Automating Right to Work Checks: What's Legal
Automating right to work checks runs into a legal ceiling most software pages never mention, and it is not the one you would guess. You can hand the identity-verification step to a registered provider, and from 1 October 2026 that route reaches further than it used to. What no provider can take off you is the liability: if the prescribed check is not carried out the way the scheme requires, the civil penalty is yours, whoever pressed the buttons. The check stays yours.
What automates well is everything around the check: the register of who has been checked, the expiry dates, the follow-up diary, the retention clock and the audit trail. That is the half where employers actually get caught, and it is the half no rule prevents you delegating to a system.
This guide is for informational purposes only and does not constitute legal advice. For advice on your specific situation, consult a qualified immigration solicitor.
This article quotes two documents for the scheme in force since 1 October 2026. The Code of practice on preventing illegal working is the revised Code laid before Parliament in draft on 30 June 2026; SI 2026/700 brought it into force on 1 October 2026, together with the prescribed requirements for the RtW DVSP route, and GOV.UK dropped "draft" from its title that day. The employer's guide is the final version the Home Office published on GOV.UK on 1 October 2026 in place of its 11 September 2026 draft; it states that it "came into force on 1 October 2026". We last checked both against GOV.UK on 5 October 2026. If a later version differs from the text quoted here, the later version governs — check the live employer's guide and the Codes collection before you rely on a detail.
What a digital verification service may lawfully do
The employer's guide to right to work checks for the scheme from 1 October 2026 calls these providers right to work digital verification service providers (RtW DVSPs) — the same term the amended legislation now uses; the earlier guidance called them digital verification services, or DVS. Using one is optional. If you do, registration is not:
"Whilst it is not mandatory to conduct right to work checks digitally in this way, if an employer chooses to do so, it is mandatory that the DVSP is registered on the Office for Digital Identities Attributes (OfDIA) register, and that they are able to provide right to work checks."
What a registered provider is permitted to do is set out expressly, and it is wider than the British-and-Irish-passport route the previous guidance allowed:
"A RtW DVSP is able to carry out digital right to work checks on holders of valid British or Irish passports (or Irish passport cards) (up to 6 months past the expiry date), verify acceptable documents from List A and List B of Annex A when and where they are available from the issuing authority in a digital format, and provide facial recognition technology to enable an employer to confirm that a worker is the same individual the right to work check was conducted on and is not an imposter."
The widening is in the legislation, not only the guidance. From 1 October 2026 the documents a registered provider may verify include "the digital version (if any) of a document listed in the Schedule provided to an RtW DVSP by a Government department or Government agency" — the Schedule being Lists A and B.
Three things follow from that sentence. Passports up to six months past expiry are in scope, not only current ones. List A and List B documents can be verified digitally — but only "when and where they are available from the issuing authority in a digital format", which is a real constraint and varies by document. And coverage differs between providers: the guide says "Services available by RtW DVSPs will vary across the registered providers", so ask yours what it actually covers rather than assuming the full permission. Our guide to the digital right to work check covers how that route works step by step.
You still cannot make the digital route the only route:
"Employers must not treat those who do not hold a valid passport (or passport card) (up to 6 months past the expiry date), or do not wish to prove their identity using a RtW DVSP, less favourably. Where an individual does not wish for the right to work check to be carried out digitally, employers should provide another way for them to prove their right to work by carrying out a manual document-based right to work check instead."
The limit: the liability does not move
This is the sentence worth reading twice, because it is the one that decides what your software can and cannot be:
"Where an employer uses a RtW DVSP, the employer (and not the RtW DVSP) remains responsible for ensuring that the check is carried out in accordance with the prescribed requirements. Where those requirements have not been met, the employer will not establish a statutory excuse and may be liable for a civil penalty if the worker is found to be working without the required permission."
A provider can perform the verification. It cannot hold the excuse. If the check falls short of the prescribed requirements — wrong document, wrong route, missing record — you are the one who pays, and "the vendor said it was fine" is not a defence the scheme recognises.
The delegation rule says the same in different words, and marks out the one carve-out:
"With the exception of prescribed checks carried out by a RtW DVSP, the employer is responsible for carrying out the check. This responsibility may be delegated to individuals or members of staff acting on behalf of the employer, including workers, agency workers, or others working under the employer's control, direction and who are accountable to the employer. However, the employer will remain liable for a civil penalty in the event the individual is found to be working illegally, and the check has not been carried out as prescribed."
