Recruitment Agency Compliance 2026: Umbrella Liability, ICO Rules and the Employment Rights Act
120 recruitment agencies entered liquidation in the last six months. On 6 April 2026 the joint and several liability for umbrella company tax failures began. An umbrella in your chain may not pay its PAYE or its NICs. HMRC can then ask you for the whole amount. On 31 March 2026, the ICO published a report finding that most AI recruitment tools in the UK are non-compliant with data protection law. And the Employment Rights Act is reshaping unfair dismissal, zero-hours contracts, and day-one rights across every placement you make. This guide covers what your recruitment software needs to handle now.
Connect with us about recruitment software · · Replies within 24 hours
120
Recruitment businesses entered liquidation in the last six months
6 Apr
Joint and several liability for umbrella company PAYE/NICs went live
29 May
ICO consultation on automated recruitment decisions closes
Umbrella Company Liability: What Changed on 6 April 2026
The Finance Act added a new Chapter 11 to Part 2 of ITEPA 2003. It makes you liable, with the others, for PAYE income tax and Class 1 National Insurance. That applies whenever an umbrella company sits in the chain. The operative date was 6 April 2026. A parallel secondary legislation creates equivalent liability for NICs.
What This Means in Practice
A worker comes through an umbrella company, and a UK recruitment agency sits in the chain. HMRC will go to that agency for any PAYE or NIC that is missing. If there is no agency in the chain, the end client takes on that liability instead. The liability is for the full amount of unpaid tax and NICs, not just a proportional share.
This is not theoretical. The FCSA (Freelancer and Contractor Services Association) warned that agencies must act before 6 April. The REC issued guidance confirming that agencies using umbrella companies need to verify compliance as part of their standard supply chain management.
This is a tax compliance measure, not full regulation. The April 2026 change creates the liability. A separate regulatory regime for umbrella companies is still pencilled in for 2027. Until that regime exists, the burden of verifying umbrella company compliance sits entirely with the agency. Your systems need to support that verification.
What Your Software Needs to Handle
Umbrella company register. A record of every umbrella company in your supply chain, including their PAYE registration, FCSA or Professional Passport accreditation status, and last verification date
Due diligence workflows. Before placing a worker through an umbrella, your system should flag whether the umbrella has been verified. If verification is expired or missing, the placement should be blocked or flagged for manual review
Payslip monitoring. The FCSA recommends checking that workers are receiving compliant payslips showing gross pay, PAYE deductions, NIC deductions, and net pay. Your system should log that payslip checks have been performed
Audit trail. If HMRC pursues your agency for an umbrella company's tax shortfall, your defence rests on demonstrating that you took reasonable steps to verify compliance. Every check, every verification, every flag needs to be timestamped and retrievable
No major recruitment CRM (Bullhorn, Vincere, JobAdder, Firefish) has announced a dedicated umbrella compliance module, because this liability is new. Most agencies are managing it through spreadsheets, manual checks, or bolted-on processes outside their CRM. That is a risk by itself. Your due diligence evidence may not sit in your main system. It is then harder to produce when HMRC asks for it. For a comparison of the main CRM platforms, see our CRM vs ATS guide.
The ICO and Automated Recruitment Decisions
The ICO published a report on automatic decisions in recruitment on 31 March 2026. It spoke to more than 30 employers, and it audited the companies that make AI recruitment tools. The findings were stark: most organisations using automated recruitment tools are not meeting their data protection obligations.
What the ICO Found
Here is the main problem. Employers think their tools only support a decision, so that the AI suggests and a person chooses. In practice those tools make the whole decision, with no real part for a person. A recruiter who rubber-stamps every AI recommendation without independent assessment is not providing meaningful human oversight.
Under UK GDPR Article 22, solely automated decisions that produce legal or similarly significant effects on individuals are restricted. Rejecting a candidate from a hiring process is a "similarly significant effect." Your ATS may reject candidates by itself, from keyword scores, from what it reads in a CV, or from a ranking. If no person truly reviews that decision, you may be breaking the rules.
