Commercial and tech

EU AI Act

The EU AI Act became law in summer 2024. It will apply to any AI output that is available within the EU, so will impact UK companies that provide or deploy AI services in the EU. Some of the new rules have already started with the remaining provisions due to start in August 2026 including new transparency rules and the obligations on high-risk systems, but this timescale may be impacted by the proposed Digital Omnibus Package (see below). Track developments on our AI resource centre.

EU Data Act

Key obligations under the EU Data Act are expected to come into force in 2026 including an obligation for manufacturers to design and manufacture in-scope connected products placed on the EU market after 12 September 2026 (and provide related services) in a manner that allows a user to access the product data and related service data. The Data Act also introduced new rules in September last year regarding EU customers wishing to switch to an alternative cloud provider midway through a subscription and terminate their contracts early. Please see our article here for more information. This may be impacted by the Digital Omnibus Package (see below).

Digital Omnibus Package

The EU has proposed a Digital Omnibus Package to simplify existing rules on AI, cybersecurity and data. On AI, it is proposed that companies will only have to apply the rules for high-risk AI systems under the EU AI Act once the necessary support tools and standards are in place. It also proposes targeted amendments to the EU AI Act, including simpler rules, opportunities for real-world testing and centralised oversight of AI systems. In regard to cybersecurity, companies must currently report cybersecurity incidents under several different laws. The package introduces a single-entry point where companies can meet all incident-reporting obligations. It also proposes targeted amendments to the General Data Protection Regulation (GDPR) to harmonise, clarify and simplify certain rules, without lowering data protection standards, and modernised cookie rules which will improve users’ experience online. It also proposes to make data rules simpler and practical for consumers and businesses by consolidating EU data rules through the Data Act. This includes introducing targeted exemptions to some of the Data Act's cloud-switching rules for SMEs and SMCs, offering new guidance on compliance with the Data Act and boosting European AI companies by unlocking access to high-quality and fresh datasets for AI. It also proposes a new data union strategy to unlock high-quality data for AI and European Business Wallets to digitise companies' operations and interactions so they won't need to be done in person e.g. digitally sign, timestamp and seal documents.

Cloud and AI Development Act

The EU has proposed a new Cloud and AI Development Act which is expected in 2026 following a consultation in 2025. This will improve Europe's infrastructure to support the growth of AI and Cloud services and provide sustainability targets for data centres used to operate AI.

UK AI Regulation

In the UK, there is a non-legislative approach to AI whereby regulators provide guidance based on a set of principles. In 2025, the Government indicated it would bring forward AI-specific legislation to govern a small number of companies creating frontier AI systems. However, this is yet to emerge. More developments may occur after publication of the Government's response to its consultation on copyright and AI (please see the IP section). The Digital Regulation Co-operation Forum plans to consider regulatory challenges to the uptake of agentic AI. The Government launched a call for views on the AI Growth Lab last year which may inform future decisions on regulation in this space.

Blockchain

The Property (Digital Assets etc) Act became law in December 2025. It establishes, in statute, the common law position that certain digital assets can constitute property. The Act expressly makes provision about the types of things that are capable of being objects of personal property rights, including a thing that is digital or electronic in nature, despite being neither a thing in possession nor a thing in action. Our article summarises the impact of the new law.

Late payments

In 2025, the Government consulted on proposals to tackle late payments to small businesses. We are currently waiting for the outcome of the consultation which is due in Q1 2026 and will likely lead to legislation in this area in 2026 or 2027. Proposals include making the statutory interest rate for late payments mandatory, requiring businesses wishing to challenge an invoice to do so within 30 days (or else be liable to statutory interest) and capping payment terms at 60 days. It also proposes allowing the Small Business Commissioner to fine large firms that regularly pay late and conduct spot checks as well as mandating audit committee or board-level scrutiny of payment practices. New rules started on 1 January 2026 under the Companies (Directors' Report) (Payment Reporting) Regulations 2025 which require large companies to list information about payment practices in their director's report.

New EU rules on communicating software updates

In the EU, new rules will come into force in relation to communicating software updates on 27 September 2026 under the Empowering Consumers for the Green Transition Directive. This includes a ban on withholding the fact a software update will negatively impact the functioning of goods or services and falsely presenting software updates as necessary. Pre-contractual information must also be provided to consumers including telling them how long the producer or provider commits to providing software updates for.

Cybersecurity

Please see the Health & Safety/Product Safety section.

Franchising reform

The case of APK Communications Ltd v Vodafone Ltd is expected to be heard in the High Court in 2026. Vodafone franchisees are claiming that a duty of good faith should be implied into their franchising relationship. This may have wider implications for agency or distribution agreements. In January 2026, the Prime Minister assured Parliament he would examine the outcome of the case and consider if stronger regulations are needed in franchising. Further, an appeal is due to be heard by December 2026 in the case of Ellis v John Benson [2025]; the High Court in this case found implied duties of good faith and fair dealing in 20 one-sided franchise agreements.

Guidance for service providers on equality

Following consultations and the Supreme Court judgment in For Women Scotland v Scottish Ministers [2025], the Equality and Human Rights Commission has submitted to the UK Government for approval its updated draft Code of Practice for services, functions and associations. This will provide guidance on obligations under the Equality Act 2010, particularly regarding discrimination in the supply of services.

Please fill in the form below to access the full report.