Ellis was hanged in July 1955 after being convicted of murdering her partner, David Blakely, in north London. She was the last woman in Britain to be hanged, and her family have long campaigned for a pardon.

Her family, supported pro bono by law firm Mishcon de Reya, argued that evidence of the abuse she suffered at the hands of Blakely was not properly considered at trial. Victor Mishcon was brought in to fight for a last minute reprieve for Ellis during her lifetime, as such, this is a full circle moment for the firm.

Katy Colton, Partner and Head of Politics and Law, said: "The granting of a posthumous conditional pardon to Ruth Ellis is a landmark moment — for her family, for the British justice system, and for every victim of domestic abuse failed by the courts.

"Mishcon de Reya is proud to have acted for Ruth's grandchildren, alongside our colleagues at Matrix Chambers. This application had to be brought. The evidence was compelling, and we are pleased the Justice Secretary has recommended His Majesty grant Ruth Ellis a posthumous conditional pardon.

"Today's decision does not only right a wrong done over seventy years ago. It sends a clear signal about the aspirations of our justice system. Violence against women and girls remains a national emergency. The Government's public acknowledgement that the abuse Ruth Ellis endured should have impacted the outcome of her case reflects an important principle: that survivors of domestic abuse today deserve a justice system that properly understands and recognises the impact of that abuse.

"Our founder, Victor Mishcon, who fought to secure a last-minute reprieve for Ruth, would be immensely proud. We congratulate Ruth's grandchildren on their tenacity and courage in pursuing this application. It has been a privilege to stand alongside them as a firm."

Grace Houghton, Associate, Mishcon de Reya LLP, Solicitor for the Grandchildren said: "The granting of a posthumous conditional pardon for Ruth Ellis is both legally significant and historically important.

"The application demonstrated, on the evidence, that Ruth suffered from what is now understood as battered woman syndrome, and that the cumulative impact of the abuse she sustained would, under the law as it stands today, have supported defences of both diminished responsibility and loss of control. Had Ruth Ellis been tried just two years later, following the passage of the Homicide Act 1957, the outcome would have been very different.

"The Justice Secretary has exercised the Royal Prerogative of Mercy on a principled basis: that legal and social developments since 1955 make clear that the punishment imposed on Ruth was unjust.

"Today's pardon is a reminder that the law must reflect on its own history - and, where it finds injustice, must acknowledge those failings. We are honoured to have acted for Ruth's family in securing this outcome, and we hope they can now begin to heal from the generational trauma that has haunted them for decades."

Daniel joined the firm in 1998 and has been a Partner since 2004. Until April, he was Chair of the Employment department and sat on the Management Board. Daniel’s fee earning work includes advising on complex contentious and non-contentious employment matters and, as Chair of Employment, he oversaw substantial growth of the firm’s market-leading Employment practice.

Daniel serves as Managing Partner supported by an Executive Partner team of Johanna Walsh and Daniel Levy alongside the Chairs and other senior management, including the Operations Board. In addition to supporting Daniel in the management of the firm and the delivery of its strategic objectives, the Executive Partners will continue to advise and support their clients without change.

Johanna Walsh leads the White Collar Crime and Investigations team, as well as one of two divisions in the Dispute Resolution department. She joined the firm as a partner in January 2019 and sat on the firm’s Management Board for five years until 2025. 

Daniel Levy leads the Real Estate Litigation team and is Division Head of Property Litigation and Construction. He joined the firm in 2006, founding and leading the Real Estate Litigation team. He has sat on the Management Board since 2025 and, for the past two years, has served as Partners’ representative on the Operations Board. 

Daniel Naftalin, Managing Partner of Mishcon de Reya, said:

“I am very pleased to be taking over as Managing Partner and very proud that my partners put their faith in me to lead this exceptional firm. I care deeply about Mishcon de Reya, its people, what it stands for, and its place in an increasingly competitive market. Over the last few months, I have been working with my team to consult and develop our strategy to face our challenges and thrive. I was involved in the creation of our 2030 vision and our three pillars of private, real estate and innovation are fundamental to how I see the firm succeeding. 

“I want to guide Mishcon de Reya to a successful, profitable, and sustainable future. I want it to remain a values-led firm that rewards hard work and excellence and that people are proud to work for and to recommend. My team and I will work tirelessly to ensure that the firm is even stronger at the end of my tenure than it is today.”

Paying tribute to his predecessor James Libson, Daniel said: 

“James epitomises everything that is special about Mishcon de Reya, someone who is passionate about the law and has blended that with an exceptional commercial and strategic vision of what it takes for this firm to succeed. He has been involved in so many of the cases that have made us great and I am delighted that the Board has asked him to take on the honorary title of Senior Partner and that we will all continue to benefit from his extraordinary wisdom and love for this firm.”

Following Daniel’s election as Managing Partner, the Employment department elected partner Susannah Kintish as Chair of the Employment department from 1 April 2026.

This is a moment that demands clear-eyed analysis – not simply of whether FRAs are a good idea, but of what impact they actually have in practice, and whether the Commission's approach is proportionate to the environment in which this scheme now operates.

What are the expectations?

The staged implementation will begin with the largest remote operators, triggering FRAs where customers exceed £5,000 in net deposits over a rolling 24-hour period; for under-25s the trigger is £2,500.  Once fully implemented "in due course", those thresholds drop considerably: to £1,000 in net deposits over a 24-hour period (or £3,000 over 90 days) for customers aged 25 and over, and to £750 per 24 hours (or £2,000 over 90 days) for those under 25.

Assessments will be conducted via Credit Reference Agencies (CRAs), and, according to the Commission, will have no impact on the customer's credit score.  The Commission has also stated that no enforcement action will be taken against operators who fail to act on an FRA result during the early stages of rollout, though all other existing licence conditions continue to apply.

In terms of what FRAs require in practice, the Commission vaguely states that it will "back operators to take appropriate proportionate action, considering everything they know about the customer" – with options ranging from reducing marketing to supporting customers to set deposit limits or more where needed.  Whilst this appears to be a sensible statement of intent, there are still fundamental questions about data reliability, consumer impact, and practical implementation that remain unresolved.  The Commission has itself acknowledged that CRA outputs can differ between agencies for the same customer, and operators will receive only an overall assessment accompanied by four data points: defaults, multiple arrears, significant arrears, and the existence of a Debt Management Plan.  Operators are therefore expected to make decisions that could materially affect customer relationships on the basis of information they cannot fully interrogate and that the Commission concedes is not entirely consistent.

The Commission's commitment not to take enforcement action for a failure to act following an FRA during the early stages represents a common sense approach.  However, operators must still comply with all other existing licence requirements, and the Commission will continue to conduct compliance assessments against those requirements.  The Commission has consistently maintained that FRAs are a distinct and more targeted tool, focused solely on identifying customers in financial difficulties rather than assessing what any given customer can or cannot spend.  Many operators will find that distinction difficult to maintain in practice, given the Commission's historic track record of applying affordability-related expectations during regulatory enforcement action despite there being no formal regulatory basis to do so.  Any sensible operator will be thinking carefully about how the information gathered from an FRA should be taken into account when discharging its other regulatory obligations, principally wider social responsibility requirements and AML obligations (where applicable), as the Commission will undoubtedly expect operators to take such information into account when dealing with a customer.

Frictionless or are document checks necessary?

Speaking at the Ethical Gambling Forum in April, Tim Miller said about FRAs, "… in 2026 it can't be right that this still leads to some operators asking consumers to share bank statements and other financial documentation. Such an approach is outdated, inconsistent and disproportionate."  He went on to state that one of the advantages of the FRA framework is that it would allow the Commission to give "clear guidance to operators that they should not require consumers to provide documents to assess financial risk following a financial risk assessment."  However, the Commission's FRA blog post on 7 July is explicit that some customers may not be assessable through a frictionless CRA check, and that for these customers this "might mean assessing financial risk through other processes such as open banking or document checks."  

These two positions are in direct tension: on one hand, document checks are contemplated as a legitimate fallback for customers who are not assessable through an FRA; on the other, the regulator suggests such checks are disproportionate and that the FRA framework should effectively end the practice.  Operators would be well advised to keep track of how many instances of failed FRAs they encounter so that they can help the Commission understand the true scale of this issue.  In the meantime, operators will need to resolve this contradiction themselves and take decisions based on all the other information available to them about the customer in question (and of course, record the rationale for those decisions).

Staged implementation plan

While the industry will quite reasonably question the decision to implement at all, especially in the absence of full published findings from the pilot, the staged approach carries several genuine benefits for operators: an initial scope limited to the largest operators and at thresholds higher than those which will eventually apply; time to prepare; and the Commission's commitment that no enforcement action will follow a failure to act on an FRA result during early rollout.  

We suggest that operators make use of this time to gather feedback and analyse data on their use of FRAs, including any challenges in implementing them, and what effect the use of FRAs has on their customer base.  It will be particularly interesting to know, for example, whether the data shows that FRAs identify (and therefore provide protection to) a raft of customers who would not otherwise have been captured by existing SR and AML requirements (where applicable) and the operator's own compliance framework.  This feedback will be crucial if operators are to meaningfully influence the forthcoming guidance on what constitutes proportionate action (whilst leaving scope in any appropriate areas for operator discretion) and how CRA outputs should be interpreted.  It will also help the Commission to evaluate the success of FRAs and to determine if they are indeed a proportionate response to the issue they believe to be addressing.

Another burden on an already pressured sector

It is worth pausing for a moment to consider the environment in which this decision lands.  As we commented in May, the cumulative compliance and cost burden on licensed operators today is substantially greater than when FRAs were first conceived.  Since 2023, the sector has absorbed wave after wave of regulatory reform; Remote Gaming Duty has nearly doubled to 40 per cent; a statutory levy is now in force; and increased licence fees are expected later this year.  FRAs arrive not as a standalone measure but as yet another layer on top of a regulatory stack that has fundamentally changed the economics of operating a licensed business in Great Britain.

Against that backdrop, the Commission's decision to press ahead without publishing an updated assessment of the cumulative impact of all these changes – let alone the expected incremental impact of FRAs in the current environment – is a significant omission.  The White Paper's estimated Gross Gambling Yield (GGY) reduction of between £380 million and £710 million as a result of 'Financial Risk Checks' was produced in a very different economic setting.  The real figure today could be materially higher, with consequences not just for operators but for the broader ecosystem – including the sports and racing industries that depend on the health of the licensed betting sector.  

Good regulation demands that the case for any new obligation be assessed against the system as it stands, not as it stood three years ago.  That assessment has not been made public, and the Commission's willingness to proceed without it is difficult to reconcile with the principles of proportionate, evidence-based regulation.

What operators should do now

Operators should not wait for formal guidance before progressing their FRA compliance preparation:

• First, begin mapping your existing customer interaction framework against the FRA trigger points.  The Commission has been clear that FRAs are in addition to, not a replacement for, existing customer interaction obligations.  An FRA flag, and the information gathered from it, will need to be considered alongside the information operators already hold about a customer.
• Second, document your decision-making.  Whatever action you take, or do not take, following an FRA result and the ability to demonstrate that you applied a coherent, evidence-based, and outcomes-focused process will be critical in any future compliance or enforcement context.
• Finally, engage with the implementation group process.  This is the mechanism through which operators have the best opportunity to shape the guidance that will determine what "proportionate action" actually means.  The Commission has said it wants that process to be collaborative.  Operators should take the Commission at its word and use it.

We will be monitoring developments closely and advising clients throughout the implementation phase and beyond.  If you have questions about these changes, please get in touch with our Betting and Gaming team.

Founded in 2018, Orbital sits at the centre of property transactions, automating the legal work that has traditionally been slow and manual and connecting the parties who depend on it.  

It now handles over 200,000 transactions a year for some of the UK's top law firms including Mishcon de Reya and works directly with the real estate businesses behind those deals: the developers, owner-operators, investors and REITs shaping the built environment.  

By bringing law firms and their clients onto a single platform, Orbital is building the infrastructure for how real estate gets bought, sold and financed.  

It opened a New York office in 2025 and, in January, raised a $60 million Series B to scale further across the US. 

The 197-bedroom hotel which overlooks the famous Hamilton Straight section of the Silverstone racetrack was developed by Bricks Capital over a number of years with funding from multiple lenders. The hotel successfully opened in July 2023 with Hilton as its operator. The Bricks Capital property owning vehicles fell into administration in August Ian Corfield and Simon Baggs of FRP Advisory were appointed as joint administrators and Mishcon were appointed to advise on the sale.

The Mishcon team was led by Paul McLoughlin, Partner in Restructuring and Real Estate Finance, alongside Nick Strutt, Roya Zohrabi, Gareth Jamieson and Sophia Andronikou. Hannah Naji, Jenna Oppong, and Venessa Toofanny worked on the Real Estate aspects, whilst Troy Featherstone and Beth Hitchcock handled the Corporate elements of the deal. The deal also involved Charles Jordan from the Construction team, and Jessica Williams from the Insolvency team.

