Joint and Several Liability IR35 2026: What JSL Doesn't Fix

Introduction

On 6 April 2026, joint and several liability for umbrella PAYE came into force. Within a fortnight, RSM, Grant Thornton, Lewis Silkin, Birketts and Personnel Today had all published post-effective-date briefings. Bauer & Cottrell went further and argued the new rules have actually made IR35 less risky for end clients.

There is something to that argument. But only some of it. JSL closes one specific leak in the supply chain. It doesn't touch most of the exposure a CFO or Head of Tax carries on contractors, and in one important sense it probably widens it.

This post sets out what JSL actually changed, where the "less risky" narrative comes from, the five things that haven't moved an inch, and what a credible post-JSL governance posture looks like.

What JSL changed on 6 April

The mechanism is narrow and worth stating plainly. Where a worker is engaged through an umbrella company, the end client and the recruitment agency in the chain now share joint and several liability for any PAYE and National Insurance the umbrella fails to account for. If the umbrella collapses, disappears, or runs a mini-umbrella fraud, HMRC can recover the unpaid tax from the agency first and the end client if the agency cannot pay.

That is a material shift. Before 6 April, the liability sat with the umbrella itself, which is precisely why rogue providers could pocket PAYE and walk away. Pushing the risk upstream forces agencies and end clients to care about who sits in their supply chain. RSM, Grant Thornton, Lewis Silkin and Birketts all framed the reform the same way: due diligence on umbrella providers is now a commercial necessity, not a nice-to-have.

Personnel Today's summary on the day itself was blunt. End clients who assumed PAYE was "someone else's problem" inherited a new one on 6 April.

The "less risky" narrative, and where it comes from

Bauer & Cottrell's piece in April made a reasonable point. If more supply chain PAYE risk now sits with the agency and end client when using an umbrella, some engagers will relax the historic preference for pushing contractors through umbrellas solely to insulate themselves from IR35. In theory, that makes direct PSC engagement more attractive, because the relative risk gap has narrowed.

You can see the logic. The umbrella route was always partly a risk-transfer exercise. JSL raises the cost of that transfer. So for a certain class of engagement, particularly higher-skilled contractors who prefer to operate through their own limited company, the calculus does shift.

But "less risky" is doing a lot of work in that headline. It compares one specific risk path against another. It does not mean the underlying exposure around how engagers use contractors has reduced. In several ways, the exposure has just changed shape.

What JSL didn't change

Five things sit exactly where they sat on 5 April.

Status classification is still yours to get right. The off-payroll working rules from April 2021 haven't moved. If your organisation is medium or large, you are still the party responsible for determining whether a contractor engaged through their own PSC is inside or outside IR35. JSL does nothing to that. A wrong determination still creates a deemed-employment liability on the engager's books.

Pseudo-employment drift inside SOWs is untouched. A statement of work is not a magic shield. If the day-to-day reality looks like employment (fixed hours, line management, no substitution, integrated into a team for years), HMRC can and does look through the contract wrapper. We see this most often in IT, engineering and transformation programmes where a "consultant" from a services firm has been sat in the same seat for 30 months. That risk lives with the end client regardless of umbrella JSL.

Tenure drift is still a quiet problem. Contractors who start on six-month engagements and roll over for years are a compliance risk, a workforce planning risk, and a budget risk. No reform in April touched this. It only becomes visible when someone actually looks.

Hidden headcount is still hidden. Most finance teams can tell you headcount to the decimal place. Ask how many contractors are currently delivering services across the group, through PSCs, umbrellas, consultancies, SOWs and embedded suppliers, and the answer usually comes back as a range. The range is often 20 to 60 per cent wider than the initial estimate. JSL does not help you see any of this.

Board expectations have gone up, not down. Audit committees have spent two years asking sharper questions about contractor exposure. They are not going to stop because one leak in the umbrella chain has been plugged. If anything, "what is our post-JSL position on contractor governance" is now on the agenda for most finance committees that weren't already running it.

So: one problem fixed, four still sitting on the CFO's desk, and one new one created by the shift in engagement mix.

Why visibility matters more after JSL, not less

Here is the part the "less risky" argument misses. If some engagers now tolerate more direct PSC engagement, the population of contractors on PSCs inside large organisations will grow. Every one of those engagements requires a status determination, a record, and an ongoing check that the working practices still match the contract.

More PSC engagements means more status decisions. More status decisions means more places the determination can drift wrong. And since the end client remains the liable party under the off-payroll rules, every additional PSC engagement is a small addition to the engager's balance of risk.

This is before you account for the new JSL-driven due diligence on umbrella providers, which most procurement and tax functions are now trying to retrofit across live supplier lists.

The common thread in all of this is visibility. You cannot run due diligence on umbrellas you don't know you use. You cannot check status determinations you have never collated. You cannot spot pseudo-employment drift on SOW engagements you have no register of. The work HMRC, audit committees and a post-JSL supply chain now expect from engagers rests on a single capability: knowing who is working for you, through what route, under what terms, for how long.

Most organisations don't have that. They have fragments of it, held in procurement, in HR, in finance, and in the heads of line managers. JSL has raised the cost of that fragmentation.

What a credible post-JSL governance posture looks like

A practical checklist rather than a programme.

A live register of every contractor engagement, by route (PSC, umbrella, SOW, agency), with current status determination and start date.
A documented due diligence standard for umbrella providers, applied before engagement and reviewed annually.
A quarterly review of SOW-based engagements that have run beyond 18 months, to test whether working practices have drifted.
A board-level dashboard showing contractor exposure by business unit, route and duration, owned by Finance and Tax jointly.
A clear internal answer to the question "if HMRC asked for our full contractor population tomorrow, how long would it take to produce it?" If the answer is longer than a week, that is the first thing to fix.

None of this is exotic. It is the basic governance that a post-JSL environment now assumes you have.

Key Takeaways

JSL closes a specific PAYE leak in umbrella chains. It does not touch status risk, SOW drift, tenure drift, hidden headcount or board expectations.
The "less risky" narrative compares one risk path to another. The underlying engager exposure on contractors has not reduced.
More direct PSC engagement post-JSL means more status determinations for engagers to get right, not fewer.
The governance work JSL now demands, due diligence, documentation, SOW review, only works if you have a live contractor register. Visibility is the precondition.

What This Means for Your Organisation

If you've engaged contractors through umbrella companies, the first step is visibility. A simple contractor register, kept current, is the difference between answering HMRC in hours and answering them in weeks. CoComply helps finance and tax teams surface hidden headcount across PSCs, umbrellas and SOWs so governance, due diligence and status review all run off the same source of truth.

Sources: