Ellis was hanged in July 1955 after being convicted of murdering her partner, David Blakely, in north London. She was the last woman in Britain to be hanged, and her family have long campaigned for a pardon.

Her family, supported pro bono by law firm Mishcon de Reya, argued that evidence of the abuse she suffered at the hands of Blakely was not properly considered at trial. Victor Mishcon was brought in to fight for a last minute reprieve for Ellis during her lifetime, as such, this is a full circle moment for the firm.

Katy Colton, Partner and Head of Politics and Law, said: "The granting of a posthumous conditional pardon to Ruth Ellis is a landmark moment — for her family, for the British justice system, and for every victim of domestic abuse failed by the courts.

"Mishcon de Reya is proud to have acted for Ruth's grandchildren, alongside our colleagues at Matrix Chambers. This application had to be brought. The evidence was compelling, and we are pleased the Justice Secretary has recommended His Majesty grant Ruth Ellis a posthumous conditional pardon.

"Today's decision does not only right a wrong done over seventy years ago. It sends a clear signal about the aspirations of our justice system. Violence against women and girls remains a national emergency. The Government's public acknowledgement that the abuse Ruth Ellis endured should have impacted the outcome of her case reflects an important principle: that survivors of domestic abuse today deserve a justice system that properly understands and recognises the impact of that abuse.

"Our founder, Victor Mishcon, who fought to secure a last-minute reprieve for Ruth, would be immensely proud. We congratulate Ruth's grandchildren on their tenacity and courage in pursuing this application. It has been a privilege to stand alongside them as a firm."

Grace Houghton, Associate, Mishcon de Reya LLP, Solicitor for the Grandchildren said: "The granting of a posthumous conditional pardon for Ruth Ellis is both legally significant and historically important.

"The application demonstrated, on the evidence, that Ruth suffered from what is now understood as battered woman syndrome, and that the cumulative impact of the abuse she sustained would, under the law as it stands today, have supported defences of both diminished responsibility and loss of control. Had Ruth Ellis been tried just two years later, following the passage of the Homicide Act 1957, the outcome would have been very different.

"The Justice Secretary has exercised the Royal Prerogative of Mercy on a principled basis: that legal and social developments since 1955 make clear that the punishment imposed on Ruth was unjust.

"Today's pardon is a reminder that the law must reflect on its own history - and, where it finds injustice, must acknowledge those failings. We are honoured to have acted for Ruth's family in securing this outcome, and we hope they can now begin to heal from the generational trauma that has haunted them for decades."

Daniel joined the firm in 1998 and has been a Partner since 2004. Until April, he was Chair of the Employment department and sat on the Management Board. Daniel’s fee earning work includes advising on complex contentious and non-contentious employment matters and, as Chair of Employment, he oversaw substantial growth of the firm’s market-leading Employment practice.

Daniel serves as Managing Partner supported by an Executive Partner team of Johanna Walsh and Daniel Levy alongside the Chairs and other senior management, including the Operations Board. In addition to supporting Daniel in the management of the firm and the delivery of its strategic objectives, the Executive Partners will continue to advise and support their clients without change.

Johanna Walsh leads the White Collar Crime and Investigations team, as well as one of two divisions in the Dispute Resolution department. She joined the firm as a partner in January 2019 and sat on the firm’s Management Board for five years until 2025. 

Daniel Levy leads the Real Estate Litigation team and is Division Head of Property Litigation and Construction. He joined the firm in 2006, founding and leading the Real Estate Litigation team. He has sat on the Management Board since 2025 and, for the past two years, has served as Partners’ representative on the Operations Board. 

Daniel Naftalin, Managing Partner of Mishcon de Reya, said:

“I am very pleased to be taking over as Managing Partner and very proud that my partners put their faith in me to lead this exceptional firm. I care deeply about Mishcon de Reya, its people, what it stands for, and its place in an increasingly competitive market. Over the last few months, I have been working with my team to consult and develop our strategy to face our challenges and thrive. I was involved in the creation of our 2030 vision and our three pillars of private, real estate and innovation are fundamental to how I see the firm succeeding. 

“I want to guide Mishcon de Reya to a successful, profitable, and sustainable future. I want it to remain a values-led firm that rewards hard work and excellence and that people are proud to work for and to recommend. My team and I will work tirelessly to ensure that the firm is even stronger at the end of my tenure than it is today.”

Paying tribute to his predecessor James Libson, Daniel said: 

“James epitomises everything that is special about Mishcon de Reya, someone who is passionate about the law and has blended that with an exceptional commercial and strategic vision of what it takes for this firm to succeed. He has been involved in so many of the cases that have made us great and I am delighted that the Board has asked him to take on the honorary title of Senior Partner and that we will all continue to benefit from his extraordinary wisdom and love for this firm.”

Following Daniel’s election as Managing Partner, the Employment department elected partner Susannah Kintish as Chair of the Employment department from 1 April 2026.

A recent Employment Tribunal case highlights the latter issue. Taken alongside HMRC’s increased scrutiny of employer-funded visa expenses, it underlines the need for employers to consider immigration, tax and employment law together.

Key points for employers

• Employer-funded immigration costs may be taxable. HMRC is advancing a broader interpretation of the BIK rules and seeking tax and National Insurance contributions where certain visa and sponsorship expenses have been met by employers on employees’ behalf.
• Each cost must be considered separately. The tax treatment may depend on what was paid, who was legally liable, who benefited, the employee’s circumstances and whether an exemption or deduction is available. For example, employer-specific sponsorship costs such as the Certificate of Sponsorship ("CoS") fee and the Immigration Skills Charge ("ISC") must be borne by the sponsor and cannot be passed on to the worker, supporting the argument that they are the employer’s own regulatory costs rather than benefits provided to the employee. HMRC may, however, rely on the broad employment-related benefits rules to argue that the employee nevertheless benefits from the employer paying the CoS and ISC fees, as payment enables their sponsorship. The Home Office prohibition on passing the CoS and ISC fees to the worker does not, therefore, necessarily determine the tax position.
• Tax relief may be available in some cases. The distinction between costs relating to an employee’s initial move to the UK and those arising on a subsequent visa extension can be particularly important.
• Salary decisions made for immigration purposes should also be tested for discrimination risk. A recent Employment Tribunal case involved a non-sponsored employee who was paid less than sponsored colleagues performing the same support worker role.  At the remedy hearing, the Tribunal awarded her compensation.  
• The risks are connected. Employers need to look at the complete remuneration and immigration support package, not simply whether the worker’s basic salary meets the relevant salary threshold required for sponsorship.

Immigration costs and the BIK risk

Employers commonly fund visa application fees and other immigration-related expenditure when recruiting or retaining sponsored workers. Historically, some businesses may have regarded those expenses simply as costs of employing international talent.

HMRC has, however, increased its scrutiny of employer-funded visa expenses and is advancing a significantly broader interpretation of the BIK rules, seeking to collect tax where an employer has met visa costs on an employee’s behalf.

The correct treatment is fact specific. Employers should establish:

• what immigration or professional cost has been paid;
• whether it relates to the employee, their family or the employer;
• who is legally responsible for paying it;
• who receives the underlying benefit; and
• whether a specific exemption or deduction applies.

Employers should avoid treating every immigration expense in the same way. Even where a cost initially falls within the benefits regime, tax relief may be available for certain travel and related expenses when an individual comes to work in the UK. The employee’s circumstances, and whether the cost relates to their initial move or a later visa extension, may affect the result.

The analysis should therefore address three questions:

• Does a taxable benefit arise?
• Is an exemption or deduction available?
• How should any taxable amount be reported?

In limited circumstances, certain visa costs incurred in connection with an employee’s (and potentially their family’s) travel to the UK may qualify for relief. This may be relevant where an overseas recruit or international assignee incurs visa-related costs as part of their initial relocation to the UK. By contrast, the position may be more difficult where an employee is already working in the UK and the employer pays for a later visa extension, as those costs may be less readily connected with the original journey to the UK. The availability of relief will depend on the particular facts and statutory conditions.

Visa application fees and the Immigration Health Surcharge* have generally been regarded as taxable benefits when paid on an employee’s behalf unless a specific exemption or deduction applies. 

*Payment of the surcharge entitles the applicant to access NHS services during the period of their permission, broadly on the same basis as a UK resident, subject to standard NHS charging rules (for example, it does not cover prescription or dental charges that UK residents would also pay).

The wider cost of getting the tax treatment wrong

If an immigration expense is taxable, the employer must decide how it should be reported and who will bear the tax. Depending on the circumstances, this could involve payroll, benefits reporting or settlement through a PAYE Settlement Agreement ("PSA").

Employer National Insurance contributions may also be payable. If the employer has agreed to protect the employee against the additional tax liability, a tax gross-up could turn an already substantial immigration expense into a significantly larger cost.

The practical risk is heightened where different teams operate independently. Immigration may approve the expenditure, Finance may pay it and the Global Mobility team may manage the employee, without Payroll being told that a potentially reportable benefit has arisen.

Pay parity: can sponsored workers be paid more?

Tax is not the only issue. Where a sponsored worker must receive a particular salary to meet the requirements prescribed under the Immigration Rules, employers may find themselves paying that worker more than a non-sponsored colleague doing the same job.

This issue arose in the Employment Tribunal proceedings of Mrs G Gharabli v Cedar Hope Care Services Ltd (Case Number: 6009247/2024). Ms Gharabli worked as a support worker from February 2023. She discovered that overseas support workers with Skilled Worker visas were being paid £12.31 an hour, while she and other non-sponsored support workers received £10.50 an hour. Approximately 80% of the employer’s staff worked under sponsored visas.

Ms Gharabli’s pay was increased after she raised the discrepancy. Following further events and disagreements, she resigned with immediate effect in June 2024, citing discrimination on the basis of pay among her reasons. Her Tribunal claims included direct and indirect race discrimination, direct and indirect religion or belief discrimination, and whistleblowing. Only her indirect race discrimination and whistleblowing claims succeeded.

The Tribunal accepted that complying with the Skilled Worker minimum salary requirements was a legitimate aim. However, immigration compliance alone was not enough to establish that the resulting pay disparity was proportionate. In particular, the employer had not provided analysis or evidence showing why it would have been financially prohibitive to increase the pay of non-sponsored employees performing the same role.

At the remedy hearing, the Tribunal awarded her £14,174, which included £10,000 for injury to feelings and £2,237 for financial losses.

This case was a first-instance Employment Tribunal decision and is not binding on other tribunals. Nor does it establish a blanket rule that sponsored and non-sponsored employees performing the same role must always be paid the same. Focusing on indirect discrimination, the question will be whether any indirectly discriminatory pay practice can be objectively justified as a proportionate means of achieving a legitimate aim. Employers should therefore be cautious about the litigation risk where sponsored and non-sponsored workers performing the same role receive different rates of pay.

A discrimination issue?

If sponsored workers are predominantly of particular nationalities or racial groups, a policy of paying them more than non-sponsored colleagues may lead to race discrimination claims, particularly claims of indirect race discrimination.

The key point is that meeting an immigration salary requirement does not end the analysis. Salary-setting decisions made for immigration purposes should be tested through an equality lens. Employers should ask:

• Are sponsored and non-sponsored employees performing the same or materially similar roles?
• Is there a difference in pay?
• What is the reason for that difference?
• Has the rationale been recorded and reviewed by HR and employment legal teams?
• Could the same immigration requirement be met without creating an unexplained disparity?

Looking at pay and benefits together

The two risks can pull employers in different directions.

A business may increase a sponsored worker’s salary to meet immigration salary thresholds, creating a pay disparity with existing staff. Alternatively, it may fund immigration expenses as part of the worker’s package, only to discover that the expenditure creates a taxable benefit and additional National Insurance costs.

Employers should therefore review the overall package, including:

• basic salary;
• visa and related immigration expenses;
• support provided to family members;
• any employee tax paid or grossed up by the employer; and
• any other benefits provided because the employee requires sponsorship.

This combined review should identify both the employment tax consequences and any potentially problematic differences between sponsored and non-sponsored workers.

Wider immigration changes

These issues arise against the backdrop of continuing changes to immigration routes, salary requirements and sponsor obligations. Employers can read more in our article: The major immigration changes in 2025 and what to expect this year.

Key actions for employers

Employers with sponsored workers should:

• Analyse immigration expenditure: identify all visa, relocation and associated professional costs paid for workers and their families.
• Review the BIK treatment: determine who is liable for and benefits from each cost, and whether any exemption or deduction is available.
• Review contracts and policies: identify whether contracts, policies or assignment letters require the employer to meet or gross up the employee’s tax.
• Check reporting arrangements: confirm whether taxable amounts are being dealt with through payroll, benefits reporting or a PSA.
• Audit pay differences: compare sponsored and non-sponsored employees performing the same or similar work.
• Record the rationale: document why any difference in salary or benefits exists and assess it through a discrimination lens.
• Review historic treatment: consider whether previous immigration expenses or pay arrangements require further investigation.
• Join up internal teams: ensure immigration, HR, global mobility, finance, payroll, employment tax and legal teams share information effectively and apply a consistent approach.
• Budget for the full cost: include possible income tax, employer National Insurance contributions and gross-ups when modelling the cost of recruiting or relocating sponsored talent.

Immigration compliance should not be considered in isolation. A decision that enables the business to sponsor a worker may still create an unexpected tax liability or an employment dispute about differences in pay. Reviewing both issues at the outset is likely to be considerably easier, and less expensive, than addressing them after HMRC or an employee asks probing questions.

James has 40 years’ experience in real estate. He began his career at Hirshfield’s in 1986, specialising in auctions and investment, before becoming a founding member of niche commercial investment agency Lewis and Partners in 1994. 

In 2000, he established Faircroft Real Estate in partnership with Arrowcroft, completing transactions with a value exceeding £100 million. During the global financial crisis, he helped create a substantial asset management business dealing with distressed assets on behalf of a range of financial institutions. He subsequently became Chief Executive Officer of Arrowcroft following its acquisition of Faircroft in 2012. 

James left Arrowcroft in 2013 to establish Phoenix Real Estate, a multi-family real estate investment vehicle. 

Throughout his career, James has led office refurbishment and redevelopment projects across the UK’s major cities. His work is now focused primarily on London. 

He is a qualified chartered surveyor.

Roshni is a corporate occupier specialist with particular expertise in the technology and retail sector. Her practice is further complemented by broad experience acting for various institutional landlords and investors.

Before joining Mishcon de Reya, Roshni advised major UK and international businesses and retailers on complex occupational transactions, including flagship acquisitions, portfolio management and international expansion.

“I am delighted to be joining Mishcon de Reya. Its emphasis on people and relationships, combined with the importance of Real Estate to its long-term strategy, made Mishcon a natural fit for me. Acting for clients who set the benchmark in the occupier market is a key part of my practice, and Mishcon’s ambition and market-leading reputation provide a strong platform for the continued growth of that practice. I am looking forward to working alongside an exceptional team and contributing to the firm’s continued success," said Roshni Kotecha Chadda, Partner.

Stephen Hughes, Chair of Real Estate said, "We are thrilled to have Roshni join the Mishcon de Reya Real Estate team. Her joining underlines the continued investment and recognition of Real Estate as a key sector in Mishcon de Reya's Vision 2030. She is a brilliant lawyer with a proven track record of deep client insight, and building trusted relationships. Roshni expertly blends technical excellence with a commercial approach, and she will be an asset to our existing practice, which is underpinned by operational insights and long-term, embedded client relationships."

Nicholle welcomed the focus on development and greater housing density around well-connected stations but said the real test would be whether the reforms address the practical barriers delaying delivery.

She also highlighted the potential for AI to help speed up planning decisions. As the Government seeks to streamline consultation and expand delegated decision-making, Nicholle suggested that AI could support planning officers by analysing planning policy and consultation responses, while retaining appropriate professional oversight.

Read the coverage

• Estates Gazette
• Planning
• BENews 

• The UK NZCBS provides a common reference point for anyone seeking to fund, procure, design, construct, occupy, manage or invest in net zero carbon buildings.
• As well as providing an industry-agreed definition of what constitutes a "Net Zero Carbon Aligned" building, it also lays out the methodology for demonstrating that these conditions have been met.
• As of 28 July 2026, buildings may be independently verified against the standard, helping to cut through greenwashing and ensuring that only buildings with demonstrable low carbon outcomes can claim Net Zero Carbon Aligned status.
• Having contributed to the UK NZCBS's development, Mishcon de Reya is delighted to see this industry-wide initiative move from concept to implementation.
• Because the UK NZCBS complements existing frameworks (e.g., BREEAM, LEED and NABERS UK), we foresee that the market norm for leading assets will become a combination of all of them.
• We advise real estate stakeholders to actively consider how, and how quickly, adoption of UK NZCBS is likely to influence investment decisions, occupier requirements, procurement strategies and financing arrangements.

Why does the UK NZCBS matter?

For many years, the real estate industry has embraced net zero ambitions. However, different organisations have adopted different methodologies, reporting approaches and definitions, making it difficult to compare assets or assess the credibility of competing claims.

Co-developed by leading institutions across the built environment, the UK NZCBS addresses the need for a consistent, industry-agreed definition of what constitutes a Net Zero Carbon Aligned building and unified methodology for determining that these requirements have been met. Evidence of conformity must be verified by independent experts to ensure confidence that only buildings with demonstrable low carbon outcomes can earn Net Zero Carbon Aligned status.

That verification process opened on 28 July 2026 and, having contributed to the development of the standard, Mishcon de Reya is delighted to see this industry-wide initiative moving from pilot into implementation.

Where does the UK NZCBS fit alongside BREEAM, LEED and other standards?

Understanding how the UK NZCBS fits within the existing landscape helps to illuminate its significance further. Rather than viewing different frameworks as competing certifications, it is more useful to think of them as answering different questions:

A new market norm?

We believe it is entirely possible that the market norm for leading assets will become a combination of all these certifications and frameworks. A building may continue to achieve BREEAM Outstanding or LEED Platinum to demonstrate broad sustainability credentials, while also pursuing UK NZCBS verification to substantiate claims of net zero carbon alignment.

How does the UK NZCBS add value for market participants?

The importance of the standard lies not simply in its technical requirements, but in the wider role the UK NZCBS is intended to play in the market — providing a common reference point for anyone seeking to fund, procure, design, construct, occupy, manage or invest in net zero carbon buildings.

For owners, it is a way to demonstrate that an asset is genuinely aligned with the UK's legally binding climate targets and the real estate sector's fair share of the remaining carbon budget, using independently verified evidence rather than design-stage assumptions. For investors, occupiers, funders and other stakeholders, it can offer a level of confidence and comparability that has previously been missing, allowing them to make better informed decisions.

What should they be doing now that UK NZCBS verification is open?

For real estate stakeholders, the practical question is no longer whether a common net zero standard will emerge. Now that verification is open, it is whether and how quickly that standard will begin to influence investment decisions, occupier requirements, procurement strategies and financing arrangements.

How can Mishcon de Reya help?

Mishcon Purpose — our interdisciplinary ESG and sustainability practice — advises corporates and private interests on evolving ESG risks and opportunities, and development and implementation of strategy and governance frameworks to address them. By combining expert lawyers and sustainability professionals, our team balances compliance with strategic foresight, not only helping clients to mitigate risk, but also to seize opportunities to lead and benefit from sustainable transition.

With over 140 fee earners, including 46 partners, Mishcon de Reya's Real Estate department is one of London's largest and most diverse property teams. The department includes well-regarded specialist practice areas and provides a one-stop shop for all our clients' property requirements, delivering a seamless service from investment, structuring, funding, acquisition and planning, through to construction, development, tax and litigation advice. Real Estate is one of the three key strategic sectors outlined in the firm's Vision 2030 strategy.

To discuss your biggest challenges and ways we can help, get in touch.

Shortly after being made a Partner, Cassandra went on maternity leave and, in the interview, she discusses the challenges on her return of rebuilding client relationships and the pressures facing women at a pivotal stage of their career.

Cassandra also feels strongly about normalising people’s needs to balance parenthood and external commitments with work-life. She feels a responsibility to show that it can be done, and that partnership, parenthood and business development need not be mutually exclusive.  

Read the full article (subscription required)

Adam McGlynn, Managing Associate in the Employment department and part of the team acting in the case, has commented for People Management on the implications of the judgment for employers. Adam explained that policies and decisions should be applied to comparable staff “equitably and consistently”, in accordance with the pro-rata principle.

“Arrangements that do not comply with the pro-rata principle, such as fixed payments, benefits or deductions that apply to all staff regardless of hours worked and, therefore, have a disproportionate impact on part-time staff, represent a potential compliance risk.”

Adam said employers should consider whether workplace arrangements “proportionately pursue a legitimate business aim” and clearly document their decisions, in light of the fact they now face a greater evidential burden.

Read the article in full

The Mishcon de Reya team of Antonia Felix, Krishma Sangani, Nick Bass and Jess Cane instructing Michael Glaser KC of Fourteen, successfully persuaded the court to uphold the terms of the pre-nuptial agreement in full, in line with the husband's interpretation, despite the judge describing the agreement itself, which was drafted by the parties' previous representatives, as "a piece of sub-optimal drafting."

In a case with total assets of £26.6 million (of which £8.6 million was realisable and £18 million was deferred/non-realisable), the wife was awarded a total of £2.837million plus a capitalised spousal maintenance fund of £1 million, with the husband retaining the remainder. The judge found this sufficient to meet the wife's needs and was content to restrict her claims accordingly, in light of the valid pre-nuptial agreement.

The case serves as a timely reminder of the court's willingness to uphold the terms of validly entered nuptial agreements unless it would be unfair to do so, or the agreement fails to adequately provide for needs. HHJ Hess noted that, on the facts, there was no basis to depart from the terms of the pre-nuptial agreement "on the basis of anything other than need".

• The UK Jurisdiction Taskforce (UKJT) has now published a final version of its legal statement on liability for AI harms, following a public consultation earlier this year.
• The UKJT's position remains largely unchanged from its draft statement: in most cases liability for AI harms will be governed by existing principles of contract or tort law. The UKJT expects that English law is sufficiently flexible to accommodate any novel issues arising from AI harms.
• However, the final statement does expand on the analysis in some key ways, including: the interplay between AI harms and non-delegable duties of care; the application of the "material contribution to damage" approach to causation; and the availability of contributory negligence as a partial defence to claims arising from AI harms.
• It also reframes the approach taken in the draft statement to liability for defamatory statements published by AI.

Introduction

We previously wrote about the UKJT's draft legal statement on how English law can and should approach novel questions of liability arising from the use of AI tools.

Following a consultation process, the UKJT has now published its final legal statement. Broadly speaking, the UKJT has maintained its earlier positions. For example, it continues to adopt a "technology agnostic" definition of AI: "technology that is autonomous". It also remains of the view that, as "a well-developed flexible common law system", the English legal system is able to "provide certainty and predictability in the context of technological innovation".

As before, the UKJT concludes that questions of liability resulting from the use of AI will primarily be dealt with via either contract law, or the tort of negligence. Where harm arises that is subject to contractual agreements, the final statement emphasises that "the fact that the subject matter of a contract may be AI poses no special difficulty". Similarly, with regard to the law of negligence (and other tortious claims), it concludes that:

"There is no conceptual reason why the law of negligence cannot be applied to harms caused by AI failures to ascertain whether and to what extent a party will be liable for those harms. In many cases, neither is there any practical difficulty in applying the normal principles in an AI context".

The UKJT's overall approach, and much of its detailed analysis, remains unchanged in its final statement. However, some further elements have been added which develop their analysis.

Key changes

The final statement adds analysis of the following points:

• Liability for AI harms in the context of "non-delegable duties";
• The "material contribution" approach to causation;
• The application of contributory negligence; and
• A "participation or authorisation" approach to liability for the publication of defamatory material.

Vicarious liability and non-delegable duties

In its draft statement the UKJT concluded that an AI has no legal personhood. Therefore, AI cannot itself be held liable for harms caused by its use.

By extension, the UKJT concluded, there cannot be vicarious liability for the actions of an AI tool: a party can only be vicariously liable for the actions of another legal person that is itself liable for the harms caused by those actions. An AI or AI tool is not a person, and so such vicarious liability cannot arise. There could, however, be vicarious liability for another person's negligent misuse of AI.

The final statement maintains this analysis. However, the UKJT now considers the situation where a person owes a "non-delegable" duty to protect a third party from harm. As examples of such duties, it cites the duty of an employer to "provide a safe system of work for its employees", or for hospitals to safely treat their patients. In these circumstances, the UKJT concludes, the party that owes such a duty is likely to be liable where an AI has caused harms that it was duty bound to protect against. This is so even if they have not been negligent in allowing the use of AI.

Material contribution

The final statement also expands the analysis of the application of the law of causation to harms caused by AI. As with any cause of action, where a claimant seeks damages for harms arising from the use of AI it must show that the development of faulty AI and/or the (mis)use of AI has caused the harm suffered. The UKJT had acknowledged in the draft statement that the "opaque" way in which AI operates might make causation particularly challenging to prove. However, it concluded that these challenges "are neither more severe nor different in kind to the sorts of issues that arise in other domains and that the English common law is well able to accommodate".

Expanding on this line of analysis, the final statement now also highlights the English law principle of "material contribution to damage". This applies where: multiple parties have each, in breach of a duty of care, contributed to a single harm; but, no individual contribution was on its own necessary or sufficient to cause that harm. In these limited circumstances, English law does not insist on proving a strict "but for" causation, which would require the claimant to prove that the harm would not have occurred had that particular breach not occurred. Instead, it may be enough to show, on the balance of probabilities, that a party's actions "materially contributed to the damage".

The UKJT points out that: this material contribution principle already applies in some contexts, such as industrial disease and clinical negligence claims; and, the Supreme Court has recently endorsed it as a more general principle. The UKJT states there is "no reason in principle" why this approach could not be adopted in relation to harms caused by AI. This would potentially make it easier to establish liability even in the case of harms which have or might have multiple causes.

Contributory negligence

The draft statement did not consider the application of contributory negligence in the context of harms caused by AI.

The final statement now includes a section specifically addressing this principle. It concludes that contributory negligence will be available as a partial defence in this context in the same way as any other. The final statement gives the example of a party that uses AI to plan a driving route, and then suffers harm as a result of following the proposed route. If the user followed the AI's route despite knowing that it would expose them to significant hazards that could be avoided by another route, then it is likely that any damages awarded would be reduced as a result of their own contributory negligence.

Liability for publication

Perhaps the most significant change in the UKJT's analysis is in relation to liability for publication of defamatory material produced by AI.

In its draft statement the UKJT framed its analysis in terms of "primary" and "secondary" publishers. "Primary" publishers are those that create the defamatory material, and "secondary" publishers are those that disseminate defamatory material created by others. The UKJT queried whether the creator of an autonomous AI could be considered a "primary" publisher of material generated autonomously by the AI, or if they were more likely to be treated as "secondary" publishers, which are "protected by statute".

In the final statement the UKJT has adopted a different approach. Instead of distinguishing between "primary" and "secondary" publishers, it suggests that a person will be considered a publisher if they have "participated in, or authorised" the publication. It notes that the question of whether a party involved in the "AI supply chain" will meet this threshold will be "highly fact-specific". The UKJT suggests that a party will be more likely to do so (and therefore potentially attract liability) if it:

• Manually reviews the AI's output before publication; or
• Deliberately deploys the AI for the purpose of publishing statements to the public in the course of its business.

However, it notes that there will be a number of factual and legal considerations that will have to be applied to the specific facts of each case.

Conclusion

The UKJT's final statement remains very close to the draft statement published for consultation. It expands the analysis in some areas, and in the case of the discussion of defamation, significantly reframes the issues. However, overall, the conclusion remains clear: English law is flexible. AI presents some novel challenges, and provides a new context to existing ones. In either case, the authors remain confident that the law will be able to adapt to and accommodate claims relating to AI based harms.

The law in this area is already beginning to evolve: as the UKJT also notes, the EU has published and dropped an AI Liability Directive. Meanwhile some professional bodies (such as the Royal Institution of Chartered Surveyors) have already published guidance on appropriate use of AI systems which will likely frame the courts' assessment of liability in these areas. Professionals in particular should also take heed of the UKJT's warning that they "could be liable for failing to use AI in circumstances where a competent member of their profession would have done so".

It still remains to be seen how the English law will react when claims arising from AI harms reach the courts. However, whilst not binding, the UKJT's statement is likely to be considered by the courts when they do come to grapple with these issues. No doubt it will be persuasive.

Here’s what you need to know about results day and how the review and appeals process works.

What students should do before A Level results day on Thursday 13 August 2026

• Know your UCAS login information (username and password), your UCAS personal ID and your clearing number (if applicable). You will need these if you want to contact universities or make decisions via the UCAS website
• Ensure that you are aware of your predicted grades and the required grades for entry to your first-choice university or college, or incoming employment. If you are apprehensive about your results and are applying to higher education, you can pre-emptively search through unfilled university courses via Clearing: Search courses | UCAS
• Have the contact details for your firm and insurance universities at hand (and other universities you're interested in, if applicable)

What students should do on A Level results day:

• Collect your results as early as possible. Remember to bring ID with you (just in case). You can also arrange to receive them by email or post
• At the same time as collecting your results, UCAS will receive the results directly and the website will go live (around 8am). It will show one of the following updates:
  • Unconditional (firm choice): you have met your firm offer and your place at that university or college is confirmed
  • Unconditional (insurance choice): you have not met your firm offer, but your insurance choice has accepted you
  • Clearing: you have not met the conditions of either offer meaning that you are now in clearing
• If you have missed the grades for your first-choice university or college and have not been accepted, you must contact that university or college as soon as possible. They may be able to keep your place open until you have had your grades reviewed, or they may be able to accept you even if you have missed your grades
• If you apply for a university place through Clearing, you will need:
  • Your UCAS ID number and login
  • Your UCAS Clearing number from the UCAS Hub
  • Phone numbers for universities you wish to contact
  • Your personal statement

The review and appeals process in England and Wales

• If you believe your results are wrong, speak to someone at your centre (i.e. school or college) as soon as possible
• Your centre will then contact the relevant exam board on your behalf and ask for your marks to be reviewed under the post-results service. There are various services available, so make sure you speak with your centre to find the appropriate one
• A 'priority' service is available for students whose university or college place is contingent on A Level results
• If you still think you have been marked incorrectly after the post-results service, you can ask your centre to appeal the grade
• There is generally a two-stage appeals process:
  • Stage One: the preliminary appeal. The case will be reviewed by a member of the awarding body who has not had any previous involvement with, or personal interest in, the matter
  • Stage Two: the appeal hearing. The case will be considered by a panel which will include at least one independent person
• At each stage, the appeal will either be upheld, not upheld or partially upheld. The relevant awarding body will send the centre an outcome letter for each appeal once a decision has been reached
• Finally, if students are dissatisfied with the decision of an appeal hearing, an appeal may be made to the relevant Exam Procedures Review Service

Should you have any questions regarding A Level results and appeals, please do not hesitate to contact Robert Lewis or another member of the Mishcon de Reya Education Sector Group.  

• The UPC Court of Appeal has dismissed Guardant's appeal against the rejection of its application for provisional measures against Sophia Genetics, holding that Guardant did not act with the required urgency when it made its application.
• The Court found that a patent holder need not assert all infringed patents in a single application but, once aware that a document evidences infringement of one patent, it must not turn a blind eye to the fact that the same document may evidence infringement of others. Unreasonably delaying an application to await information on all patents can be fatal to urgency. Here, a three-month delay was unreasonable, leading to rejection of the application.
• The UPC's order also addresses international jurisdiction over non-Contracting Member State defendants, claim construction, added matter, and cost allocation.

Background

Guardant Health, Inc. is the proprietor of European Patent 3 443 066 with unitary effect (the Patent), covering a method for detecting colorectal, ovarian, lung or pancreatic cancer using deep sequencing of circulating cell-free DNA.

On 27 May 2025, Guardant sent a warning letter to Sophia Genetics SA concerning alleged infringement of certain UK patents by Sophia's "MSK-ACCESS powered with SOPHIA DDM" liquid biopsy test, and began UK litigation on 14 July 2025.

On 29 August 2025, Guardant applied for provisional measures before the Paris Local Division against four Sophia Genetics group companies for alleged infringement of the Patent and other patents; one further patent claim was later withdrawn.

The Paris Local Division rejected the application (finding the Patent more likely than not invalid for added matter) and ordered Guardant to pay an interim costs award of EUR 400,000.

Guardant appealed in respect of the Patent and costs; Sophia cross-appealed.

Urgency: the decisive issue

The Court of Appeal's key determination concerned whether Guardant had acted with sufficient urgency in making its application. The Court of Appeal found that Guardant had not made its application for a provisional injunction with sufficient urgency under Rule 211.4 Rules of Procedure, making infringement and necessity irrelevant. Whilst a patent holder need not assert all infringed patents in one application, and filing separate applications weeks apart is compatible with procedural efficiency, delaying an application until information on all patents is available may itself constitute unreasonable delay.

It is the applicant's burden to show it acted without unreasonable delay. Guardant's own 27 May 2025 warning letter (concerning other patents) relied on a User Manual that also disclosed the Patent's features, meaning Guardant knew or should have known of the alleged infringement well before that date; the court assumed the relevant technical details were known by 1 May 2025.

A diligent patent holder using the same public information could have established infringement by all four Sophia companies within two weeks, meaning Guardant should have had the requisite knowledge by 15 May 2025 at the latest. Since all information relied upon by Guardant was publicly available, no substantial investigative measures were required.

Guardant's application was not filed until 29 August 2025 - a delay of more than three months not adequately explained by technical analysis, expert consultation, or awaiting a response to the warning letter.

There is no legislative deadline for filing a PI application: the court will apply a case-by-case assessment of all circumstances of the matter.  In this case, the Court of Appeal indicated that Guardant had not submitted sufficient evidence to conclude it had acted with the required urgency, indicating that if a patent holder's behaviour shows that the enforcement of their rights is not urgent, provisional legal protection is not required.

International jurisdiction over Swiss and Spanish acts

Sophia contested jurisdiction over alleged infringing acts taking place in Spain and Switzerland. The Court of Appeal held that jurisdiction over the three defendants domiciled in Contracting Member State arose from that domicile under Article 4 in conjunction with Article 71b(1) of the Brussels Recast Regulation, regardless of where the infringing acts occurred.

As for the Swiss-domiciled company, jurisdiction over its acts flowed from Article 8(1) of Brussels Recast Regulation, using the French subsidiary as anchor defendant, and applying the CJEU's Solvay v Honeywell case law on the risk of irreconcilable judgments.

Claim construction

The Court of Appeal construed claim 1 of the Patent broadly: it does not require identification of the specific cancer type; instead, detection of just one of the four listed cancers suffices, and the test need not distinguish those cancers from other cancer types mentioned elsewhere in the description.

The required sequencing depth of at least 50,000 reads per base applied to all loci in the 25-gene panel, and "consensus sequence" under feature 1.7 covered both the "collapsing" method and probabilistic functions.

Added matter

Reversing the Paris Local Division's decision, the Court of Appeal rejected the added matter complaint, finding all features of claim 1 directly and unambiguously disclosed as filed.

Key takeaways

• Infringement analysis should be conducted across the whole of a patent portfolio as soon as possible, considering all the obtained information and documentation. The Court of Appeal here treated the patent holder's constructive knowledge broadly: once a document (here, Sophia's User Manual) discloses features relevant to more than one patent, urgency is assessed from the date that document was available, not from when the holder chose to consider it in relation to additional infringements or has obtained additional supporting documents.
• A delay of just three months can be detrimental to a Patent holder's application for provisional measures, even when there is no negative determination in relation to validity.
• Filing separate provisional injunction applications for different patents days or weeks apart remains procedurally acceptable, but there is no equivalent tolerance for delay caused by waiting to build a combined case. Parties should treat urgency clocks as running per patent, per defendant, from the earliest point infringement could reasonably have been identified from public information.

Mark said employers should bear in mind that reliance on the accommodation-only exemption under the NMW Act is “highly fact sensitive and a blanket approach should never be adopted”.

“A ‘no salary’ or ‘in exchange for accommodation only’ arrangement can still amount to a contract of employment and can still fall outside the national minimum wage obligations under the narrow exemption at section 44 of the National Minimum Wage Act 1998, but only if the facts genuinely support both conclusions,” he explained. “Employers cannot rely on labels alone.”

Read the article in full

Before joining Mishcon de Reya, Robert led the international arbitration practice of Denton’s Hong Kong. He has significant experience in disputes involving Chinese and other Asian parties, frequently acting in matters seated in London, Hong Kong and Singapore. This Asia‑Pacific expertise complements his broader international practice and reflects his long-standing involvement in cross‑border disputes.

Robert will be based in London but will continue to practice in both London and Hong Kong, working between Mishcon de Reya's UK and Asia offices. He is the eighth Partner hire for the firm this calendar year.

"Mishcon de Reya has strong technical arbitration expertise, combined with geopolitical and commercial insight," Robert said. "I am very happy to have joined Mishcon's 'disputes powerhouse' and look forward to continuing to build my international practice as part of a fantastic team."

In addition to Robert joining the firm, and the recent appointment of Bushra Ahmed and Charlotte Bijlani as Co-Heads of Disputes in the UAE, Mishcon de Reya’s international arbitration practice also announces the promotion of Margrit Trein in London to Legal Director / Counsel, and that Nataliia Bertagna has joined the London team from White & Case in Paris.

Greg Falkof, Head of the International Arbitration Practice at Mishcon de Reya said:

"We are delighted to welcome Robert to the firm. He is a star disputes partner with a stellar reputation, whose practice sits perfectly within the Mishcon disputes powerhouse.

"Robert's addition to the team is part of our strategic growth and investment into our international arbitration practice, alongside the recent hire of two new partners in our UAE offices, Bushra Ahmed and Charlote Bijlani. We’re also delighted to be investing in the long-term future of our arbitration practice, with the promotion of Margrit Trein to Legal Director and the recruitment of Nataliia Bertagna as Managing Associate. They are quality practitioners who represent the next generation of arbitration talent, and we’re excited for the opportunities that they offer to continue developing our international arbitration practice.”

• The UK Supreme Court has allowed Tesla's appeal in its dispute with InterDigital and Avanci, holding that there is a serious issue to be tried on whether the FRAND obligation applies to SEP owners licensing through pools or platforms, and overturning the decisions of both Fancourt J and the majority of the Court of Appeal.
• In doing so, it has opened the door to court scrutiny of pool and platform licence rates in the UK for the first time, and confirmed that the English courts have jurisdiction to hear Tesla's claims for declaratory relief. This has significant implications reaching beyond automotive into consumer electronics, streaming and IoT.
• The substantive questions will now be assessed by the Patents Court to decide Tesla's case on the merits.

Background

The case arises against the backdrop of the increasingly prevalent practice of licensing standard essential patents (SEPs) through pools and platforms rather than bilaterally. The Avanci 5G Platform is administered by Avanci as agent for its member licensors, which at the time of the appeal numbered 89 SEP owners licensing 86 brands and representing the equivalent of over 7,500 bilateral licences. Among its members is InterDigital, a significant SEP owner in the ETSI (European Telecommunications Standards Institute) 2G, 3G, 4G and 5G standards, and itself a frequent party to FRAND court proceedings.

Tesla wished to launch 5G-enabled vehicles in the UK and therefore required a licence under the relevant UK SEPs. The platform licence offered by Avanci was set at a flat rate of $32 per vehicle, which Tesla considered not to be FRAND. In December 2023, Tesla therefore commenced proceedings in the UK Patents Court seeking, amongst other things, declarations that: (i) the FRAND licence to InterDigital's UK SEPs on the Avanci 5G Platform is a global platform licence; (ii) the Avanci 5G Platform rate is not FRAND; and (iii) a determination of the rate that would be FRAND. These are the "Licensing Claims".

In July 2024, Fancourt J struck out the Licensing Claims, holding there was no serious issue to be tried and that the Delaware Court of Chancery was an available alternative forum because the claim had a closer connection with the US (including because the principal parties are all Delaware companies, the majority of the SEPs are US patents, and the Avanci Licence is administered and regulated in the US). The Court of Appeal dismissed Tesla's appeal, with Phillips and Whipple LJJ in the majority. Arnold LJ dissented, concluding that there was a serious issue to be tried against both InterDigital and Avanci and that the English courts had jurisdiction. The Supreme Court has now adopted, in all material respects, Arnold LJ's reasoning.

