Retail horizon scan - July 2026

AI-generated content in advertising

From 2 August 2026, transparency obligations under the EU AI Act (Article 50) apply in the EU to providers and deployers of generative AI systems, including those producing advertising content. Deepfakes and AI-generated or AI-manipulated text published on matters of public interest must be clearly labelled. Users must also be informed when interacting with AI systems such as chatbots. The European Commission published a final Code of Practice on 10 June 2026 to help providers and deployers implement these requirements; signing the Code is voluntary but compliance with Article 50 is mandatory from 2 August 2026 regardless. In the UK, CAP published a guidance note earlier this year confirming that existing advertising codes apply to all AI-generated content on the same basis as human-created content, with particular caution advised around the use of deepfakes in advertising.

Please see our article here and the European Commission's guidelines here.

Digital Fairness Act

The EU is preparing a new Digital Fairness Act (DFA). As of July 2026, the Commission has not yet published a formal legislative proposal. The DFA will tackle unfair commercial practices including dark patterns, influencer marketing, addictive design and targeted advertising. The European Commission launched a public consultation and call for evidence which closed on 24 October 2025. On 19 December 2025, the Commission published a report setting out input to the consultation and call for evidence. The Commission's legislative proposal is expected in Q3 or Q4 2026, following which it will proceed through the European Parliament and Council.

Fraudulent Advertising

Under the Online Safety Act (OSA), in-scope service providers must put in place proportionate systems and processes to prevent fraudulent advertising and take it down when made aware. Ofcom launched a consultation on draft Fraudulent Advertising Codes of Practice on 10 July 2026. The draft codes set out nearly 40 measures for Category 1 and Category 2A services — including major social media and search platforms — covering governance, fraud-indicator assessments, advertising moderation, account integrity and advertising libraries. The consultation closes on 2 October 2026. Ofcom intends to publish its final statement by mid-2027, after which the codes will take effect once approved by Parliament.

Tobacco and Vapes Act

The Tobacco and Vapes Bill received Royal Assent on 29 April 2026, becoming the Tobacco and Vapes Act 2026. The Act bans the advertising and sponsorship of herbal smoking products, cigarette papers, vaping, consumer nicotine products and tobacco products, and gives the Government powers to restrict packaging, branding and in-store displays. The advertising ban is not yet in force: it requires commencement regulations, and the Government has indicated it intends to bring the restrictions into force from 1 June 2027. CAP and BCAP have indicated they are likely to consult on changes to the existing Advertising Codes to reflect the new provisions.

Greenwashing

Please see the ESG section for more information about upcoming developments regarding greenwashing.

Less Healthy Food and Drinks

New rules on TV and online advertising of less healthy food and drink products started on 5 January 2026. Such products are now banned from TV ads between 5.30am to 9.00pm. In addition, there is now a ban on paid-for online advertising for such products (with some limited exceptions). The Advertising Standards Authority (ASA) has published guidance on advertising less healthy products. The ASA issued its first enforcement rulings under the new regime on 15 April 2026, clarifying how the identifiability test applies and confirming that a single identifiable less healthy product in an advertisement is sufficient to constitute a breach. On 26 March 2026, the Government launched a consultation on applying its updated Nutrient Profiling Model to the restrictions, which closed on 17 June 2026; the outcome could widen the range of products caught by the rules.

EU AI Act

The EU AI Act became law in summer 2024, but has had a staggered implementation programme. It applies to any AI output available within the EU, and so will affect UK companies that provide or deploy AI services in the EU. The Digital Omnibus on AI entered into force on 27 July 2026. The obligations on high-risk systems have been deferred: stand-alone Annex III systems (covering areas such as employment, education and credit scoring) now apply from 2 December 2027, and high-risk systems embedded in regulated products from 2 August 2028. However, the Article 50 transparency obligations still apply from 2 August 2026. These include telling users when they are interacting with an AI system (such as a chatbot) and labelling deepfakes and AI-generated or AI-manipulated content published on matters of public interest. Please see our article here for more information. Providers of AI systems that generate synthetic content must ensure that content is marked in a machine-readable format detectable as artificially generated. Systems already on the market before 2 August 2026 have until 2 December 2026 to comply with this marking requirement. Track developments on our AI resource centre.

EU Data Act

Key obligations under the EU Data Act will come into force in 2026, including an obligation for manufacturers to design and manufacture in-scope connected products placed on the EU market after 12 September 2026 (and provide related services) in a manner that allows a user to access the product data and related service data. The Data Act also introduced new rules in September last year regarding EU customers wishing to switch to an alternative cloud provider midway through a subscription and terminate their contracts early. Please see our article here for more information. This may be impacted by the Digital Omnibus Package (see below).

Digital Omnibus Package

The Digital Omnibus on AI is now law — see the EU AI Act entry above for its effect on implementation timelines. The broader Digital Omnibus (covering GDPR, Data Act, cybersecurity and cookie rules) was proposed alongside it in November 2025 and remains in the EU legislative process. Its proposals include a single reporting portal for cybersecurity incidents, targeted simplifications to GDPR compliance obligations, and targeted exemptions to the Data Act's cloud-switching rules for SMEs. Businesses should continue to comply with existing rules while monitoring the progress of this wider package.

Cloud and AI Development Act

The European Commission published its formal proposal for the Cloud and AI Development Act on 3 June 2026. The proposal introduces a sovereignty framework for EU public-sector cloud procurement, with four tiers of assessment criteria based on sensitivity of activity. It also targets tripling EU data centre capacity within five to seven years and supports research and innovation in EU-developed cloud and AI infrastructure. The proposal is in its early stages and will now progress through the standard EU legislative process.

UK AI Regulation

In the UK, there is a non-legislative approach to AI whereby regulators provide guidance based on a set of principles. No standalone AI Bill was included in the May 2026 King's Speech. The Government has confirmed it is not pursuing a cross-sector AI statute at this stage, preferring to use existing regulatory frameworks augmented by sector-specific guidance. The Regulating for Growth Bill, announced in the King's Speech, includes provision for an AI Growth Lab — a programme of regulatory sandboxes allowing new AI products and regulatory reforms to be tested in live market conditions, with a route to make successful changes permanent through secondary legislation. Following the change of Prime Minister on 20 July 2026, the Department for Science, Innovation and Technology was abolished and its functions split across other departments. Kanishka Narayan was appointed as the UK's Minister for Artificial Intelligence and is to attend Cabinet, and a new AI Taskforce has been established in the Cabinet Office. The Government's approach to AI policy under the new leadership should be monitored. Separately, the Government published its statutory report on copyright and AI on 18 March 2026, confirming it will not proceed with legislative reform at this stage (see the IP section).

