How should organisations prepare for the October 2026 right to work extension?

What preparation actually means before the scope changes

The practical task is to convert a legal expansion into an operational control change, not a policy announcement. Organisations should first identify every workforce path that will fall into scope, then decide where verification sits in each flow. If contractors, agencies, and gig labour are handled differently today, the extension is a chance to standardise the control point before exceptions multiply.

That review should cover onboarding, re-verification, end-of-assignment checks, and who can grant an exception. If the process depends on a manager, recruiter, or client team making local judgement without a recorded owner, the organisation will struggle to prove consistency once the new requirement applies. A controlled process is the objective, not a longer checklist.

How to build a verification model that works across non-traditional labour

Map the labour routes by risk and volume, then assign ownership for each route to the team that can actually verify the right evidence. In practice, that usually means separating direct employees, agency workers, contractors, and platform or gig arrangements so the organisation can match the verification step to the engagement model instead of forcing one generic workflow onto all cases.

Where third parties supply labour, the organisation should define whether the supplier verifies, the host organisation verifies, or both do. The weaker the handoff, the more likely gaps appear at the point of entry and again when assignments change. If a worker can move between sites, clients, or roles without a fresh decision about eligibility, the control has not really been extended.

Documentation matters as much as the check itself. A defensible model records which route was used, what was verified, who approved it, and when the verification must be revisited. That is especially important where labour is intermittent or project-based, because a one-time approval can outlive the assignment that justified it.

What should change in policy, systems, and oversight

Policy should say which engagements are in scope, which evidence types are acceptable, and what happens when evidence is missing or disputed. Systems should mirror that policy so the operational team is not improvising from email, spreadsheets, or ad hoc approvals. Where possible, NIST Cybersecurity Framework 2.0 is a useful reminder that governance, identification, and control execution need to be joined up rather than treated as separate activities.

The process also needs control testing. Organisations should sample cases from each labour route and confirm that the same decision logic is being applied, especially where agencies or intermediaries sit between the worker and the business. If the process is only reliable when one specialist team handles every case manually, it will not scale cleanly into the extended scope.

For organisations that rely heavily on contingent labour, the wider access and verification environment also deserves review. The same control discipline that governs who is allowed in should align with how access is granted and removed, which is why teams often pair workforce checks with identity and access controls. For that lens, NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful control reference, and NIST Cybersecurity Framework 2.0 helps keep the governance picture coherent.

Risk and Threat Considerations

The main risk is not the legal change itself, but inconsistent execution across labour types. If verification is strong for employees and weak for contractors or gig workers, organisations create a predictable gap where unverified or wrongly approved labour can enter business processes. That gap can become an access, fraud, or auditability problem, depending on how much authority the worker receives.

Failure mechanism: Decentralised hiring and onboarding create exceptions, missing evidence, and unclear ownership, so the organisation cannot show that every in-scope labour path was verified before work began or continued.

Impact: The result can be non-compliance, avoidable operational disruption, weak audit evidence, and increased exposure if an ineligible or unauthorised worker is allowed to perform controlled tasks or access sensitive systems.

Practitioner Guidance

What to prioritise: Start with the labour routes that are highest volume, highest churn, or most dependent on third parties, because those are the cases most likely to break when the scope expands. Build the operating model around the route, not around the job title.

What to verify: For each route, confirm who owns the decision, what evidence is required, and what event forces re-checking. If the answer differs by team or location, standardise it before the deadline rather than after the first exception appears.

Practitioner takeaway: Treat the October 2026 change as a workflow-design problem, not a wording change. The organisations that cope best will be the ones that can prove consistent verification across every labour channel, with clear ownership and no hidden exceptions.

Related resources from NHI Mgmt Group

• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?
• How can organisations reduce the blast radius of compromised agent identities?
• Should organisations prioritise external exposure or internal credential governance first?