Was there a serious issue to be tried?

In a judgment delivered by Lord Hamblen and Lord Kitchin, the Supreme Court split this question into three issues.

Jurisdiction

On jurisdiction, the Supreme Court endorsed what it described as the "formidable line of authority" that has developed in this area, confirming that the Licensing Claims were properly characterised as claims relating to InterDigital's UK SEPs, not as a freestanding worldwide licensing claim. The fact that the only FRAND licence would be global did not alter the subject matter of the claim.

Service on InterDigital was upheld under the CPR rules governing intellectual property claims, and the claims against InterDigital and Avanci each passed through the relevant gateways for service out of the jurisdiction. On forum, the Supreme Court again adopted Arnold LJ's conclusion that the Delaware Court of Chancery was not an available alternative: on the balance of probabilities, a US court would only adjudicate FRAND terms for US patents.

Comment

It is important to be clear about what the Supreme Court has and has not decided. It has not held that pool or platform administrators are themselves subject to the FRAND obligation, or that the only FRAND licence for any particular licensor's SEPs must be the global platform licence. These questions will now return to the Patents Court to be decided on the merits.

What the decision does establish is that those are serious issues to be tried, that the English courts have jurisdiction to consider them, and that the Avanci 5G Platform rate is not beyond the reach of the court simply because it is offered through a platform rather than bilaterally.

The breadth of interest in the appeal (with written interventions from the CCIA, the ICLE, ACT, the FSA and the Motion Picture Association) illustrates that the implications of this decision extend well beyond the automotive sector, into consumer electronics, streaming services, IoT devices and beyond.

The funding marks an important milestone for LemonEdge as it continues to scale its platform for the private markets sector. The new funding will support the company’s continued growth, expansion of its client base and delivery of its 2026 and 2027 innovation roadmap.

David T. O’Malley, CEO of LemonEdge, said: “LemonEdge was built to simplify the complexity of the rapidly scaling private markets space, with global private market AUM forecast to reach $26.7tn by 2030. Legacy systems froze, and, as a result, many of the most sophisticated private market firms in the world are being held back by tools that were not designed for the complexity they face today. With this new funding, we plan to continue to address these major gaps and accelerate growth over the next 12 months, by bringing on a significant number of new clients and rapidly deploying our 2026 and 2027 innovation roadmap.”

James Court, Managing Associate at Mishcon de Reya, commented: “LemonEdge is tackling a significant challenge in the private markets space with technology designed for the needs of an evolving industry. Its platform is helping to modernise partnership and fund accounting infrastructure at a time when firms are under increasing pressure to operate more efficiently and at greater scale. We are pleased to have supported David and the LemonEdge team on this important transaction and look forward to seeing what the future holds for them.”

Request a consultation

UK: new rules on operational Incident and third-party reporting

On 18 March 2026, the Financial Conduct Authority (FCA), the Prudential Regulation Authority (PRA), and the Bank of England published final policy statements introducing a co-ordinated framework for operational incident and third-party reporting (FCA PS26/2 and PRA PS7/26). The new rules will be enforceable from 18 March 2027, giving firms a 12-month implementation period.

The framework represents a significant evolution from the existing regime, under which reporting obligations were linked to the concept of impact tolerances and firms were required to notify regulators if they were unable to remain within tolerable levels of harm. Under the new rules, firms will notify incidents linked to service disruption or data loss (similar to DORA incident reporting rules – see below). This is because the concept of impact tolerances will not be relevant to all firms in scope and some of the incidents will need to be reported even if there is no impact on the tolerance levels.

Reporting triggers in the UK are regulator-specific: consumer harm for the FCA, safety and soundness of the firm for the PRA and FCA, and market stability and integrity for the FCA. One of the central aims of the new framework is to harmonise incident reporting across the financial sector.

The reporting process will be standardised for payment service providers (PSPs) in the same way as for other financial firms, and compliance with the new framework will satisfy the equivalent obligation under the Payment Services Regulations, avoiding duplication. PSPs retain a tighter initial notification deadline of four hours from first detection, consistent with their existing obligations, whilst other firms must provide an initial notification within 24 hours.

For firms dual-regulated by both the PRA and the FCA, a single report will be submitted through the FCA Connect portal. This applies where an incident simultaneously meets the FCA's consumer harm threshold and poses a risk to the firm's safety and soundness, thereby meeting the PRA threshold. Reporting obligations should be clear to InfoSec teams: in some circumstances, at a dual-regulated firm with EU operations, a single incident could simultaneously engage the FCA/PRA 24-hour trigger, DORA's initial notification, UK GDPR's 72 hours, and the PSR four-hour clock.

Incident definition and reporting tiers

An operational incident is defined as "either a single event or a series of linked events which disrupts the firm’s operations such that it: disrupts the delivery of a service to an end user external to the firm; or impacts the availability, authenticity, integrity or confidentiality of information or data relating or belonging to such an end user."

This now aligns to the definition of an ICT-related incident under DORA, a single event or a series of linked events that compromises the security of network and information systems and has an adverse impact on the availability, authenticity, integrity, or confidentiality of data or services.

thresholds for reporting are not strictly set as for major incidents under DORA. However, an example given is broadly similar to the thresholds under DORA: for PSPs, an incident must be reported where it affects more than 10 per cent of payment transactions totalling more than £100,000, and affects more than 10 per cent of payment service users or more than 5,000 users in total. Unlike DORA, the UK thresholds are illustrative rather than prescriptive, affording firms a degree of judgement in their application.

framework introduces two tiers of reporting: a standard tier, applicable to all in-scope firms, and an enhanced tier, which applies to a subset of firms and is also open to other firms on a voluntary basis.

reporting:

firms must submit an initial notification within 24 hours of first detecting a reportable incident (or within four hours for PSPs, in line with their existing obligations), followed by an intermediate report and a final report within 30 days of the incident concluding.

reporting (applies to the following firm types):

• Enhanced scope SMCR firms
• Banks
• Designated investment firms
• Building societies
• Solvency II firms
• CASS large firms
• Payment service providers
• UK RIEs
• Registered trade repositories
• Registered credit rating agencies

What do firms' notifications tell us? FCA observations one year on

On 27 March 2026, the FCA published its Operational Resilience: Insights and Observations One Year On report (the FCA Observations Report), reviewing good and poor practice from firms' annual operational resilience self-assessments following the end of the transition period on 31 March 2025.

The FCA identified several areas where further improvement in compliance is needed:

• Third-party vulnerabilities: firms must improve their identification, assessment, and remediation of third-party vulnerabilities. The FCA found that many firms focus disproportionately on technology, whilst insufficiently addressing risks arising from third-party dependencies.
• Scenario testing: scenario exercises should include sufficiently severe scenarios to provide evidence that the firm can remain within its impact tolerances. The FCA noted concern that some firms assert that no scenario exists from which they could not recover, without providing evidence of having tested adequately severe scenarios.
• Scenarios should also account for consumer harm and market impact.
• Vulnerability reporting: a number of self-assessments lack sufficient detail on the framework and end-to-end process for vulnerability identification and remediation.
• Communications strategies: firms are expected to maintain tested internal and external communications strategies capable of operating during a disruption, including contingencies for the loss of usual communication channels. Communications strategies must be documented and exercised as part of scenario testing.

EU: DORA and NIS2 updates

DORA's First Incident Report

The European Supervisory Authorities (the EBA, EIOPA, and ESMA, together the ESAs) published their first annual report on major ICT-related incidents in June 2026, based on data reported to competent authorities during 2025. The report provides the first bloc-wide incident benchmark since DORA became fully applicable in January 2025.

The ESAs' report analysed the 3,383 major ICT-related incidents reported to competent authorities across the EU in 2025, averaging approximately 282 incidents per month. The report offers both encouraging findings and areas of concern.

Encouraging findings:

• Only 10 per cent of major incidents were cybersecurity-related, predominantly Denial of Service (DoS) attacks, data exfiltration and manipulation, and identity theft. The report attributes the low proportion of successful attacks to the effective use of safeguards and detection mechanisms by financial entities. Ransomware attacks were concentrated in the insurance sector, which the ESAs link to the high volumes of sensitive health and financial data that insurers hold. Firms should continue applying the highest cybersecurity standards to preserve this.
• The majority of incidents were reported by the credit sector (over 60 per cent) and the payment sector (16 per cent). The ESAs note that this is partly because entities in these sectors were already subject to major incident reporting under PSD2, and partly because of the nature of the services they provide. Credit institutions and payment institutions operate some of the most "digitally intensive and consumer-facing services in the financial system, such as payments, online and mobile banking, and card processing, which are used at massive scale every day." Firms operating in less digitally intensive sectors are likely to have a significantly lower exposure to major ICT incidents.
• The direct impact of major incidents on clients, transactions, and financial counterparties was generally limited resulting in minor disruption. Where a heavier impact on clients was observed, it was concentrated in the credit and payment sectors, which the ESAs attribute to those sectors' large and frequently active customer bases.

Areas of concern:

• Around one third of major incidents were caused by failures at third parties, including ICT third-party service providers, infrastructure providers, and other financial entities. In many cases, this required financial entities to agree and implement additional safeguards with their third-party providers after the incident. The report also notes that around one third of all reported incidents had a cross-border impact, underscoring the growing interconnectedness of the EU financial sector through shared infrastructure and services.
• System failures (accounting for 51 per cent of all major incidents) and external events such as energy blackouts (27 per cent) were the principal drivers of major large-scale incidents. The April 2025 Iberian Peninsula energy blackout is a notable example, causing disruptions across all sectors.
  
  This illustrates that even where an organisation has implemented the highest cybersecurity standards, it remains vulnerable to business disruptions originating from external events. Proper technical testing, robust business continuity plans and tackling resilience issues are therefore essential for compliance with DORA.

Looking ahead, both the ESAs' DORA report and the UK FCA Mills' Review warn that cybersecurity threats are likely to intensify. The 'uplift' to attackers from more capable AI tools means that risks may spread more quickly across the increasingly interconnected financial system and this is an area regulators are interested in.