Late Payments

The Commercial Payments Bill was introduced to Parliament on 19 May 2026. The Bill introduces a 60-day hard cap on payment terms (with some exemptions), makes statutory interest on late payments mandatory, gives the Small Business Commissioner powers to investigate poor payment practices and impose significant fines on persistent late payers, and requires boards of large companies with poor payment records to explain their performance publicly.

New EU rules on communicating software updates

In the EU, new rules will come into force in relation to communicating software updates on 27 September 2026 under the Empowering Consumers for the Green Transition Directive. This includes a ban on withholding the fact a software update will negatively impact the functioning of goods or services and falsely presenting software updates as necessary. Pre-contractual information must also be provided to consumers including telling them how long the producer or provider commits to providing software updates for.

Cybersecurity

Please see the Health & Safety/Product Safety section.

Ransomware payments

The Government is developing legislation to tackle ransomware payments following publication of its consultation response. The proposed framework has three elements: a ban on ransomware payments by public-sector bodies and operators of critical national infrastructure; a payment prevention regime under which all other organisations must notify the Government before making a ransom payment, allowing authorities to check for sanctions breaches and offer guidance; and mandatory incident reporting for all organisations, likely within 72 hours of an attack, though the precise timeframe has not yet been confirmed. A Private Members' Bill on reporting obligations (the Cyber Extortion and Ransomware (Reporting) Bill) has appeared in Parliament. Government legislation giving effect to the fuller package has not yet been introduced, but businesses should review incident-response plans now in anticipation of mandatory reporting obligations and notification requirements that may constrain future payment decisions.

Franchising Case Law

The case of APK Communications Ltd v Vodafone Ltd was heard at a case management conference in March 2026, where a split trial was approved. However, Vodafone settled the claim in July 2026, before the liability issues reached trial, without any admission of liability and on confidential financial terms. The settlement means there is no judgment on whether duties of good faith applied or whether Vodafone's contractual powers were exercised lawfully. An appeal is due to be heard in December 2026 in the case of Ellis v John Benson [2025]; the High Court in this case found implied duties of good faith and fair dealing in 20 one-sided franchise agreements.

Digital Markets Competitions and Consumers Act

Following the Government's consultation response published on 2 April 2026, the subscription contract rules will now come into force in spring 2027. In April 2026, the CMA issued its first financial penalty under the DMCCA — a £4.2 million fine against AA Driving School and BSM Driving School for drip pricing (a mandatory booking fee not included in the headline price shown to consumers). Further enforcement action is expected during the remainder of 2026 based on the CMA's priorities (published in its approach document in April 2025). Its focus for enforcement includes aggressive sales practices that prey on consumers in vulnerable positions, providing information to consumers that is objectively false, banned practices including fake reviews, fees that are hidden until late in the purchase process, and contract terms that are clearly imbalanced and unfair, including those that impose unfair exit charges on consumers. The CMA has published price transparency guidance to help companies comply with the rules.

Dark patterns

In May 2026, the CMA secured a High Court-endorsed settlement with Emma Sleep, which admitted it broke consumer law by using misleading countdown timers and false 'high demand' and 'discount' claims. Emma Sleep has given binding undertakings to stop these practices and implement ongoing compliance monitoring obligations. A separate aspect of the case concerning Emma Sleep's use of 'was/now' reference pricing went to trial on 4 June 2026.

Unfair consumer contract terms

In October 2025, the CMA announced it is planning to update its guidance on unfair consumer contract terms (CMA37) to make it easier to understand. The CMA launched its consultation on 22 January 2026, which closed on 19 March 2026. They published the updated guidance following the consultation on 22 July 2026.

EU Digital Fairness Act

For more information about the DFA, please see the Advertising section.

Withdrawal button

Online retailers in the EU are now required to provide an electronic withdrawal button on their websites and digital platforms for all distance contracts covered by a 14-day right of withdrawal, the obligation having come into force on 19 June 2026. This stems from EU Directive 2023/2673, which amends the Consumer Rights Directive (2011/83/EU) by inserting a new Article 11a. Its aim is to make withdrawing from online contracts as simple as concluding them. The button must be clearly labelled, easily accessible, and available throughout the full 14-day withdrawal period, covering purchases of goods, services, digital content and consumer financial services. Non-EU retailers are also in scope where they direct commercial activities at EU consumers. Where a retailer does not provide a compliant button, the consumer's withdrawal right extends automatically to 12 months and 14 days. Retailers should confirm that their websites and apps include a compliant withdrawal mechanism.

Buy Now Pay Later

The FCA published its final rules for regulating buy now pay later products on 11 February 2026 (PS26/1), with those rules coming into force on 15 July 2026. Under the new framework, short-term, interest-free instalment plans offered at the checkout by third-party lenders are now treated as regulated credit agreements, formally designated as Deferred Payment Credit. BNPL providers must be FCA authorised or operate under a Temporary Permissions Regime. They are required to carry out mandatory affordability and creditworthiness checks before each transaction and to provide clearer pre-contract information on repayment dates and fees. Of particular relevance for retailers: for BNPL agreements entered into from 15 July 2026, consumers gain section 75 Consumer Credit Act 1974 protection for purchases between £100 and £30,000. This makes the BNPL lender jointly and severally liable with the retailer where goods are not delivered or a contract is breached. Retailers should review their BNPL partnerships to confirm these agreements reflect the new regulatory framework.

Digital Markets

In 2025, the CMA designated Apple and Google as having strategic market status (SMS) under the DMCCA in relation to their app store platforms, and Google additionally in relation to search and advertising. On 14 May 2026, the CMA launched its fourth SMS investigation into Microsoft's business software ecosystem, assessing whether Microsoft's position limits customer choice through product bundling and interoperability restrictions, and whether competing AI tools can integrate effectively with its software. A designation decision is expected by February 2027.

