What changed after Brexit
The UK left the EU on 31 January 2020. The transition period ended 31 December 2020. The immigration system that followed treats EU citizens the same as nationals of any other country, with one large grandfather clause (the EU Settlement Scheme) and two small exceptions (Irish citizens via the Common Travel Area, and frontier workers in certain regions).
For employers, three operational consequences:
- EU passports and ID cards alone no longer prove right to work (except Irish citizens via the Common Travel Area).
- EU citizens already in the UK before 31 December 2020 had until 30 June 2021 to apply for EU Settlement Scheme status; many late applications are still processed in 2026.
- EU citizens arriving after the cut-off are subject to the points-based immigration system. They need a work visa (Skilled Worker, Health and Care Worker, etc.) like any other non-UK national.
The eVisa transition: share codes replaced BRPs
Through 2024, the Home Office completed the transition from physical biometric residence permits (BRPs) to fully digital eVisas. New BRPs stopped being issued in November 2024. The migration affected several million visa holders, each of whom now manages their immigration status through a gov.uk online account.
The right-to-work flow:
- The employee logs into their UK Visas and Immigration account at gov.uk and generates a share code under “prove your right to work to an employer.” The share code is a nine-character alphanumeric token, valid for 90 days.
- The employee gives the employer the share code plus date of birth.
- The employer enters both at gov.uk/view-right-to-work. The page returns the employee’s status (work permitted, any restrictions, expiry date) and shows a photo of the employee. The employer compares the photo to the person present in front of them or on video call.
- The employer downloads or screenshots the result and stores it in the employee file. The check is valid as long as the immigration status remains active; for time-limited statuses the employer schedules a follow-up check before expiry.
The pre-2024 BRP card is no longer on the acceptable-document list for manual checks; even employees who still hold a physical card must use the share-code flow.
The manual check: British and Irish passports
For British and Irish citizens with valid passports, the employer can run a manual passport check. The process:
- Inspect the original passport in the employee’s presence (or by video call if using the Identity Service Provider flow).
- Confirm the photo matches the holder, the document is genuine and unaltered, and the dates of validity are current.
- Take a clear copy of the relevant pages, mark it with the date of the check, and retain it in the employee file.
- Alternatively, use a Home Office certified Identity Service Provider (IDSP) for digital verification. IDSPs run a one-time identity verification (photo, document check, liveness) that satisfies the statutory excuse.
For document forensics on the passport image itself, see our government ID forgery field guide.
The biometric residence permit is gone. The share code is the new artifact. British and Irish passports are the only manual exception.
The EU Settlement Scheme legacy
The EU Settlement Scheme (EUSS) gave EU, EEA, and Swiss citizens resident in the UK before 31 December 2020 a pathway to remain. Status under EUSS comes in two forms:
- Settled status. Effectively indefinite leave to remain. Granted after five years of continuous UK residence. List A right-to-work, no follow-up required.
- Pre-settled status. Five-year permission to remain pending eligibility for settled status. List B right-to-work, follow-up check before the status expires (extensions and conversions are common; do not assume expiry).
EUSS-status holders use share codes the same as any other visa holder. The status is digital-only; there is no physical card. An employer who insists on a physical document for an EUSS holder is asking for something that does not exist.
The EU side: each country runs its own check
The EU has no harmonized employer right-to-work portal as of 2026. Each member state operates its own:
- Germany. Aufenthaltstitel (residence card) plus Beschäftigungserlaubnis (employment permit). Employers verify against the Ausländerzentralregister where applicable.
- France. Titre de séjour (residence permit). For non-EU nationals, the prefecture issues the work-permitted card; employers verify through the SIRRT system in some cases.
- Netherlands. Verblijfsdocument (residence document) tied to the BSN (citizen service number). The IND (Immigration and Naturalization Service) provides verification for employers.
- Italy. Permesso di soggiorno (residence permit). Employers verify with the Questura.
- Ireland. Stamp 1, 4, etc. on the Irish Residence Permit. The Department of Justice operates the immigration service.
The longer-horizon harmonization play is eIDAS 2.0 and the EU Digital Identity Wallet, which started rolling out in 2024 and is in phased deployment through 2026 to 2030. The wallet aims to let citizens across member states present identity and right-to-work attestations from a single digital wallet. Full cross-border employer verification through the wallet is in pilot in 2026 and not yet a routine substitute for the country-specific systems.
Penalties for failing the check
The UK statutory excuse is the legal protection an employer gains by running a compliant check. Failing to obtain the statutory excuse exposes the employer to civil penalties of up to GBP 60,000 per illegal worker (a tier raised in 2024). Knowingly employing an illegal worker is a criminal offence carrying up to five years imprisonment plus an unlimited fine.
EU member-state penalties vary. Germany fines employers under the SchwarzArbBekämpfG; France under the Code du travail; the Netherlands under the Wav (Wet arbeid vreemdelingen). Most regimes scale penalties by number of workers and presence of aggravating factors (knowledge, repeat offence, exploitation).
Practical implication for HR: a working share-code check, a saved screenshot, and the dated audit trail are the difference between a compliant employer and a six-figure liability.
Where forensic AI fits
The share-code system removes the forensic-AI need for in-the-UK checks: the artifact is a token, not a document, and the Home Office system is the authoritative source. Where forensic AI still adds value:
- Identity documents at the pre-screen step. A candidate sends a passport or ID image to a recruiter before the formal right-to-work check; forensic AI confirms the passport is authentic before continuing.
- EU member-state physical residence permits where no online verification exists. Forensic AI on the card image catches Photoshop and AI-generated forgeries before the employer relies on the document.
- Supporting documents at recruitment intake: certifications, employer letters, education documents. The right-to-work check is one of several intake steps; forensic AI handles the others.
For the broader identity-verification context, see our government ID forgery field guide and our KYC document verification primer.
Frequently asked questions
What happens if a share code does not work?
Two common causes: the code expired (90 days from generation), or the employee entered their date of birth wrong. Ask the employee to generate a fresh code and try again. If still failing, contact the Home Office Employer Checking Service for a Positive Verification Notice as a fallback.
How often do I follow up on a List B check?
Before the immigration status expires, or at the follow-up date the system specifies (usually six or twelve months for pre-settled status and visa holders). Set calendar reminders; missing the follow-up forfeits the statutory excuse.
Can I run a right-to-work check remotely?
Yes for share-code checks (the system was designed to work remotely). For manual passport checks, the permanent adjusted check ended in October 2022; ongoing remote verification of British and Irish citizens must run through an Identity Service Provider (IDSP).
Do I need to do a right-to-work check for contractors and freelancers?
The statutory employer check applies to direct employees. For contractors (engaged through a limited company or umbrella), the check sits with the contractor’s own employer (the umbrella). Best practice is to confirm the umbrella runs compliant checks; for any direct individual engagement, run the share-code check.
What about Irish citizens working in the UK?
Irish citizens have an automatic right to work in the UK under the Common Travel Area arrangement, separate from EU rules. A valid Irish passport evidences right to work; no visa is needed. The manual passport check is the standard approach for Irish citizens.