Digital verification services: digital ID was cancelled, this deadline was not
In short: Digital verification services fall under Part 2 of the Data (Use and Access) Act 2025, in force since 1 December 2025. Version 1.0 of the trust framework took effect on 2 September 2026. From 1 October 2026 an employer or landlord who checks identity digitally must use a provider on the statutory register.
An employer who runs a digital right to work check from 1 October 2026 must run it through a provider on a government register. Use a provider that is not on that register and the employer has no statutory excuse, the defence against a civil penalty for employing someone without the right to work. The register is the one the Secretary of State keeps under Part 2 of the Data (Use and Access) Act 2025, and no provision of that Part requires any provider to join it. Employers, landlords, licensees and regulated firms have to work with it all the same.
Key points
- Part 2 of the Data (Use and Access) Act 2025 comprises sections 27 to 55 and came into force on 1 December 2025, except sections 45 to 48. Source: SI 2025/1213
- Version 1.0 of the UK digital verification services trust framework took effect on 2 September 2026, when the United Kingdom Accreditation Service accredited the first conformity assessment body, the independent certifier that audits a provider, to certify against it. Source: Office for Digital Identities and Attributes, 3 September 2026
- The register listed 62 certified services across 45 providers on 8 September 2026, every one of them certified against the earlier publication, known as gamma or 0.4, and none against version 1.0. A 0.4 certificate remains valid through the transition. Source: DVS register
- From 1 October 2026 an employer or landlord who verifies identity digitally must use a registered provider whose entry carries the relevant supplementary code note, which is the approval on that entry for the specific use. Source: SI 2026/700
- A provider may use the UK CertifID trust mark only where it holds a certificate against version 1.0 and appears on the register. Source: Usage guidelines, 7 September 2026
- A provider refused registration under section 34, or removed under section 41, cannot appeal to a court or tribunal. Source: Data (Use and Access) Act 2025, section 41
| Regime | What registration does for the person subject to it | Source |
|---|---|---|
| Right to work and right to rent, from 1 October 2026 | An employer or landlord who verifies digitally must use a registered provider, or has no statutory excuse. Manual and Home Office online checks remain available. | SI 2026/700 |
| Alcohol age verification, draft Order laid 30 June 2026 | A licensee who accepts digital proof of age would have to use a registered provider. Until the Order is made, no licensee may accept digital identity at all. | Draft Licensing Act 2003 (Mandatory Licensing Conditions) (Amendment) Order 2026 |
| Disclosure of public authority data, section 45, not in force | A public authority could disclose only to a registered provider. Only a registered provider may read a GOV.UK Wallet credential. | Data (Use and Access) Act 2025, section 45 |
| Customer due diligence under the Money Laundering Regulations 2017 | A regulated firm need not use a registered provider. HM Treasury approved guidance names a certified and registered service as a reliable and independent source, and a court must consider whether the firm followed that guidance. | MLR 2017 regs 28(19) and 86(2)(b) |
| Age assurance under the Online Safety Act 2023 | A regulated service gains no compliance from registration. Ofcom states that certification is not an automatic means of compliance, though a provider may use it as evidence of having had regard to the four criteria. | Ofcom Part 3 guidance, 24 April 2025, paragraph 4.6 |
The statutory regime, and the part of it that is not yet in force
Part 2 of the Data (Use and Access) Act 2025 comprises sections 27 to 55 and establishes a trust framework, supplementary codes, a register, an information gateway and a trust mark. The trust framework is the technical and governance standard a provider must meet to be listed, and a supplementary code adds the requirements for a particular regulated use, such as right to work checks. Under SI 2025/1213, all of Part 2 except sections 45 to 48 came into force on 1 December 2025. A provider falls inside the regime where it offers, at an individual’s request and to any extent over the internet, a service that checks a fact about that individual against information from someone else and confirms the answer to a third party (section 27(2) and (3)).
The Secretary of State must prepare and publish the trust framework under section 28, and must register a provider under section 33 once a conformity assessment body, an independent certifier accredited by the United Kingdom Accreditation Service, has certified that the service meets that framework. The Office for Digital Identities and Attributes, which runs the scheme for the Secretary of State, published version 1.0 on 3 March 2026, finalised it on 9 June 2026, and reported on 3 September 2026 that it had taken effect the previous day when the first conformity assessment body was accredited. Anyone relying on that date should know where it comes from: the Office recorded it in a blog post, and the guidance page still carries only the conditional wording.
Sections 45 to 48 are not yet in force. Under section 45, a public authority would be permitted to disclose information about an individual to a registered provider so that the provider can deliver the service the individual asked for. Before the Secretary of State may commence it, Parliament must approve in draft the code of practice required by section 49, and no draft had been laid on 8 September 2026. Until then no registered provider can reach authoritative government-held data through the statutory route, which is what most of them want from certification.
Why a provider outside the register cannot trade
No provision of Part 2 requires a provider to register. A provider commits no offence by offering digital verification services while unregistered, and no customer has to accept a certified service. Under section 50(3) an unregistered provider may not use the designated trust mark, and the Secretary of State enforces that restriction by injunction rather than by penalty. On those provisions alone a provider could reasonably treat registration as optional.
Section 55 changes that. Under it, the Secretary of State may define the immigration checks required by regulations by reference to a registered provider, amending the Immigration, Asylum and Nationality Act 2006, the Immigration Act 2014 and Schedule 6 to the Immigration Act 2016. In SI 2026/700 she has done so from 1 October 2026. An employer or landlord may still check documents by hand or use the Home Office online service. One who chooses the digital route must use a provider registered under section 33(1) whose register entry carries the relevant supplementary code note, so a provider outside the register cannot serve that market. Under the draft Order on alcohol age verification, laid on 30 June 2026 and approved in committee in both Houses in early September, a licensee accepting digital proof of age would be subject to the same condition.