The CMA is consulting on "steering" conduct requirements for Apple and Google's mobile platforms (proposed 30 June 2026), which would require both companies to allow UK app developers to direct customers to alternative payment options. The consultation closes 28 July 2026. In relation to Google’s search SMS designation, the CMA has imposed conduct requirements in tranches, including a Publisher requirement (3 June 2026) and Fair Ranking and Data Portability requirements (17 June 2026). Further requirements, including a User Choice requirement, remain outstanding.

CMA

In October 2025, HM Treasury published an update to its regulatory action plan, setting out the Government's strategic steer to the CMA on supporting economic growth. In March 2026, the CMA published its Annual Plan 2026–2027, with priorities including the 4Ps framework, targeting anti-competitive conduct in key markets and supporting SMEs. In January 2026, the Government consulted on competition reform, including replacing the Phase II independent expert panel with CMA board sub-committees. The King's Speech on 13 May 2026 confirmed the Government's intention to introduce a Competition Reform Bill.

Businesses should monitor the Bill’s progress through the 2026–27 parliamentary session and assess how proposed changes to Phase II decision-making may affect their deal planning.

Merger control

In October 2025, the CMA published draft revised merger remedies guidance, taking a more flexible approach to behavioural remedies and incorporating the 4Ps framework; final guidance followed on 19 December 2025. In January 2026, the CMA launched a review of merger efficiency arguments, followed by a consultation on draft revised merger efficiencies guidance on 3 June 2026. Key changes include rivalry-enhancing efficiencies assessed as part of the overall competitive impact rather than after a finding of harm, greater recognition of dynamic efficiencies, and a broader evidence base. The consultation closed on 1 July 2026, with final guidance expected later in 2026.

Once finalised, the guidance will replace paragraphs 8.2 to 8.27 of the Merger Assessment Guidelines; merging parties should engage with the revised framework, particularly in relation to dynamic efficiencies.

Labour markets

Anticompetitive behaviour in labour markets is a growing global focus. In September 2025, the CMA published guidance confirming that no-poaching and wage-fixing agreements constitute anticompetitive conduct, along with examples of sensitive information exchanges and practical compliance steps. In March 2025, the CMA issued its first labour markets infringement decision, fining the BBC, ITV, BT and IMG over £4.2 million for sharing sensitive pay information about freelance workers. This reflects a broader international shift — the European Commission imposed €329 million in fines on Delivery Hero and Glovo for no-poach infringements in June 2025.

The CMA has signalled it will publish further guidance for employers; businesses — particularly in retail, hospitality and logistics — should review their pay-setting and recruitment arrangements to ensure compliance.

Companies House reform 

The Economic Crime and Corporate Transparency Act 2023 (ECCTA) has introduced a number of company law reform measures, which are being introduced in stages. Compulsory ID verification for new directors of UK companies (and overseas companies with UK branches), LLP members and people with significant control (PSCs) who are individuals came into force on 18 November 2025; the ongoing transitional deadlines for existing directors, LLP members and PSCs depend on the positions they hold. ID verification is expected to be expanded to apply to relevant officers of certain corporate PSCs ("Relevant Legal Entities") and corporate general partners of limited partnerships.

By no earlier than November 2026, ECCTA will require that any individual delivering documents to Companies House, either on their own behalf or on behalf of another, will need to have their identity verified, unless they are an employee of an Authorised Corporate Service Provider (ACSP). It is expected that a prohibition on the use of corporate directors will be introduced, subject to certain exemptions. Limited partnership law will be reformed, requiring more information to be submitted to Companies House. For an overview of upcoming Companies House reform, including links to more information on the ID verification process, please see our briefing: Companies House reform: what has changed and what is still to come?

PISCES

Interest has been increasing in the Private Intermittent Securities and Capital Exchange System (PISCES), a framework for a new type of trading platform that enables intermittent trading of private company shares. Institutional investors, employees of participating companies and high net worth or sophisticated investors will be able to trade shares. Four PISCES platform operators had been approved by the FCA as of July 2026: the London Stock Exchange, JP Jenkins, Asset Match and Vestd. The first trade under the PISCES framework took place in March 2026. It is hoped that PISCES platforms will be used as a way to provide liquidity in the shares of later-stage private companies and may act as a bridge between private and public markets for those companies ultimately looking to an IPO. For the latest news on PISCES, please see our series of website briefings, the most recent of which is here: PISCES takes flight: the first trades on the UK's new private company trading platforms.

UK corporate re-domiciliation

Re-domiciliation enables a company incorporated in another jurisdiction to change its place of incorporation while maintaining its legal identity as a corporate body. Where re-domiciliation is not possible, as is currently the case in the UK, a business would need to incorporate a new company in the UK and then transfer its business and operations to that new entity. Following consultation and expert panel recommendations, the Government has confirmed its intention to implement an inward only re-domiciliation regime, to be administered by Companies House. For companies choosing to relocate to the UK, re-domiciliation gives maximum continuity over their business operations, because the business continues in its existing form in the existing body corporate. Implementation of a UK corporate re-domiciliation regime will require primary legislation to make the required changes to company and tax legislation. The Government plans to introduce legislation as soon as possible “when parliamentary time allows.” The Government's consultation on implementation closed on 19 June 2026. For more details and issues to consider, please see our briefing: UK corporate re-domiciliation regime: Government consults on implementation.

Data (Use and Access) Act 

The principal data protection provisions of the Data (Use and Access) Act 2025 (DUAA) came into force on 5 February 2026, including the new recognised legitimate interests grounds, revised automated decision-making rules and simplified international transfers. The maximum fine for PECR breaches also increased from £500,000 to £17.5 million or 4% of global annual turnover, whichever is higher. A new requirement for controllers to acknowledge data protection complaints within 30 days came into force on 19 June 2026. The Act amends the UK GDPR and Data Protection Act 2018 (rather than being a standalone statute). The ICO has published guidance on the changes. The DUAA also introduced major amendments to the Data Protection Act 2018 when it comes to the regulatory regime. In the coming months, the Information Commissioner’s Office will be replaced by an Information Commission. It had been planned that John Edwards, until recently the Commissioner, would become Chair of the new Commission. However he resigned from his role in June, following serious concerns about his workplace conduct. This means that a new Chair will need to be recruited. It will be important to monitor whether this leads to any changes in regulatory and enforcement focus.