Note what that does and does not permit. A registered RtW DVSP carrying out a prescribed digital check is the exception. Beyond it, the check — manual or online — is the employer's, and may be delegated to your own people — a shift manager, an agency worker under your control — but not handed to an outside service as a substitute for the prescribed check. Neither route moves the liability. Both move only the task.
There is a separate, useful allowance for tooling rather than performance:
"Whilst an employer may use a third party to provide support in terms of the technical aspects of the check, information gathering or specialised equipment to prevent the employment of illegal workers, the responsibility for performing the check (in order to obtain a statutory excuse from a civil penalty) will remain with them as the employer."
Document-scanning hardware, forgery-detection tooling, a workflow that prompts you through the steps — all fine, and all still yours to get right.
The two steps that still need a person or a registered provider
Both prescribed check routes end in a comparison — one you make yourself, or one a registered RtW DVSP makes for you. What neither route allows is nobody making it.
For a manual check, the guide requires the holder to be there:
"When checking the validity of documents, employers should ensure that they do this in the presence of the holder. This can be a physical presence in person or via a live video link. In both cases the employer must be in physical possession of the original documents."
And it closes the obvious shortcut: employers "may not rely on the inspection of the document via a live video link or by checking a screenshot or scanned copy of the document unless it is official evidence of an individual's name and NINo in a digital format." A video call works only when the originals are already in your hands.
For a Home Office online check, the same comparison applies to the photograph on the check result. Employers must:
"ensure that the photograph on the online right to work check is of the individual who is the subject of the check (i.e. the information provided by the check relates to the individual and they are not an imposter). This element of the check can be done in person, by video call or digitally using facial recognition technology. Where facial recognition technology is used to complete this element of the check digitally, this must be carried out by a registered RtW DVSP who will provide a comparison verifying the facial image from the service output and the match to the individual."
Software can fetch the record. Deciding that the face on the record is the face in front of you is either your judgement or a registered provider's facial-recognition output — and if it is the latter, the guide requires you to keep a secure copy of that comparison alongside your copy of the service output.
What automating right to work checks actually buys you
Strip out what the law reserves and a clear list remains — and it maps onto the failures that produce penalties rather than the step everyone worries about.
| Task | Can a system do it? | Why |
|---|---|---|
| Digital identity verification for a British or Irish passport holder | Yes, via a registered RtW DVSP | Expressly permitted, including passports up to 6 months past expiry |
| Digital verification of other List A and List B documents | Yes, via a registered RtW DVSP — where the document is available digitally from the issuing authority | Expressly permitted from 1 October 2026; coverage varies by provider and by document |
| The manual document check | Yes, by your own staff; not by an outside service in place of the prescribed check | The employer is responsible; delegation to staff moves the task, never the liability |
| The Home Office online share-code check | You must run it; the imposter comparison may be done by a registered provider's facial recognition | You remain responsible for ensuring the check meets the prescribed requirements |
| Prompting and sequencing the check steps | Yes | Third-party support on "the technical aspects of the check" is expressly allowed |
| Holding the register of who was checked and when | Yes | The guide requires a dated record; it does not say who keys it in |
| Calculating and diarising follow-up dates | Yes | Nothing in the scheme reserves the diary |
| Flagging the 28-day and six-month statutory-excuse windows | Yes | Same |
| Holding copies in an unalterable format | Yes | Format is prescribed; storage is not reserved |
| Scheduling secure destruction at employment plus two years | Yes | Retention period is set; the trigger is yours to build |
The record-keeping requirements are worth reading against that table, because they are unusually specific about outcomes and silent about mechanism. Employers must:
"make a clear copy of each document checked. Where facial recognition technology has been used, this must include a copy of the document checked and any comparison provided by the RtW DVSP, in a format which cannot be manually altered. This can be electronically, in HTML or as a PDF, or in hardcopy."
"retain a secure record of the date on which the check was conducted by either making a dated declaration on the copy or by holding a separate record… Simply writing a date on the copy document will not be sufficient as it does not, in itself, confirm that this is the actual date when the check was undertaken."
Read that second requirement carefully. A date typed onto a scan is not enough on its own (the June 2025 guide already said a date on the copy did not, in itself, confirm the date of the check); what the guide wants is either a dated declaration in the prescribed form or a contemporaneous record made when the check was done. That is a filing problem, not a checking problem — and it is squarely an automation problem. Our record keeping guide sets out the format and retrievability standards an inspector applies.
The same is true of the follow-up:
"Employers need to re-check the right to work of those individuals who have time-limited permission to work in the UK if they intend on continuing to employ them after their current permission expires… They must do this on, or before, the date their permission comes to an end."