Paul McLoughlin commented: "It was a pleasure to work once again with Ian and Simon and the wider FRP team on this transaction and help them deliver for creditors. This transaction was another great example of the full-service capacity of the Mishcon team as it utilised our extensive expertise across restructuring, real estate, hotels, corporate, debt finance and tax. We look forward to such a unique asset enjoying a successful future under new ownership with a strong capital structure."

• Surrogacy is becoming an increasingly common path to parenthood, despite Hong Kong’s restrictive legal framework.
• Without legal recognition of parentage, surrogate born children may face significant inheritance and succession challenges.
• Intended parents should act early to secure legal parentage and implement appropriate estate planning measures.

Under the existing legal framework, commercial surrogacy remains unlawful in Hong Kong, regardless of the jurisdiction in which the arrangement is effected.  There is however no definition of what arrangement constitutes a commercial surrogacy.  Despite the absence of openly available surrogacy services or public promotion within Hong Kong, we note a gradual shift in societal attitudes in recent years whereby individuals and couples including those within the LGBTQ community, irrespective of their martial status, are increasingly proactive in exploring options for parenthood, often undertaking independent research and considering cross-border arrangements in jurisdictions where surrogacy is legally permissible and regulated.

Surrogacy as a concept has gained broader social recognition and acceptance. This development is partly influenced by well-established legal regimes in jurisdictions such as the United States, where owing to it being a birthright country, remains a popular destination for surrogacy arrangements, particularly given its mature and comprehensive system. The availability of structured and regulated arrangements abroad has contributed to the perception of surrogacy as a viable and legitimate pathway to parenthood, particularly for those unable to conceive naturally.

 What is the current trend in surrogacy planning?

Until recent years, Clients that required legal assistance concerning surrogacy were previously primarily focused on immigration clearance, with the objective of securing lawful residence for the surrogate-born child. Issues relating to legal parentage were often treated as secondary. Intended parents were typically reluctant to pursue parental orders or adoption orders, given the stringent requirement for full and frank disclosure. Such applications necessitate detailed disclosure of the surrogacy arrangement, including financial aspects and the circumstances under which the arrangement was entered into, thereby exposing the intended parents to potential risk of contravening the legislation against commercial surrogacy.

Historically, concerns regarding risk of contravening the legislation against commercial surrogacy deterred intended parents from formalising their legal status with their surrogate child. In bringing a parental order application, it gives rise to self-incrimination by disclosing surrogacy paperwork has further reinforced this reluctance, discouraging many intended parents from taking steps to regularise their legal position.  However, there has been a noticeable shift in recent years with intended parents now adopting a more informed and strategic approach, for fear of their surrogate child not being recognised as their lawful issue. This is especially important if they already have natural born children. Parental order application is accordingly an essential mechanism for securing legal certainty, safeguarding parental rights, and promoting family stability.

Having said that, there is a recent Hong Kong judgement that reinforced the trite position of divorcing parents having treated their surrogate child as child of the family which enables the Family Court to make custody and access orders.

What are the implications for succession planning?

While succession planning may not appear to be an immediate concern at the time of a child’s birth, it is nonetheless a critical consideration of a surrogate child being entitled to inherit from his/her parents in the event of intestacy as he/she is not regarded as a child of the parents, particularly in the absence of a parental order. Early and comprehensive estate planning is essential to minimise legal uncertainty.

In contentious probate proceedings, the absence of legally recognised parentage may materially affect a child’s standing and entitlement with his/her siblings. This is especially problematic in families with multiple children, where distinctions may arise between children born by the parents and those born through surrogacy. A child without formal legal recognition may face challenges in asserting inheritance rights, thereby creating potential inequities and disputes.

The risks are amplified in cases involving high-value estates, family-owned enterprises, or complex trust arrangements. In such cases, the identification of beneficiaries and the determination of their respective entitlements are often subject to close legal scrutiny. Any uncertainty over parentage can give rise to unnecessary prolonged disputes, interrupt business operations, and place significant strain on family relationships. The financial and emotional costs associated with such disputes can be substantial, potentially undermining family harmony and long-term wealth preservation objectives.

 Why is surrogacy law reform needed in Hong Kong?

In light of the evolving social landscape and the increasing prevalence of cross-border surrogacy arrangements, there is a compelling case for reform of the current legal framework in Hong Kong. The existing regime does not fully reflect modern family structures or the practical realities faced by intended parents.

By way of comparison, in England and Wales, both couples and single individuals may apply for a parental order, provided that the statutory requirements are satisfied. However, in Hong Kong, only a heterosexual couple who were married to each other at the time of the child’s birth are eligible to apply for a parental order. Families who fall outside this narrow category have no alternative but to consider applying for an adoption order. While an adoption order is capable of conferring legal parenthood and parental responsibility there is no comparison to a parental order. In particular, an adoption order does not recognise the genetic connection between the child and the intended parent(s). Reform is therefore essential to enhance legal certainty, better safeguard the welfare of children born through surrogacy, and reduce the risk of future disputes within the family.

There is currently no legislative intention to reform the current ordinances namely the Human Reproductive Technology Ordinance (Cap.561) and the Parent and Child Ordinance (Cap.429). The intended parents must in the meantime take proactive steps to safeguard their surrogate child's legal position such as applying for a parental order to establish formal legal recognition of parentage or where a parental order is unavailable, seeking an adoption order. In parallel, comprehensive estate planning, such as the preparation of wills or set up of trusts is essential to ensure the surrogate child’s rights and interests are adequately protected.

At the same time, maintaining clarity and mutual understanding within the family is equally important. Open communication and forward planning can significantly reduce the likelihood of disputes arising from uncertainty over legal status. By taking a proactive and structured approach, intended parents can better secure both legal certainty and long-term family stability.

How we can help

At Mishcon de Reya LLP, we understand that modern family-building including through surrogacy, assisted reproduction and donor conception are increasingly popular options. We have particular experience advising on the legal complexities arising from surrogacy arrangements involving Hong Kong and cross-border family structures. Our experienced Family team are able to advise you as to the legal implications of entering into such arrangements, ensuring that your journey to family building can be navigated as smoothly as possible.

Among noteworthy developments, last quarter:

• The European Commission's simplification review of the Deforestation-Free Products Regulation (EUDR) left deadlines unchanged. Application dates remain 30 December 2026 for large/medium-sized operators and 30 June 2027 for micro/small operators.
• The UK Government is finally moving forward with its own Forest Risk Commodities (FRC) regulation. Given proposed changes to turnover thresholds and in-scope commodities, companies that considered themselves outside the scope of a future FRC regime may need to reassess.
• Proposed Minimum Energy Efficiency Standards (MEES) for commercial buildings sharpen the focus on larger assets, which could become unlawful to let from 2031 unless properties are upgraded. Biodiversity Net Gain (BNG) requirements become mandatory for Nationally Significant Infrastructure Projects from 2 November 2026.
• Revised and voluntary European Sustainability Reporting Standards (ESRS) have moved closer to adoption. Work has also resumed on standards for non-EU parent companies of groups (N-ESRS), re-emphasising the strategic choice to be made around alternative approaches to reporting.
• The Science Based Target initiative (SBTi) updated its Corporate Net-Zero Standard (CNZS V2). Although not compulsory for target submissions until 1 February 2028, companies should be using this runway to make necessary preparations, including development of now-mandatory transition plans.
• Publication of a draft framework by the Taskforce on Inequality and Social-related Disclosures (TISFD) marks an important milestone. It indicates that companies should expect systemic inequality risks to join climate and nature as part of mainstream disclosure, due diligence and resilience conversations.
• Actions against TotalEnergies, Shell and JBS show the strategic litigation frontier expanding. New claims are now targeting future corporate conduct, testing whether a company's duty of care can be translated into a concrete constraint on new fossil fuel production or the expansion of industrial agriculture.

UK standards and regulation

EU standards and regulation

International standards

ESG litigation

The outcome will matter to every employer that relies on non-competes to protect its business.

To understand how employers view these proposals in practice, we surveyed our clients on how they currently use non-competes and their views on the Government’s suggested reforms.

Our findings send a clear message: businesses are not ready for radical change and largely consider that the current legal framework already provides sufficient safeguards. Respondents also noted that restricting non-competes could redirect investment away from the UK. 

In our latest report, we set out our full findings, and what they may mean for employers.

Read the full report

• Upholding insurers' war and governmental risks exclusion, the Commercial Court has dismissed a €580 million insurance claim for damage caused to the Nord Stream gas pipelines following the Russian invasion of Ukraine.
• Loss "directly or indirectly occasioned by, happening through, or in consequences of war" imposes a broader causal test than proximate cause – war need only be a "significant" (ie, contributing) factor.
• The decision is an important reminder that war risks exclusions can reach beyond battlefield losses to damage arising from wider events in the context of a conflict.

In Nord Stream AG v Lloyd’s Insurance Company S.A. and Arch Insurance (EU) DAC [2026] EWHC 1685 (Comm), the Commercial Court considered an insurance claim for damage to natural gas pipelines operated by Nord Stream AG under its Offshore Operating All Risks policies. This damage was the result of a co-ordinated sabotage, which occurred in the context of the war that began following Russia's February 2022 invasion of Ukraine.

The Court held that the damage to Nord Stream's pipelines was excluded as a result of the war and governmental risks exclusion contained in the cover. The decision gave rise to numerous complex issues of policy construction, but will be of particular interest given its consideration of exclusionary language that loosens the proximate causation test.

Background

Nord Stream is the operator of two natural gas pipelines that run from Russia through the Baltic Sea to Germany, referred to in the judgment as NS1 Line 1 and NS1 Line 2.

On 26 September 2022, roughly seven months after Russia's invasion of Ukraine, the pipelines were damaged by co-ordinated explosions at locations about 6.5km apart and rendered inoperable. Additionally, NS1 Line 2 was damaged in the form of an indentation.

No one has claimed responsibility for the explosions. However, the parties' geopolitical experts in the proceedings agreed that there were only three likely perpetrators: (i) the USA, (ii) Russia and (iii) the government of Ukraine (or a sub-state actor of Ukraine).

At the time of the explosions, the pipelines were covered by both primary and excess Offshore Operating All Risks policies, subscribed to by various underwriters, represented in these proceedings by the two defendants. The excess layers were written on a full follow basis.

Nord Stream sought an indemnity of around €580 million under the policies for loss arising out of the damage caused to the pipelines by the explosions. Nord Stream's claim was denied by Insurers, who relied upon the policies' war and governmental risks exclusion (Exclusion 2.i), arguing that the damage was either occasioned by the war between Russia and Ukraine or caused by the act or under the order of a state.

Exclusion 2.i

Exclusion 2.i is worded as follows:

"2. The following clauses i. and ii. are only to apply to property on land and/or installed at the offshore location, but they shall not be construed to exclude physical loss or physical damage caused by mines, bombs, torpedoes, missiles or other weaponry remaining from previous hostilities or military exercises.

i. Notwithstanding anything to the contrary contained herein, this section does not cover loss or damage directly or indirectly occasioned by, happening through, or in consequence of war (whether war be declared or not), invasion, acts of foreign enemies, hostilities, civil war, rebellion, revolution, insurrection, military or usurped power or confiscation or nationalisation or requisition or destruction of or damage to property by or under the order of any government or public or local authority except as otherwise provided in Section I of the Policy.”

(emphasis added)

Numerous issues of construction and causation arose for consideration by the judge, Dame Clare Moulder DBE, in assessing the application of exclusion 2.i:

• The judge dismissed Nord Stream's assertion that the exclusion did not apply because the policies incorporated the terms of the Institute Clauses for Builders Risks ("ICB") and Institute War Clauses Builders' Risk ("IWCB"), the latter of which expressly provides cover for war risks. The ICB applies only to damage during construction or repair, and the IWCB only to floating assets (which did not include the pipelines).
• The judge held that exclusion 2.i should be read as a combined war and political risks exclusion, applying either to war damage or to damage caused by or under the order of government.
• The policies' General Condition 9, which provided cover for deliberate damage by order of any governmental or regulatory body or agency, applied only to deliberate damage to prevent or mitigate pollution hazard. Accordingly, it did not impact the operation of exclusion 2.i.

Causal connection

The part of the judgment that is likely to be of most interest and application to both policyholders and insurers is the judge's consideration of the causal link required by the words “directly or indirectly occasioned by, happening through, or in consequence of…” (in bold above).

In line with previous authorities such as Spinney's (1948) Ltd v Royal Insurance Ltd (1980) and Coxe v Employers' Liability Assurance Corporation Ltd (1916), the judge held that this phrase provided for a broader causal test than that of proximate cause. So, in this context, for the exclusion to apply the acts that constitute the relevant war need not directly cause the damage: they can indirectly cause the damage because the war permits (or even encourages) those acts.

The judge accepted that the war would have to be "significant" cause of the loss to trigger the exclusion. However, this simply means it must be a contributing factor. Provided that insurers could demonstrate this, they did not then need to distinguish between causes to demonstrate the one with the "higher degree of comparative causal contribution".

In applying this to the facts at hand, the judge made clear that her role was not to assess which of the likely perpetrators was responsible for the explosions. Instead, taking in turn each of the likely perpetrators, the judge assessed whether their actions would have had the requisite causal connection to the Russia / Ukraine war to establish that exclusion 2.i applied. The judgment explores the motivations of each potential perpetrator in detail, taking into account geopolitical expert evidence.

