Outsourcing Spotlight – Autumn/Winter 2026
In this issue, we look at extended liability for right to work checks, the £28 million fine on Virgin Media for mishandling customer calls and the practical lessons from recent case law on step-in rights and complex outsourcing contracts.
We also discuss what businesses should be doing in response to UK employment law reforms, security measures affecting premises and event management outsourcings, transparency obligations under the EU's AI Act and the EBA guidelines on non-ICT outsourcing.
From 1 October 2026, failures by service providers and subcontractors to carry out right to work checks could result in fines being imposed on businesses further up the supply chain. The civil penalties are significant: up to £45,000 per illegal worker for a first breach, rising up to £60,000 for repeat breaches.
We expect the main impact to be on outsourcing service providers which are using subcontractors, rather than on their customers (but see below). The following example illustrates how the new rules could "bite" on a call centre outsourcing:
A leading consumer-facing brand outsources its call centre operation to a specialist service provider. To keep costs down, the customer has agreed that the service provider can use subcontractors at particular times of year when demand is expected to peak. Right to work checks are normally expected to be carried out by the direct employer of the relevant staff – and prior to 1 October, if the subcontractor failed to ensure that its staff all had the right to work in the UK, then only the subcontractor could have been liable for that failure. However, following changes in the Border Security, Asylum and Immigration Act 2025, liability can now extend further up the chain – so the outsourcing service provider, which appointed the subcontractor, could now be held responsible for the presence of illegal workers in its supply chain. If the subcontractor is itself using other providers, including agencies to provide additional staff, then failures by these entities could also give rise to liability further up the supply chain, up to and including the "primary" outsourcing service provider.
The guidance makes clear that where a business is using the services itself, with no onward customer which has engaged it to provide those services, then it will not be subject to extended liability. In the above example, the outsourcing customer is likely to be regarded as consuming the services as part of its own business, rather than acting on behalf of a customer (or other entity) further up the chain.
There are a number of steps businesses can take to protect themselves from liability, including inserting protective provisions into contracts and exploring various practical steps. However, as we explain in our briefing, the contractual provisions need to meet the requirements of Home Office guidance and the practical steps require careful consideration of the wider context.
We can assist with analysis of supply chains to identify which ones are likely to be within scope of the extended liability provisions and provide you with template wording for existing and future contracts. We can also provide training for procurement, HR and operational teams who will be responsible for managing compliance day-to-day. Please speak to your usual contact at the firm or any of the contacts listed below.
In a striking example of the risks that can accompany consumer-facing outsourcings, communications regulator Ofcom has fined Virgin Media £28 million for breaches of sectoral rules designed to protect telecoms consumers.
In July 2023, Ofcom launched a formal investigation into Virgin Media, having received a large volume of complaints from customers experiencing difficulty cancelling their contracts. Virgin Media had outsourced its arrangements for dealing with customers on this issue.
The investigation found that between January 2022 and September 2024, millions of customers were forced to repeat their request to at least one further agent before their cancellation would be processed. This was because agents in the first "tier" were not able to process cancellations at all. As a result, the earliest that a consumer could cancel would be when they reached an agent in the second tier. Agents in both "tiers" employed a range of tactics designed to obstruct customers from leaving, such as routing them to other teams without justification, engineering lengthy and unnecessary periods of silence on the line and cutting off calls entirely. As a result, many customers had to make multiple attempts to cancel.
Ofcom also found that Virgin Media's commission arrangements effectively incentivised agents to obstruct cancellation requests and that the outsourcing arrangements were not subject to adequate oversight or governance arrangements.
Although Ofcom's decision highlights failures by Virgin Media to conduct proper oversight of its outsourced call centres, it also notes that the largest outsourced service provider made certain changes that were contrary to Virgin Media's processes and did so without informing Virgin Media. There are several possible reasons why Ofcom did not take action against the outsourced service providers in this case. First, its enforcement action against Virgin Media was based on the latter being a communications provider which is required to comply with Ofcom's authorisation rules under its General Conditions of Entitlement. It seems unlikely that the outsourced service providers were subject to these sectoral rules. Second, Ofcom may have taken the view that, as the call centres were acting on Virgin Media's behalf, it was entirely appropriate to make Virgin Media wholly responsible for acts or omissions of those parties. However, as we have highlighted previously, there are circumstances where an outsourced service provider could be pursued by a regulator in relation to breaches of general UK consumer law (as opposed to sector-specific rules, as in this case). Depending on the terms of the outsourcing arrangements, there may well also have been contractual consequences for the relevant service providers, such as termination and/or claims for damages from Virgin Media.
