IR35 for IT Contractors: What You Actually Need to Know in 2026

IR35 enforcement has intensified since the off-payroll rules reached the private sector in 2021. HMRC's own February 2025 assessment found the reforms raised roughly £1.8 billion more than it had projected across the first three years — and its compliance attention has concentrated on technology contractors in permanent-looking roles at large financial-services, retail and public-sector clients. For a developer, DevOps engineer or analyst working through a personal service company, that is not background noise. A wrong determination can cost tens of thousands of pounds.

This guide explains what IR35 actually means for IT contractors in 2026, how your status is determined, what "inside" does to your take-home, what HMRC is targeting, and the practical steps that keep your position defensible.

What is IR35?

IR35 is the shorthand for the off-payroll working legislation now found in Chapter 8 and Chapter 10 of the Income Tax (Earnings and Pensions) Act 2003. It exists to stop what HMRC calls "disguised employment" — someone doing, in practice, the job of an employee, but routing their pay through a limited company to reduce Income Tax and National Insurance.

The original rules were introduced in 2000. The version most contractors deal with today is the off-payroll working rules, brought in for the public sector in April 2017 and extended to the private sector in April 2021.

How the off-payroll rules changed everything

Before April 2021, if you worked through a limited company (a Personal Service Company, or PSC), you were largely responsible for assessing your own IR35 status. You could review your contract, weigh your working practices, and make a judgement call.

The reforms shifted that responsibility. For medium and large clients, it is now the client — not you — who must determine whether your engagement is inside or outside IR35. If they decide you are inside, the fee-payer (usually the recruitment agency or the client) deducts Income Tax and National Insurance from your invoice before paying you.

There is one significant exception: if your end client is a small company, the original rules still apply and you remain responsible for your own determination.

Why IT contractors are particularly exposed

Developers, DevOps and platform engineers, data and business analysts, and cybersecurity consultants face elevated IR35 risk for specific, structural reasons.

They work embedded in the client. IT contractors often sit inside the client organisation — on client hardware, in client meetings, sometimes with a client email address, occasionally managing client staff. Each of those can be read by HMRC as an indicator of employment.

The work invites supervision. A client's technology manager typically defines requirements, sets priorities and reviews output. Where HMRC sees that as control over how the work is done, it counts against an outside-IR35 position.

The chain is crowded. Most IT contractors are placed through recruitment agencies. The agency, the end client and HMRC can each form a different view of the very same engagement — and the contract on paper may not match the reality on the ground.

How status is determined: the three key tests

Whether you are inside or outside comes down to factors drawn from decades of employment case law. No single factor is decisive — HMRC weighs the overall picture — but three tests do most of the work.

1. Substitution

Could you send a genuine substitute to carry out the work if you were unavailable? If your contract says you personally must perform the services — or if, in practice, you could never send anyone else — that points toward employment. A genuine right of substitution, where you could realistically arrange a qualified colleague or sub-contractor, points toward self-employment. The word genuine is critical: a substitution clause that is impossible to exercise in practice will be disregarded.

2. Control

Does the client control how, when and where the work is done? A contractor outside IR35 typically controls their own methods and delivers an outcome, not a service. If you are told exactly which processes to follow, which tools to use, and when to be present at a specific location, that points toward employment. Remote working complicates the picture — working from home removes some traditional indicators, but required core hours, daily stand-ups and mandated processes can still evidence control.

3. Mutuality of obligation (MOO)

MOO is the ongoing expectation of work. In employment, the employer must offer work and the employee must accept it. In genuine contracting, no such obligation exists. If a client expects continuous availability, keeps you on between projects without an active statement of work, or you feel unable to turn assignments down, MOO may point toward employment.

Beyond the big three, HMRC also weighs a set of secondary factors:

• Financial risk — do you put your own money at risk (fixing faulty work at your cost, buying insurance, risking non-payment)?
• Equipment — who provides the tools and kit?
• Integration — do you appear on the org chart, hold a client email, attend company events?
• Exclusivity — are you free to work for other clients at the same time?

HMRC publishes a free tool, Check Employment Status for Tax (CEST), but it handles mutuality of obligation poorly and a result is only as good as the answers you feed it. Treat it as one input, not the final word.

What happens if you are inside IR35?

If the engagement is inside IR35, the fee-payer deducts Income Tax and employee National Insurance before you are paid. You effectively take home what an employee would — without the employment benefits. No paid holiday, no sick pay, no employer pension contributions.

The financial impact is real. The figures below are illustrative — your exact position depends on your rate, expenses and how you draw income — but they show the shape of it.

£500/day contract	Outside IR35	Inside IR35
How you're taxed	Company paid gross; salary + dividends	Taxed at employment rates via PAYE & NI
Rough retained share	~65–68% of gross	~57–60% of gross
On a £110,000 gross year	A difference of roughly £8,000–£12,000 in take-home

That gap is why an inside determination you disagree with is worth challenging — and why an outside determination is worth being able to prove.

What HMRC is targeting in 2026

Enforcement has sharpened since 2021, and the focus areas are fairly predictable:

• IT and technology contractors in permanent-looking roles at large financial-services, retail and government clients.
• Long-running engagements renewed again and again without a fresh status review.
• Public-sector contracts, where HMRC has the most enforcement experience.

How far back HMRC can look depends on why any tax was underpaid, not simply how long ago it was:

• 4 years for an innocent error or honest mistake;
• 6 years where HMRC finds carelessness;
• up to 20 years where it can show deliberate behaviour.

The onus of proving carelessness or deliberate conduct sits with HMRC — which is precisely why a dated, factual record of each engagement is worth keeping.

How to protect yourself

The most effective protection is an accurate, documented status determination — not a contract that says "outside IR35" with no working practices to back it up. In practice:

• Get an independent IR35 review of any engagement you're unsure about, so a specialist has stress-tested your contract and your working practices before HMRC ever does.
• Make your working practices match the contract — a substitution right nobody would ever honour, or "control over delivery" you don't actually have, will not survive scrutiny.
• Avoid looking like staff — don't line-manage the client's employees or sit on their org chart if your engagement is genuinely outside.
• Re-assess at every renewal. Status attaches to the engagement, and a role that drifts over two years can quietly cross the line.

For higher-risk engagements, IR35 insurance — covering investigation costs and, at the comprehensive end, any tax liability — is worth considering. Entry-level cover starts modestly (around £99–£299 a year); full tax-liability policies cost more.

The recurring theme is evidence. For every engagement you should be able to produce a dated, factor-by-factor record of why the status is what you say it is — with the specific facts and the reasoning. That is exactly what Nebula's IR35 Hub is built to produce: a scored assessment against each test, with a versioned audit trail you can rely on if an engagement is ever reviewed. You can see how it works without signing up.

The IT contractors who sleep well at enquiry time aren't the ones with the cleverest contract. They're the ones who can show a clear, dated, factual record of how each engagement actually worked.

This guide is general information for UK IT contractors operating through a limited company, based on rules and thresholds current for 2026, and is not regulated tax or legal advice. IR35 is fact-specific; for complex or disputed engagements, consult a qualified tax adviser. Always check current figures on gov.uk.