Hiring in the UK got harder this year - What changes before october

Hiring in the UK has not become impossible this year, but it has become slower, more procedural, and far more expensive to get wrong. The cipd's summer 2026 labour market outlook put the net employment balance at +9, close to its weakest reading outside the pandemic. 

Employers are not freezing because they have run out of work. They are freezing because every hire now carries more paperwork, more liability, and more ways to be caught out later.

Two dates in october will tighten that further. On 1 october, right-to-work checks stop applying only to employees. On 30 october, the duty to prevent harassment gets a harder edge, and third parties come back into scope. If your recruitment process was designed around a world where compliance began at the offer letter, you have a few weeks to redesign it.

Photo by tima miroshnichenko on pexels

What already landed in april

The first serious tranche of the employment rights act 2025 came into force on 6 and 7 april. Paternity leave and unpaid parental leave became day-one rights. Statutory sick pay became payable from the first day of absence, with the lower earnings limit removed. Whistleblowing protection was extended to cover disclosures about sexual harassment. 

What it does is shift cost and risk forward. A hire who leaves in month three used to be a cheap mistake. Now they accrue entitlements from the first morning, and your sick pay exposure starts on day one rather than day four. Hiring managers feel this as caution. Finance feels it as cost per head. Both reactions are rational, and both are showing up in the national numbers.

Why hiring feels frozen

"Low hire, low fire" is the phrase the CIPD used, and it describes the mood well. Redundancies have not spiked. Employers are holding onto the people they have, which sounds stable until you look at what it does to the pipeline: fewer entry-level routes, fewer internal moves, and a slow erosion of the bench you normally promote from.

For talent teams, this creates an awkward position. You are being asked to fill fewer roles, and each one gets scrutinised harder before sign-off. That pressure rewards evidence. 

A hiring case built on a structured assessment and a documented process survives a budget challenge far better than one built on a manager's gut feel, particularly when the skills gap you are trying to close sits in a specialist function where mis-hires are visible within weeks.

1 October: right to work checks stop being an employee-only job

Section 48 of the border security, asylum and immigration act 2025 comes into force on 1 october 2026, commenced by SI 2026/683. It widens the illegal working regime beyond contracts of employment for the first time.

Who comes into scope

From that date, the duty to check reaches people engaged:

• Under a worker's contract rather than a contract of employment,
• As individual subcontractors providing services under their own name,
• Through an online matching service or platform that puts a service provider in front of clients,
• Via agency and casual arrangements that sit outside your normal onboarding flow.

Construction, courier and delivery work, warehousing, hospitality, beauty and events are the obvious exposures. So is any business that scales headcount up and down through the year. If you run seasonal or project-based hiring, the population you have historically waved through is precisely the population this change is aimed at.

What a valid check looks like

Three methods give you a statutory excuse: a manual document-based check carried out in the person's presence, a home office online check using a share code, or a check through a certified digital identity service provider. The third option tightens in october. 

A provider must be registered on the office for digital identities and attributes register and specifically authorised for right to work checks, not merely accredited for general identity verification. Confirm that with your vendor in writing before the deadline rather than after an audit.

One practical wrinkle: the home office's updated employer's guide was still marked draft over the summer, so some detail may shift. The published draft guidance is worth reading in full if you engage contingent labour at any volume.

Where the money risk sits

Civil penalties run to £45,000 per worker for a first breach and £60,000 for a repeat breach within three years. The sharper change is that liability can travel along the contractual chain. Where the direct engager cannot be identified or fails to comply, the business further up can be penalised instead. 

Checks also only bite for engagements beginning on or after 1 october, plus follow-up checks falling due after that date. That gives you a clean cut-off to design around, and a reason to get your onboarding forms fixed before the first october start date rather than during it.

Hiring into the UK without a local entity is now a structural decision

Two groups feel this most. Overseas companies that want UK talent but have no UK entity. And UK companies whose "contractor" population has quietly become a core part of delivery.

Setting up a subsidiary gives you full control and full obligation: incorporation, PAYE registration, pension auto-enrolment, local employment contracts, and a payroll function that has to absorb every change described above. That is justifiable when you plan to hire a team and stay. 

For two or three people, the maths rarely works, which is why the employer of record model keeps growing. An EOR becomes the legal employer, runs payroll and statutory deductions, issues a compliant contract, and carries the day-to-day compliance load while you direct the work.

You inherit whatever quality of local advice your provider actually has. Deel, remote, papaya global and native teams all operate in this space with different pricing shapes and different depths of local presence, and the honest differentiator is usually whether the provider owns a legal entity in the country or resells someone else's. 

Native teams runs through its own entities in 95 plus countries, and its guide to using a UK employer of record sets out the statutory obligations that transfer and the ones that stay with you. Read two or three vendor guides side by side before you take any of them at face value.

Employer national insurance, pension contributions, holiday accrual and the provider fee all sit on top of gross salary, and the total is rarely what the sales page implies. Most providers, native teams included, publish free country guides and payroll calculators you can use to build a like-for-like comparison against the cost of incorporating. 

One caution that applies whichever route you pick: an EOR arrangement does not neutralise the october changes. Right to work checks still have to happen for UK-based work, harassment duties still apply to the people doing that work, and your managers still shape the environment they work in. The administration moves. The obligation does not disappear.

30 October: the harassment duty gets a harder edge

The second date is less discussed and, for most HR functions, harder to prepare for.

All reasonable steps, not reasonable steps

Since october 2024, employers have had a preventative duty to take reasonable steps to stop sexual harassment of their workers. From 30 october 2026, that becomes all reasonable steps. One word, and a materially higher bar. 

A tribunal can still apply a compensation uplift of up to 25% where the duty has been breached, so the practical consequence of a thin policy grows alongside the legal one.

Regulations specifying what "all reasonable steps" means are expected later rather than alongside the change, so the ehrc's technical guidance on harassment at work remains the best available benchmark. Tribunals already take it into account.

Third parties are back in scope

The act reintroduces employer liability for harassment of staff by third parties such as customers, clients, suppliers and members of the public. It covers harassment related to all relevant protected characteristics, not only sexual harassment. 

The earlier version of this liability, repealed in 2013, required a pattern the employer knew about. This one does not. A single incident can be enough where you cannot show you took all reasonable steps to prevent it.

Think about who that exposes. Front-of-house teams. Field engineers on customer sites. Delivery drivers. Support agents on video calls. Agency staff you placed somewhere. The risk sits furthest from the HR office.

What evidence looks like

If a claim lands, you will be asked what you did in advance, not what you did afterwards. In practice that means documented risk assessments by role and setting, an anti-harassment policy that explicitly covers third-party conduct, training with attendance records including at senior level, a reporting route people will actually use, and evidence that you reviewed all of it. 

A four-week plan before 1 october

Perfect readiness is not on the table. Ordered readiness is.

Week one: map your actual workforce

List every arrangement under which a human does work for you: employees, workers, agency staff, individual subcontractors, platform-sourced labour, anyone with a substitution clause. Most organisations find at least one population nobody owns.

Week two: close the checking gap

Decide who runs the check for each population, which of the three methods applies, where the record is stored, and how follow-up dates are tracked. Spreadsheets scattered across three inboxes are where this fails. Confirm your digital provider's registration status in writing.

Week three: fix the documents

Update offer and engagement templates, supplier terms, and onboarding checklists. Add right-to-work status to whatever system already tracks start dates, and make the check a blocking step rather than a reminder.

Week four: brief the humans

Train the people now caught by this, which is rarely just HR. Site managers, agency coordinators, operations leads, and procurement all touch engagement decisions. Cover the harassment changes in the same session, since both duties land in the same october and both are evidenced through records rather than intentions.

Don't let compliance wreck the candidate experience

The separate code of practice on avoiding unlawful discrimination still applies, and it matters more as checking spreads. Apply checks consistently to everyone in a given population. Do not check only the people you assume are migrants. Do not make assumptions from a name, an accent, a passport cover, or how long somebody has lived here. 

Discrimination compensation has no upper limit, and a reputation for intrusive onboarding travels fast in candidate-short markets.

Every additional verification step lengthens time-to-start, and candidates with options drop out of slow processes. The fix is sequencing rather than shortcuts: run structured assessment and interview stages on their normal timeline, prepare the compliance pack in parallel, and tell candidates what documents they will need and when. 

Teams that already run a disciplined global hiring process tend to absorb this well, because they were already treating onboarding as a workflow with dependencies rather than a formality at the end.

Conclusion

The right to work expansion is an operations problem with a hard deadline, a clear scope, and a penalty you can calculate. The harassment duty is a culture problem with a soft edge, where what protects you is a paper trail built before anything goes wrong. Handle the first with process owners and a tracker. 

Neither change argues against hiring. They argue for hiring deliberately: knowing which entity employs each person, which checks apply to them, who runs those checks, and where the evidence lives. Get those four answers straight for your current workforce, and the october deadlines become administration rather than exposure. 

Leave them vague, and every flexible arrangement you have built becomes a question you cannot answer under pressure.