For the reasons set out in detail in the judgment, the judge held that the necessary causal link to the war was satisfied irrespective of whether the attack on the pipelines was carried out by Russia, the USA or Ukraine, given the likely motivation behind the attack. The judge took the view that there was sufficient evidence to determine this, notwithstanding that (i) there were gaps in the evidence and (ii) no one had admitted responsibility.

Conclusion

This decision makes clear that, depending upon the wording, war risks exclusions can extend beyond losses sustained "on the battlefield" to losses resulting from wider events occurring in the context of the relevant conflict. Applying this more generally, policyholders should be alert to exclusionary language that loosens the causal connection required between the excluded peril and the loss (thereby effectively narrowing the scope of cover available).

The Nord Stream judgment also suggests that even if the identity of the culprit responsible for damage is unknown, the court will not necessarily shy away from considering the motivations of likely culprits. In the geopolitical context, expert evidence will be key to this process.

Set across a full day, we have carefully curated a festival of topics and ideas focused on the far‑reaching changes introduced by the Employment Rights Act as well as developments relating to business protection that are highly relevant to employers.  You can expect to hear from leading employment lawyers and industry specialists, who will help you navigate what lies ahead.

• The statutory cap on unfair dismissal claims is scheduled to be abolished from 1 January 2027.
• Anyone continuously employed for six months or more from that date has protection from unfair dismissal.
• Compensation for unfair dismissal is primarily based on financial loss.
• Dismissing employees in regulated sectors is going to become much higher risk as their financial losses are more likely to be significant and will no longer be capped.
• Exposure may be particularly acute in sectors with high value benefits, such as deferred variable compensation or equity or defined benefit pension schemes.

Background

Regulated sectors tend to have mechanisms that limit the employability of individuals who are dismissed for regulatory reasons. Dismissals in certain contexts can therefore cause significant, or even career-impacting, losses to the employee, because they may prevent the employee from obtaining employment in the same sector either until the matter has been determined by a relevant regulator or at all.

Until now, unfair dismissal claims have been a weapon of limited benefit in these circumstances due to the cap on compensation, which is currently the lesser of a year's pay or £123,543. Financial services employees who are subject to the FCA's (or PRA's) certification regime have found themselves in a particularly invidious position because they do not have direct recourse to the regulator. Obtaining an unfair dismissal finding can potentially recover a career and claimants have made good use of reinstatement orders in recent years to get around the compensation cap.

This article looks at the likely consequences of removing the unfair dismissal cap in regulated sectors, with a specific focus on financial services firms and on schools, but it will equally apply to other regulated sectors.

What is changing and when?

From 1 January 2027 there will no longer be a cap on compensation for unfair dismissal claims. Therefore, employees will be able to get compensation for their actual losses; if an employee who earns £100,000 per annum is dismissed and is out of work for three years, they could in theory be awarded £300,000 in compensation. The existing rules on mitigating losses (requiring claimants to take reasonable steps to find alternative work) and Polkey reductions (where an employer demonstrates there was a chance the employee would have been fairly dismissed in any event) will still apply.

The unfair dismissal qualifying service requirement is also changing. Instead of requiring two years' qualifying service, anyone continuously employed for six months or more from 1 January 2027 will have unfair dismissal protection. You can read about the implications of this change for employers here.

Financial services

Employees who are subject to the certification regime require a "regulatory reference" from their former employer to obtain a role at another regulated firm. The regulatory reference form requires former employers to disclose whether they have concluded that the individual was not "fit and proper" to perform a regulated function, whether they have taken disciplinary action related to whether the individual was fit and proper, and any other information that may be relevant to such an assessment. They are also required to notify the regulator if they have reason to believe that the individual has committed a Conduct Rules breach.

The consequence of this regime is that it can be extremely difficult for an employee who is dismissed in certain circumstances to obtain alternative employment with another FCA- (or PRA-) regulated employer. Most regulated firms are unlikely to take a risk on an individual who has already been determined as not fit and proper by another firm. It can also prevent promotion to a senior management function, which requires approval from the regulator, who will take the former employer's fit and proper determination into account when making its assessment.

Until now, certified employees in the financial services sector have been in a particularly invidious position because, ultimately, the regulator will not determine whether the dismissal was valid, and yet if their former employer considers that they have engaged in conduct which calls into question their fitness and propriety or which might amount to a Conduct Rule breach, it can be extremely difficult to find alternative employment. There has been a recent trend for affected claimants successfully to use applications for reinstatement orders (for example Weir v Citigroup Global Markets Limited and Jones v J P Morgan Securities plc).

Teachers in schools

There are three related, but interconnected, routes where a dismissal of a teacher in a school can result in it being very difficult to obtain alternative employment in the same sector.

First, teachers are subject to regulatory approval by the Teaching Regulation Agency (TRA). If a teacher is dismissed for "serious misconduct", or would have been dismissed had they not resigned beforehand, the school must make a referral to the TRA, which can determine if a prohibition order should be issued. A full TRA hearing typically takes over a year and sometimes much longer. In the meantime, the teacher is likely unable to work in their chosen profession.

Second, when asked to provide references for a teacher, schools must ensure the information confirms whether a teacher applicant is suitable to work with children and provide facts of any substantiated safeguarding concerns or allegations that meet the harm threshold. This renders it practically impossible for a teacher dismissed in such circumstances to obtain any role working with children (and for very good reasons).

Third, schools must make referrals to the Disclosure and Barring Service if they have decided to dismiss a teacher and they consider that one of the triggers for inclusion on the barred list applies.

Liability for losses

The implication of removing the unfair dismissal cap for regulated employers like financial services firms and schools is that employers can be on the hook for very high compensation claims if a dismissal in these circumstances is defective. If a financial services firm wrongly determines that a certified employee committed misconduct that renders them not fit and proper, or a school determines that a teacher was dismissed in circumstances that questions their suitability to work with children, the employee may be unlikely to be able to mitigate their losses at all before an unfair dismissal hearing.

The benefits associated with employment in these two sectors can also increase financial exposure. Financial services employees are typically partly paid, often to a significant proportion, in some form of deferred remuneration (for example long-term incentive awards) that can be lost on termination of employment. While such deferred remuneration arrangements are rare for teachers in school, most teachers have a valuable benefit in the form of a defined benefit pension in the Teachers' Pension Scheme. Potential losses from losing access to such a scheme can be extremely high.

What to do?

The simple fact is that the stakes around holding a fair disciplinary process are about to get much higher. There are steps employers can take to protect their position:

• It is invaluable to ensure that managers, and those who are advising them, are appropriately trained on conducting fair disciplinary processes. The above referenced reinstatement judgments highlight that even highly resourced global investment banks can get regulatory-related dismissals wrong.
• The possibility of significant pension losses forming part of unfair dismissal claims is another reason why those schools who are able to and have not yet done so may wish to consider withdrawing from the TPS.
• Employers should ensure their relevant policies and procedures are regularly reviewed and up-to-date and take into account the regulatory environment in which the employer operates, rather than using generic off-the-shelf precedents.
• Some employers who are able to do so are considering using the previously forgotten "employee shareholder" status, which removes employees from the ordinary unfair dismissal, regime in exchange for the employee receiving fully paid-up shares worth at least £2,000.

How Mishcon de Reya can help

Our Employment team advises financial services firms, schools and other regulated employers on all aspects of disciplinary and dismissal processes, including regulatory obligations and the management of unfair dismissal risk. As the removal of the compensation cap approaches, we can help you review and strengthen your disciplinary procedures, advise on fit and proper assessments and regulatory reference obligations, and represent you in Employment Tribunal proceedings. Please contact us if you would like to discuss how these changes may affect your organisation.

The Spear’s Legal Indices are part of the wider Spear's private client ecosystem and recognise leading lawyers trusted by and advising high-net-worth and ultra-high-net-worth individuals in matters relating to wealth, assets, international mobility and complex legal affairs.  The indices are designed to assist a global audience identify leading advisers operating at the highest level of the private client market.

The indices cover five core areas: 

• Art Lawyers - See the full Spear's art lawyers index
• Classic Car Lawyers
• Immigration Lawyers - See the full Spear's immigration lawyers index
• Criminal Lawyers - See the full Spear's criminal lawyers index
• Aviation & Yachts Lawyers

Inclusion is entirely merit-based and independently curated by the Spear’s Research Unit.

See the full indices on the Spear's website.

• The UK has significantly tightened its Russia sanctions regime, expanding trade, energy and transport restrictions, including a ban on third-country processed Russian oil products and maritime transportation of Russian LNG. At the same time, it has issued targeted general licences to ease the pressure on energy prices caused by war in Iran.
• The EU has not followed the temporary easing of energy-related sanctions as a matter of policy. Its recent packages continue to treat Russian oil and gas as a circumvention and enforcement issue, with a particular focus on shadow fleet vessels, maritime services, tanker sales and non-Russian operators involved in the trade.
• If a final US-Iran deal is reached, energy, trading, shipping and financial services firms should expect further EU and UK restrictions on Russian oil and gas alongside an easing of Iran sanctions. For now, parties must ensure they are monitoring indirect sanctions exposure across their broader networks and, if relying on one of the UK's general licences, keep a close eye on revisions and expiry dates.

The significant disruption to global energy supplies caused by the war in Iran has once more brought western sanctions against Russia's oil and gas sector into focus. The need to mitigate economic fall-out from the conflict has led to a softening of some sanctions on Russian energy products, and brought into relief increasing differences in emphasis between US sanctions policies on the one hand, and the EU and UK on the other.

The terms of the Memorandum of Understanding (MOU) between Iran and the US included a commitment to the "terminat[ion] of all types of sanctions" against Iran. Although, at the time of writing, President Trump has described the MOU as "over" in light of renewed attacks in the Strait of Hormuz, negotiations over peace terms with Iran are continuing. If a final peace deal is reached and sanctions against Iran are lifted, it seems likely that the UK and EU's divergence from the US will deepen – with consequences for the energy sector and beyond. Sanctions experts at Mishcon de Reya in London and August Debouzy in Paris provide an update on the current UK and EU positions and look at what could lie ahead if a final peace deal is reached.

Signs of divergence before the Iran war

Since 2022, international sanctions on Russia have been wide-ranging and extensive, targeting strategic sectors of Russia's economy, including banking, energy and defence. In the early stages of the Ukraine war, the US sanctions policies under President Biden were closely aligned with those of the UK and EU. A key example of this coordination was the price cap for Russian crude oil and refined oil products agreed between the G7, EU and partners in late 2022 and early 2023. This prohibited service providers (shipping companies, insurers, brokers) from the UK and coalition countries from facilitating the transport or trade of Russian oil, unless it was traded or sold at or below the agreed cap.

However, since President Trump took office in January 2025, there has been increasing divergence between US sanctions on Russia, and those imposed by the EU and UK. For example, the UK and EU have lowered the oil price cap on several occasions, most recently on 31 January 2026, to USD44.10 per barrel, whereas the US continues to apply the original cap of USD60 per barrel – a near 27 per cent difference.

The UK and EU have also maintained a notably stronger focus on Russia's "shadow fleet": a fleet of ageing, often poorly maintained tankers used to transport Russian oil, typically under flags of countries with looser regulatory standards, in order to unlawfully circumvent the price cap. The UK and EU have each designated hundreds of shadow fleet vessels, as well as entities and individuals implicated in facilitating the shadow fleet, targeting entities established in India, China, Hong Kong and the UAE. By contrast, the US has not introduced any new designations in connection with the Russian shadow fleet since the end of the Biden Administration, although designations for Venezuelan and Iranian shadow fleets have continued.

Current sanctions on the Russian oil and gas sector – what has changed since the Iran war began?

UK

In order to ease pressure on the global energy supply caused by the war in Iran, the UK has issued two narrow General Trade Licences, permitting (i) diesel and jet fuel processed in third countries from Russian crude oil to be imported into the UK and (ii) the supply of liquified natural gas (LNG) from the Sakhalin-2 LNG terminal or Yamal LNG terminal to a third country or between two third countries under contracts not exceeding one year. Both licences expire on 1 January 2027 and can be revoked at any time earlier, although the Government has indicated it will endeavour to give four months' notice if the first licence is revoked. If oil prices stabilise following a final peace deal, the licences may well be withdrawn before the expiry date.

However, it is clear that these limited exceptions do not represent a wider softening of the UK's stance towards Russia. The day after the licences were issued, the UK Government introduced numerous amendments to the existing suite of Russia sanctions, widening the scope of export prohibitions across a range of goods (including those related to emerging technologies such as AI), and introducing significant new restrictions on the Russian energy sector.

These restrictions expand the existing prohibition on the import, acquisition, supply and delivery of Russian-origin oil and oil products into the UK by now also prohibiting the import into the UK of any oil products that have been processed in a third country from crude oil originating in Russia, irrespective of the number of intermediate countries or processing stages involved. The prohibition also captures co-mingled products, where oil products derived from Russian crude are blended with non-Russian oil and oil products in a third country prior to import. 