For customers, this case is a reminder that regulators will typically look to hold the consumer-facing business responsible for breaches of relevant consumer protection rules, notwithstanding that the activity in question has been outsourced. Whilst this case related to rules specific to the telecoms sector, the UK Competition and Markets Authority (CMA) now has powers to impose similar fines for breaches of general UK consumer law. Our view is that similar conduct outside the telecoms sector would be at risk of significant sanctions under this new regime – and the CMA has already shown its willingness to impose fines for breach of general consumer law. Against this background, it is all the more important for outsourcing customers to:
Service providers, meanwhile, should aim to demonstrate to customers that they understand the regulatory risks and have robust processes in place to mitigate them.
In sectors which are only subject to general UK consumer law, this risk may have been considered to be less significant in the past (because, for example, there were no powers to impose fines); as such, both customers and service providers in those sectors may want to consider whether their current outsourcing arrangements have sufficient safeguards against conduct of the type which occurred in the Virgin Media case.
Step-in rights are fairly common in more complex, longer term outsourcing agreements. They typically allow the customer to take over the management of a seriously underperforming service – or to appoint a third party to do so on its behalf. In practice, this is often seen as something of a last resort, albeit one that may sometimes be preferable to the "nuclear option" of terminating the contract and seeking a replacement provider. That said, the possibility that the customer might exercise its step-in rights can sometimes help to focus the service provider's mind on improving its performance – which shows that such clauses can sometimes be a useful tool for customers, even when they are not actually exercised.
However, in a recent case – Secret Mode v Victura (2026) – the court refused to grant an injunction that would have required the supplier to permit its customer to exercise its step-in rights. Does this mean that in future, such rights are less likely to be an effective tool for outsourcing customers which are concerned about poor performance from the service provider?
Victura was developing a video game called "Six Days in Fallujah". Secret Mode agreed to act as publisher of the game (and to bear the relevant costs) as well as contributing $8 million to enable the game to be completed – although by this point, Victura had already spent over $50 million on the game's development. Secret Mode claimed that Victura had failed to meet various milestones and that it was therefore entitled to exercise its step-in rights with a view to getting the project back on track. Victura, meanwhile, argued that the step-in rights had never been validly exercised and that it had lawfully terminated the agreement for repudiatory breach by Secret Mode.
Both parties applied for interim injunctions, pending a full trial. Secret Mode's application asked the court to order Victura to comply with the step-in rights. Among other things, those rights entitled Secret Mode to use its own or third party resources to complete the game, retain 75% of the profits from commercialisation (as opposed to 50%), access Victura's source code and obtain a royalty free licence to continue to develop and commercialise the game in future on all platforms.
The court refused the injunction primarily because it was concerned that it would not just allow Secret Mode to take over completion of the game, but would risk depriving Victura of the benefit of key intellectual property rights in which it had already invested over $50 million (whereas Secret Mode had contributed a far smaller amount). The court was particularly concerned that if Victura were to be successful at trial, the exercise of the step-in rights by Secret Mode could make it impossible for Victura to secure all those benefits for itself.
At first sight, this case may appear to cast doubt on the willingness of courts to intervene in support of the use of step-in rights. However, it's important to bear in mind that the step-in rights in this case contained some unusual features, allowing the customer to gain what the court described as "the keys to the kingdom" (in the form of Victura's intellectual property in the video game). In a service-based outsourcing transaction, it would be unusual for step-in rights to allow the customer to effectively take over the exploitation of the service provider's intellectual property. Instead, the focus is more likely to be on requiring the supplier to cooperate with the new management put in place by the customer. Provided the step-in rights are limited to what is necessary or desirable to facilitate continued provision of the services under the customer's direction, our view is that a court would be less likely to object to their enforcement on the grounds set out in Secret Mode v Victura.
Finally, it's worth noting that the court was fairly dismissive of Victura's argument that Secret Mode did not have the requisite expertise to exercise the step-in rights effectively. This is significant because a common practical issue with step-in rights is that customers themselves often do not have the necessary in-house expertise to take over the service. They will therefore normally need to bring in third parties who do possess the appropriate experience and skills to manage the service effectively. In this case, the court accepted that, even if Secret Mode did not have all the necessary expertise to complete the game itself, it had a "sufficiently large network among software developers" that it could have brought in third parties to do so. It follows that lack of expertise should not generally be an issue when it comes to enforcing step-in rights – provided that the outsourcing customer can demonstrate to the court's satisfaction that it has access to third parties with the relevant skills and experience.