Direct Marketing Code of Practice

The ICO published updated direct marketing guidance in April 2026, reflecting changes under the Data (Use and Access) Act 2025. The statutory direct marketing code of practice, required since 2018, remains unpublished.

ICO guidance on automated decision-making in recruitment

On 31 March 2026, the ICO published a report on the use of automated decision-making (ADM) in recruitment alongside a consultation on updated ADM and profiling guidance. Drawing on evidence from more than 30 employers, the ICO's key finding was that many organisations using AI hiring tools believed those tools were supporting human decisions when, in practice, they were making solely automated decisions with no meaningful human involvement. The consultation closed on 29 May 2026 and final guidance is expected in summer 2026. Employers using AI for CV screening, shortlisting or candidate ranking should treat the report as a signal that enforcement in this area is increasing. The Government is also currently consulting on proposals to support the fair, transparent and responsible use of workplace monitoring technologies.

Beliefs, and single-sex services

Employees continue to assert political, gender-critical and other protected beliefs in the workplace. In the context of the ongoing transgender/gender-critical debate, following the Supreme Court's ruling that 'man' and 'woman' in discrimination law refer to biological sex only, we are starting to see employment tribunal case law on the provision of workplace single-sex facilities such as toilets and changing rooms.  The EHRC's interim guidance on single-sex spaces was upheld by the High Court in February 2026. On 21 May 2026, the EHRC laid an updated Code of Practice for services, public functions and associations before Parliament — this Code covers service providers rather than employers. An updated EHRC Employment Code of Practice is expected in due course but no timetable has been confirmed. Employers should continue to monitor developments as case law in this area evolves.

Employment Rights Act

The Employment Rights Act represents the most significant overhaul of UK employment law in a generation. Key provisions include:

• Unfair dismissal: Employees will acquire protection after just 6 months rather than 2 years, and the cap on compensation will be completely removed. These changes are due to take effect from January 2027. Employers should ensure their probationary review processes are proactive and robust, review their recruitment practices to reduce the likelihood of early-stage dismissals, and train managers on the steps required to ensure that a fair process is followed prior to making any decision to dismiss.
• Zero hours and shift workers: Zero hours and shift workers: New rights to guaranteed hours, reasonable shift notice and compensation for late cancellations of shifts will impact flexible scheduling practices and operational costs. In particular, employers who rely on zero hours workers and 'low hours' workers (the exact definition of what constitutes a 'low hours' worker is yet to be decided) will be obliged to offer guaranteed hours contracts to those who regularly work in excess of their contracted hours.  These rights are expected to come into force during 2027. Employers should identify the scope of the impact on their workforce and configure their systems to comply with the new requirements.
• Fire and rehire restrictions: Automatic unfair dismissal for restricted contract variations (being variations to core provisions such as pay) will materially affect workforce restructuring and outsourcing policies. Employers may wish to consider accelerating any planned restructuring before the new provisions come into force, now confirmed for January 2027.
• Collective redundancies: Maximum awards for collective consultation breaches doubled to 180 days' gross pay per affected employee from 6 April 2026. New rules are being formulated with regard to the consultation obligations of large scale organisation-wide redundancy exercises across multiple 'establishments', but these have yet to be finalised. Employers should review redundancy processes to ensure they are robust, factor increased liability exposure into restructuring budgets, and carefully track the number of dismissals across their organisation.
• Trade unions: The Act resets the power balance between unions and employers, heralding a significant increase in union involvement in the workplace over the next several years. It will be considerably easier for unions to seek statutory recognition and to take industrial action, and employers will be expected to co-operate with the marketing efforts of unions prior to recognition.
• Time limits: Employment Tribunal claim time limits will double to six months, which will lead to an increase in the number of claims made and prolonging the uncertainty for employers of whether staff will litigate against them. Employers should prepare by reviewing their document retention policies in advance of this change. This will take effect from 1 October 2026.

Phased implementation this year and into 2027 requires careful planning and preparation. Please visit our Employment Rights Act Hub for more information.

Preventing harassment

Employers are currently required to take proactive "reasonable steps" to prevent sexual harassment in the workplace. The Employment Rights Act will strengthen this obligation to take "all reasonable steps" from October 2026. It will also, from October 2026, introduce direct employer liability for sexual and other harassment of employees by customers, suppliers and other third parties. In addition, NDAs preventing employees from alleging or disclosing harassment or discrimination will be void from some time in 2027 (exact date to be confirmed).

Mishcon de Reya's Employment team offers a training solution to assist employers in equipping their workforce to deal with harassment issues effectively. For more information, please contact Will Winch or visit our Duty to Prevent Sexual Harassment in the Workplace Hub.

Non-compete clauses

The Government ran a fresh review of non-compete clauses in employment contracts.  The review explored several potential models, including an outright ban, a ban below a salary threshold, statutory duration limits, and a hybrid model. The Government's concerns relate to the widespread use of non-compete clauses, their impact on competition and innovation, and their potential to inhibit labour mobility and entrepreneurship. The consultation closed in February 2026 and the Government's response is awaited.  We discuss the options in our article on the Government's review.

Draft Equality (Race and Disabilities) Bill

In March 2026, the Government published its response to the consultation on mandatory ethnicity and disability pay gap reporting, including indicative draft clauses. The draft Bill has not yet been published. The Bill is expected to introduce mandatory ethnicity and disability pay reporting for employers with 250+ employees as well as ethnicity and disability equal pay rights that mirror the current (somewhat cumbersome) equal pay regime.

Sustainable products

In the EU, new rules under the Right to Repair Directive will come into force on 31 July 2026, whereby products will need to meet new repairability requirements and processes for product warranties may need to be reviewed.

Under the Ecodesign for Sustainable Products Regulation, the ban on the destruction of unsold apparel, clothing accessories and footwear took effect on 19 July 2026 for large enterprises (medium-sized enterprises must comply by 19 July 2030). New secondary legislation under the Ecodesign for Sustainable Products Regulation is expected soon in relation to the product priorities identified last year, including textiles (by 2027) and furniture (by 2028).