The Three ICO Expectations
Proactive bias monitoring. Test AI recruitment tools regularly for biased outputs. Ask developers about their own bias testing when procuring tools. Consider monthly bias reviews.
Transparency. Tell candidates if automated decision-making is being used. Explain how it works. This is a legal obligation under UK GDPR Articles 13 and 14, not a best-practice recommendation.
Right to challenge. Tell candidates how to exercise their right to request human review of an automated decision. Ensure there is a functioning process to carry out that review.
The ICO consultation on draft automated decision-making guidance is open until 29 May 2026. Final guidance will follow. The ICO also wrote to 16 named organisations that it believes use automatic decisions in hiring. All of them have agreed to act on its advice.
47% of UK job seekers have now had an AI interview. The scale of automated recruitment is already massive. The regulatory framework is catching up. Your agency may give AI screening tools to clients, or use them itself. Check those tools against the three ICO expectations before the final guidance arrives.
What Your Software Needs to Handle
Decision logging. Record how every decision was made, both to reject a candidate and to move one forward. A person made it, an AI tool made it, or a person acted on advice from an AI tool. If the decision was AI-assisted, record what the AI recommended and what the human decided independently
Transparency records. Log that each candidate was informed about the use of automated decision-making at the point of application or at first contact. Your system should generate or trigger this disclosure automatically
Human review workflow. A candidate can ask a person to review an automatic decision. Your system must send that request to somebody qualified. It must record what they decide, and tell the candidate. This cannot be an ad-hoc email thread
Bias audit trail. If you use AI screening tools, log when bias testing was last performed, what was tested, and what the results were. The ICO expects this as standard practice
Connect with us about recruitment software · · Replies within 24 hours
The Employment Rights Act: What Is Changing for Agencies
The Employment Rights Act 2025 received Royal Assent on 18 December 2025. Changes are being phased in across 2026 and 2027. Several provisions directly affect how recruitment agencies operate.
Already Live (April 2026)
Fair Work Agency launched 7 April 2026. A single enforcement body consolidating three existing bodies, chaired by Matthew Taylor. This is the regulator that will police agency compliance
Day-one Statutory Sick Pay. No earnings threshold, no three-day waiting period. Every temporary worker placed through your agency qualifies from their first day of work
Day-one paternity and parental leave. Candidates placed through your agency have these rights immediately
Coming January 2027
Unfair dismissal at six months (not two years). The qualifying period drops from two years to six months. Compensation caps are being abolished entirely. Anyone hired from July 2026 onwards will gain protection when this kicks in. For an agency, that makes the quality of a placement matter more. A poor placement can end in dismissal in the first year. The legal risk to your client is now much higher
Zero-hours contract reforms. Workers on zero-hours or low-hours contracts must be offered guaranteed hours based on patterns worked over a 12-week reference period. This applies to agency workers too. Your system needs to track hours worked per assignment and calculate when a guaranteed-hours offer is triggered
Shift cancellation compensation. Employers (and agencies placing workers) may need to compensate staff for short-notice shift cancellations. Your system needs to record shift schedules, cancellations, and notice periods
The definition of "employment agencies" is expanding. The Employment Rights Act brings umbrella companies under the definition of employment agencies for the first time. A live government consultation ("Make Work Pay: Modernising the Agency Work Regulatory Framework") is shaping these rules. When the final regulations land, your compliance obligations will be broader than they are today.
120 Agencies Went Bust: What the Survivors Are Doing Differently
The insolvency rate in recruitment is the highest since 2008. 120 agencies entered liquidation in six months. Even Hays, one of the largest UK recruiters, saw operating profits halve from £105.1 million to £45.6 million. The pressures are built into the market. Employer NICs have risen to 15%. Hiring in technology has slowed. The BBLS loans from the pandemic are now due. The umbrella liability adds a new compliance cost.