Outsourcing transactions – particularly those which are more bespoke and involve longer term commitments – have a tendency to result in extremely long and complex contracts. Customers will often be acutely aware that if the supplier under-performs, termination is very much a last resort; as a result, they will typically push for more detail in order to strengthen their ability to hold the supplier to account. Suppliers, meanwhile, will often respond by seeking to add their own wording designed to protect their position and limit their exposure. The resulting agreement can run to hundreds of pages, including numerous schedules – and case law shows that this length and complexity can create problems of its own. But as we explain below, there are also various ways in which parties to outsourcing transactions can seek to minimise these risks.
Outsourcing agreements often contain a large number of detailed schedules, but unless there is a "hierarchy clause", the courts will not normally give more weight to the main body of the agreement than the schedules (a "hierarchy clause" might say that in the event of any conflict, the terms of the main body should be given precedence over the schedules). The Supreme Court ruling in MT Hojgaard v E.ON Climate & Renewables (2017) illustrates how this approach can lead to parties being "caught out" by wording that is "hidden away" in a schedule (as opposed to being more prominently set out in the main body).
The dispute arose after the failure of some offshore wind turbines installed by MT Hojgaard. The purchaser, E.ON, argued that the foundations of the turbines were subject to a 20-year warranty set out in the Technical Requirements of the project (which formed part of the agreement). The supplier, MT Hojgaard responded that if the parties had genuinely intended there to be such a significant warranty, it would have been clearly set out in the main body of the agreement, not "hidden away" in a technical annex. It maintained that the reference to lifespan was only included because the foundations were being constructed to a particular technical standard, based on which the foundations would be expected – but not guaranteed – to last 20 years. That standard ultimately turned out to be flawed, leading to the failure of the wind turbines – but since MT Hojgaard had not developed the standard itself, it argued that it was not directly at fault for that failure. The Court of Appeal agreed, finding that the reference in the schedule was "too slender a thread on which to hang a finding that [MT Hojgaard] gave a warranty of 20 years' life for the foundations." The Supreme Court, however, ruled that the technical annex was expressed to have contractual effect – and that the wording was also clear enough to give rise to a 20-year warranty (even if, subjectively, this was not what the supplier had intended). For more discussion of this case, see our detailed briefing.
Whilst the main body will often be pored over by the parties' legal advisers, schedules won't always get the same level of attention – and some may be drafted without any legal review at all. The danger is that in the event of a dispute, one of the parties may then trawl through the schedules in search of wording that supports its desired position. A hierarchy clause won't necessarily help because unless the main body is clearly at odds with the wording in the schedule, the courts will normally take the view that there is no conflict – and the wording in the schedule will stand. In many cases, it may be impractical and/or uncommercial for all schedules to be subject to the same level of detailed review as the main body. However, there will often be a "middle way", which involves identifying which schedules are particularly important and seeking to ensure that these are subject to at least some level of review, designed to spot any inadvertent "hostages to fortune" in the wording.
The longer and more complex the outsourcing contract, the higher the chance of internal contradictions, inconsistencies or mistakes. This is well illustrated by Amey v Birmingham City Council (2018), which involved a dispute over an outsourcing agreement for the maintenance of the Council's entire road network. Amey was struggling to make it profitable and a serious backlog had developed, resulting in numerous potholes going unfilled. Some of the roads for which the Council was legally responsible were missing from one of the schedules. Amey argued that this meant that they weren't covered by the agreement and the Council would have to pay extra for maintenance of those roads. The Court of Appeal disagreed. Having undertaken a close reading of the contract, it concluded that it could – and should – be read in a way which resulted in the roads being covered, despite the omission from the schedule. But Lord Justice Jackson also had this to say:
“Any relational contract of this character is likely to be of massive length, containing many infelicities and oddities. Both parties should adopt a reasonable approach in accordance with what is obviously the long-term purpose of the contract.”
Stepping back from the detail, the Court of Appeal's view was that the obvious long-term purpose of the contract was the maintenance of the Council's entire road network; as the majority of the wording was consistent with this, it was appropriate to treat Amey's argument in favour of a narrower, more literal interpretation, with a significant degree of scepticism.