Alongside the tightening of rules on oil products, the new measures introduce a ban on the maritime transportation of Russian LNG, together with related ancillary services. The ban closely aligns with measures adopted by the EU and applies to any person who supplies or delivers such LNG by vessel, and any person who owns, controls, charters, or operates a vessel carrying the LNG or who is involved in its transfer (subject to limited exceptions in the general licence).

Enforcement of sanctions in the context of the shadow fleet has also stepped up. The UK's second set of criminal charges for breaches of the Russia sanctions were brought against John Ormerod in April 2026, for allegedly transferring funds in violation of sanctions laws. Few details of the transactions have been released, but Mr Ormerod was previously designated by the UK for acquiring tankers that became part of Russia's shadow fleet. Earlier this month, in an unprecedented operation, British forces also boarded and detained a Russian-linked oil tanker in the English Channel. One of the crew was arrested on suspicion of sanctions offences.

EU

The EU has, if anything, moved in the opposite direction from the targeted flexibility adopted by the UK. Rather than issuing general licences to ease energy sector pressure, the EU's recent measures treat Russian oil and gas primarily as a circumvention and enforcement problem. Any flexibility that has emerged is narrow, technical and reversible – a concession to energy security arithmetic, not a strategic softening on Russia. This is clear from the successive sanctions packages adopted since 2025. The 18th package lowered the crude oil price cap from USD 60 to USD 47.60 and introduced an automatic dynamic adjustment mechanism, first applied in January 2026, resulting in a new cap of USD 44.10 per barrel from 1 February 2026. The 19th package then tightened the focus on Russian energy, third-country banks, crypto providers and the shadow fleet, including additional vessel listings, a ban on reinsuring shadow fleet vessels, measures against third-country operators and transaction bans affecting banks and oil traders outside Russia.

The 20th package continues the same logic, with a stronger anti-circumvention architecture. It includes dedicated due diligence obligations for EU sellers of vessels, a mandatory “no Russia” clause in relevant sale contracts, measures targeting ports linked to the shadow fleet and oil price cap circumvention, and the legal basis for a future prohibition on the transport of Russian oil and petroleum products in coordination with the G7 and the Price Cap Coalition. It also extends pressure on financial services and crypto, including measures against Russian crypto-asset service providers and third-country financial institutions used to frustrate sanctions.

The proposed 21st package follows this trajectory. The Commission has proposed pausing the automatic adjustment of the oil price cap until January in order to preserve pressure on Russian revenues despite market volatility. It also intends to add 30 further vessels to the shadow fleet list and, for the first time, targets vessels that assist the shadow fleet, including by providing bunkering or other services. The same proposal would expand transaction bans to additional Russian banks and to banks, crypto firms, platforms and oil traders in third countries alleged to have serviced sanctioned Russian persons or circumvented EU measures.

The emphasis has therefore moved well beyond whether a direct counterparty is Russian or listed. The EU is now looking at the full chain: the origin of the cargo, the vessel's flag history, its ownership and control structure, its insurance arrangements, manipulation of vessels' automatic identification systems (AIS), ship-to-ship transfers, financing flows, trading intermediaries and the ultimate destination of the product. This makes compliance more fact-sensitive and more dynamic: an operation that appears permissible at the outset may become high-risk if the vessel changes flag, the cargo is blended or re-routed mid-voyage, a new intermediary is introduced, or fresh guidance or listings are adopted before performance is complete. For energy majors, commodity traders and their financing and insurance counterparties, conformity with the rules as they stand today is necessary, but no longer sufficient. Increasingly, what will be tested is the quality of the process – the red-flag analysis, the risk-based due diligence, the contractual protections, the screening, the escalation and the documented decision – not merely the result.

The shift from sanctions against persons and goods towards sanctions against networks, routes and services is reflected in the EU's measures on maritime services and tanker sales. EU port access restrictions already capture vessels suspected of engaging in prohibited ship-to-ship transfers, manipulating or switching off AIS, or otherwise supporting the transport of Russian oil in breach of the price cap. The 20th package further strengthens this by imposing due diligence obligations around tanker sales to third-country buyers, requiring EU sellers to obtain contractual guarantees regarding end-use and to document their assessment of the risk that a vessel could subsequently be deployed in the Russian oil trade. For shipowners, insurers, brokers, financiers and traders, due diligence can no longer be a purely declarative exercise.

The French authorities' recent seizures of suspected Russian shadow fleet vessels illustrates this more interventionist phase of enforcement. Even though one vessel has ultimately been released, the operational consequences of detention, investigation, delay, insurance scrutiny and reputational exposure can be severe.

What lies ahead?

As recent events show, peace negotiations are fraught and could still fall apart if tensions continue to escalate over the Strait of Hormuz. However, if the US does achieve a final deal which includes the lifting of all sanctions (including UN Security Council Resolutions) against Iran as promised under the terms of the MOU, the EU and UK are likely to come under significant diplomatic pressure to ease their Iran sanctions too.

Easing Iran sanctions and restoring trade through the Strait of Hormuz on a more permanent basis will also enable the EU and the UK to redouble their focus on limiting Russia's oil and gas revenue – a foreign policy objective that seems unlikely to change if Andy Burnham, who has been a vocal supporter of Ukraine, becomes the UK's next Prime Minister. Should a final deal be reached with Iran, we can expect to see a wind down of the UK's recently introduced general licences and a further crackdown on the processing and transport of Russian-origin oil and gas via third countries, as the EU and UK continue their push to close evasion routes. This is likely to be accompanied by a further hardening of the EU's network-based approach – extending designations further up and down the value chain, and increasing scrutiny of the financial, insurance and logistics infrastructure that enables Russian oil and gas to reach global markets.

Bringing an end to war in Iran may also see a renewed focus on Russia by President Trump. He has suggested that the US's own general licences for Russian oil could be withdrawn once a final deal is reached with Iran – although there is no suggestion yet that it would see a return to greater US alignment on the shadow fleet or oil price cap, so the divergent emphasis in the UK, EU and US regimes seems set to remain for now.

While negotiations over the deal continue, parties in the energy sector, as well as other affected sectors such as commodity trading, shipping and financial services, should ensure they are considering sanctions risk beyond direct connections to Russia and Iran. The EU and UK's increasing focus on non-Russian actors – particularly in Turkey, China, the UAE and Azerbaijan – means that exposure can arise well beyond the direct counterparty. Any party relying on existing UK general licences for Russian and Iranian oil and gas should monitor these carefully, as they are likely to be directly affected by the progress of a deal with Iran, whether it succeeds or fails. More broadly, as the EU's regime continues its shift towards sanctions against networks, routes and services, the quality of the compliance process itself – the screening, the escalation, the documented decision – will be tested as much as the outcome.

In the interview, Victoria reflects on her career path, discusses one of the most challenging matters she has worked on, shares her views on the opportunities artificial intelligence presents for the legal profession, and offers advice to junior lawyers on the importance of curiosity, perspective and surrounding themselves with talented colleagues.

Read in full (subscription required)

James said: “It is time for lawyers to participate more forcefully and more loudly in the debate. We should do so because without promoting, securing and ensuring the funding of the English rule of law system, we will all be impacted financially. But, even more importantly, we should do so because we are responsible as legal professionals, with privileged insight into the risks we face, and as citizens, to speak up and protect the values that led us into the profession in the first place.”

Read the article in full (subscription required)

This conference brings together leading legal and commercial experts to explore the forces reshaping modern sport. From high-stakes litigation over historic results to the evolving rules on club ownership and governance, we examine where power now lies. We will also unpack the rapidly changing media landscape, where broadcast rights, streaming, and new revenue models are redefining the industry. Across three dynamic panels, we consider how law, regulation, and commercial strategy are converging.

Sessions

This conference is for in-house lawyers, barristers, decision makers dealing with governance, ownership, and commercial strategy.  

In its latest decision, the Constitutional Court held that the Supreme Court failed to conduct the meaningful review required by Albania’s Constitution, including to determine whether Mayor Veliaj’s continued detention remained necessary and proportionate; to evaluate less restrictive alternatives; to address the constitutional consequences of preventing the democratically elected Mayor of Tirana from exercising the mandate entrusted to him by the citizens of Tirana; and to consider significant constitutional claims arising from Mayor Veliaj’s treatment during judicial proceedings.

Although the majority remanded the matter for renewed constitutional review, one of the Constitutional Court judges issued a separate concurring opinion that went significantly further. The concurring judge concluded that the evidence relied upon by the lower courts failed to establish the constitutionally required reasonable suspicion to justify Mayor Veliaj’s detention. According to the concurring opinion, prosecutors relied on facts that merely reflected the ordinary exercise of Mayor Veliaj’s official responsibilities and would not persuade “even an objective observer” that he had committed the charged offences. The concurring judge therefore concluded that Mayor Veliaj’s continued detention lacked the constitutional foundation required under both Albanian law and the European Convention on Human Rights.

Other members of the Constitutional Court likewise expressed serious concerns regarding Mayor Veliaj’s treatment. Separate opinions criticised the use of a glass enclosure during court proceedings as inconsistent with human dignity, concluded that restrictions imposed during detention interfered with Mayor Veliaj’s ability to communicate effectively with counsel, emphasised that the Supreme Court failed to protect adequately the constitutional presumption of innocence and the right to an effective defence, and criticised the lower courts for failing to weigh properly the constitutional implications of depriving the democratically elected Mayor of Tirana of the ability to exercise the office entrusted to him by the electorate.

Taken together, the Constitutional Court’s majority opinion and the accompanying concurring opinions identify a remarkable series of independent constitutional deficiencies, including the failure to establish sufficient reasonable suspicion by adequate evidence; the failure to meaningfully evaluate whether continued detention remained necessary and proportionate; the failure to adequately safeguard the constitutional presumption of innocence and the right to an effective defence; the failure to protect courtroom procedures that protected Mayor Veliaj’s dignity and his confidential communications with counsel; and the failure to fully consider the constitutional consequences of preventing a democratically elected mayor from exercising the office entrusted to him by the electorate.

The decision establishes constitutional principles extending well beyond this case by reaffirming that restrictions on personal liberty must be subject to meaningful constitutional scrutiny; that courts must independently determine whether detention remains necessary and proportionate; that less restrictive alternatives must be genuinely considered; and that constitutional protections remain fully applicable even in proceedings involving elected public officials and matters of significant public importance.

Daniel J. Fetterman, lead international counsel for Mayor Veliaj and a partner at Kasowitz LLP, issued the following statement:

“The Constitutional Court deserves recognition for its careful, independent, and principled application of Albania’s Constitution. Today’s decision represents the Constitutional Court’s second ruling recognising significant constitutional deficiencies in the State’s treatment of Mayor Veliaj.

“The Constitutional Court has performed precisely the function entrusted to it by Albania’s Constitution: ensuring that even in matters involving public officials and allegations of criminal misconduct, constitutional guarantees remain fully enforceable. Constitutional rights exist precisely to ensure that difficult cases are decided according to law rather than expediency. 

“This decision reinforces a principle shared by constitutional democracies throughout Europe and the United States: personal liberty cannot be restricted without rigorous judicial scrutiny and faithful adherence to constitutional safeguards. The Constitutional Court has now required exactly that searching review, and one member of the Court concluded that the evidence never satisfied the constitutional standard necessary to justify Mayor Veliaj’s detention in the first place. Once the Albanian Supreme Court faithfully undertakes the review required by today’s decision, carefully weighs each of the deficiencies identified by the Constitutional Court, and applies the governing standards, we fully expect it will conclude that Mayor Veliaj’s continued detention cannot constitutionally be sustained and will order his immediate release.

“When those constitutional deficiencies are considered together with the publicly identified use of two purportedly fictitious complainants whose existence has never been established and the participation of a prosecutor who admitted that he lacked the legal qualifications required to hold his office, the Albanian judiciary should ultimately be required to determine whether the cumulative effect of these defects has so compromised the integrity of these proceedings that the prosecution can continue consistently with the guarantees of due process, the Albanian Constitution, and the European Convention on Human Rights.

“The rule of law ultimately is measured not by the constitutional rights written on paper, but by the willingness of independent courts to enforce those rights when doing so is most difficult. Independent courts faithfully applying constitutional principles without fear or favour are indispensable to democratic governance, public confidence in the administration of justice, and the protection of every citizen’s fundamental liberties.  We remain hopeful that Albania’s judicial institutions will uphold those enduring constitutional principles.”

Delivered in collaboration with BDO, the showcase will bring together some of the region’s most exciting early-stage and scaling technology companies for an evening of networking, discovery and conversation.

Guests will have the opportunity to explore a range of company displays, meet the teams behind the businesses, and connect with founders, investors, entrepreneurs and others from across the Cambridge innovation community. Drinks and canapés from local Cambridge suppliers and caterers will be served throughout the evening.

The evening will highlight the breadth of talent, ambition and innovation coming out of the region, while bringing together the people and businesses helping to shape its future.

Attendance is free, but places are limited and registration is subject to approval.

Register your interest

Clare discusses the division of matrimonial and non-matrimonial assets, the challenges of valuing private and illiquid wealth, the treatment of future financial interests, and the role of trusts and offshore structures. She also highlights the importance of transparency, careful planning, and nuptial agreements in protecting wealth and reducing disputes.