New rules also come into force under the Empowering Consumers for the Green Transition Directive by 27 September 2026 whereby consumers must be given pre-contract information about the sustainability of the product. The EU has also announced plans to introduce a new Circular Economy Act in 2026 to address e-waste and measures regarding the single market for waste, secondary raw materials and their use in products. In the UK, the Product Regulation and Metrology Act paves the way for regulations similar to the EU in respect of reducing or mitigating products' environmental impacts. Also on 27 July 2026, the UK Government opened a call for evidence seeking views on "digital product records" (DPRs) and how the UK should approach them (e.g. Digital Product Passports), the call for evidence closes on 21 September 2026.

Packaging

In the EU, the Packaging and Packaging Waste Regulation will repeal and replace the Packaging Waste Directive on 12 August 2026. This will reduce packaging waste by setting binding re-use targets, restricting certain types of single-use packaging, and requiring economic operators to minimise packaging.

Greenwashing

In the EU, new rules on greenwashing under the Empowering Consumers for the Green Transition Directive will start on 27 September 2026. This includes a ban on unsubstantiated generic environmental claims (such as "environmentally friendly", "eco-friendly", "green", "biodegradable" and "carbon friendly"), claims based on greenhouse gas offsetting, overly-wide environmental claims (for example about an entire product when it only concerns an aspect) and misleading sustainability labels.  Although not formally withdrawn, the Green Claims Directive, which proposed to regulate the substantiation and communication of green claims, remains politically stalled.

In the UK, the ASA and CMA have continued to focus on greenwashing. In January 2026, the CMA published new guidance on making green claims across the supply chain, and we reported on ASA rulings about three fashion retailers' ads in our article here. Companies should note that, under the Digital Markets, Competition and Consumers Act, the CMA is empowered to fine companies up to 10 per cent of global turnover for breaches of consumer law, including misleading green claims. The failure to prevent fraud offence (under the Economic Crime and Corporate Transparency Act) also means that companies could now be held criminally liable for greenwashing, unless they can demonstrate reasonable procedures to prevent misleading claims and statements.

Sustainability, due diligence and disclosure

In the EU:

• Under the Corporate Sustainability Reporting Directive (as amended by the EU Omnibus I Directive), EU undertakings and non-EU issuers with more than 1,000 employees and €450 million annual turnover must report in line with revised standards from 2028, covering financial years starting on or after 1 January 2027. Non-EU ultimate parent companies of groups that exceed €450 million annual turnover in the EU, and which have an EU subsidiary/branch with net turnover of more than €200 million, must report from 2029, on financial years starting on or after 1 January 2028.
• Under the Corporate Sustainability Due Diligence Directive (as amended by the EU Omnibus I Directive), in-scope companies must comply with due diligence obligations by 26 July 2029 and publish required disclosures by 1 January 2030. This includes: EU undertakings with more than 5,000 employees and annual turnover of over €1.5 billion; non-EU undertakings exceeding €1.5 billion turnover in the EU; and undertakings with franchising or licensing agreements in the EU, where turnover exceeds €275 million and royalties are more than €75 million.
• Application dates left unchanged by a simplification review, the Deforestation Free Products Regulation (as amended in December 2025) will apply from 30 December 2026 for large/medium-sized operators and from 30 June 2027 for micro/small operators. Only large and medium-sized "primary operators" (i.e., those placing regulated commodities/derived products on the EU market for the first time) remain obligated to carry out full due diligence.
• Applicable from December 2027, the Forced Labour Products Regulation prohibits products made with forced labour being imported into/sold in/exported from the EU market.

In the UK:

• On 25 February 2026, the Government published the final UK Sustainability Reporting Standards (UK SRS S1 and S2) for voluntary use, closely aligned to ISSB standards. The FCA has consulted on proposed amendments to UK Listing Rules, which would require listed companies to report in line with UK SRS. Separately, the Government is expected to launch a consultation later this year on equivalent changes to the UK Companies Act, which would similarly affect large private companies.
• The Government has also consulted on requiring UK-regulated financial institutions and large companies to develop and implement credible transition plans, aligned with the 1.5°C goal of the Paris Agreement. It is yet to publish its response.
• The Government is considering legislative options to strengthen the Modern Slavery regime, including introduction of mandatory human rights and environmental due diligence measures, and a new "failure to prevent" obligation in relation to forced labour.
• On 23 June 2026, the Government announced its intention to move forward with its own due diligence regime in relation to forest risk commodities, aiming to deliver the necessary secondary legislation in 2027. Compared to the regime first promised in the Environment Act 2021, a new policy proposal indicates closer alignment with the EU Deforestation Free Products Regulation and a significant lowering of turnover thresholds (from £50 million to £1 million). Companies that have previously considered themselves out of scope of a future FRC regime may need to reassess.

Product safety

In the UK, a new Product Regulation and Metrology Act became law in July 2025. This will reform the UK's product safety regime. It is framework legislation that will allow the Government to make secondary legislation introducing product requirements (for example, how a product is made and marketed). Likely areas of focus for upcoming secondary legislation include tackling the sale of unsafe products through online marketplaces.

In the EU, in spring 2025 the European Commission carried out its first product safety sweep under the General Product Safety Regulation and more are expected this year, with a focus on the sale of unsafe products through online marketplaces. The EU is also replacing the Machinery Directive with the Machinery Products Regulation from January 2027 with revisions to address risks from emerging digital technologies.

Following its 2025 call for evidence on machinery safety legislation, the UK Government has confirmed it will update the Supply of Machinery (Safety) Regulations 2008 to introduce similar measures to the EU Machinery Regulation.

Product liability

The EU's Revised Product Liability Directive starts to apply from 9 December 2026 and companies should start to prepare now. It extends the existing product liability regime to capture emerging digital technologies (including software), contains broader responsibilities and potential liabilities, and makes it easier for consumers to bring claims for damages caused by defective products.

In the UK, last year the Law Commission announced a review of the UK product liability regime, also in light of emerging digital technologies and a consultation paper on this is expected in the second half of 2026.