Financial entities should treat this as a prompt to review and strengthen their cybersecurity programmes now, rather than waiting for the next incident. The report underlines contemporary cyber security strategy – focusing on rapid detection, and efficient and effective response over pure protection. Incidents will happen, but reducing the impact ultimately is the place to be.

NIS2 implementation

The transposition deadline for the NIS2 Directive passed on 17 October 2024, yet a significant number of EU Member States missed it. By early 2026, the majority had completed transposition, many following infringement proceedings initiated by the European Commission.

Of the remaining Member States, the Commission has now referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the EU for failing to complete transposition and proposed targeted amendments to NIS2 in January 2026 to increase legal clarity, with the Dutch Senate acting to implement just ahead of referral.

The UK critical third parties regime

As of 13 July 2026, the Bank of England, the Prudential Regulation Authority (PRA), and the FCA started overseeing the first critical third parties (CTPs), with the intent to manage the resilience of the critical services these provide to the UK financial services sector.

The Treasury has announced the first designations of global cloud services and technology providers: Amazon Web Services, Google Cloud, Microsoft, and Oracle.

These providers are deeply embedded across organisations, creating new forms of systemic risk for the economy.

Register your interest for a free consultation

Request a complimentary 30-minute consultation with a Mishcon expert on your organisation's cybersecurity compliance.

Request a consultation

The transaction brings together two highly respected names in legal pricing and AI innovation, with the aim of helping law firms improve profitability and commercial performance.

Ayora was incubated in MDR Lab, our programme for early-stage technology companies, and Mishcon de Reya is also a customer of the business. We have supported Ayora from the early stages of its development through to this latest milestone.

The acquisition follows Ayora's partnership with BigHand, announced last quarter. The first phase will bring Ayora's data enrichment technology and agentic workflows together with BigHand's Matter Pricing solution, with combined capabilities expected later this year. The businesses also intends to extend Ayora's AI technology into areas where BigHand already has an established presence, including resource management and business intelligence.

Andrew Wolfin, Partner at Mishcon de Reya, commented: “This is a really satisfying success story – having supported Ayora through MDR Lab and worked closely with the business as a key enterprise customer, we are especially delighted to have advised Stefan and the team through the next stage of its development. This deal is a great example of our commitment to advising ambitious, fast-growing businesses, and to helping advance a more tech-enabled legal sector.”

Stefan Ciesla, CEO and co-founder of Ayora, commented: “Ayora was incubated in MDR Lab in 2023, and Mishcon has been a valued customer ever since. It therefore felt particularly fitting to have the firm advise us on this important milestone. Andrew and his team were outstanding throughout, expertly guiding us through the complexities of the transaction and offering pragmatic solutions at every stage. They were also an absolute pleasure to work with. We could not have been in safer hands.”

Ayora said that joining BigHand will enable it to bring its technology to more firms, more quickly, while continuing its mission to empower legal transformation through better data.

The Mishcon de Reya team was led by Andrew Wolfin and Becki Quick, who were supported by Hannah Leaf and Liron Cohen.

Why do you need a parental order in England and Wales?

In England and Wales, the person (so in the case of surrogacy, the surrogate) who gives birth is the child's legal mother, regardless of genetics or intention. A parental order transfers legal parenthood from the surrogate (and, in some cases, their spouse or civil partner) to the intended parent(s), giving them permanent legal recognition as the child's parents. You can only have 2 legal parents in England and Wales. 

How long does it take to get a parental order?

The process typically takes around 9 to 12 months, although timescales can vary depending on the court and the individual circumstances of the case. An application is made 6 weeks after the birth of the child and before 6 months. 

Top 5 things to think about when starting a surrogacy journey

• Talk to other people who have been through the journey so you can ask questions and chat through their experiences - you don't know what you don't know! 
• Get specialist legal advice early, especially for international surrogacy journeys where you need advice in multiple jurisdictions. 
• Understand the fertility and medical process and who can assist you with different stages of the process.
• Think ahead about the practical arrangements after the birth. E.g. if you are on an international journey need to stay in that country for a period after birth, take time off work and receive medical care for your baby. If you already have children, you should consider what their arrangements will be during this period.
• Obtain immigration advice if it's an international journey to find out if you can pass down your nationality, what passports your baby is entitled to and timings to get home. 

Can I do a surrogacy journey as a single applicant?

Yes. Since 2019, single people have been able to apply for a parental order in England and Wales, provided they meet the criteria. This means surrogacy is an option for single intended parents as well as couples.

Do I need to be genetically linked to my child if they are born via surrogacy and if so, what other options are there to become the legal parent of my child?

To obtain a parental order under the current law in England and Wales, at least one intended parent must have a genetic link to the child. If there is no genetic link, a parental order is not available, but adoption may be an alternative route to becoming the child's legal parent, depending on the circumstances.

How do I bring the baby home?

If you are on an international journey, you should seek specialist immigration advice. The route home will depend on your/your partner's nationality and citizenship.

What about costs?

Commercial surrogacy is illegal in England and Wales, but the courts recognise that people travel abroad for commercial surrogacy arrangements. The costs of an international journey can fluctuate. We strongly recommend using reputable service providers on well-trodden routes that have clear and supportive local laws regarding surrogacy arrangements. For domestic surrogacy, only "reasonable expenses" can be paid to the surrogate. You should keep a record of all costs from the start of the process, as the court will expect you to be fully transparent with the costs incurred. 

• A series of targeted amendments to existing legislation governing the UK's Register of Overseas Entities (the ROE) came into force on 9 July 2026.
• The most significant change is that when a member of the public applies to see protected trusts information on the ROE, they will no longer be required to state the relevant trust's name.

What is the Register of Overseas Entities and how does trust disclosure work? 

Overseas entities which hold title to qualifying UK real estate are required to be registered on the ROE at Companies House. The ROE makes public "registrable beneficial owners", i.e. those with the requisite level of control over the overseas entity.

Where any registrable beneficial owner is a trustee, they must provide certain information about the trust to Companies House, including details of beneficiaries, settlors, grantors and other "interested persons". This information is not public but it is possible to apply to Companies House to access that information. Until recently, in order for an application to be granted by Companies House, it was necessary to include in the application the name of the relevant trust.

What are the key changes to the Register of Overseas Entities disclosure rules?

In practical terms, the changes alter the protection and disclosure regime in these key ways:

1. Removal of requirement to state the trust's name: perhaps the most significant change is that the requirement to name a trust when applying for disclosure is removed. This will make it easier to apply to access trust information, for example, by using the name and registered number of an overseas entity that is publicly available on Companies House.
2. Registrar can protect a minor's data while releasing other trust information: on the trust disclosure side, the changes address a gap whereby previously the presence of a minor in a trust structure could effectively block disclosure of all trust information. Under the new legislation, the Registrar will be able to release information relating to other trust participants while still protecting the minor's data.
3. Evidence no longer required to suppress residential address from the ROE: before the changes were made, it was possible to apply to suppress a relevant individual's residential address from the ROE, provided evidence was submitted that the relevant individual lived at that address. The requirement to provide supporting evidence when applying for suppression of personal information has now been removed. The amendments may reduce the administrative burden on individuals who struggle to obtain formal evidence. A service address must still be provided as a replacement for any suppressed residential address, preserving a degree of public accountability for persons connected to active overseas entities.

A June amendment to the draft regulations first published in April corrected what appeared to be a drafting error which had narrowed the class of persons eligible to make a protection application under the third change above to registrable beneficial owners and managing officers only. Had this been retained, settlors and beneficiaries would have been excluded from that class.

What will the impact of the latest Register of Overseas Entities reforms be? 

Giving members of the public the ability to access protected trusts information on the ROE at Companies House is a significant change. The other amendments made to the ROE reflect an attempt to balance privacy with transparency, easing certain procedural requirements for individuals seeking protection of their personal data, while adjusting the disclosure regime to prevent minor-related protections from being used to shield wider trust information.

How Mishcon de Reya can help

The changes to the Register of Overseas Entities may have important implications for trustees, settlors and beneficiaries. Our Private Wealth and Tax team advises clients on trust structures, transparency and disclosure obligations, helping them navigate evolving reporting requirements and protect their interests in an increasingly transparent regulatory environment.

Aarti Thakor, a Partner in the Charities and Social Ventures team at Mishcon de Reya, has written a piece The EU Global Facility on AML/CFT. It examines the financial sanctions frameworks in England, France and Germany, and the challenges they present for organisations working internationally, from asset freezes and restrictions on economic resources to due diligence, banking access and terrorist financing risk.

Read the full article.

Agatha, who died in May this year, was a talented and well-loved young lawyer who joined Mishcon de Reya as a trainee in 2022 and qualified into the Reputation Protection and Crisis Management team in 2024, becoming an integral and well-loved member of the firm.

Developed in consultation with Agatha’s family, the initiative comprises two complementary elements: the Agatha Hunt Award for Outstanding Contribution to Responsible Business and the Agatha Hunt Bursary Fund at the University of Sheffield. Together, they will celebrate Agatha’s values and create opportunities for future generations of law students and junior lawyers to make a difference in their communities.

The Agatha Hunt Award for Outstanding Contribution to Responsible Business will recognise colleagues who demonstrate an exceptional commitment to mentoring, volunteering and pro bono service — qualities that defined Agatha's contribution to the firm and wider society. It will be introduced as part of Mishcon de Reya’s annual Responsible Business Awards programme. The inaugural Agatha Hunt award will be presented posthumously to Agatha, with the honour accepted by her family. Future recipients will receive a physical award and the opportunity to nominate a charity to receive a £500 donation.

In parallel, the firm is establishing the Agatha Hunt Bursary Fund in partnership with the University of Sheffield Law School, where Agatha studied and remained actively involved after graduation. During her time at Sheffield, Agatha served as a lead volunteer in the University's pro bono clinic and continued to support mentoring initiatives long after joining the profession. The dedicated fund will provide flexible support for law students, including pro bono bursaries, mooting competition sponsorship and academic prizes awarded in Agatha's memory.

To establish and sustain the fund, the firm has committed £50,000 between now and 2032 to kick start a broader fundraising programme involving colleagues, trainees and members of Agatha's family and her friends, who will continue to play an important role in shaping and supporting the initiative.