Read the full article.

From proposed bans and statutory time limits to salary thresholds, Jennifer and Jonathan assess the Government’s reform options and the practical concerns they raise for employers and employees alike.

Read the full article on ELA briefing (access requires ELA membership)

Jennifer and Claire explore the key requirements of the Directive, the UK Government’s ongoing consultation on pay transparency reforms, the implications for Northern Ireland, and the practical steps employers should take now to prepare for a more transparent pay landscape.

Read the full article on ELA briefing (access requires ELA membership)

David said: “While this case was decided under Irish law, it carries important lessons for UK employers too. Under the Equality Act 2010, a person has a disability if they have a physical or mental impairment that has a substantial and long-term adverse effect on their ability to carry out normal day-to-day activities.

“There is no prescribed list of qualifying conditions. What matters is the impact of the condition on the individual, assessed on a case-by-case basis. 

“This case is a timely reminder that employers should not assume a condition does or does not amount to a disability simply because it may not obviously fit a familiar category. Vestibular migraine, like many other episodic conditions, can cross the threshold depending on its effects.

“Early referral to occupational health can be invaluable. It provides an evidence base, demonstrates good faith, and helps identify practical solutions before a dispute arises.

“As this case shows, an employer who cannot demonstrate they properly considered an adjustment risks a finding that they failed in their legal duty.”

Read the full article in HR Magazine.

"Most employers are likely to take a sensible approach, but clear boundaries and expectations should be communicated to the workforce.

"Inappropriate conduct, such as turning up to work drunk or severely hungover (or missing client meetings) can, and perhaps should, be dealt with under the employer's disciplinary policy. Some employers may proactively invite employees to take their annual leave on the Monday."

Read the article in full

Founded in 1866, Grenson supplied boots to British soldiers during both world wars. Tim and Julia acquired their stake in Grenson in 2010, and Grenson has continued to embrace its heritage and focus on quality design to constantly innovate and create contemporary and iconic luxury footwear.

Castore is a premium sportswear brand, whose acquisition of Grenson forms part of their continued growth and wider expansion in the premium consumer market.

The Mishcon de Reya team was led by Daniel Goldsborough, Partner in the Corporate team and Managing Associate Karine Bashardust, Associate Thomas Hurley and Trainee Charlotte Lowe in the Private Equity team. Margarita Elia led on Employment aspects of the deal.

Daniel Goldsborough commented: “We are delighted to have delivered this exit for Tim and Julia. They took over the business in 2010 and while cherishing Grenson's amazing heritage they have worked tirelessly to continuously innovate and evolve the business. It was a privilege to advise them both and to help them achieve this thoroughly deserved reward for all their hard work. Congratulations to Castore they've acquired an iconic British brand that I'm sure they will take from strength to strength."

Tim Little commented: “For me this deal was the culmination of 16 years of building the brand and finding the right people to take it on into the future. The Mishcon team were the perfect people to lead me through what for most people is a once in a lifetime process and they were a dream to work with.  They were extremely thorough but also calm when the inevitable twists and turns appeared. I felt completely safe in their hands."

In brief

• The Attorney General of Northern Ireland referred the question of whether a person lacking capacity under domestic law could express "valid consent" to confinement so as to mean they have not been deprived of their liberty.
• The Supreme Court, overruling its prior decision in Cheshire West, held that "valid consent" was an autonomous concept that could not be equated to a bright-line capacity question. A wider inquiry as to the thoughts and feelings of the individual was required.
• The Supreme Court also reaffirmed the 'multifactorial' approach to Article 5, holding that determination of a deprivation of liberty required consideration of various factors including the purpose and nature of the confinement, and the individual's views.
• While the full implications of the judgment are yet to be reflected in updated policy guidance, it is already clear there will be a significant reduction in the number of individuals considered to be deprived of their liberty.

Background: The attorney general's reference and the decision in Cheshire West

Background to the Reference

This case was a Reference from the Attorney General of Northern Ireland (the 'Reference') concerning the validity of proposed amendments to the Deprivation of Liberty Safeguards Code of Practice in Northern Ireland.

The effect of the proposed amendment would mean that those who could not consent as a matter of domestic law (because they lacked capacity), could nevertheless be taken to have consented to the deprivation of their liberty for the purposes of Article 5 of the European Convention on Human Rights ("ECHR"), which protects the right to liberty and security of person.

The Attorney General's Reference arose because the proposed amendments directly conflicted with the Supreme Court's prior ruling in Cheshire West and Chester Council; Surrey County Council v P [2014] UKSC 19 ('Cheshire West').

The Decision in Cheshire West

Before turning to the decision in Cheshire West, it is necessary to understand the legal framework that constitutes Article 5. There are three components of a deprivation of liberty under Article 5 of the ECHR:

1. Objective component: Confinement in a particular place for a material period of time; 
2. Subjective component: Without "valid consent"; and
3. State component: In circumstances where the state, directly or indirectly, is responsible. 

In their analysis of the above requirements, Cheshire West advanced what has been labelled an 'acid test' for whether a deprivation of liberty is made out, asking whether the individual is subject to "continuous supervision and control" so they are "not free to leave".

In the event that the 'acid test' is made out, and there is no "valid consent", a deprivation of liberty has occurred. Importantly, the Supreme Court in Cheshire West held that "valid consent" can only be given by those with the mental capacity under domestic law to do so.

In the Reference, the Supreme Court had to grapple with both elements of the Cheshire West judgment: the 'acid test' and the Court's conclusion on capacity.

In summary: The Supreme Court's decision

Overruling Cheshire West, the Supreme Court held that:

1. The 'acid test' was not supported by authority, and instead what is required is a multifactorial approach to Article 5; and
2. 'Valid consent' is an autonomous concept capable of being given by those lacking capacity under domestic law.

The multifactorial approach

While the Reference concerned the Court in Cheshire West's decision on the question of consent, the Supreme Court agreed with the submissions of the Secretary of State for Health and Social Care that the subjective and objective elements could not be considered separately.

It was here that the Supreme Court rejected the 'acid test' and reasserted the primacy of a multifactorial approach to Article 5. Only by taking into account a range of factors could decision-makers determine if a person was subject to confinement.

The Court articulated a number of these factors, most important of which were:

• The "relative normality" of the individual's life and the extent to which the confinement interrupted their day-to-day life;
• The purpose of the confinement;
• The nature of the setting and how closely it resembles what they referred to as the "paradigm" instance of deprivation of liberty, a prison cell; and
• The subjective perceptions of the individual and whether they feel confined or restricted.

As is clear from this list, the Supreme Court envisages an inquiry that is not confined to a largely factual question of whether an individual has their movements restricted, but rather a multifaceted inquiry into the nature, purpose and effect of confinement.

"Valid consent"

The most significant finding of the Court was that the Court in Cheshire West was wrong to reduce the question of "valid consent" to one of capacity. The Supreme Court held that, while an individual may "lack capacity in a full legal sense, they may nevertheless have a fundamental understanding of whether they are broadly happy or unhappy about something".

It is this ability to indicate happiness or unhappiness with a situation that underpins the Court's analysis. A lack of capacity under domestic law cannot tell us whether an individual is happy or unhappy with their present position, and to suggest that capacity would always defeat an individual's ability to express this was wrong.

The argument that, because some adults will find it difficult to communicate and express views and feelings about their placement, the views of no adults should be capable of vouching consent creates an arbitrary threshold and may lead to unnecessary and intrusive interference with the private lives of those adults with impaired mental capacity who are able to express views and feelings.

The practical consequence is that a lack of capacity will no longer be sufficient to satisfy the subjective element.

The Supreme Court noted that further guidance is necessary to flesh out when an individual may be taken to have expressed valid consent, but did provide a number of important observations:

• The Supreme Court acknowledged that there may be "considerable evidential difficulties" in determining consent, but that these would need to be judged on a case-by-case basis;
• While a "tacit positive indication of wishes and feelings" may be sufficient to indicate valid consent, "mere compliance or acquiescence may carry little weight"; and
• Where there is "serious doubt" as to a person's attitude, then "no inference of valid consent should be drawn."

The Court's judgment is a welcome return to "valid consent" as an autonomous concept doing real work in the Article 5 inquiry, as opposed to a tick-box, reductive question as to a person's capacity.

Taking stock: where are we now?

The practical takeaway from the decision is that Cheshire West is no longer good law, and the decision must now be reflected without delay in guidance, decision-making and applications. We can, however, cast an eye forward to see what may be in store for those who need to consider the issue of whether someone has been deprived of their liberty.

Reassessing the current approach

The first stage for local authorities, care providers and practitioners is to reassess their current approach to deprivation of liberty. Local authorities and care providers will be required to review their current cases (both those with active cases and those subject to a backlog) to determine whether they still fall within the remit of a deprivation of liberty.

The key practical result of the decision is that far fewer individuals will be considered to be deprived of their liberty. This is a welcome change. The Court in Cheshire West aimed to provide a wider group of individuals with safeguards to their liberty, but that goal had significant unintended consequences. DoLs authorisation requests rose from 13,700 in the year prior to Cheshire West to 322,455 referrals in 2023/24, leaving a backlog of over 123,000 cases and creating a lottery even for the most serious instances of confinement. Further, and as was noted by the Court, the personal toll on individuals going through the DoLs process and waiting for approval should not be a forgotten impact of the wider ranging approach in Cheshire West.

While the Court in Cheshire West may have had a laudable goal, it is to be hoped that the Supreme Court's decision restores some much-needed order and priority.

Rebuilding the decision-making process

The second stage will be developing an understanding of how the multifactorial approach works in practice. The approach represents a significant departure from Cheshire West and will require substantial elucidation. In the short term, we can expect fewer DoLs applications, but likely more litigation as decision-makers and courts alike come to terms with the new test.

A shift to alternative safeguards?

One unfortunate outcome of the Cheshire West judgment was an overextension of the concept of deprivation of liberty to ensure safeguards for those who lack capacity and are subject to some element of confinement. However, a person need not be found to have their liberty deprived in order to be protected. As the Supreme Court noted, the Mental Capacity Act itself contains further safeguards that operate independently of the DoLs regime. In some cases, decision-makers are required to create support plans that are subject to annual review, and in any event, they remain under a duty to investigate safeguarding issues arising from residential placements. There are, of course, various other tools at the disposal of decision-makers, and the focus is likely to shift toward how these regimes ought to be used in light of the Supreme Court's decision.

Why attend?

Drawing from our experience on cyber incident response cases, this session offers a clear view of the most significant threats facing organisations today. From AI-driven attack methods to targeted software supply chain compromises, attendees will gain insight into how these risks are evolving and how to better prepare from a risk, legal, and compliance perspective.

Who is it relevant to?

Designed for senior professionals across compliance, risk, and legal functions as this session provides critical insight for those accountable for cyber risk governance, regulatory obligations, and incident response strategy.

Employment law is constantly changing, and it can be hard for employers - and particularly managers - to keep up.  

This half-day session, aimed at managers in your business with people responsibilities and junior HR practitioners, will explain the basics of Employment law when it comes to managing staff. Designed to empower employees to take on the right amount of responsibility and to understand when to contact HR, it will cover:

• Probationary periods and how to use them 
• Performance management 
• Managing sickness absence 
• Disciplinary processes 
• Handling grievances 
• The basics of unfair dismissal 
• The basics of discrimination law 
• How to hold challenging conversations 
• What happens when things go wrong 

Numbers will be limited, so we may need to cap the number of delegates that organisations can send. If you would be interested in a dedicated session for your business, please contact Will Winch. 

Security researchers have since quantified the scale of the campaign. Now nicknamed "FortiBleed', it is reported to have compromised somewhere between 30,000 and 75,000 devices across 194 countries. One analysis placed the figure at over 73,000 unique Fortinet firewall URLs and described an extraordinary volume of automated attempts: an estimated 1.16 billion credential-based attempts against more than 320,000 FortiGate targets.

Importantly, this was not a sophisticated exploit of a hidden flaw in Fortinet's software. Researchers found no evidence of a Fortinet zero-day or a breach of Fortinet itself. Instead, attackers relied on something far simpler and far more common: credential stuffing, password spraying, brute-force attempts, and reused passwords from prior leaks. In plain terms, attackers took passwords stolen in earlier, unrelated breaches and tried them, at industrial scale, against the login pages of firewalls and VPNs exposed to the open internet. Where a password had been reused, the door simply opened.

There is also a worrying dimension: experts note that adversaries are leveraging generative AI to automate these attacks, adopting tactics typically associated with nation-state actors. Capabilities once reserved for sophisticated state-backed groups are increasingly available to ordinary criminal operations.

Why does this matter?

Think of a firewall or VPN gateway as the front door and security desk of a company's digital building. Almost everything else - email, file servers, customer databases, finance systems, factory control systems - sits behind it. It is designed to be the mechanism that keeps unauthorised people out whilst allowing legitimate staff in.

When that front door is compromised, an attacker does not just see the lobby. They can often walk straight into back offices with elevated privileges, because these devices typically hold powerful administrative access by design.