As the Court of Appeal acknowledged in Amey, the length and complexity of many outsourcing contracts is likely to make it difficult to iron out all internal inconsistencies. Where there is a particular concern that a counterparty may seek to exploit such issues, it may be worth considering the imposition of a general duty of good faith with regard to aspects of the contract which are considered to be of particular importance. Good faith may prevent "cynical resort to the black letter" of the agreement – or at least assist in pushing back against a very narrow and excessively literal approach to contractual interpretation by the counterparty. Having said that, any such drafting needs careful consideration; our view is that generally, a carefully targeted duty is preferable to a very broad, contract-wide duty of good faith (since the latter may have unintended consequences).
Whilst there are usually perfectly good reasons why many outsourcing contracts are long and complex documents, case law demonstrates that this can create its own problems. Since eliminating all ambiguity and inconsistency is likely to be impossible parties should instead:
The Employment Rights Act 2025 introduces a number of reforms to UK employment law which could have a significant impact for outsourcing arrangements – and those measures are now being brought into force. Here's a summary of the key reforms and relevant timings:
From 30 October 2026, employers will become liable for harassment of their employees by third parties, such as customers, suppliers and contractors. In an outsourcing context, the most obvious risk area would be interactions between staff of the customer and service provider. Both parties to an outsourcing arrangement should therefore take measures to protect their own staff from harassment by the other party's staff. Service providers in particular may increasingly face questions from existing and potential customers about what they are doing to comply – and they should also consider asking the same questions of their customers. This builds on the existing duty on employers to protect staff from sexual harassment (which includes third party sexual harassment) but applies to any form of harassment (e.g. related to race, religion or sexual orientation).
From 30 October 2026, trade unions will have new rights of access to workplaces for recruiting and organising workers. This will apply to all workplaces in all sectors. It will also apply where workers work at a third party's premises, e.g. security staff. In that scenario, on request, the security contractor would have to seek to arrange for trade union access to the customer's premises at which the security staff work. If the customer refused, the trade union could apply for an order for access. Businesses with outsourced workers on their premises will therefore need to be aware of this and should ask service providers to inform them immediately if they receive a trade union access request, so that they can agree appropriate arrangements.
On 1 January 2027, the qualifying period for unfair dismissal protection will reduce from two years to six months, and the cap on compensation (currently £123,543) will be removed. This is likely to increase the costs of hiring and firing staff, which may add to the costs of outsourcing. In addition, where an outsourcing agreement contains an indemnity for staff termination costs (e.g. on an exit), those termination costs could be higher from January 2027.
As previously reported, from January 2027, it will become automatically unfair to dismiss employees in order to replace them with non-employees doing essentially the same work. These rules could capture an outsourcing situation where a customer's employees are replaced with staff of the service provider performing the same services. For more details see our Spring/Summer 2026 Outsourcing Spotlight.
UK employers with 250 or more staff are currently required to report annually on the gap between male and female pay within their organisation. There will be a new requirement for customers who meet the employee threshold to publish the names of outsourced providers that they use when publishing their pay gap figures. The intention is to create more transparency and accountability over pay gaps in the supply chain. This is expected to come into force in 2027 but no date has been confirmed.
The Terrorism (Protection of Premises) Act 2025 – also referred to as "Martyn's Law" (after one of the victims of the Manchester Arena attack) – is due to take effect in April 2027. This means that businesses have about six months left to plan and prepare appropriately. The Act requires businesses to take measures to protect against terrorist attacks (and, for larger premises and events, to take steps to reduce vulnerability to terrorist attacks) and will affect premises and event management outsourcings.
By way of a reminder, the Act applies to certain specified types of premises where it is reasonable to expect at least 200 individuals to be present at one time. Examples range from retail premises through to schools, hospitals and certain transport facilities. As well as notifying the Security Industry Authority (the "SIA") of their premises, these venues will be expected to put in place appropriate public protection procedures for staff to follow if an act of terrorism were to occur at the premises, or in the immediate vicinity. Venues where at least 800 people could reasonably be expected to be present at one time are subject to an enhanced duty; for example, among other things, they are required to take steps to reduce the premises' vulnerability to terrorist attack (so far as practicable).
The new obligations will fall on the person who has control of the premises in relation to their specified use. For example, if the owner of a large venue has outsourced its operation to an event management business, the outsourced service provider is likely to be the responsible person. In other cases, such as where security at a venue has been outsourced, the relevant service provider is less likely to be regarded as having control – but it will still be expected to cooperate with the responsible person.
