There is a particular kind of letter that changes a small business owner's week. It is not a bill. It is a question — from HMRC, from an agency's compliance team, from an investor's lawyer — and it takes roughly this form:

Show us what you did, and show us why.

Eighteen months after the fact. About a decision you made in an afternoon.

Most guidance about UK compliance is a list of deadlines. This is not that. Deadlines are the symptom. What follows is an explanation of the four mechanisms that actually catch small businesses — because once you can see the mechanism, you can see it coming, and you can tell whether the person handling your books is equipped for it.

Read it as a diagnostic for your own business. At the end there is a five-question self-check.

Important: this article is general information, not advice about your specific circumstances. Nebula Finance provides accounting software and AI-assisted guidance reviewed by qualified professionals; it does not provide regulated financial advice. Figures and deadlines were correct as at 12 August 2026 — confirm your own position with a qualified adviser.

First, the shift nobody announced

For most of the last decade, UK compliance was an annual administrative chore. Get the books to an accountant, sign what comes back, file it, forget it.

That era ended in 2026. Not because the rules got harder to understand, but because of a change in what the rules ask of you. Compliance used to be about producing a correct answer once a year. It is now about holding evidence continuously — evidence that you did the right thing, at the time you did it, which you can hand to someone who asks much later.

That is a different job. And it is why a filing cabinet, a spreadsheet and an annual meeting no longer cover it.

£25bn

Spent by UK SMEs on tax compliance a year, across 240 million hours

£4,500

And 44 hours — the average small business's annual compliance cost

2,500

Separate obligations compliant businesses must meet (NAO)

5.4m

UK micro businesses carrying rules designed for larger ones

That is the cost before any of the 2026 changes. 57% of small businesses say the burden got worse over the last twelve months. There are 5.7 million SMEs in the UK, and 5.4 million of them are micro. These obligations were designed with larger organisations in mind. They land on a one-person consultancy.

Mechanism 01

Calendar risk

The obligation you meet late because nobody told you it started.

Calendar risk is the simplest mechanism and the most common. You are not disputing anything. You simply did not know a clock was running.

What changed

Making Tax Digital for Income Tax went live on 6 April 2026 for anyone with qualifying income above £50,000. Qualifying income is gross — turnover from self-employment and property combined, not profit. The threshold falls to £30,000 in 2027 and £20,000 in 2028, which is the part most people miss: if you are under it today, you are probably in scope within two years.

What it actually requires

Not one return, but digital records kept as you go and four quarterly updates, plus a final declaration. The first quarterly deadline was 7 August 2026 — already passed. Late submissions accrue points under a points-based penalty regime; enough points and the financial penalty follows.

Why it catches people

The old rhythm let you be disorganised for eleven months and heroic in January. Quarterly filing removes that option. The work did not get harder — the tolerance for leaving it disappeared.

6 April 2026

MTD for Income Tax live at £50,000 gross qualifying income. Four updates a year replace one return.

In force
19th, monthly

The CIS return, if you are in construction. A nil return is still a return — the commonest CIS penalty there is.

Ongoing
18 November 2026

Every existing director and PSC must have verified their identity at Companies House.

Three months out

The Companies House deadline deserves emphasis, because its penalty is not a fine you pay and move on from. It is a company that cannot file, and an individual who cannot act. Identity verification has been mandatory for new directors and incorporations since 18 November 2025; existing officers have until this November.

What good looks like

Obligations should arrive on your screen before they are due, computed from your actual records rather than remembered by someone. "We'll remind you in January" is not a system.

Mechanism 02

Liability that travels

Someone else's mistake becoming your bill.

This is the mechanism that changed most sharply in 2026, and the one least understood.

What changed

Since 6 April 2026, where an umbrella company fails to operate PAYE correctly, the recruitment agency or the end client can be jointly and severally liable for the unpaid tax. "Jointly and severally" means HMRC can pursue any one party for the whole amount and let them argue about it afterwards.

The critical detail

Under the off-payroll (IR35) rules, a client who takes reasonable care over a status determination can transfer the liability. Under these new umbrella rules, there is no reasonable-care defence. Care does not discharge the liability. Nothing does, except the tax having been operated correctly in the first place.

What that does to behaviour

If you supply through agencies, this is now your problem even though it is not your rule. An agency with unlimited, undefendable exposure will manage it the only way it can: by demanding evidence from everyone in its supply chain, and dropping anyone who cannot produce it. This is already happening.

And the IR35 decision moved back to some of you

The small-company thresholds for off-payroll rose — turnover £10.2m to £15m, balance sheet £5.1m to £7.5m. Around 14,000 companies were reclassified as small, which means their contractors are no longer covered by a client-side determination. If your end client became "small", you now determine your own status and you carry the risk of getting it wrong.