For a business, the practical consequences of this kind of compromise can include:

• Operational disruption - production lines, logistics, or customer-facing systems going offline.
• Data theft - customer records, intellectual property, or financial data extracted before anyone notices.
• Ransomware as the second act - initial access via a compromised VPN is one of the most common ways ransomware gangs get a foothold, often weeks or months before the ransomware itself is deployed.
• Regulatory and reputational fallout - breach notification obligations, client trust damage, contract and insurance implications.
• Knock-on risk to partners and customers - compromised networks are frequently used as a launchpad to attack suppliers, clients, or other connected organisations.

What this trend represents more abstractly

This incident is not really a story about Fortinet specifically. Fortinet's own systems were not breached - and the same pattern has played out against other vendors. Researchers note a near-identical campaign in thesame period targeting enterprise VPN authentication infrastructure, specifically Palo Alto Networks GlobalProtect and Cisco SSL VPN gateways, and the NCSC has separately issued advisories about attacks on Cisco firewall platforms.

The real story is structural, and it points to three broader shifts:

1. The perimeter is the target now, not just the destination. For years, security strategy assumed the firewall was a static, trustworthy barrier. Attackers have recognised that the wall itself - its login page, its credential store, its management interface – can be the single richest target in the entire network. Compromise the gatekeeper, and you inherit its trust.
2. Human and process failure outpaces technical failure. This was not a brilliant exploit. It was password reuse, weak credential hygiene, and internet-exposed administrative panels - entirely preventable, well-understood weaknesses that organisations have been advised to address for over a decade. The technology generally worked as designed; the operational discipline around it did not.
3. Automation and AI are collapsing the cost of attack. Billions of login attempts, organised credential databases sorted by country, sector, and revenue, and AI-assisted automation represent industrial-scale opportunism. Attackers no longer need to specifically target your organisation; they need only to know you exist, use a familiar product, and have a reused password somewhere in its history.

Taken together, this represents a shift from attacks requiring skill and patience to attacks requiring only scale and persistence - a far larger and more enduring threat for every organisation with an internet-facing footprint, regardless of size or perceived importance.

Strategic recommendations for organisations

The NCSC's technical guidance is sound and immediately actionable. Translated into management priorities, organisations should:

• Treat edge devices as crown jewels, not commodity IT. Firewalls, VPN gateways, and other internet-facing infrastructure should receive the same governance attention, patching discipline, and monitoring as your most sensitive applications, because they are, functionally, the master key to everything behind them.
• Get the basics right, and verify they are actually being followed. Change all default, generic, or reused administrator passwords and ensure multi-factor authentication is enforced on all VPN and device management logins. These are not aspirational best practices; they are the specific gaps this campaign exploited. Audit, do not assume.
• Take admin interfaces off the public internet. Ensure management interfaces are not exposed to the internet and restrict access to trusted internal networks. There is rarely a good reason for a firewall's management console to be reachable by anyone with a browser and an internet connection.
• Keep technology current - and retire what cannot be. Update to the latest version and remove out- of-support systems as soon as practicable. Unsupported, unpatched edge devices are a standing invitation to attackers.
• Assume compromise, then verify you are wrong. Do not wait for visible symptoms. Determine whether your Fortinet device has been compromised by checking for common indicators of compromise, including unauthorised account creation and unexpected activity in log files. Investigate devices reachable from the compromised device and monitor firewall logs for suspicious activity to confirm the breach has not spread further into the network.
• Build credential hygiene into culture, not just policy. Password reuse is a human behaviour problem as much as a technical one. Password managers, mandatory MFA, and regular credential rotation for privileged accounts should be non-negotiable for any account with administrative reach.
• Subscribe to early warning services. Free resources such as the NCSC's Early Warning service exist specifically to give organisations advance notice of a cyber incident before it escalates. Use them.
• Plan for the next vendor, not just this one. Because this is a pattern, not an isolated event, boards and leadership teams should ask: if our other internet-facing infrastructure were targeted tomorrow in the same way, would we know, and could we respond? That question, asked regularly, is more valuable than any single patch.

The bottom line

This campaign is a reminder that the most common point of failure in cyber security is rarely the exotic, headline-grabbing exploit. It is the neglected basics; a reused password, an exposed login page, a missed update. The scale here - tens of thousands of devices, billions of automated attempts, AI-assisted operations rivalling nation-state tradecraft - shows that attackers no longer need sophistication when scale and persistence will do. For every organisation that relies on a firewall or VPN to secure its network (which is to say, nearly every organisation), the lesson is not 'switch vendors'. It is lock the front door properly and check regularly that it is still locked.

• Third party harassment is one of the most significant changes introduced by the Employment Rights Act 2025 ("ERA 2025").  It comes into force in October this year, and the liability can be significant.  In this article, we suggest ways in which employers can prepare themselves for it.
• In addition to introducing liability for the acts of third parties, the ERA 2025 also strengthens workplace protection against harassment, including sexual harassment, in two other ways:
  • From April 2026, disclosures related to sexual harassment automatically qualify for whistleblower protection where the worker reasonably believes the disclosure tends to show that sexual harassment has occurred, is occurring, or is likely to occur; and
  • from October 2026, the proactive duty on employers to take "reasonable steps" to prevent sexual harassment will be raised to require "all reasonable steps".

Whistleblower protection for sexual harassment disclosures

On 6 April 2026, the ERA 2025 amended the definition of a "qualifying disclosure" to expressly include disclosures that sexual harassment has occurred, is occurring, or is likely to occur.

To some extent, it is hard to see why this provision will add much of significance to the legal landscape.  Such disclosures were arguably already capable of qualifying under the pre-April regime (whether by way as a breach of a legal obligation or a health and safety concern), and a worker who suffers dismissal or detriment as a result can bring a victimisation claim under the Equality Act 2010 ("EA 2010").  However, the change does provide greater certainty for those thinking of raising concerns. 

Perhaps the most important practical consequence will be that workers will be able to claim 'interim relief' if they are dismissed because they blew the whistle on sexual harassment.  While it is very difficult to succeed in an application for interim relief (the bar for success is high as the Tribunal must be satisfied, before hearing all of the evidence, that the claimant will be likely to succeed at trial), it does in theory entitle the worker to continue receiving pay throughout the period leading to the tribunal hearing – even if they do not win the eventual claim.  Given the significant delays in the Tribunal system, this could be significant.

What is the new requirement to take "all reasonable steps" to prevent sexual harassment?

From October 2026, the ERA 2025 will raise the standard of the proactive duty to prevent sexual harassment from "reasonable steps" to "all reasonable steps", bringing it in line with the existing statutory defence under section 109(4) of the EA 2010 against vicarious liability for discrimination committed by employees.

What constitutes “all” reasonable steps is undefined, and concerns have been raised that it will be a difficult standard to meet. During the passage of the Employment Rights Bill, the Employment Lawyers Association observed in its response to the Public Bill Committee Call for evidence on the Employment Rights Bill that the “all reasonable steps” defence under s.109(4) EA 2010 is rarely invoked because it rarely succeeds, and warned that importing this standard into the proactive duty risks imposing something approaching strict liability on employers.  The government has the power to specify in Regulations what steps will satisfy the duty, though those Regulations are not expected until 2027/28 (in other words, at least a year after the duty has come into force).

That said, some commentators are not convinced that this change to the law will actually make much difference in practice.  It would be a bold employer who suggests that they escaped liability for failing in their duty to prevent sexual harassment because they took one step to combat it, when (say) three other obvious steps were also open to them but were ignored.

Where does this leave employers? Satisfying the standard in practice will depend on the specific circumstances of each employer including their size, sector, resources and working environment and courts are likely to take a fact-sensitive, contextual approach. Employers should have already conducted a proper risk assessment in accordance with the EHRC's existing technical guidance and will have identified what steps should be taken to address the risks that are identified.  Provided employers do this, they should be relatively well placed to answer any claim. 

In the meantime, a breach of the proactive duty already carries the risk of a compensation uplift of up to 25% in any related tribunal proceedings, a significant commercial incentive to take proactive steps now rather than await regulatory guidance.

Employers' liability for third party harassment

While the first two changes described above should not, in our view, create much in the way of additional burdens for employers, from October 2026, the ERA 2025 will impose liability on employers who fail to take "all reasonable steps" to prevent third parties from harassing their employees in the course of their employment.  In other words, an employer will be held liable for the actions of a third party in very much the same way as it would be liable for the actions of one of its own employees.

Third-party liability is not completely new. For a period until 2013, the law imposed liability under a "three strikes" rule, requiring at least two prior incidents of which the employer was aware, before liability would attach. The ERA 2025 reintroduces third-party liability without an incident threshold.  The only way of avoiding this liability is for the employer to show that it had taken "all reasonable steps" to prevent the harassment.

"Third parties" will mean a person other than the employer or one of its employees. The category is therefore broad, extending beyond the obvious examples of customers, clients and suppliers to include members of the public, delivery drivers, visitors, contractors and even those who share an office building or workspace, such as co-tenants.

Significantly, this duty also extends to harassment related to all relevant protected characteristics (e.g. race, religion and sexual orientation) under the EA 2010, not just sexual harassment.

This will prove particularly challenging for employers in customer-facing sectors such as retail, hospitality and professional services, as well as other sectors where staff regularly interact with third parties over whom employers have limited control.

How should employers prepare for the introduction of third party harassment?

Employers will need to be proactive to ensure that they are in the best position to prevent and, if necessary, defend claims.  Relevant steps include the following.

• Ensuring that the 'tone from the top' is clear.  Senior leadership engagement with measures that employers implement will be helpful in ensuring compliance.  Reports to the board on complaints data and buy-in for staff training and sponsorship of any new policy by a senior officer will all contribute to an anti-harassment culture.
• Carrying out risk assessments to identify the contexts in which employees may be exposed to harassment, including by third parties, and the steps needed to mitigate those risks.
• Reviewing and updating harassment, whistleblowing, and grievance policies to reflect the new standards.
• Reviewing lone working and remote working arrangements, as third party harassment risks may be harder to detect and respond to in these situations.
• Providing staff training so that employees can identify and report harassment, including by third parties, and managers are equipped to respond appropriately, with training refreshed periodically.
• Strengthening reporting channels to ensure they are accessible, confidential, and cover third-party incidents as well as internal complaints, and ensuring employees are aware of the applicable whistleblowing protections.
• Considering anti-harassment signage, and establishing clear procedures for managing or excluding third parties who harass employees.
• Reviewing contracts and terms of business with third parties to include express provisions dealing with harassment by the counterparty's employees or agents, which include the ability to terminate the agreement for cause if the conduct is sufficiently serious or persistent.
• Keeping records of risk assessments, policy reviews, and training.

Further guidance on preparing for the upcoming changes can be found on our ERA Hub.

How can Mishcon de Reya help?

Our Employment team has extensive experience advising on complex workplace issues, including harassment and whistleblowing. We can help you to conduct risk assessments, review and update policies and procedures, and design and provide tailored training programmes. If you would like to discuss what the ERA 2025 changes mean for your organisation, please contact a member of the Employment team.

• In December 2025, the UK Government elevated two offences to "priority" status under the Online Safety Act 2023 (OSA), encouraging or assisting serious self-harm , and cyberflashing.
• The necessary changes to the risk framework constitute "significant changes" under the OSA, requiring providers to promptly review and update their Illegal Content Risk Assessments, content moderation policies, and content judgement processes to address the risks of the two new harm categories, including revised risk factors.
• In addition to the updated documents published by Ofcom, amendments to the illegal content Codes of Practice will be implemented separately. Providers should also anticipate further regulatory updates in autumn 2026, alongside policy development in relation to the additional new offences and priority offences introduced through the Crime and Policing Act 2026.

Introduction

Ofcom has published a statement on new priority offences under the Online Safety Act 2023 (OSA), providing guidance to tech companies as to the steps they will now need to take in relation to reviewing and updating their Illegal Content Risk Assessments (ICRAs) and taking appropriate steps to comply with Ofcom's updated risk assessment requirements. Providers should now review and update their ICRAs, content moderation policies, and compliance positions across the two new harm categories, and continue to monitor Ofcom's programme of regulatory updates.

The new priority offences

In December 2025, the Government created two new 'priority offences': encouraging or assisting serious self-harm, and cyberflashing. Both were previously non-priority offences. The recategorisation means that regulated online service providers have specific duties in relation to them.

Suicide and self-harm

Ofcom has combined the pre-existing offence of encouraging or assisting suicide with the new offence of encouraging or assisting serious self-harm into a single harm category, and has updated its Risk Assessment Guidance and the Illegal Content Codes of Practice (Codes) to reflect this. The effect of this change is that providers will need to assess the risk of both harms and assign an overall risk level to 'suicide and self-harm'. Further, they will need to take account of relevant measures that specifically apply to suicide content or services at medium or high risk of encouraging or assisting suicide which will now apply to self-harm content and relevant services. However, whilst the offences have been combined in this way, services will be expected to reflect the differences in how the two harms manifest when carrying out their duties.