Cybersecurity

Cybersecurity rules are being introduced to regulate products which connect to the internet. Under the EU's Cyber Resilience Act, vulnerability and incident reporting obligations under Article 14 apply from 11 September 2026, with full product requirements applying from 11 December 2027 (this is the EU's answer to the UK PSTIA, which seeks to impose minimum cyber standards on IoT devices). The UK may extend the UK PSTIA to the regulation of B2B connected devices to align with the EU's Cyber Resilience Act.

The UK Government introduced the Cyber Security and Resilience Bill to Parliament for its first reading on 12 November 2025. The Bill completed all its Commons stages in June 2026 and entered the House of Lords on 17 June 2026, with Lords second reading taking place on 14 July 2026. It will focus on the cybersecurity of digital services as opposed to products. It will extend the existing Network and Information Systems (NIS) Regulations 2018 to data centres, critical supply chains and IT managed services. For more information about cybersecurity in relation to the Digital Omnibus Package, please see the Commercial and Technology section. We may also see proposed legislation this year on the regulation of ransomware payments.

Crime and Policing Act 2026

The Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Many provisions came into force in June 2026, with further measures to follow as additional commencement orders are issued. It creates an offence for assaulting a retail worker to protect staff, measure the scale of the problem and drive down retail crime. The offence carries a maximum of six months' imprisonment and/or an unlimited fine. The new law also removes the £200 threshold for shop theft, so all theft can be prosecuted as a standard criminal offence.

Martyn's Law

The Terrorism (Protection of Premises) Act 2025 (aka Martyn's Law), which seeks to ensure and improve the safety and security of public venues, received Royal Assent on 3 April 2025. The purpose of Martyn's Law (named in memory of Martyn Hett, one of the victims of the 2017 Manchester Arena bombing) is to ensure that venues and events are better prepared to respond to terrorist attacks by requiring those responsible to assess risks and implement appropriate security measures. It has not yet come into force, as there is a planned implementation period of at least 24 months, giving venues and event organisers time to understand and meet their new obligations. You can watch our webinar on this here. On 17 July the Government published guidance on the new law.

Right to work obligations are expanding from 1 October 2026

From 1 October 2026, right to work (RTW) obligations will be expanded to go beyond the traditional employer-employee relationship. The definition of "employer" for RTW purposes will require businesses to carry out RTW checks not just for direct employees, but also for workers engaged:

• under a worker's contract (including casual and zero-hours arrangements);
• as individual sub-contractors; and
• through an online matching service (i.e. platforms that keep a register of service providers and match them with clients or customers for a fee or commission).

Businesses with complex supply chains, and those that rely on non-employee workers and subcontractors are likely to be particularly exposed.

We recommend taking the following steps as soon as possible before 1 October 2026:

• Map your workforce and supply chains: identify which workers and arrangements will fall within the new rules.
• Review and consider updating your contracts: ensure agreements with suppliers, sub-contractors and agencies include the necessary provisions to satisfy the prescribed requirements.
• Review your RTW processes and record-keeping: ensure checks cover all in-scope workers, are carried out correctly, and that records are retained as evidence of compliance.
• Training: ensure HR teams and those responsible for engaging workers understand the new requirements and how to identify which arrangements are in scope and who RTW checks should be completed for.
• Seek legal advice: The new provisions are detailed and complex and legal advice should be sought on how they apply to you and your business.

Other key immigration changes

Earlier this year, the Home Office consulted on proposals to significantly transform the requirements for ILR. The key proposals are:

• Doubling the standard timeline to ILR from five to 10 years (which can be extended or reduced depending on individual circumstances).
• Introducing new expedited pathways to ILR for high-earners and top talent.
• Effectively abolishing the 10-year long residence route to ILR.
• Introducing requirements for certain dependants to meet strict financial criteria. This could have unforeseen knock-on implications for children's ability to qualify for ILR.

Many MPs and stakeholders have spoken out against various aspects of the proposals.  It remains to be seen how the new Labour leadership will interact with the proposals and the extent to which they will be brought into force. It is currently expected that any changes will come into force from the autumn, though the detail remains to be seen.  

Other key immigration changes

• English language requirement: From 8 January 2026, the minimum English language requirement for Skilled Worker, High Potential Individual, and Scale-up visas has risen from B1 to B2 level. This change applies to new applicants, rather than existing visa holders. From 26 March 2027, the B2 standard will also apply to settlement (ILR) applications.
• Graduate visa: From 1 January 2027, the standard duration of the Graduate visa will be reduced to 18 months. Applications submitted before this date should continue to receive two years of leave. PhD graduates will remain eligible for three years of leave.
• Salary compliance: From 8 April 2026, the Home Office assesses Skilled Worker salary compliance on a per-pay-period basis (which would ordinarily be monthly pay) rather than by reference to annual salary alone. Sponsors should review their payroll arrangements to ensure each pay period meets the required threshold.

COVID-19 

The ongoing litigation regarding business interruption insurance claims arising out of COVID-19 closures continues, although the limitation deadline has now passed for many businesses. The latest major development was the Supreme Court's confirmation in Gatwick Investment Ltd v Liberty Mutual Insurance Europe SE [2026] UKSC 14 that furlough payments made under the Coronavirus Job Retention Scheme reduced sums payable by insurers.  Read more here: Supreme Court rules on the impact of furlough payments on COVID-19 business interruption insurance claims

Litigation funding 

In December 2025, the Government confirmed its intention to introduce legislation "as soon as Parliamentary time allows" to reverse the Supreme Court's 2023 decision in PACCAR and to implement regulation of third-party litigation funding agreements. Once these changes had been implemented the Government said it would consider the wider litigation funding reforms proposed by the Civil Justice Council. However, the proposals were not referenced in the King's Speech and PACCAR remains in force. We discussed the Government's announcement in our article here: PACCAR reversal: Government confirms intention to introduce new legislation.

GenAI & IP

In March 2026, the Government published its long-awaited Report on Copyright and Artificial Intelligence, together with an economic impact assessment, following its consultation issued at the end of 2024.

The Government confirmed that it will not introduce copyright reform at this stage, and stepped back from its previously stated preference to allow scraping of copyright works for AI training with a rights-holder opt-out. For now, therefore, existing copyright laws continue to apply.