The agencies that survive did three things. They cut the cost of each placement with automation. They tightened their compliance work, to avoid a penalty. They held their margin, by scoping and pricing each job accurately. All three of these depend on software that works.
Compliance Area
Status
What Your System Must Do
Umbrella PAYE/NIC liability
Live (6 Apr 2026)
Umbrella register, due diligence workflow, payslip monitoring, audit trail
ICO automated decisions
Consultation closes 29 May 2026
Decision logging, transparency records, human review workflow, bias audit
Day-one SSP
Live (6 Apr 2026)
SSP calculation from first day, no earnings threshold
Fair Work Agency
Live (7 Apr 2026)
Consolidated compliance records accessible for enforcement review
Unfair dismissal at 6 months
January 2027
Placement tracking, probation period management, screening documentation
Zero-hours guaranteed hours
January 2027
12-week reference period tracking, guaranteed-hours offer generation
Why the evidence must be part of the record, not next to it
Both changes above ask the same thing of you. Show, later, what you checked and who decided. The umbrella check, and the part a person played in a rejection.
Most agencies hold that in a spreadsheet, a shared drive or an email. Each of those is a record a person can write, so each is a record a person can change. Evidence like that is weak exactly when it matters.
On engage.re every action goes to a signed log, and each entry holds the hash of the one before it. Nothing can be added or removed later without breaking the chain. The umbrella check, the decision and the person who made it are therefore the same age as the events themselves.
They also sit in the same data as the placement, so nothing must be joined afterwards. We explain why one shared foundation makes this normal, and not expensive, in bespoke software for a whole sector.
When Bespoke Software Makes Sense
Your agency may use a large CRM such as Bullhorn or Vincere, in a plain and standard way. That means permanent placements, no umbrella chain and no AI screening. Those platforms will probably catch up as they add features. For agencies that need to move faster than their CRM vendor, bespoke makes sense in specific scenarios.
Agencies with significant umbrella supply chains. You may place workers through several umbrella companies. You then need the checks inside your CRM, and not in a separate spreadsheet. A part built for you can join the placement work to the umbrella checks, to the payslips you watch, and to the audit log. All of it sits in one system. No major CRM offers this natively
Agencies using AI screening that need ICO compliance now. Your ATS may screen by itself, through keyword scores, CV reading or video interview analysis. You must then show three things before the final ICO guidance arrives. A log of each decision. What you told the candidate. How a person reviews it. Building that into your own system now is faster than waiting for your ATS vendor
Agencies managing both permanent and temporary placements. The Employment Rights Act affects temp placements differently from perm placements (day-one SSP, zero-hours reforms, shift cancellation rules). A good system follows these duties for each kind of assignment. It works out SSP by itself. It marks a guaranteed-hours trigger from the hours actually worked. That removes work by hand that grows with every placement
Agencies that have outgrown their CRM but cannot afford downtime. You may be thinking of a move from Bullhorn or Vincere. Our Bullhorn alternatives and Vincere alternatives guides cover the choices. A system built around the way you work, with compliance in it from the first day, avoids the compromises of another ready-made platform
The compliance landscape for recruitment agencies has shifted fundamentally in 2026. The umbrella liability is new. The ICO expectations are new. The Employment Rights Act changes are phased but accelerating. The same Act hits other sectors that depend on people just as hard. Our guide to the Employment Rights Act for cleaning companies shows how day-one SSP and the zero-hours changes affect shift work across many sites. Agencies that treat these as separate, manual processes will spend more time on compliance admin than on placing candidates. Agencies that build compliance into their software stack will spend less.
You can see this in a working system. The ESRE live recruitment demo opens with no login, and it shows the compliance work in this guide. Sign in as compliance and run the right to work and reference checks, or as owner and see the audit trail. It is a working system, not a screenshot.