A legacy of giving back

Agatha was widely admired across the firm for her energy, generosity and unwavering commitment to helping others. Throughout her career, she dedicated countless hours to pro bono and community initiatives, often going above and beyond to support vulnerable individuals and broaden access to justice.

Her contributions included:

• Providing pro bono advice to litigants in person through the Royal Courts of Justice Advice Centre.
• Volunteering with SPITE, supporting individuals affected by image-based abuse.
• Mentoring students through GROW Mentoring and the Sutton Trust, helping young people access opportunities within the legal profession.
• Supporting asylum seekers through Speak Street, helping participants develop English language skills and confidence.
• Supporting numerous pro bono matters relating to data breaches, reputation management, Ofcom submissions and other legal claims.
• Participating in the London Legal Walk, the Centrepoint Sleep Out, and volunteering in support of Brain Tumour Research.
• Leading fundraising efforts for Arts for All and serving on departmental responsible business committees.
• Supporting inclusion initiatives across the firm, including celebrations for Lunar New Year and Diwali.

Agatha's enthusiasm for service extended far beyond any single programme. She brought people together, inspired colleagues to become involved and consistently demonstrated the positive impact legal professionals can have in their communities.

Emma Woollcott, Partner and Head of Mishcon de Reya’s Reputation and Crisis Management team, of which Agatha was a member, commented:

“Agatha placed the highest value on generosity of spirit. She was always the first to volunteer to support others and to collaborate on initiatives which benefited our clients and our community. She understood the privilege of being a lawyer and used her skills and experience to help others to access their rights and to fulfil their potential. I am extremely proud that we are honouring her life in this way and continuing her legacy of empowerment and commitment to public service.”

Agatha's family said:

"Agatha loved being a student at the University of Sheffield and considered it a privilege to pursue her dream law career at Mishcon de Reya. We are immensely proud of Agatha, who approached everything with passion, dedication, kindness and an unwavering determination to do the right thing. Agatha gave her time, energy and heart to so many people and we know how much joy she found in making a positive difference. We hope this award and fund will inspire others to continue the same sense of purpose and care for others that defined Agatha's life. Whilst nothing can fill the void left in our lives, knowing Agatha's name will live on is a great comfort to us."

Sheffield University commented:

“Agatha was a proud Sheffield graduate whose talent, generosity and compassion were evident throughout her degree and extended far beyond her time as a student. Agatha was an engaged and committed student; she volunteered with the University's CommLaw pro bono clinic, rising to become a group leader, mentoring other students with great skill and good humour. She took the opportunity to study abroad for a year of her degree. After graduating with a First Class Law degree in 2020, she volunteered her time with the University to share her knowledge and experience to encourage and advise students as they looked to build their future careers. Agatha’s impact on our university community is remembered with great warmth and honoured through the Agatha Hunt Bursary Fund, established in her memory.”

The Agatha Hunt Memorial Fund will officially launch later this year, with fundraising activities commencing across the firm imminently. The first Agatha Hunt Award for Outstanding Contribution to Responsible Business will be presented as part of the annual Responsible Business Awards programme. A JustGiving page has been set up to raise money for the Agatha Hunt Bursary Fund at the University of Sheffield.

• The EU Corporate Sustainability Reporting Directive (CSRD) applies to companies and groups headquartered outside the EU, if they generate more than €450 million in EU turnover and have an EU subsidiary or branch with turnover exceeding €200 million.
• Such businesses will be required to make sustainability disclosures in line with European Sustainability Reporting Standards (ESRS) from 2029, for financial years beginning on or after 1 January 2028.
• They have three options for this: apply a new, dedicated set of standards for non-EU companies (ESRS-40a) on a global basis; apply ESRS-40a using a "mixed approach" that limits the scope of certain disclosures to EU operations; or apply the full ESRS required of large EU businesses.
• Analysis of the ESRS-40a consultation draft, published on 23 July 2026, suggests that proposed simplifications may prove illusory for many in-scope organisations, including UK parent companies of groups already preparing to comply with incoming UK Sustainability Reporting Standards (UK SRS).
• For several reasons, including the potential to relieve EU subsidiaries of their own separate reporting obligations, we believe many such businesses would be better served by adopting the full ESRS framework, rather than the ostensibly simpler ESRS-40a standards.
• Either way, now is the time for such businesses to confirm whether they are in scope of EU reporting obligations, to model and make strategic decisions about their reporting options, and to engage in the consultation process to help refine ESRS-40a standards before they are finalised.

What is ESRS-40a and who is it for?

ESRS-40a is the new name for what has previously been referred to as Non-EU ESRS (N-ESRS) or ESRS for Third Countries (ESRS-TC). This dedicated set of standards defines the sustainability reporting obligations of undertakings in scope of article 40a of the Accounting Directive. Following Omnibus amendments, that means non-EU undertakings that:

1. Had EU turnover of more than €450 million (at a group or individual level) in each of the last two consecutive years; and
2. Have an EU branch or subsidiary that generated more than €200 million turnover in the previous financial year.

The stated objective of ESRS-40a reporting is to ensure that there is a level playing field for businesses operating in the EU market, as well as to ensure transparency on impacts on people and the environment of non-EU businesses with significant EU activities.

What does ESRS-40a actually do?

ESRS-40a mirrors the 12-standard structure of the recently revised core ESRS (two cross-cutting standards plus 10 topical standards). It also covers substantially similar disclosure requirements across governance and strategy, management of material sustainability matters through policies and actions, and metrics and targets.

However, some fundamental policy choices distinguish it from the reporting regime for EU undertakings, most notably:

How much does ESRS-40a really simplify?

Cutting mandatory data points by more than 60 per cent and total data points by more than 70 per cent, revisions to the full ESRS adopted by the Commission on 3 July 2026 have already done a lot of heavy lifting in terms of simplification. It is questionable what ESRS-40a contributes over and above those revisions. If anything, the proposed mixed approach adds greater complexity, and the removal of RORD disclosure requirements is perhaps not as burden-reducing as it first appears.

For reasons expanded upon below, the benefits of deleting E1-2, E1-3 and E1-11 are likely to prove illusory for non-EU entities already committed to IFRS or equivalent reporting standards. While representing a genuine burden reduction for non-EU entities with no such existing commitments, the large, multinational groups most likely to meet CSRD scope thresholds are precisely those least likely to be in that position.

Just as significantly, the impact materiality work that companies generally find more challenging — the hard work of mapping actual and potential negative impacts across complex, geographically dispersed value chains — remains substantially intact.

Reporting standards focused on impacts are not inherently simpler if a company does not yet have well-developed systems and processes for identifying, assessing and mitigating those impacts.

Is there a compelling case for non-EU undertakings applying full ESRS instead of ESRS-40a?

In-scope non-EU undertakings are offered three alternative approaches for meeting their reporting obligations. They can:

1. Report in line with ESRS-40a on a global basis, applying the standards' disclosure requirements to their operations worldwide;
2. Report in line with ESRS-40a using the mixed approach (as described above), limiting disclosure of non-climate impacts to those arising in the EU; or
3. Report in line with the full ESRS, as required of large EU undertakings.

For reasons we explore below, for many non-EU groups, the third option may prove more advantageous than it initially appears:

What should non-EU undertakings be doing now?

How can Mishcon Purpose help?

Mishcon Purpose — our interdisciplinary ESG and sustainability practice — advises corporates and private interests on evolving ESG risks and opportunities, and development and implementation of strategy and governance frameworks to address them. By combining expert lawyers and sustainability professionals, our team balances compliance with strategic foresight, not only helping clients to mitigate risk, but also to seize opportunities to lead and benefit from sustainable transition.

To discuss your biggest challenges and ways we can help, get in touch.

In this article, Aarti Thakor, a Partner in the Charities and Social Ventures team at Mishcon de Reya, and Dawda Jawara, Deputy General Counsel at The Children's Investment Fund Foundation, examine the evolving challenges facing organisations delivering international programmes, from sanctions and counter-terrorism compliance to governance, due diligence and risk management.

The article explores the practical frameworks that can help organisations navigate uncertainty while continuing to pursue their charitable objectives responsibly and effectively.

Read the full article.

• Despite ongoing peace talks, the conflict in Iran is already giving rise to disputes, including a recent case before the English High Court. We are likely to see further litigation emerge, especially if the current phase of negotiations fails.
• The United States’ sanctions policy toward Iran continues to be in flux, leaving businesses to navigate an unpredictable landscape in which compliance positions can shift within days.
• Given the protracted nature of the conflict, the UAE has entered a new phase, putting in place permanent mitigations to reduce reliance on the Strait of Hormuz.
• As uncertainty over the conflict and access to the Strait of Hormuz continues, parties operating in the region should consider what litigation risks they face and may want to explore litigation as a means of recouping their own losses.

Following our recent articles on the impact of the Iran war on Russia sanctions and proposed tolls in the Strait of Hormuz, Mishcon de Reya's London and Dubai offices bring you an update on current sanctions and litigation risks in light of the latest developments in the conflict.

What litigation risks arise out of the Iran conflict?

Since the Memorandum of Understanding (MOU) between the US and Iran was declared "over" by President Trump in early July 2026, the conflict between the two nations has quickly re-escalated. Despite continued negotiations, the sustained and volatile nature of the conflict means we are likely to see an increasing volume of commercial litigation, principally driven by two converging factors.

First, existing clauses in commercial contracts may not contain sufficient flexibility to address the materially changing risk environment in the region and operational disruption arising out of the conflict. Delay and higher costs in performing contractual obligations are likely to be a recurring flashpoint, whether resulting from vessels being re-routed, ordered off port, or unable to transit the Strait of Hormuz. English law typically imposes a high threshold before performance under a contract is considered to be "impossible". Failing to perform contractual obligations as a result of higher associated costs will, absent clear wording in the contract, generally not excuse a party from breach. These operational challenges may also cause tension between charterers and owners when deciding on a safe course of action. Clauses concerning the impact of war, such as force majeure provisions, may well also be triggered – a risk that may widen in geographic scope as Yemen's Iranian-allied Houthi rebels threaten vessels in the Red Sea. Beyond disputes arising out of operational disruptions, parties should also expect to see insurance coverage disputes come to the fore.