What good looks like

You should be able to hand a counterparty a verifiable record of your compliance standing — without handing over your turnover, your bank data or your client list. And be clear-eyed about what such a record is: HMRC has stated publicly that no accreditation or checking technology provides a legal defence against this liability. What a good record gives you is a documented, independently checkable decision — which, in a regime with no reasonable-care defence, is worth considerably more than a confident assertion nobody can verify.

Mechanism 03

Threshold risk

The line you cross without noticing.

Thresholds do not announce themselves. They are crossed by ordinary trading and discovered in arrears — usually by an accountant, usually too late to do the cheap thing.

VAT registration

The threshold is £90,000, and the test that catches people is not "did I turn over £90,000 this tax year". It is a rolling twelve-month look-back, re-tested every single month. A good quarter in month eleven can push a rolling total over the line while your annual figure still looks comfortable. Register late and you owe VAT on sales you already made without charging it — out of margin you have already spent.

The director's loan

If you take money out of your company that is not salary and not a lawful dividend, it is a loan. An overdrawn balance still outstanding nine months and one day after your year end attracts a charge under CTA 2010 s.455 at 33.75% of the balance. It is refundable when the loan is repaid — but it is payable first, and companies routinely discover it when the cash is gone.

Two related traps sit next to it. A dividend can only be paid from distributable reserves; one voted when the reserves are not there is unlawful and gets recharacterised — often as a loan, straight back into s455. And the salary/dividend mix interacts with the corporation tax bands (19%, a 26.5% marginal band, then 25%), so the right answer changes with your profit level rather than staying fixed year to year.

CIS verification

Deduct at the wrong rate and the shortfall is yours personally. The rates are 0% gross / 20% registered / 30% where status is unverified — note that the safe default is the expensive one. The deduction applies to the labour element only: materials, the subcontractor's own plant and VAT sit outside it. Deducting from the gross invoice over-charges every line; under-deducting leaves you liable. Meanwhile gross payment status has its own turnover test (£30,000 per director, £100,000 aggregate) that businesses grow into without ever applying for it.

What good looks like

Thresholds should be monitored continuously against your live figures, with the warning arriving while you can still act. A threshold checked once a year is a threshold you find out about after crossing it.

Mechanism 04

Evidence risk

Being right, and being unable to prove it.

This is the mechanism that has grown fastest, and the one most invisible until it bites. You did the correct thing. Two years later you cannot demonstrate that you did — and in tax, an undemonstrable position is treated much like a wrong one.

R&D relief is the worked example

HMRC took its R&D compliance headcount from around 100 in 2021 to over 500. It worked: SME-scheme error and fraud fell from 14.7% to 10.6%. It also meant enquiries running up to eighteen months, and genuine claimants abandoning valid claims rather than face one. The variable separating those two outcomes is almost never whether the R&D was real. It is whether the claim came with contemporaneous, structured evidence — records made at the time, not reconstructed afterwards from memory and a bank statement.

SEIS/EIS is the slow-burn example

Most founders treat the relief as done once advance assurance comes back and the certificates go out. It is not. Each certificate carries a three-year holding period, during which a disqualifying event can strip your investors of their relief — while the company's own obligations continue: funds employed within the statutory window (two years for EIS under ITA 2007 s.175), no value received, the trade continuing, no shares redeemed. Disqualifying events carry short notification deadlines. They surface two years after everyone stopped paying attention, and by then the evidence either exists or it does not.

It applies to ordinary decisions too

Why that expense was treated as allowable. Why that vehicle qualified. Why that dividend was lawful on that date. Each is defensible at the time and undefendable later, unless the reasoning was captured when it was made.

What good looks like

Every figure should open up to show its working — the transactions behind it, the rule applied, the statute the rule comes from — and the record should be tamper-evident, so its integrity is checkable rather than asserted.

Why the usual answer is failing

The traditional response to all four mechanisms is "get a good accountant". It remains excellent advice. It is also becoming harder to act on.

73%

Of firms say talent shortages are severely affecting them — and are turning away clients

67%

Of accountants aged 55+ planning to retire soon

9,000

Fewer students entering the professional pipeline over five years

So the demand side rose — quarterly filing, undefendable liability, continuous thresholds, evidence obligations — while the supply of qualified people to absorb it fell. Firms are rationing, and rationing runs downward: the one-director consultancy is not the client a stretched practice fights to keep.

This is not a gap software should fill because software is fashionable. It is a gap software has to fill because the arithmetic no longer works.

