New right to work rules made site access a legal control. It only works if the network does.
Most rule changes that affect construction land on someone else’s desk. This one lands on yours.
Since 1 October 2026, liability for illegal working no longer stops at the direct employment relationship. It reaches self employed operatives, agency labour, subcontractors and the payroll intermediaries sitting between them. If the Home Office cannot identify the direct employer, it can look up the contractual chain and fine a business that never signed anything with the individual concerned. The figures being quoted are £45,000 per worker for a first breach and £60,000 for a repeat.
Read the practical guidance that has come out since and you find the same advice everywhere. Contract clauses requiring your subcontractors to run compliant checks are necessary and nowhere near sufficient. What actually protects you is evidence. Proof that the person who walked through the turnstile is the person who was checked. Audit trails you can produce on demand. Identity verification covering passes, facial verification, biometrics and attendance records. The in person element of a check can now be done digitally through a certified provider, which genuinely helps, but only if you can run digital verification at the point of entry.
Every one of those controls is a live system. The turnstile authenticates against a cloud directory. The certified identity provider gets queried over an API in real time. Attendance data has to synchronise back to a central record that still exists years after the compound has been demolished and the hoarding has gone.
None of it works offline. A gate that cannot reach the internet either stops the works or waves people through on paper, and the paper option is exactly the gap these rules exist to close.
The awkward bit is timing
You need those controls on the first morning labour arrives. That is typically weeks or months before anyone can deliver a fibre circuit to a plot that has no postal address, no mains power and no permanent entrance.
Construction networks fail in ways enterprise networks rarely do. The site office moves three times during the programme. The compound sits in a cutting where mobile coverage drops to a single bar. The principal contractor changes halfway through and the whole access control estate changes with it. Circuit lead times routinely outrun the period when the connection matters most, and by the time the fibre goes live the groundworks team has already left.
For years the answer was to treat each site as a one off. Order whatever the local carrier can provide, accept that the single connection is a single point of failure, and hope. That was fine when the network carried email and a shared drive. It is not fine now that the network carries the evidence keeping a civil penalty off your balance sheet, along with the design models, the plant telematics, the cameras and the voice service someone will use to call an ambulance.
Stop ordering circuits, start defining sites
The thing that changes the maths is separating the service from the transport.
Modern SD WAN solutions let you define a site once, as a policy and a set of applications, then satisfy that definition with whatever is physically available on the first day. A 5G fixed wireless service at the gatehouse. A low orbit satellite terminal on the welfare cabin while the mast order grinds through. A business broadband line when the local exchange eventually catches up. Run all three together, pin the verification traffic to the most reliable path, and push the bulk model synchronisation onto whichever link is cheapest at that moment.
The site team sees one network that behaves identically on every project. The programme stops waiting for a circuit. That is the whole trick, and it is not a complicated one.
Why this suits contractors better than most sectors
Construction IT teams are small relative to the estate they carry, and the estate is deliberately temporary. A retailer configures a shop once and leaves it alone for seven years. A contractor might stand up and tear down 40 sites a year, each with a different transport mix, a different access control vendor and a different set of joint venture partners who all need segmented access to the same compound.
That churn is what managed SD WAN absorbs well. Policy lives centrally. A new site inherits the template, including the segmentation that keeps the subcontractor tablet estate well away from your finance systems and the quality of service rules protecting voice and verification traffic when the welfare cabin starts streaming the football. Devices ship preconfigured and get brought into service by a site electrician rather than a network engineer on a train from Birmingham.
There is also the question of who holds the keys, and in our experience this is where most conversations stall. Contractors do not want to hand over visibility, because when the Home Office or the principal designer asks a question, the answer has to come fast and from someone who understands the scheme. A jointly managed model keeps your team looking straight at the network while the escalation, the out of hours cover and the field engineering capacity sit underneath. That distinction matters at three in the morning when a biometric reader at a remote compound has dropped off the network and the first pour is booked for six.
The same logic travels. Global connectivity run through one policy framework avoids the mess where a Dutch depot, a Spanish solar farm and a Midlands housing scheme each sit on separate contracts, separate security standards and separate support arrangements that nobody can audit as a whole. Anyone who has tried to answer a group wide security questionnaire with 14 different carrier portals open will recognise the problem.
Someone still has to climb the ladder
None of this works without a decent physical install. Remote connectivity on a construction site comes down to unglamorous detail. Where the satellite terminal sits so its view of the sky survives the next crane lift. How the 5G antenna is sited and earthed. Whether the enterprise wifi coverage actually reaches the gatehouse rather than dying twenty metres short of the turnstile, which is the one place it absolutely has to work.
This is why we use our install partner StarLink Solutions for Starlink installation across the UK, 5G broadband installation, enterprise wifi installation and satellite internet solutions on sites where a conventional circuit is simply not an option yet. A properly planned install in week one removes most of the support calls that would otherwise turn up in weeks four to twelve.
What to do about it
Treat the gate as a network location with its own resilience requirement, not as an accessory to the site office. Specify the access control systems and the connectivity carrying them in the same conversation rather than six weeks apart. Assume your first transport will be wireless or satellite, and design the policy so a later fibre delivery is a swap rather than a rebuild. Build the audit path on purpose, so verification records reach central storage with a retention period that matches how long you can be asked about them. Then standardise it, because the exposure sits with the organisation, not with whichever site happened to get good signal.
The Home Office collection on right to work checks for employers sets out the official position, and it is worth reading next to your own supply chain contracts rather than instead of them.
What strikes me about this change is how little of it is really about immigration policy. It is another instance of regulation asking for continuous evidence instead of periodic paperwork, and continuous evidence needs a network that is continuously available, on sites that were never designed to have one. Building safety records went the same way. Environmental monitoring is going the same way. The gate was just first.
Book a workshop with our experts
If you look after connectivity across a construction portfolio and want to work out how a managed SD WAN approach could carry identity verification, site access and audit evidence from day one of a programme, our engineers will go through your estate with you and map the options.