Ofcom has updated the User-to-User Risk Profile to include the risk factors most strongly associated with suicide and self-harm and added a reference to self-harm in the Search Risk Profile. The Register of Risks suicide and self-harm chapter has also been updated to include additional evidence on how these types of harms manifest online. 

Cyberflashing

Cyberflashing has been added as a new, standalone category of illegal harm. The offence under section 66A of the Sexual Offences Act 2003 covers the intentional sending of a photograph or film of genitals for the purpose of causing alarm, distress or humiliation, or for the purpose of obtaining sexual gratification, with recklessness as to whether alarm, distress or humiliation would be caused.

What this means for in-scope service providers

The changes to the risk framework constitute "significant changes" within the meaning of the OSA, triggering the specific legal obligation for providers to review and update their ICRAs, to assess the risks of the new kinds of illegal harms on their service. In particular, providers should now do the following (noting that Ofcom recommends that providers do this as soon as practicable after publication of its statement):

• Consult the updated Guidance: including the Risk Assessment Guidance and Risk Profiles, Illegal Harms Register of Risks, Illegal Content Judgements Guidance (ICJG), and Record-keeping and Review Guidance, all of which have been published alongside Ofcom's statement.
• Update ICRAs: this will involve assessing the risks of suicide and self-harm as a combined harm category, assigning a single overall risk level, and separately assessing the risks of cyberflashing on the service.
• Review content moderation and illegal content judgement processes: the ICJG provides updated guidance on how to assess whether content amounts to either offence.
• Consider the updated risk factors: the updated Risk Profiles include new risk factors directly associated with functionalities such as direct messaging, group messaging, and recommender systems. Providers should consider whether these features increase the likelihood of illegal self-harm or cyberflashing content appearing on their service and reflect this in their risk assessments.
• Consider the updated Codes: as soon as they complete the Parliamentary process and come into force, providers will need to adopt the safety measures set out in the Codes or use other effective measures. Ofcom has published the draft consolidated versions of the User-to-User Code and the Search Code.
• Update record-keeping: to reflect the evidence base required for assessing both suicide and self-harm (as a combined category) and cyberflashing separately.

AI-generated content

Ofcom has confirmed that it is not yet incorporating generative AI into the Risk Profiles or Register of Risks as a specific risk factor, pending a more comprehensive review. However, existing Code measures already apply to AI-generated content shared by users on user-to-user services, and to GenAI services that fall within the scope of the Act. Providers should therefore already be treating harmful AI-generated content as subject to their existing obligations.

Next steps

Ofcom has already published updated versions of the Risk Assessment Guidance and Risk Profiles, Illegal Harms Register of Risk, ICJC and Record Keeping and Review Guidance. 

The amendments to the Codes are subject to parliamentary process and will therefore come into force once that process is complete.

More broadly, Ofcom has confirmed that it expects to publish its decisions on user control measures (from its April 2025 Consultation) and additional safety measures (from its June 2025 Consultation) in autumn 2026. Separately, further updates are anticipated following the Crime and Policing Act 2026, which introduces a number of additional new offences and priority offences. Ofcom is scoping the policy work required to respond, and providers should expect further updates to the regulatory framework in due course.

If you require assistance navigating these changes, or understanding the obligations on service providers, please contact a member of our Online Safety team.

Following on from an in-person event in February 2026, Partner Jennifer Millins joined the Glass Cliff Podcast with Emma Sangeelee (Partner, CM Murray LLP), Sophie Williams (Author of The Glass Cliff and former global executive at Netflix), and Kevin Hogarth (Partner, PSFI LLP and Board Adviser, Executive Coach and NED) to discuss:

• What the glass cliff is - and how societal and often unconscious discrimination shapes leadership outcomes
• Why underrepresented leaders are more likely to be appointed into roles during periods of organisational crisis
• The structural and cultural dynamics behind these appointments, including unequal access to progression, sponsorship and high-profile opportunities
• How unconscious bias shapes decision-making
• The risks for individuals, including scrutiny, limited support and the potential for disproportionate blame when things go wrong
• Practical signs to look out for when considering a senior role
• The role of sponsorship, organisational support and active leadership in improving outcomes

Watch or listen to the full discussion.

In brief

• The UPC can hear cases involving patents in countries outside the UPC system, including the UK, provided the defendant is domiciled in an EU Member State.
• Such a defendant cannot ask the UPC to hand the case to a non-EU court on the basis that it would be a more convenient forum.
• If the UPC finds infringement, it can grant relief that covers non-UPC countries, subject to those countries' own courts having the final say on validity of the patent designated in their territory. The Court of Appeal has set out a process by which the UPC should exercise its jurisdiction.

Background

Fujifilm sued three German-domiciled Kodak companies before the Mannheim Local Division alleging infringement of various designations of a European patent covering lithographic printing plate precursors. The claim included both the German and UK designations. Kodak objected to the UPC having jurisdiction in relation to the UK designation. As we discussed in our article in July 2025, the Mannheim Local Division accepted jurisdiction and found infringement of both designations, granting the first UPC injunction covering the UK.

The UPC Court of Appeal has now reversed the infringement findings but has also confirmed the court did have jurisdiction in relation to the UK, articulating rules that will govern how the UPC approaches non-UPC designations.

Does the UPCA confine the UPC to its own territory?

Kodak's argument here was textual: Article 34 UPCA provides that UPC decisions cover the territory of those Contracting Member States for which a European patent has effect. Kodak argued this was an implicit limit to the court's jurisdiction.

The Court of Appeal rejected that reading. Article 34 addresses the scope of decisions as a default rule but says nothing about the limits of jurisdiction. Article 3(c) UPCA, which brings European patents validated outside the UPC territory within "matter governed by" the Agreement, pointed firmly in the other direction. The provision Kodak relied on was about what decisions cover, not about what the court can hear.

The UPC's jurisdiction derived from the Brussels Recast Regulation (the EU regulation governing cross-border jurisdiction between Member State courts). Under Article 4 of Brussels Recast, defendants domiciled in a Member State should be sued there. All three Kodak entities were domiciled in Germany, which resolved that basic jurisdictional question. Under the "Owusu principle", a court with jurisdiction cannot decline it on the ground that a non-Member State court would be more appropriate (known as "forum non conveniens"). That principle has been embedded in EU private international law since 2005, and the Court of Appeal applied it in this case.

Meanwhile, the CJEU's February 2025 ruling in BSH Hausgeräte v Electrolux reinforced this approach in the patent context: Article 24(4) of the Brussels Recast Regulation, which confers exclusive jurisdiction on the courts of the granting state for patent validity proceedings, did not apply to third-state courts such as those of the UK post-Brexit. No competing exclusive jurisdiction existed that could displace the UPC.

Limits to exercising jurisdiction

While confirming it had jurisdiction, however, the Court of Appeal drew a clear distinction between the existence of that jurisdiction and its exercise. A court hearing infringement of a patent validated in another country must apply both the law of that country and international law principles, including comity. On that basis, the Court of Appeal set out a structured framework covering the likely scenarios where non-UPC designations are involved and validity is disputed, as follows.

Joint tortfeasorship

The judgment also confirms that UPC jurisdiction extends to joint tortfeasor claims. Following its October 2025 ruling in Belkin v Philips, the Court of Appeal held that an "infringer" under the UPCA includes a person to whom a third party's infringing acts are attributable because they acted as an accessory.

The facts of this case show where the limits lie. Fujifilm argued that Kodak Graphic, though not the primary infringer, was liable as a joint tortfeasor for UK infringement. The court accepted jurisdiction but dismissed the claim on the substance. Under UK law, joint tortfeasor liability requires a common design and knowledge of the essential facts making the relevant acts wrongful. Fujifilm had not shown that any Kodak entity possessed the necessary technical knowledge before Fujifilm itself raised the allegation. Corporate control of a manufacturer was not, on its own, sufficient.

What does this decision mean for UPC strategy?

For patentees with European patents extending into non-UPC territories, the conditional order route opens a path to pan-European relief through a single UPC action, without waiting for national proceedings to conclude. The condition subsequent is a real constraint, but the trade-off is clear: timely and geographically broad relief from the UPC, with national courts retaining the final word on the validity of their own patents.

For defendants, the possibility of avoiding the UPC's jurisdiction on the basis of "forum non conveniens" has been shut down. Where the defendant is EU-domiciled, the UPC will hear the case. The more productive line of defence lies in challenging the substance: validity of the non-UPC designation, the UPC-territory patent itself, and, as this case shows, whether the right defendant has actually been identified and sued at all.

Fujifilm v Kodak is a significant marker in the UPC's development. The Court of Appeal has read the jurisdictional framework broadly but carefully, providing some limits to the exercise of that jurisdiction.

In a thoughtful discussion, Mary reflected on her career in football, the importance of teamwork and encouragement, and the role sport can play in building confidence and resilience. She also spoke about living with MS, sharing how her diagnosis shaped her outlook and the way she approaches challenge and change.

The session gave us the chance to hear a thoughtful and personal perspective on resilience, change and the importance of encouragement.

This recognition reflects the pace and ambition of a team that continues to grow in the scale, complexity and profile of the work we are delivering for clients.

In addition, Ian Ginbey has maintained his 3rd place ranking among the UK’s leading planning solicitors.

The survey, which is peer‑led and independently assessed, is a strong endorsement from across the development and planning community.

See the survey on the Planning Resource website.

Jon said questions remained about “how long Mr Edwards’ behaviour was known about, and by whom, both at the ICO and in government”.

He said: “If it was known about, why and how was it tolerated, and might it have impacted on decisions made by him and those working for him?” Baines added that he intended to write to Dame Chi Onwurah, chair of the science, innovation and technology committee, to suggest that MPs examine the matter.

He said the committee had previously been given reassurance by Paul Arnold, the deputy commissioner and chief executive, about governance and leadership arrangements at the ICO during Edwards’ absence, but added that “a great deal has come to light since then that needs proper scrutiny”.

Read the article in full (subscription required)

Katy commented that the outgoing Prime Minister Keir Starmer’s tenure had seen a “failure to understand the consequences of his policies on businesses.

“Two years ago felt different. Labour did court the business community, but now the general sense among my clients – and financial services more widely – is that they were not supported, and that there was a failure to understand the full consequences of certain taxation policies on businesses.”

Katy also said the business community is yet to be fully convinced by Burnham’s vision of ‘Manchester-ism’.

“There is still a nervousness about what is to come,’ she said.

“As mayor of Manchester, there was a sense Burnham was trying to embrace and understand the importance of capital influx into the region. But at the Makerfield election he focused on local issues – and kept his powder dry as to his policies as a PM, so his approach to the business community more broadly is still unclear – and a lack of certainty is never good for the market.”

Read the full article (subscription required)

In brief

• A Premier League Independent Disciplinary Commission has ruled in Burnley v Everton that Everton must pay Burnley £26 million in damages plus £9 million in interest, finding that Everton's breach of the Profit and Sustainability Rules (PSR) materially contributed to Burnley's relegation at the end of the 2021/22 season.
• The decision is significant because it establishes that financial rule breaches can give rise not only to sporting sanctions (such as points deductions) imposed by the governing body, but also to private compensation claims brought by competitor clubs who can demonstrate they suffered identifiable loss as a result of the breach.
• The ruling carries wider implications for clubs, investors, insurers, and governing bodies, as it increases the financial exposure associated with regulatory non-compliance and suggests that breaches of financial rules may increasingly attract substantial liability, though its ultimate effect depends on the outcome of Everton's appeal.

Background

The claim arose from Everton's breach of the Premier League's PSR framework at the end of the 2022/23 season. Everton was subsequently sanctioned by the Premier League for exceeding the permitted financial thresholds but, because of delays in hearing the case, the points deduction imposed in relation to the club's financial misconduct were only applied in the 2023/24 season. Burnley contended that Everton's overspending had enabled it to obtain a sporting advantage during the 2021/22 season and that, absent that breach, Everton would have been relegated instead of Burnley. Burnley therefore sought compensation for the financial losses flowing from its relegation, including the loss of Premier League revenues and associated commercial opportunities. The central issue before the Commission was one of causation. Burnley was required to establish that Everton's breach was not merely a technical regulatory infringement but that it had materially contributed to Burnley's relegation and the losses that followed.

The Commission's findings

The Commission accepted Burnley's case. Applying the civil standard of proof, it concluded that, on the balance of probabilities, Burnley would have avoided relegation had Everton not committed the relevant PSR breach. Having found a sufficient causal connection between Everton's regulatory breach and Burnley's losses, the Commission awarded Burnley damages of £26 million together with interest. Everton has publicly announced that it has appealed the decision and has criticised the Commission's conclusions on both factual and legal grounds. The appeal is expected to be heard later this year. Nevertheless, unless overturned on appeal, the decision represents a material development in the legal consequences that may follow breaches of football's financial regulations.

Why the decision matters

The significance of the decision extends beyond the immediate parties. Historically, breaches of league financial regulations have primarily been addressed through sanctions imposed by the relevant governing body, such as points deductions, fines, transfer restrictions or other sporting penalties. The Everton decision demonstrates that regulatory sanctions may not be the only consequence. A club that can establish that it has suffered identifiable loss as a result of another club's breach may also be able to pursue a private claim for compensation.