What should parties to premises or events management outsourcings be doing now?
First of all, work out whether the premises or the relevant events are caught by the legislation. If so:
For more information, see our detailed briefing.
Transparency obligations under the EU's AI Act (largely) came into effect on 2 August 2026. These require providers and deployers of AI to be open about the use they are making of it – for example, to tell people when they are talking to a machine or warn them when AI is analysing their emotions.
A provider is an entity that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trade mark. A deployer is an entity that uses an AI system under its own authority in a professional capacity.
In an outsourcing context, it will be essential to work out whether a party is a provider in its own right (perhaps because, as the service provider, it has developed its own AI system or is supplying an AI-enabled system under its own brand) or a deployer, which is merely operating a third party system. This is because deployers are subject to more limited transparency obligations than providers.
The following examples are intended to give a flavour of how the new transparency obligations could affect different types of outsourcings:
Yes, providers placing an AI system on the market or putting it into service in the EU are caught regardless of their location or place of establishment. Providers outside the EU are also caught where outputs are intended for use in the EU – "intended" means foreseeable use, not incidental or unauthorised downstream use. For deployers, the transparency obligations apply where the deployer foresees that outputs will be disseminated or used in the EU.
For more information, see our briefing: Is it a bot? EU AI Act transparency rules take effect 2 August 2026.
As we first highlighted in our briefing in November 2025, the European Banking Authority (EBA) has been consulting on a new set of guidelines to replace its existing 2019 outsourcing guidelines. Following a long wait, the finalised guidelines were published on 18 September 2026. The exact date of entry into force of the new guidelines will be determined when the formal translated versions are published in due course.
The new guidelines significantly expand the existing EBA outsourcing framework and seek to create a regime that has many similarities to the EU Digital Operational Resilience Act (DORA) framework, but governs arrangements with third-party service providers for non-ICT services.
The guidelines apply to non-ICT third-party arrangements generally, which includes outsourcings as a subset, but are significantly wider – essentially, the guidelines can apply to any services (except those which are specifically excluded) which support one or more functions of the firm on a recurrent or ongoing basis – although as highlighted below, there are some important exclusions from the scope of the guidelines.
Broadly speaking, the guidelines will apply to the following types of entities within the EU:
In the case of banks, investment firms and issuers of asset-referenced tokens, the guidelines may also apply to the wider group.
Arrangements for services provided by third parties which are excluded from the scope of the guidelines include:
Firms which are subject to the new guidelines will need to comply with a range of obligations in relation to in-scope third-party arrangements. Broadly speaking, these include operating appropriate governance arrangements and third-party risk management policies and ensuring that there is appropriate oversight and accountability within the firm. They will also need to consider potential conflicts of interest and have appropriate business continuity plans in place. Alongside this, firms will need to operate a third-party arrangement process, which will include pre-contractual risk assessments, due diligence, ensuring appropriate documentation and information access rights, ongoing monitoring, appropriate termination rights and considering appropriate controls over any sub-contracting by the third party.
Certain of these obligations apply only in relation to third-party arrangements relating to "critical or important functions". These are functions which, if disrupted, would materially impair the firm's financial performance or the soundness or continuity of its services and activities, or would materially impair the firm's ability to comply with its authorisation conditions or other obligations under financial services law. Since the consultation version of the guidelines, some of the obligations have been further narrowed so that they are expressed to apply only in relation to these arrangements for critical or important functions. In some cases, the guidelines deem some types of services automatically to be critical and important.
The guidelines make some provision for group-level arrangements, but this is subject to ensuring that appropriate monitoring and oversight still occurs at the level of the EU firm.
For all third-party arrangements that are entered into, reviewed or amended on or after the date the new guidelines come into effect, the new requirements will apply immediately.
Firms will need to review existing third-party arrangements supporting critical or important functions within two years of the guidelines taking effect, or will otherwise need to notify their regulators.
For existing third-party arrangements that do not support critical or important functions, the firm can review the arrangements at the point at which they are next up for renewal.
Given the extent of the third-party arrangements that could be caught, and the need for new or amended arrangements to comply with the guidelines immediately once they have entered into effect, affected EU firms should review their existing frameworks against the final guidelines as soon as practicable. Meanwhile, service providers for in-scope EU firms may find that their customers are looking to make changes driven by the new guidelines.
We regularly advise both customers and suppliers on outsourcing transactions in a broad range of sectors. Recent examples include:
