Hiring in the UK got harder this year - What changes before october

Hiring in the UK has not become impossible this year. It has become slower, more procedural, and a lot more expensive to get wrong. Two dates in October 2026 decide how much of that cost lands on you. On 1 October, right to work checks stop being an employee-only job and the deadline for bringing most tribunal claims doubles. On 30 October, the duty to prevent harassment gets a harder edge and third parties come back into scope.

The mood was already cautious. The CIPD Labour Market Outlook for Summer 2026 put the net employment balance at +9, close to its weakest reading outside the pandemic, with only 62% of employers planning to recruit over the following three months. Employers are not freezing because the work dried up. They are freezing because every hire now carries more paperwork, more liability, and more ways to be caught out later.

If your recruitment process was built for a world where compliance started at the offer letter, you have a few weeks to redesign it. This guide is written for the people who will actually do that work: founders, operations leads and HR generalists at UK companies small enough that nobody has an in-house employment lawyer on speed dial.

TL;DR

• From 1 October 2026, right to work checks apply to workers, individual subcontractors, agency staff and gig or platform labour, not just employees.
• Get the check wrong and the civil penalty runs to £45,000 per worker for a first breach and £60,000 for a repeat. Liability can now reach businesses further up the labour chain.
• Also from 1 October, the window to bring most employment tribunal claims doubles, so a hiring decision stays contestable for twice as long.
• From 30 October 2026, preventing sexual harassment moves from reasonable steps to all reasonable steps, third-party harassment is back in scope, and you must tell staff in writing they can join a trade union.
• Both duties are proved by records, not intentions. The fix is one documented hiring process that produces evidence as a by-product.

What changed in April 2026?

The first serious tranche of the Employment Rights Act 2025 came into force on 6 and 7 April. Paternity leave and unpaid parental leave became day-one rights. Statutory sick pay became payable from the first day of absence, with the lower earnings limit removed. Whistleblowing protection widened. None of it was dramatic on its own, and that is exactly why it slipped past a lot of small employers.

The cumulative effect is what matters. A hire that used to carry a qualifying period before most obligations kicked in now carries several from the first shift. Acas guidance on the Employment Rights Act 2025 tracks what has landed and what is still queued, and it is the plainest summary of the sequence available.

Why does hiring feel frozen right now?

Because the cost of a wrong hire moved. It used to be mostly a productivity problem. Now it is a productivity problem plus a compliance file, an extended claim window, and a penalty regime that does not care whether the mistake was careless or deliberate.

Look at what that does to a hiring manager's incentives. Leaving a role open is boring and safe. Filling it quickly with an agency worker whose paperwork nobody owns is fast and, from October, genuinely risky. So roles sit open, contract populations grow quietly in the gaps, and the skills gap that caused the vacancy gets worse. Freezing is not caution. It is a decision to pay the cost somewhere less visible.

Who needs a right to work check from 1 October?

From 1 October 2026 the duty to check extends well beyond employees. It reaches anyone engaged under a worker's contract, individual subcontractors providing services under their own name, people sourced through an online matching service or platform, and agency or casual arrangements that sit outside your normal onboarding flow. The rules bite on work that starts on or after that date, even where the contract already exists.

Which working arrangements come into scope

The practical test is not what the contract is called. It is whether a human is doing work for your business under an arrangement you control. The Home Office set out the detail in its draft employer guide to right to work checks, published in September 2026 ahead of the deadline.

Which sectors are most exposed

Construction, courier and delivery work, warehousing, hospitality, beauty and events are the obvious ones. So is any business that flexes headcount through the year. If you run seasonal or project-based hiring, the population you have historically waved through is precisely the population this change is aimed at. The same goes for platform-sourced labour, where the coordination gaps common in gig work tend to hide who is responsible for what.

What does a valid right to work check look like?

A compliant check gives you a statutory excuse. That phrase does a lot of work: it means that if the person turns out not to have the right to work, the Home Office issues a no action notice instead of a penalty. The excuse is the whole point of the exercise, and it only exists if the check happened before the work started and was recorded properly.

The three routes to a statutory excuse

A manual document-based check carried out in the person's presence. A Home Office online check using a share code. Or a check through a certified digital identity service provider. All three are valid. Only the third one changes materially in October.

The digital identity provider trap

A provider must be on the Office for Digital Identities and Attributes register and specifically authorised for right to work checks, not merely accredited for general identity verification. Those are different permissions and vendors blur them in sales conversations. Ask for written confirmation of the right to work authorisation before the deadline, not after an audit. One more detail worth knowing: the updated guidance accepts digital National Insurance number documents issued by or on behalf of a government agency, which removes a common cause of rejected paperwork.

What do the penalties actually cost?

Enough to matter for a company of any size. Civil penalties run to £45,000 per worker for a first breach and £60,000 per worker for a repeat. The sharper change is extended liability: where the direct engager cannot be identified or fails to comply, a business further up the contractual chain can be penalised instead, even though it never employed the person. Reporting on the new checks has focused on platform firms, but the exposure follows any labour supply chain.

Why do tribunal time limits double on 1 October?

The government's stated aim is access to justice: three months is a short window for someone who has just lost a job, and many valid claims never got filed in time. From 1 October 2026 the limit for most employment tribunal claims doubles to six months, per the government timeline for the Employment Rights Act.

For employers the effect is quieter and more awkward. Evidence has to survive longer. Interview notes, scorecards, rejection reasons and the reasoning behind a decision now need to be findable half a year later, by someone who may not have been in the room. Most hiring teams do not keep records that well, because nothing forced them to. This does.

What changes on 30 October 2026?

Three things land together, and only one of them gets much attention.

