Right to work checks widen on 1 October 2026, and new duties on harassment start on 30 October. They come from different Acts, but they point the same way. An employer's responsibility no longer stops at the people it employs. It now reaches the contractors and agency staff who work for it, and the customers, clients and members of the public its staff deal with.
Right to Work Checks Widen from 1 October 2026
Section 48 of the Border Security, Asylum and Immigration Act 2025 takes the illegal working rules beyond employees. Casual, temporary and zero-hours workers, individual sub-contractors and people found through online matching platforms are brought into scope, alongside a revised Home Office code of practice on preventing illegal working. What counts is how the work is actually arranged, not what the contract calls it.
Liability also moves up the supply chain. Where illegal working turns up in a sub-contracted arrangement, a business further up the chain can face a penalty as well as the one that engaged the worker, so agency and sub-contractor terms now carry real weight. Civil penalties run to £45,000 per illegal worker for a first breach and £60,000 for a repeat breach. A correct check made before work starts is still what gives a business its statutory excuse.
Third-Party Harassment Duties from 30 October 2026
The Employment Rights Act 2025 raises the duty to prevent sexual harassment, in force since October 2024, from reasonable steps to all reasonable steps. It also makes employers liable when their staff are harassed by customers, clients, suppliers or members of the public, unless they took all reasonable steps to prevent it. That covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation, and a single incident is enough. The changes apply in England, Wales and Scotland.
The Act does not define all reasonable steps. The Equality and Human Rights Commission's guidance is the reference point until regulations follow a consultation expected in 2027. The EHRC can enforce the sexual harassment duty, and a tribunal can raise compensation by up to 25% where the duty has been breached. Reporting sexual harassment has also been a protected whistleblowing disclosure since April 2026.
What the October 2026 Changes Ask of Businesses
Neither change asks for anything unusual. Both favour the business that can show what it did, when, and for whom. In practice they come down to:
- Map who works for you - and how each person is engaged, including agency and sub-contracted people
- Check everyone before they start - the same way whatever their nationality, with a follow-up check where permission to work runs out on a set date
- Agree checks in writing - who checks agency and sub-contracted people, with evidence that it was done, and records kept for the engagement plus two years
- Risk-assess harassment - including contact with third parties, by role and location
- Cover third parties - in the harassment policy, and in conduct terms for customers and suppliers with the right to refuse or end service
- Report, train and review - clear reporting routes, training with records kept, and a regular review of all of it
The alphaZ documents covering both have been updated. The right to work changes run through the recruitment, illegal working, labour standards and contractors policies, set out in the right to work file update post. The harassment changes run through the harassment risk assessment and the harassment, equality and behaviour policies, set out in the harassment file update post.
Bullying and Harassment at Work
Legal and Compliance Obligations for UK Businesses
Published: 29 September 2026