The decision that carries no appeal
Under section 34 the Secretary of State may refuse to register a provider on national security grounds, or where she is satisfied that the applicant is failing to comply with the trust framework. Under section 41 she may remove a registered provider on those grounds, for failing to comply with a supplementary code, or for failing to answer an information notice. In each case she must give the provider at least 21 days to make written representations, may withhold her reasons where national security requires it, and may bar the provider from applying again for up to two years. A provider she refuses or removes cannot appeal to a court or tribunal, and Part 2 provides no independent review, so a provider shut out of the right to work market has judicial review and nothing else.
The Secretary of State publishes the rules that determine the outcome administratively, and does not lay them before Parliament. On 21 January 2025 the House of Lords rejected an amendment that would have required her to lay the trust framework before both Houses, by 87 votes to 157, the minister replying that the government remained of the view that the trust framework does not require parliamentary scrutiny.
What providers, employers and landlords have to do
A provider certified against the gamma (0.4) publication of the trust framework keeps a working certificate and a register entry, and has a minimum of 15 months to move to version 1.0. Under section 0 of version 1.0, such a provider must apply to certify against 0.4 by 2 December 2027 if it wants to stay there, being 15 months from 2 September 2026, and all 0.4 certification ceases to have effect on 2 December 2028, being 27 months from that date. A provider running on 0.4 may not use the UK CertifID trust mark, because it must hold a certificate against version 1.0 and appear on the register to qualify, so no provider was eligible to use the mark when the Office for Digital Identities and Attributes published its usage guidelines on 7 September 2026. Under section 4.1.f of the framework the Office may also require a provider to move to a newer version of the framework less than three years after its certificate was issued, without stating criteria, a notice period or a route to challenge.
An employer or landlord taking the digital route carries obligations the provider cannot carry out for it. It must check that the provider’s register entry covers right to work or right to rent, because a provider can be registered without holding the supplementary code note for either. The framework version on that entry does not matter for this purpose: an employer or landlord using a provider certified against 0.4 and listed on the register meets the 1 October requirement, and every provider on the register today is in that position. It must satisfy itself that the photograph and details the provider returns relate to the individual in front of it, and retain a clear copy for as long as the rules require. It must also offer an alternative to anyone who cannot or will not use a digital check. The provider certifies the identity; the employer or the landlord answers for the check. Any organisation working out whether its own service falls inside section 27 will find the perimeter question set out at regulatory perimeter and market entry.
Viewpoint
Part 2 is now the only statutory digital identity regime the United Kingdom has. The government cancelled the national digital ID programme in July 2026, and never introduced the Digital Access to Services Bill announced in the King’s Speech on 13 May 2026. A Home Office minister put the distinction on the record on 7 September 2026, telling a delegated legislation committee that the national digital ID proposals are no longer being taken forward and that the alcohol changes build on the regime the Data (Use and Access) Act 2025 established.
The Secretary of State has left section 45 out of force for nine months and cannot bring it into force until Parliament approves a code of practice that has not yet been laid. And section 0.d of the framework states that expired 0.4 certificates are to be ignored without saying who then removes the affected service from the register, so the register can show a certification that the framework has already ended. An employer or landlord checking the register in late 2028 will have no way to tell from the entry alone. The Information Commissioner, whose statute the whole scheme engages, must be consulted under section 28(3)(a) and holds no supervisory role over the register, which sits oddly beside the institutional reform the same Act makes to the regulator itself.
Frequently asked questions
Is registration mandatory for a digital verification service?
No. No provision of Part 2 of the Data (Use and Access) Act 2025 requires a provider to register, and a provider commits no offence by offering digital verification services while unregistered. The only restriction is that an unregistered provider may not use the UK CertifID trust mark, which the Secretary of State enforces by injunction under section 50(4). Registration matters because other regimes require it.
What changes for employers and landlords on 1 October 2026?
An employer or landlord who chooses to verify identity digitally must use a provider on the digital verification services register whose entry carries the right to work or right to rent supplementary code note. Without that, the employer or landlord has no statutory excuse. Manual document checks and the Home Office online service remain available and compliant, and the employer or landlord answers for the check either way.
Does certification satisfy the Online Safety Act age assurance duty?
No. Ofcom’s guidance of 24 April 2025 sets four outcome criteria for highly effective age assurance, being technical accuracy, robustness, reliability and fairness, and states at paragraph 4.6 that using a service certified against the trust framework is not an automatic means of compliance. A regulated service may use certification to evidence that it had regard to those criteria. Ofcom measures the duty by outcome, and it stays with the regulated service.
When will the section 45 information gateway come into force?
No date has been given. The Secretary of State cannot commence section 45 until Parliament approves in draft the code of practice required by section 49, and no draft had been laid on 8 September 2026. The Office for Digital Identities and Attributes reported in July 2026 that it had drafted and consulted on the code, aimed to publish it by the end of 2026, and would commence section 45 once Parliament had approved it, with HM Revenue and Customs, Revenue Scotland and the Welsh Revenue Authority excluded initially.
If you are working out whether your service falls inside Part 2, or what registration requires before 1 October 2026, Bratby Law advises providers, employers and relying parties on the regime. Contact Rob Bratby.