A date, known at the moment of the first check, that has to survive twelve or eighteen months of a business's attention. Our guide to follow-up right to work checks covers the mechanics, and the follow-up timeline calculator works out the dates from a single check.
From 1 October 2026 there is more to track, not more to automate
Two things moved on 1 October 2026, and only one of them is about automation. The digital route widened, as above. Separately, and more consequentially for most employers, the volume of people underneath it grew.
From that date, section 48 of the Border Security, Asylum and Immigration Act 2025 extends the Right to Work Scheme beyond contracts of employment:
"In sections 15 to 24, a reference to a person employing another person includes a reference to— (a) a person ('person A') engaging an individual ('individual A') under a worker's contract, (b) a person ('person B') engaging an individual sub-contractor ('individual B'), and (c) an online matching service ('person C') providing the details of an individual who is a service provider ('individual C') to potential clients or customers."
Casual staff, zero-hours workers and individual sub-contractors need the same initial check and the same follow-ups as employees — on people who move between engagements far more often than employees do.
One qualifier matters before you start a retrospective exercise, and most coverage omits it. The change is not backdated. Both the guidance and the Code of Practice for the scheme from 1 October 2026 state that for engagement under a worker's contract, as an individual sub-contractor, or through an online matching service, "a civil penalty may only be imposed where the employment commenced on or after 1 October 2026". The Code adds that this "applies both to civil penalty liability arising directly under section 15 of the IANA 2006 and to civil penalty liability arising under the extended liability provisions in section 15A of the IANA 2006"; the guidance puts the extended-liability side in terms of contract dates instead, applying its requirements "where the relevant contractual arrangements were entered into on or after 1 October 2026". Engagements already running on 30 September 2026 do not attract a penalty under the new categories. If you do choose to check an existing population anyway, check all of it rather than a selection: the guidance says employers should not "discriminate when conducting right to work checks".
The check itself is no more automatable than it was. The register behind it went from difficult to keep by hand to unrealistic. See what changes on 1 October 2026 for who is caught.
What to ask a vendor
If you are evaluating a tool, three questions separate the ones that fit the rules from the ones that describe a service the scheme does not recognise.
- "Are you on the OfDIA register for right to work, and which of my workers can you actually verify?" Registration is mandatory for the digital route, and coverage varies by provider and by document — a provider may verify British and Irish passports, other List A and List B documents where the issuing authority publishes them digitally, or only some of that. Ask which prescribed check they are performing for each group, and get the answer in writing, because you remain responsible for it meeting the prescribed requirements.
- "What happens eighteen months after the hire?" Point-of-hire verification is the well-served half of this market. Expiry tracking is the half that produces penalties.
- "Can you show me a dated record I could hand an inspector?" Not a dashboard — the copy, in an unalterable format, with the date of the check recorded as the date of the check.
Our guide to choosing right to work check software works through the wider evaluation, including the difference between per-check verification services and ongoing compliance tracking.
The bottom line
Automating right to work checks means automating around the liability, not out of it. A registered RtW DVSP may complete digital identity verification — for British and Irish passport holders, and from 1 October 2026 for other List A and List B documents where they are available digitally from the issuing authority — but the employer, not the provider, remains responsible for the check meeting the prescribed requirements, and the penalty lands on the employer when it does not. Manual checks are yours, in the holder's presence or on a video call with the originals in hand, delegable to your own staff and no further. What is fully automatable is the register, the dated record, the follow-up diary, the retention clock and the audit trail — which is where missed checks actually come from, and which got materially harder on 1 October 2026 when the scheme grew to cover casual and sub-contracted work engaged from that date onwards.
Sources
- Employer's guide to right to work checks — GOV.UK (quotations are from the final version that came into force on 1 October 2026, published on GOV.UK that day in place of the 11 September 2026 draft)
- Code of practice on preventing illegal working: Right to Work Scheme for employers — GOV.UK (quotations are from the revised Code laid in draft before Parliament on 30 June 2026 and brought into force on 1 October 2026 by SI 2026/700)
- Border Security, Asylum and Immigration Act 2025, Section 48 — legislation.gov.uk
- The Border Security, Asylum and Immigration Act 2025 (Commencement No. 4) Regulations 2026, reg 2 — legislation.gov.uk
- The Immigration (Restrictions on Employment and Residential Accommodation) (Prescribed Requirements and Codes of Practice) (Amendment) Regulations 2026 (SI 2026/700), reg 2 — legislation.gov.uk