The Government intends now to undertake further research in various areas. It will publish a consultation on digital replicas (deepfakes) in summer 2026, and will publish an interim report on labelling of AI-generated content in autumn 2026. As noted in the Commercial and Technology section, the EU AI Act's transparency rules e.g. relating to labelling of deepfakes and other certain AI-generated content come into effect on 2 August 2026.

Meanwhile, GenAI cases continue to come before the courts (you can track them in our GenAI and copyright tracker and sign up to receive alerts). Most of the 130+ cases are taking place in the US. In the UK, following the High Court decision rejecting Getty Images' claim for copyright infringement against Stability AI, Getty Images' appeal will be heard in November 2026. The Court of Appeal's decision should provide useful guidance on issues relating to both training and use of GenAI models. Decisions are also anticipated in Germany (Gema v Suno, re the music generator tool) and the Court of Justice of the European Union (Like Company v Google re snippets).

Potential removal of copyright protection for computer-generated works

The Government's March 2026 Report on Copyright and Artificial Intelligence indicated that it intends to remove the existing copyright protection for computer-generated works under section 9(3) of the Copyright, Designs and Patents Act 1988.

Currently, where a work is generated by a computer with no human author, copyright subsists for 50 years and is attributed to the person who made the arrangements for the work's creation. The UK is one of only a small number of countries which provides this form of protection.

The Government has concluded that this provision is unclear in the context of authorial works and has no economic benefit, and has formed the provisional view that the protection should be removed (a final decision is still to be made and the Government will continue to monitor the position before acting). Even if the Government takes the step of removal, AI-assisted works that are created with meaningful human creative contribution may still be protected by copyright, as will AI-generated entrepreneurial works, such as sound recordings. Businesses generating content using AI tools should be aware that outputs with no meaningful human authorship may, in future, attract no copyright protection.

As part of its consideration of potential reforms to design law, the Government may also remove protection for computer-generated designs (see below re design reform).

Design law and practice reform: UK

In 2025, the UK Intellectual Property Office (UKIPO) launched a major consultation on the UK's design law framework. The consultation focuses on measures to improve registration quality, particularly in the face of a perceived increase in abusive registrations (often used to extract takedowns of legitimate designs from online platforms). It also addresses digital-age challenges including clarifying the scope of design protection for graphical user interfaces and animated designs, and proposing to remove protection for computer-generated designs without human authors. Further issues discussed in the consultation include potential simplification of the framework for protecting unregistered designs, the complex overlap with copyright, and the rules around first disclosure of unregistered designs (a subject made particularly complex post-Brexit).

The Government's response to the consultation has been delayed and is now not expected before autumn 2026. Design-led businesses should note the potential for divergence following the EU design reform package (see below).

In the meantime, the UKIPO has issued a Designs Practice Notice relating to digital designs, which clarifies and simplifies the approach to registering as designs graphic symbols and icons, graphical user interfaces, and animated or dynamic designs.

Design law and practice reform: EU

On 1 May 2025, Phase 1 of revisions to EU design law and practice took effect, including changes in terminology and definitions, new fees and simplified processes. Phase II changes came into force on 1 July 2026. Key Phase II changes include new design representation requirements (removing the previous limit of seven static views and enabling animated and dynamic representations), simplified invalidity procedures, and improved access to unregistered design protection.

EU member states must also implement certain changes to their national design laws by 9 December 2027.

UKIPO One IPO transformation programme

The UKIPO is currently conducting a transformation programme, including plans for a new digital trade marks service.

As part of this, it intends to discontinue the ability to file a series of trade marks. Trade mark applicants can currently file a single trade mark application at the UKIPO containing up to six trade marks which differ in only non-distinctive matter. Series trade marks may be useful where, for example, a business is not yet sure which variant of a mark it wishes to use.

Following consultation, the UKIPO has decided to discontinue the option to file for a series of marks. The change will take effect when the new digital trade marks service launches, though the launch date has not yet been confirmed. We have written about series marks and the digital transformation programme in this article.

 

IP protection in Jersey

From 1 August 2026, there will be significant changes to Jersey's intellectual property framework. From this date, trade marks can be registered directly in Jersey, ending the current dependence on first obtaining a UK registration. To facilitate this, a new IP registry has been established under the Jersey Financial Services Commission (JFSC).

International trade mark registrations designating the UK (under the WIPO system) will no longer automatically extend to Jersey, and so applicants will need to designate Jersey separately. Transitional provisions will protect existing UK-designated registrations, automatically adding Jersey designations.

Extensions of international patent and design treaties are also anticipated (though the dates still to be confirmed), which will extend some UK patent and design protections to Jersey automatically.

Website blocking order re weight loss medication

The High Court has granted a website blocking injunction to Novo Nordisk in relation to websites selling counterfeit/unlicensed/prescription-only medicinal products (Ozempic, Wegovy etc).

The Court granted the website block in relation to the four websites on the basis that their activities involved trade mark infringement, passing off, and also criminal breaches of the Human Medicine Regulations 2012. This is the first website blocking application before a court concerning counterfeit/unlicensed prescription-only medicinal products.

The Court noted that any form of civil or criminal wrongdoing will suffice as a basis for granting a website block. It went on to consider the usual principles before granting the order, noting in particular the potential risk to public health / reputational damage to the applicant.

The MHRA had failed in its attempts to take down/block access to the relevant websites and had asked for the trade mark owner's assistance in doing so, which led to the application being made.

Trade mark licences: register at UKIPO to protect your claim

In May 2026, the Court of Appeal decided Lifestyle Equities v Frasers Group (formerly Sportdirect.com), with important consequences for brand owners and their licensees.

The Court held that the trade mark proprietor could not recover losses suffered by sub-licensees in infringement proceedings as the relevant licences had not been registered at the UKIPO (under the provisions for voluntary registration of transactions affecting registered trade marks).

The Court also confirmed that, whilst there is no time limit for making an application to register a transaction, and registration may have retrospective effect, ordinary limitation rules still apply: the six-year limitation period runs from the date of infringement, not from the date a licence registration is applied for. On the facts, the relevant sub-licences had not been registered, in order to preserve commercial confidentiality, and the sub-licensee loss claims were statute-barred.

