a broader workforce framework. It flags contractors, subcontractors, agency workers, platform workers and substitutes as likely to be in scope. It also describes a registered digital route, where a provider must be on the Office for Digital Identities and Attributes register, and says facial recognition, if used, must come through such a provider, with a reasonable alternative for workers it cannot match.

Because that note pre-dates the final guidance, the sensible approach is to read the final employer's guide on GOV.UK yourself, particularly if you use freelancers, agency staff or people who cover shifts for others. GOV.UK's own current page says other employment statuses follow different rules, so do not assume one process fits every worker.

Keeping records

GOV.UK says to keep copies during employment and for 2 years after the person stops working for you. The copies must be clear and unalterable, and you should record the date you made the check. For passports, copy the expiry page and the details pages, including any work visa endorsements. For other documents, copy the whole document. You must also follow data protection law, which in practice means storing these copies securely and limiting who can see them.

Morgan Lewis notes that for online checks you should keep a PDF or HTML copy of the profile page for the same period. If you are still keeping photocopies in a filing cabinet, now is a good moment to move to a secure digital folder with restricted access. Setting up secure storage is a job for cloud and security tooling, and process automation can add reminders for expiry dates so follow-up checks are never missed.

What happens if you get it wrong

GOV.UK says you could face a civil penalty if you employ an illegal worker and have not carried out a correct check. The GOV.UK pages do not list the amounts, but law firm Bevan Brittan reports that from 13 February 2024 the maximum is up to £45,000 per illegal worker for a first breach, up from £15,000, and up to £60,000 for repeat breaches, up from £20,000. A correct check gives you a statutory excuse against that penalty, which is why the paperwork matters.

Morgan Lewis also notes that a valid status check offers no protection where it is reasonably apparent the person presenting is not the person shown in the check. In plain terms: look at the person in front of you, compare them with the photo, and escalate anything that does not add up.

If the applicant cannot show a share code or documents

GOV.UK says that if an applicant cannot show documents or online status, you must ask the Home Office to check. The Home Office then issues a Positive Verification Notice, which you must keep. Morgan Lewis says a positive notice generally gives a statutory excuse for six months, that the Employer Checking Service aims to respond within five working days, and that a negative notice ends the excuse, so you should not carry on employing the person until it is resolved. Do not let someone start work on a promise that the paperwork is coming.

What to do this week

• Read the current GOV.UK employer's guide to right to work checks, now updated for 1 October.
• List everyone who works for you, including part-timers, agency staff, freelancers and anyone who covers shifts, and note how each one was checked.
• Diary the expiry date of every time-limited right to work, with a reminder well before it arrives.
• Check that copies are clear, dated and kept securely for the length of employment plus 2 years.
• Decide who in your business carries out checks, and write the steps on one page so a new manager does the same thing.
• If you want to use a digital identity provider, ask whether it is on the Office for Digital Identities and Attributes register and what the fallback is when it cannot match a face.
• Do not treat old biometric residence cards as acceptable evidence.

What about digital ID?

You may have seen headlines about a national digital ID. Plans for it are still being debated, so it is not something to act on yet. For now, the three methods above are what the GOV.UK guidance describes, and the best preparation is a tidy, repeatable process that you could move onto a digital provider later if you chose to.

This post is general information, not legal advice. If you have a complicated situation, such as a worker on a student visa or an agency arrangement, speak to an immigration adviser or use the Home Office Employer Checking Service.