Whole construction supply chain now on the hook as new right to work rules take effect

LONDON, Oct. 21, 2026 /PRNewswire/ -- UK construction firms can now be fined for illegal working anywhere in their supply chain, not just among their own employees. Penalties can reach £45,000 per illegal worker for a first breach and £60,000 per worker for a repeat breach. That was the warning from experts at a briefing hosted by innDex, the construction site and workforce management platform, at the House of Commons on 29 September.

Contractors heard from Kevin Barker, an immigration compliance specialist and former Home Office official, and a Home Office policy representative. The session was chaired by innDex co-founder George Smithies and Dean Tuhey, founder of right to work specialist PPAC.

What has changed

Until 1 October, a civil penalty for illegal working depended on a direct employer-employee relationship. Liability now extends to self-employed workers, gig workers, subcontractors and labour supply chains.

Where the Home Office cannot identify the direct employer, or prescribed requirements have not been met, it can impose the penalty on another business in the contractual chain.

Businesses now need a statutory excuse built on three requirements:

• Contractual terms requiring subcontractors to carry out compliant right to work checks, seek consent before further subcontracting, accept audits and cooperate with the Home Office.
• Substitution controls, so the person on site is the person who was checked.
• Identity verification systems, such as access passes, facial verification, biometrics and attendance records.

Kevin Barker said: "The two things I want people to remember are that responsibility is changing, and so is liability."

Why construction is exposed

Construction supply chains are often several tiers deep, running through subcontractors, agencies and payroll companies. A gap at any tier can come back to the businesses above it.

Contract clauses alone are not enough

The Home Office will judge how well each requirement works in practice, and audits must actually happen and be evidenced. As penalties are a civil matter, decided on the balance of probabilities, what counts as "reasonable and proportionate" will ultimately be decided by a County Court judge.

"New powers tend to be used as soon as they arrive," said Kevin Barker. "It's no good just having it written in your terms and conditions. You have to do it, and you must be able to show you've done it."

Dean Tuhey added: "A right to work check is no longer a tick box exercise. It's a process. Student visa hours, sponsor confirmations and workers in roles their visas don't cover are all on sites today. There's only one acceptable number in construction: 100%."

The role of digital verification

Under the UK Digital Identity and Attributes Trust Framework, certified digital verification service providers (DVSPs) now play a central role in the new regime.

From 1 October, certified providers can check British passports that expired up to six months ago, and the in-person element of a check can be carried out digitally. Employers must still confirm each check matches the person they engage.

PPAC passed its certified DVSP audit on 21 September. With innDex, it links a worker's right to work check to their site induction, a face check on arrival and daily biometric clock-in. If a visa expires, site access updates in real time.

George Smithies, co-founder of innDex, said: "We kept hearing confusion from our clients about what was changing, who's responsible and what they need to do. Our message is simple: the law has moved from the employer to the whole chain, and the industry needs a process that can prove who is on site, every day."

About innDex:

innDex delivers end-to-end workforce management solutions purposefully designed for the construction industry. Built by civil engineers, the platform simplifies project delivery through digital tools that enhance safety and compliance on site. Today, innDex supports more than 26,400 companies across 27 countries and five continents.

About PPAC:

Founded in 2016, PPAC provides right to work and identity verification built specifically for construction, making onboarding faster, verification more accurate and compliance simpler on site.