How to judge whoever handles this for you

Here is the useful part. Whatever you use — a firm, a platform, us, someone else — these are the questions that separate something that will hold up from something that will not. Ask them out loud.

  1. Where does each number come from? A figure should trace to a rule, and the rule to a statute. If a system cannot show you the derivation, it cannot show HMRC either. Ask specifically whether an AI model can originate a number. It should not be able to.
  2. How do you know your rates are current? Tax rates rot. A system that carries last year's thresholds silently is worse than one that admits it does not know. Ask what happens when a rate goes out of date — the honest answer is that something breaks loudly.
  3. Who is personally accountable for what leaves? A named, qualified human should sign anything reaching HMRC, Companies House or your accountant — and that signature should be bound to the exact document, so a later edit invalidates it. "The software produced it" is not a signature.
  4. Can I get the evidence out, and can someone else check it? Not a PDF you could have typed yourself. A record whose integrity a third party can verify independently, without trusting you or the vendor.
  5. What does it refuse to do? This one is the tell. A system that names its limits — what it does not compute, what it cannot file, where a capability is not yet live — is a system whose positive claims mean something. One that never says no is not being careful; it is being quiet.

Where Nebula fits

We built Nebula against those five questions, because they are the ones we would ask. It is not a bookkeeping app with an AI feature bolted on — it is built as an accountancy firm that happens to run on software, with the anatomy of a real practice, because that anatomy is what makes the output survive a challenge.

The four commitments underneath it

  • A machine never invents a number. Every figure comes from a deterministic rules engine, keyed to the period it applies to and traced to its legislative basis. A validation gate sits between the AI and you, and strips any figure the engine did not produce.
  • Rates carry a review date. When it lapses, a test fails. The system notices its own decay rather than serving you last year's numbers.
  • A named professional signs anything that leaves — and the stamp is bound by fingerprint to the exact document, so changing a figure invalidates the sign-off. The AI drafts; a human is accountable.
  • Every figure shows its working, and every change lands on a tamper-evident audit log. Reports are sealed so a third party can verify them independently.

Against the four mechanisms: it computes deadlines from your records rather than remembering them; it produces consent-gated verification a counterparty can check without seeing your finances; it monitors thresholds continuously against live figures; and it captures the reasoning at the time the decision is made.

If you are a contractor

Safe extraction with a hard stop on unlawful dividends rather than a warning you can click past. The s455 clock watched before it strikes. CIS computed monthly on the labour-only base. IR35 assessed against the five HMRC status factors with a downloadable Status Determination Statement — and borderline cases routed to qualified human specialists whose signed determination supersedes the automated verdict everywhere it appears.

If you are a startup

The full SEIS/EIS lifecycle rather than the first step of it — advance assurance, compliance statement, investor certificates, continuing-compliance monitoring across the three-year holding period, annual confirmation, and a reference pack so each investor can claim their own relief. Plus cap table and dilution modelling, EMI design with HMRC valuation, runway scenarios, and a pre-submission check that reads your narrative for the patterns HMRC's manuals flag as rejection reasons — before you send it.

If you are an SME

Breadth handled: VAT threshold monitoring, payroll and RTI, a year-end close with a reconciliation gate that will not pass a draft on unreconciled numbers, company secretarial work, director and PSC verification standing ahead of November, and ten sector profiles naming the obligations that bite in your trade specifically.

What we do not do

  • We do not file with HMRC or Companies House ourselves. We prepare; a named reviewer signs; approved output goes to your systems of record and the recognised rails.
  • We are not your book of record. Your accounting platform and your bank hold the ledger. We sit above them and apply judgment.
  • We never hold or move your money. Payment instructions are prepared and approved, then handed to an authorised provider.
  • We are not FCA-authorised. Investment and pension content is educational, never regulated advice.
  • Where a capability is not live, the product says so rather than faking a result.

That list is not modesty; it is question five, answered about ourselves. A system willing to overstate what it does is a system willing to overstate what it found.

Your five-question self-check

Answer these about your own business. Any "no" is exposure — whoever handles your books.

  1. Do I know which of the four mechanisms I am exposed to right now? Calendar, travelling liability, thresholds, evidence.
  2. Am I in scope for MTD, or will I be by 2028? Gross income above £50,000 today; £30,000 in 2027; £20,000 in 2028.
  3. Have my directors and PSCs verified at Companies House? The deadline for existing officers is 18 November 2026.
  4. Could I produce, today, the evidence behind a decision I made last year? The expense treatment, the dividend, the R&D claim, the status determination.
  5. If an agency or investor asked for proof of my compliance standing this week, what would I send them? If the honest answer is "I'd ask my accountant and wait", that is the gap. It used to be an inconvenience. In 2026 it is a liability.

Sources