The decision therefore introduces an additional layer of risk for clubs operating close to the limits of the regulatory framework. Financial rule breaches may now expose clubs not only to action by competition organisers but also to potentially substantial claims from competitors who can demonstrate loss arising from those breaches. That is particularly the case given that most financial breaches cover multiple seasons, with any sporting sanction only applied in a following season. That means that even where a sporting sanction is applied as punishment by regulators, that is unlikely to be an adequate remedy for a club that has suffered as a result of the breach when it occurred.

The case is also notable because it reflects a willingness by football tribunals to engage with complex questions of sporting causation. Determining whether a particular regulatory breach altered the outcome of an entire football season is inherently difficult. The Commission's willingness to conclude that causation could be established on the balance of probabilities in this case may encourage similarly affected clubs to consider whether compensation claims are available in future cases.

Wider implications

The longer-term implications of the decision remain uncertain and will depend in part on the outcome of Everton's appeal. However, the ruling is likely to be closely examined by clubs, investors, insurers and governing bodies alike. For clubs, the decision increases the potential financial exposure associated with regulatory breaches. For investors and owners, it highlights the possibility that liabilities arising from historic compliance failures may continue long after the underlying conduct occurred. For governing bodies, it raises important questions about the interaction between regulatory enforcement mechanisms and private compensation claims.

Whatever the outcome of the appeal process, the decision represents a significant development in football regulation. It suggests that breaches of financial rules may increasingly be viewed not only as matters for sporting discipline, but also as conduct capable of giving rise to substantial civil liability where another club can demonstrate that it has suffered loss as a result.

• On 2 August 2026, four categories of obligations relating to transparency for certain AI systems become applicable under Article 50 of the EU AI Act. Each of the obligations apply to different types of AI systems or their outputs, and impose obligations on providers of relevant AI systems, as well as deployers.
• On 10 June 2026, the European Commission published the final version of its Code of Practice on Transparency of AI-Generated Content. The Code is a voluntary tool setting out practical steps that both providers and deployers of in-scope AI systems placed on the market in the EU can take in order to demonstrate compliance with their respective transparency obligations.
• The Code must now be assessed for adequacy by the Commission and the AI Board, but providers and deployers should proceed on the basis that this assessment will be completed before 2 August 2026 with no changes being made.
• Separately, the Commission published draft Guidelines on the implementation of the transparency obligations on 8 May 2026, which were open for stakeholder consultation. Once finalised, the Guidelines will be the primary interpretive document for Article 50 as a whole and will complement the Code.

What are the transparency obligations under the EU AI Act and when do they become applicable?

The rules on transparency in the EU AI Act (found in Article 50) become applicable on 2 August 2026. There are four categories of transparency obligation in Article 50:

Providers and deployers of open-source AI systems still need to ensure compliance with relevant transparency requirements.

There is one potential carve-out on timing in relation to the marking and detection obligation on providers in Article 50(2). The AI Omnibus proposal (discussed in our article: EU AI Act simplified? Unpacking the AI Omnibus Agreement of May 2026 ) proposes a limited transitional period for providers of generative AI systems that were already placed on the EU market or put into service before 2 August 2026, who will have until 2 December 2026 to comply with the marking and detection obligation. However, the other Article 50 obligations will still all take effect on 2 August 2026 without any transition, including for legacy systems. Generative AI systems newly placed on the EU market from 2 August 2026 must also comply with all four transparency categories from that date.

What are the consequences of non-compliance with the EU AI Act transparency obligations?

Non-compliance with Article 50 can attract fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. Compliance with the Article 50 transparency obligations is therefore a significant legal and commercial priority for both providers and deployers operating in the EU.

What is the difference between the Code of Practice and the Guidelines?

The two instruments have a different scope:

• The Code addresses only the transparency obligations in Articles 50(2) and 50(4), i.e., providers' marking and detection obligations, and deployers' deepfake and text labelling obligations.
• In contrast, the draft Guidelines address the full scope of Article 50, including additionally: Article 50(1) (re interactive AI systems) and Article 50(3) (re emotion recognition and biometric categorisation systems). Providers and deployers subject to these obligations must look to the Guidelines, not the Code, for practical guidance.

The Code is voluntary and does not replace the AI Act or the Guidelines. Where a provider or deployer does not sign the Code, they will need to demonstrate compliance with their transparency obligations through other means after 2 August 2026 (or 2 December 2026 for Article 50(2) in the case of legacy systems). Non-signatories will be assessed individually by national market surveillance authorities and will be expected to benchmark their approach against the Code in any event.

Signing the Code will assist providers and deployers to demonstrate compliance with their transparency obligations, and give them the benefit of a streamlined compliance pathway. Signatories will also be able to participate in Signatory Taskforces, to share practices and advance implementation of marking and labelling requirements.

What does the Code say? Section 1 — Providers

Section 1 of the Code focuses on the obligations of providers who develop an AI system capable of generating synthetic audio, image, video or text content (as set out in Article 50(2)). It details four commitments relating to marking of AI-generated content and related detection mechanisms, including through machine-readable methods that are effective, interoperable, robust and reliable.

Whilst the relevant transparency obligations in the EU AI Act do not apply to them, providers of general-purpose AI (GPAI) models and providers of marking and detection solutions may also choose to sign Section 1. This will facilitate compliance by downstream providers of AI systems built on those models and/or using third-party detection mechanisms. The draft Guidelines encourage providers of GPAI models to implement appropriate transparency measures at the model level, even where they do not formally fall within Article 50.

Section 1 contains the following four commitments by providers, and supporting measures:

What does the Code say? Section 2 - Deployers

Section 2 of the Code focuses on the obligations of deployers of generative AI systems, in particular those who use generative AI systems for professional purposes and who are subject to the transparency obligations in Article 50(4) relating to labelling of: (1) deepfakes; and/or (2) AI-generated or manipulated text published with the purpose of informing the public on matters of public interest (which has not undergone human review or editorial control by a natural or legal person holding editorial responsibility for the content).

There are important limits to deployers’ relevant transparency obligations. For example, deepfakes in scope comprise images, audio or video content that are AI-generated or manipulated to resemble existing persons, objects, places, entities or events, and which would falsely appear to a person to be authentic or truthful. The draft Guidelines clarify that the test is whether the subject resembles something that can exist or could have existed in reality. For example, simulated persons or events etc that defy the laws of nature or physics (such as humans flying without mechanical aids, dragons or elephants driving cars) would be considered unrealistic and fall outside the scope of the transparency obligation.

The draft Guidelines also confirm that any intent to deceive by the deployer is irrelevant: the test is whether the content would falsely appear authentic to the audience that may be exposed to the content, including vulnerable groups such as children (where the threshold for deception will be lower).

The transparency obligation is attenuated where deepfake content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme. The draft Guidelines note that this requires that the content's categorisation as artistic etc is neither potentially unclear nor ambiguous. Commercial usages involving AI-generated deepfakes of celebrities, for example, would not fall within the attenuated exception. Importantly, this 'exception' relates only to the form of disclosure; it does not remove the transparency obligation. The AI origin must still be disclosed, but in an appropriate manner that does not hamper the display or enjoyment of the work. This will require a case-by-case assessment of all relevant factors, such as the nature of the work, the audience and context.

The draft Guidelines give as examples of an artistic/fictional work AI-generated special effects in movies such as simulations of actors, de-aging of actors and digital replicas of deceased actors; and AI-generated gaming imagery involving deepfake simulations of existing persons or locations. However, an AI-generated image of a celebrity implying their involvement in an activity, with no fictional, satirical or analogous purpose, would not fall within the category.

Aside from the requirements of the EU AI Act, of course, deployers should consider personality rights, intellectual property, data protection provisions and other appropriate measures (as discussed in our article on deepfake regulation in the UK).

Deployers make four commitments in the Code of Practice as follows:

Analysis on marking and detection obligations

There are some further points to note in relation to providers/deployers' transparency obligations. First, the draft Guidelines recognise an exception from the requirement to mark and detect AI generated outputs in limited cases of "industrial AI applications" and B2B applications. The exception will cover outputs such as engineering drawings, industrial production workflows, and similar content.  However, this exception is narrow and will only apply where two cumulative requirements are met:

• The generated output is strictly technical in nature; and
• It is only intended to be perceived by a limited pre-defined number of natural persons acting in a professional capacity within the provider/deployer's organization. If the output is shared with an external party, such as a customer, supplier or contractor, the full marking obligation will apply.

Article 50(2) also contains certain exceptions to providers' transparency requirements. One relates to assistive functions for standard editing. The draft Guidelines distinguish between editing that is exempt from marking obligations and editing that triggers them:

• Exempt (standard editing): e.g., grammar correction, spellchecking, format conversions, technical compression, noise reduction; minor cropping, rotating or rescaling; minor colour adjustments; limited sharpening; removing red-eye caused by flash photography etc.
• Marking required (substantive alteration): substantial alterations of content including AI-generated translations and summaries; addition or removal of objects; face alteration; converting black-and-white images to colour; creation of composite images or video clips.

Interactive AI systems and emotion recognition/biometric categorisation systems

The Code of Practice does not deal with the two other transparency obligations in Article 50, concerning interactive AI systems and emotion recognition/biometric categorisation systems.

Article 50(1): Interactive AI systems

Providers of AI systems designed to interact directly with natural persons (such as chatbots, AI agents, virtual assistants and AI companions) must inform users that they are interacting with an AI system. This obligation applies from 2 August 2026.

The test is whether it would be obvious to the reasonably well-informed, observant and circumspect natural person that they are directly interacting with an AI system, which will depend upon the nature of the interaction and the composition of the target audience. For example, the draft Guidelines suggest that AI-powered code assistance chatbots available only to professional developers and AI-enabled Non-Playable Characters (NPCs) in video games would meet the obviousness exception. However, AI companion pets, AI systems embedded in immersive environments using realistic avatars, and AI chatbots embedded in online platforms or assistance support tools where users directly interact and receive AI outputs they may perceive as neutral or human generated (including via agentic AI systems) would not.

The draft Guidelines also confirm that certain techniques will not, on their own, satisfy the transparency requirements e.g., disclosures contained only in terms and conditions, machine-readable markings which are not perceivable by users at the point of interaction, unclear or ambiguous signals (e.g., generic references to an "assistant") or technical or capability-based descriptions (e.g., "this system uses LLMs"). Disclosure protocols will therefore need reviewing and updating in advance of 2 August 2026.

Article 50(3): Emotion recognition and biometric categorisation systems

Deployers of emotion recognition and biometric categorisation systems must inform all natural persons exposed to the system’s operation, at the latest at the time of first exposure, unless an exception applies.

Importantly, this obligation covers all biometric categorisation systems, not just those classified as high-risk. The format for providing the disclosure is flexible, provided it is clear and distinguishable and meets applicable accessibility requirements. The example is given of a centrally placed pop-up onboarding message before a computer game is launched indicating that the player's face is recorded, capturing their emotions.

General requirements for all of the transparency requirements

Article 50(5) is a horizontal provision applying to all of the transparency obligations. It requires that disclosures are made to natural persons in a clear and distinguishable manner at the latest at the time of first interaction or exposure and conform to applicable accessibility requirements. The draft Guidelines provide further insight:

• ‘Clear’ means noticeable and easy to understand, including for people with accessibility needs.
• ‘Distinguishable’ means easily identifiable as separate from surrounding content and the environment in which it is presented. Disclosures cannot therefore be hidden in terms and conditions, manuals or layered menus.
• ‘First exposure’ does not focus on just the first viewer but applies to each natural person who encounters the content for the first time. This means, for example, that disclosures in a live broadcast should be made at the beginning of the broadcast and also at later stages.

Interaction with other laws

The transparency provisions in the EU AI Act focus on how content has been created and its artificial origin. Providers and deployers must also, of course, comply with data protection laws, and other regimes, including intellectual property rights and criminal law regimes. The provisions also facilitate effective implementation of the EU's Digital Services Act, as very large online platforms (VLOPs) and very large online search engines (VLOSEs) may make labelling tools available to deployers (who may use them to fulfil their labelling obligations). Further, platforms may remove a non-labelled deepfake under the DSA on the basis that it constitutes 'illegal content'.

Next steps for developers and deployers

To be included in the initial list of signatories to the Code, completed forms must be submitted by 22 July 2026 (6pm CEST). Signatories may sign the entire Code, or just Section 1 (providers), Section 2 (deployers), or both, but cannot sign individual commitments within each Section.

More generally, given the approaching compliance date of 2 August 2026 for the majority of the transparency obligations, providers and deployers should prioritise:

• Scope assessment: Identify all AI systems in use and determine which Article 50 obligations apply.
• Chatbot etc disclosures: Review all customer-facing AI interfaces and consider whether disclosure design changes are required.
• Deepfake and text labelling: Review content creation and publication workflows and implement the required disclosures, including e.g., through adopting the EU icon.
• Emotion recognition or biometric categorisation: identify relevant systems in use and implement the required disclosures, including for systems not classified as high-risk.

How Mishcon can help

If you would like more guidance on transparency obligations under the EU AI Act, please get in touch with a member of our AI team. You can also track developments via our AI resource centre.