Brand owners operating through licensing and sub-licensing arrangements, particularly those in the retail and consumer goods sector, should audit arrangements to confirm that key licences have been registered, and factor this into enforcement planning.

EU definition of 'pastiche' in copyright law

The CJEU has delivered its long-awaited ruling in the Pelham II music sampling case, providing the first authoritative EU definition of 'pastiche' in copyright law. The case concerns the use of a two-second rhythmic sample from Kraftwerk's recording Metall auf Metall, and whether this could be permitted as pastiche.

The CJEU held that a work qualifies as pastiche where it: evokes one or more pre-existing works; is noticeably different from those works; and uses characteristic protected elements of the source material in a way that engages in an artistic or creative dialogue that is objectively recognisable as such. The UK courts are not bound by this decision but may take it into account.

Questions of pastiche are particularly interesting in the context of GenAI, with such tools being used regularly to create an image in 'the style of'. Pastiche defences are likely to be relied upon where works created using GenAI objectively have a pastiche character.

Damages for infringement of luxury trade marks: Fendi Italia Srl & Ors v Rolo Fashion Limited & Anor [2026] EWHC 1703 (IPEC)

In this July 2026 IPEC judgment, HHJ Hacon awarded £213,000 to Fendi Italia Srl, Loewe, Christian Dior Couture and Celine (all LVMH-owned brands) against a social media influencer and her company for selling counterfeit luxury goods, including some described as higher-quality 'superfakes', sourced from sites including AliExpress. The court awarded £200,000 for lost profits and £13,000 on the user principle in respect of sales that did not deprive the claimants of a direct sale. On the user principle, the judge held that damages could be assessed on that basis even where the trade mark owners would not have licensed their marks to the defendant. However, no damages were awarded for reputational harm: the court found that the buyers understood they were purchasing counterfeits and did not associate responsibility for quality or conduct of the supplier with the brands. Brand owners and retailers should note the court's approach to quantifying losses.

Business rates

The business rates changes announced in the November 2025 budget came into force on 1 April 2026. A new 5-multiplier structure now applies, with permanently lower multipliers for qualifying retail, hospitality and leisure properties and a higher multiplier of 50.8p for all premises with a rateable value of £500,000 or more. The previous temporary RHL relief ended on 31 March 2026. However, a nationwide revaluation of business premises has taken effect in April 2026, based on values as they stood at April 2024. Many businesses will see significant increases in their rateable values, and therefore a sharp increase in their rates bills, despite the headline-grabbing lower multipliers. Business ratepayers should be prepared to lodge valuation appeals if they believe their new rateable value is inaccurate. Transitional relief is available to cap large bill increases.

Upwards-only rent reviews to be banned

The English Devolution and Community Empowerment Act 2026 received Royal Assent on 29 April 2026. It bans upwards-only rent review clauses in new and renewal commercial leases. Existing leases are not affected, but any options to renew entered into on or after 17 March 2026 will be caught. The ban is not expected to come into force until 2027 or 2028 at the earliest, pending commencement regulations. Alternative mechanisms — including fixed stepped increases and index-linked reviews (allowing rent to move up or down) — remain permitted. If an existing (pre-commencement) lease is renewed in the future, then the ban will apply to the renewal lease. For more information, please see our article here.

Landlords' insurance commissions – appeal settled

A High Court decision in 2025 cast doubt on whether commercial landlords can charge tenants for the commission element of an insurance premium. There was no issue over the commission payable to the landlord's broker, but could the tenant be forced to pay a separate commission that would go into the landlord's own pocket? No, said the High Court.

The landlord appealed but the parties reached an undisclosed settlement before the Court of Appeal hearing took place. As a result, the High Court's findings remain the only court ruling on the point. Depending on this ruling, many business tenants may have grounds to review their historic insurance charges and consider claims for overpaid sums. Each case will depend on the wording used in the lease. Please see our article on this controversial issue here.

Tougher energy efficiency measures on the horizon

On 18 June 2026, the Government published its interim response to longstanding consultations on minimum energy efficiency standards (MEES) for commercial properties. The previously proposed interim requirement of EPC C by 2027 has been dropped. Instead, from 2031, privately rented non-domestic buildings over 1,000 square metres will be required to reach EPC B, where cost-effective. Buildings under 1,000 square metres remain subject to the current minimum of EPC E, with no new deadline. Secondary legislation is required before the EPC B requirement becomes binding. Some energy efficiency duties may also be imposed on tenants, and further detail on this and on enforcement is expected in the Government's full consultation response. Landlords of larger premises should begin planning upgrades now to avoid a last-minute scramble.

Landlord and Tenant Act 1954 consultation

The initial consultation in 2025 concluded with a recommendation to keep this Act on the statute book. The 1954 Act gives business tenants a statutory right to renew their lease, unless the lease is contracted out of the Act's protection. The option to contract out will be retained. On 16 June 2026, the Law Commission published its second consultation paper, focusing on how the 1954 Act's renewal regime should be modernised in practice rather than whether it should survive. Proposals include simplifying the contracting out process, taking the friction out of renewal procedures and addressing modern leasing arrangements such as turnover rents and energy efficiency. The consultation closes on 16 September 2026.

At Mishcon de Reya we are passionate about retail because it brings together a host of ideas and professions: self-expression, sustainability, forward- thinking, commercialism, brand identity, to name but a few.

Our knowledge spans the spectrum of retail and consumer goods and services, from the high street to high-end luxury and from online to experiential. Among our clients you will find famous retail brands, alongside retail developers and operators, entrepreneurial start-ups, small independents and individuals. Our aim is to help each of these clients protect and maximise the value of their assets, whether these are their brand, their products and services, their property, their people or their reputation.

Our Retail Academy hosts regular webinars and events on legal issues relevant to the retail sector and we regularly post articles, videos and podcasts on the Retail Academy website here. If you would like to be kept up to date with our latest Retail Academy news and events, please subscribe to our mailing list.

Sally Britton

Partner
T  +44 20 3321 6014
E  sally.britton@mishcon.com

Lewis Cohen

Partner
T  +44 20 3321 6296
E  lewis.cohen@mishcon.com