All reasonable steps, not reasonable steps

Since October 2024 employers have had a preventative duty to take reasonable steps to stop sexual harassment of their workers. From 30 October 2026 that becomes all reasonable steps: Acas guidance on sexual harassment states that from that date employers will be liable unless they have taken all reasonable steps to prevent it. One word, and a materially higher bar. A tribunal is no longer asking whether you did something sensible, it is asking what else you could have done. Legal analysis of the October changes puts the tribunal uplift for breaching that duty at up to 25% of the award, so a thin policy costs more than it used to.

Third parties are back in scope

Employer liability for harassment of staff by customers, clients, suppliers and members of the public returns, covering all relevant protected characteristics rather than sexual harassment alone. The version repealed in 2013 required a pattern the employer already knew about. This one does not. A single incident can be enough where you cannot show you took all reasonable steps to prevent it.

Think about who that exposes. Front-of-house staff. Field engineers on customer sites. Delivery drivers. Support agents on video calls. Agency staff you placed somewhere else entirely. The risk sits furthest from the HR office, with the people least likely to be in a policy briefing.

The trade union notice nobody has drafted

From the same date, employers must give staff written notice of their right to join a trade union. It is administratively small and easy to miss, which is why it will catch people. Fold it into the written statement of particulars you already issue on day one rather than inventing a separate process.

What evidence will a tribunal expect?

If a claim lands, you will be asked what you did in advance, not what you did afterwards. In practice that means documented risk assessments by role and setting, an anti-harassment policy that explicitly covers third-party conduct, training with attendance records including at senior level, a reporting route people will genuinely use, and proof that somebody reviewed all of it on a date.

Notice the shape of that list. Every item is a record produced by a process, not a document written after the fact. A policy drafted the week a claim arrives reads exactly like a policy drafted the week a claim arrives.

A four week plan before 1 October

Perfect readiness is not on the table. Ordered readiness is.

Week one: map who actually works for you

List every arrangement under which a human does work for your business: employees, workers, agency staff, individual subcontractors, platform-sourced labour, anyone with a substitution clause. Most organisations find at least one population nobody owns. That population is the reason this rule exists.

Week two: close the checking gap

Decide who runs the check for each population, which of the three methods applies, where the record is stored, and how follow-up dates get tracked. Spreadsheets scattered across three inboxes are where this fails. Confirm your digital provider's registration in writing while you are at it.

Week three: fix the documents

Update offer and engagement templates, supplier terms and onboarding checklists. Add right to work status to whatever system already tracks start dates, and make the check a blocking step rather than a reminder somebody can dismiss.

Week four: brief the humans

Train the people now caught by this, which is rarely just HR. Site managers, agency coordinators, operations leads and procurement all touch engagement decisions. Cover the harassment changes in the same session, since both duties land in the same month and both are proved through records rather than intentions.

How do you stay compliant without losing candidates?

This is where most compliance projects quietly damage the business. Every extra verification step lengthens time-to-start, and candidates with options drop out of slow processes. Meanwhile the code of practice on avoiding unlawful discrimination still applies, and it matters more as checking spreads: apply checks consistently to everyone in a population, and never decide who to check based on a name, an accent, a passport cover or how long somebody has lived here. Discrimination compensation has no upper limit.

The fix is sequencing, not shortcuts. Run structured assessment and interview stages on their normal timeline and prepare the compliance pack in parallel, so verification is not the thing everyone waits on. Tell candidates up front which documents they will need and when. Teams that already treat hiring across borders as a workflow with dependencies absorb this well, because they were never treating onboarding as a formality at the end.

For companies weighing UK hires without a local entity, the same logic applies to the employer of record route: the administration moves, the obligation does not. Right to work checks still happen for UK-based work and harassment duties still cover the people doing it. Employer of record options for compliance-heavy hiring are worth comparing on which obligations genuinely transfer, not on headline price.

Pro Tip: make the right to work check a gate in your hiring workflow rather than a task in someone's inbox. A gate cannot be skipped under deadline pressure, and it timestamps itself, which is the evidence you will want six months later when the claim window is still open.

Hire with a process that survives an audit

Both October duties reward the same thing: a hiring process that is consistent, documented and produces evidence as a by-product. That is what the Testlify Hiring Workflow Method describes, running role-relevant assessment, structured interviews, multi-reviewer scoring and consistent comparison criteria in one place, and syncing results into the applicant tracking system you already run. Structured scoring gives you a defensible reason for every rejection, recorded on the day you made it.

If you want to see what that looks like against your own roles, book a demo or start by reviewing how you build a hiring process around assessments.

Key Takeaways

• The scope change is bigger than the rule change. Right to work checking itself is not new; applying it to workers, subcontractors and platform labour is. The work is auditing who does work for you, and most companies find a population nobody owns. Start there, because you cannot check people you have not listed.
• Extended liability is the part that surprises people. A penalty of up to £60,000 per worker can land on a business that never engaged the person, because responsibility now follows the labour chain. If you buy labour through agencies or platforms, get written agreement on who runs each check and who keeps the record.
• A longer claim window changes your record-keeping, not your hiring bar. Six months instead of three means interview notes and rejection reasons must be findable long after the people involved have moved on. Structured scorecards solve this almost by accident; free-text notes in a manager's inbox do not.
• All reasonable steps is a standard you evidence, not one you assert. Risk assessments, training records, a working reporting route and a dated review are what a tribunal reads. Anything written after a complaint arrives carries very little weight.
• Third-party harassment moves the risk away from head office. The people most exposed are front-line and often not employees at all. Any prevention plan that only briefs office staff misses the population it is meant to protect.
• Compliance and candidate experience are not in tension if you sequence them. Run assessment and interviews on the normal timeline, prepare verification in parallel, and tell candidates what is coming. Slow, opaque onboarding loses good people in a market where most employers are hesitating anyway.

FAQs