Secondly, the cessation of hostilities under the MOU in June, and more recently the short ceasefire in late July, will have provided parties with the time and stability to consider their legal position and convert potentially paused disputes into formal proceedings. The renewal of hostilities following the MOU will also have made clear that a resolution to the conflict will not be straightforward. As a result, parties who may otherwise have been prepared to wait for a peace deal, in the hope that normal contractual performance would soon resume, may now be more motivated to start proactively seeking redress for losses they have suffered.

Sanctions exposure, already a key risk when dealing with Iran, has also become more complicated as the diplomatic position changes, and may well become a further source of disputes in connection with, for example, any payment of tolls to Iranian entities.

View from the US

The current status of the MOU is best described as suspended. Signed as a political framework only, and carrying no legal effect, the practical significance of the MOU lay in the US Office of Foreign Assets Control’s (OFAC) implementing actions described below. Although the parties are reportedly continuing discussions, none of the US government’s sanctions-related undertakings have been implemented and Iran remains subject to comprehensive US sanctions.

The MOU established a framework for broader negotiations between the United States and Iran, including an undertaking by the United States to terminate sanctions against Iran. On 22 June 2026, the US government took the first concrete step outlined in the MOU when OFAC issued General Licence X (GLX). GLX temporarily authorised the production, delivery and sale of crude oil, petrochemical products and petroleum products of Iranian origin to 21 August 2026, as well as associated activities and services necessary to facilitate these activities (i.e. shipping, port operations, insurance underwriting, financing and US dollar payments to Iran). However, following Iranian attacks on commercial vessels in the Strait of Hormuz in early July, President Trump declared the parties’ ceasefire was “over” and OFAC revoked GLX on 7 July 2026.

GLX was superseded by General Licence X1 (GLX1), effectively removing the sanctions relief that had been granted in GLX. However, GLX1 granted a ten-day wind down period for businesses that had begun activities under GLX, provided that any payments due to a blocked person were deposited into a blocked, interest-bearing account located in the United States. There is no general license authorising trade in Iranian-origin oil currently in place: the primary and secondary sanctions directed at Iran that were in place prior to 22 June 2026 currently remain in force.

On 29 July 2026, OFAC designated ten entities and eight vessels reportedly related to Iran’s efforts to "monetize ​the Strait of Hormuz." These recent developments highlight the speed at which US sanctions can change. The fluidity of US sanctions creates uncertainty for any companies seeking to do business in or with Iran.

A crystallised dispute in the UK

Mercuria Energy Trading S.A. v Baltic Exchange Information Services Limited is a key example of commercial litigation arising from the conflict.

Global commodities giant, Mercuria, has brought a claim in the English High Court against Baltic Exchange, a provider of benchmark shipping indices. The claim concerns TD3C, a benchmark tracking freight rate for Very Large Crude Carriers transporting crude oil from the Gulf to China. The reliability of TD3C has been called into question as the route it measures is heavily affected by the effective closure of the Strait of Hormuz. Mercuria claims that the benchmark no longer reliably represents the underlying market it is intended to measure, and that Baltic Exchange breached its contractual or statutory duties by failing to suspend the benchmark. As a result, Mercuria claims to have suffered losses on physical freight contracts and freight derivatives benchmarked to TD3C, which are estimated to be worth hundreds of millions of US dollars. Baltic Exchange denies the claim in full, asserting that it produces its benchmarks according to established and robust governance frameworks, methodologies and oversight processes, and that it has met and continues to meet all its obligations.

The outcome of this case will carry consequences beyond the immediate parties. A Mercuria success would raise questions about how index-linked contracts respond when war, sanctions, or security risks disrupt benchmark routes. Meanwhile, a Baltic Exchange success would confirm that a benchmark can remain assessable in stressed conditions even where it diverges sharply from underlying market reality during a crisis.

The parties appeared before the Court in late July for a case management conference and an expedited hearing is scheduled for 26 October 2026. Meanwhile, there remains scope for future litigation if commodity traders and energy companies with contractual agreements reliant on the same benchmark consider bringing similar claims.

The UAE's response: a permanent mitigation

The conflict has accelerated efforts within the UAE to reduce reliance on the Strait of Hormuz and strengthen alternative trade and energy corridors. A significant development in this strategy is DP World's agreement in principle with the Fujairah Ports Authority to develop two new container and general cargo terminals on the UAE's east coast. Located on the Gulf of Oman, outside the Strait of Hormuz, the facilities are intended to provide an alternative gateway for cargo flows that would otherwise be dependent on transit through the Strait of Hormuz. The project reflects a broader recognition among governments, port operators, cargo interests and other commercial stakeholders that recent disruptions have exposed vulnerabilities in existing trade routes and increased the operational and contractual risks associated with reliance on a single maritime chokepoint.

The same risk-driven approach can be seen in the energy sector, where the UAE has accelerated development of a new West-East Pipeline that is expected to significantly increase the state-owned oil company ADNOC's export capacity through Fujairah and further reduce dependence on the Strait of Hormuz. Together, the Fujairah port and pipeline projects demonstrate how the public and private sector are responding to the disruption experienced during the hostilities by investing in alternative trade and export corridors. While these developments may reduce future exposure to delays, diversions and access restrictions, they also illustrate the extent to which regional businesses are now viewing geopolitical disruption as a structural commercial risk requiring long-term mitigation rather than a temporary operational challenge.

Conclusion

Clearly the position is fast-moving and unpredictable, but given the already protracted nature of the conflict and the length of time before the UAE's mitigation efforts will bear fruit, it seems inevitable that further commercial disputes arising out of the Iran conflict will emerge.

Although parties operating in the region will now be well-versed in dealing with the operational fall-out from the war and closures of the Strait, it will be increasingly important to consider litigation, both as a risk from counterparties and a potential source of remedy while the uncertainty continues.

• R v Osmond is the first reported case which considers the elements of the tipping off offence under Part 7 of the Proceeds of Crime Act 2002 ('POCA 2002').
• The judgment is a helpful clarification – and confirmation – of the scope of the offence for individuals and businesses in the regulated sector who may become aware of investigations into their clients.
• Although the judgment leaves open the prospect that a tipping off offence may not be committed where the investigation is already in the public domain, this will be highly fact specific.
• The judgment also confirms that information leading to a tipping off offence is not restricted to information received in the course of providing a regulated service to a client; it is enough that information is received by the individual in their capacity as "a person carrying on business in the regulated sector".

The offence of "tipping off"

Section 333A(3) of POCA 2002 provides that a person commits an offence if:

1. The person discloses that an investigation into allegations of an offence under Part 7 of POCA 2002 is being contemplated or is being carried out;
2. The disclosure is likely to prejudice the investigation; and
3. The information which the disclosure is based on came to the person in the course of a business in the regulated sector.

In regard to (b), it is not necessary that the disclosure actually prejudices the investigation, but only that prejudice is "likely". It is also not a defence if no prejudice is caused by the disclosure.

In regard to (c), the requirement is that information is obtained in the "regulated sector". For the purpose of R v Osmond, the regulated conduct was "the participation in financial or real property transactions", which explicitly includes "the buying and selling of real property […] or business entities".

The mental element required for a tipping off offence is found in section 333D(4): a person does not commit a tipping off offence if the person "does not know or suspect that the disclosure is likely to have the effect mentioned in section 333A(3)(b)", ie. of prejudicing the relevant investigation.

Case background

Mr William Osmond was the senior partner of a law firm, Osmond and Osmond Solicitors. In 2013, Mr Osmond acted for his long-standing client, Mr James Ramsay, when he provided a £4 million loan, which the borrower put towards a purchase of an £8 million residential property in Mayfair. As Mr Ramsay routed this loan through an offshore company, Mr Osmond dealt with the purchase of a new "off-the-shelf" British Virgin Islands company through which to grant the loan. Mr Osmond also prepared the relevant loan documentation. The £4 million was then paid into Mr Osmond's client account and transferred onwards to the borrower and purchaser of the residential property.

Mr Ramsay's £4 million loan came to the attention of the Serious Fraud Office ('SFO') during its investigation into a company called Eurasian Natural Resources Corporation Limited ('ENRC'). This investigation began in 2013 and was prompted by allegations of fraud, corruption and money laundering. During the SFO's investigation, it transpired that the recipient of Mr Ramsay's loan and purchaser of the £8 million Mayfair property was the wife of a senior ENRC official and daughter of one of ENRC's founders.

On 7 June 2018, Mr Osmond received a call from an SFO investigator regarding the Mayfair property purchase; Mr Osmond was requested to provide documents related to the loan transaction, details of his client relationship with Mr Ramsay and details of the explanation given by Mr Ramsay for contributing to the borrower's purchase price. The SFO investigator followed up with Mr Osmond in writing on 15 June 2018, sharing a formal notice under the Criminal Justice Act 1987 (CJA 1987), with more detailed requests and questions which could assist the ENRC investigation. Unbeknownst to the SFO investigator, Mr Osmond had at this stage already telephoned Mr Ramsay on 8 June 2018 about the SFO's enquiries and travelled to Malta (Mr Ramsay's country of residence) on 14 June 2018 and returned to the UK the following day.

At first instance, Mr Osmond was also found guilty of forgery under section 1 of the Forgery and Counterfeiting Act 1981 ('F&CA 1981'). This arose because, when asked by the SFO investigator to provide a copy of the engagement letter provided to Mr Ramsay for the loan transaction, Mr Osmond created a false letter of engagement back-dated to five years prior – 24 October 2013 – and provided this to the SFO. On the contrary, no such engagement letter existed between Mr Osmond and Mr Ramsay at the relevant time.

Trial

The issues at trial in Mr Osmond's case broadly fell under three categories:

• Investigation in public domain: At first instance, an argument was made on Mr Osmond's behalf that his disclosure of information related to the SFO's enquiries was not capable of prejudicing the investigation because the ENRC investigation was already widely publicised and inevitably already known to Mr Ramsay (and anyone connected with ENRC). The prosecution's position was that the "investigation" capable of being prejudiced was not the entire ENRC investigation, but rather a separate investigation in relation to the Mayfair property purchase which Mr Ramsay provided financing for.
  
  HHJ Trowler KC made a pre-trial ruling in favour of the prosecution, finding that "there is no sensible basis on which it can be argued that a person cannot commit the offence of 'tipping off' simply because the broader investigation is already
  known to the relevant parties".
   
• Context of receiving information: An argument was also made at first instance that the information about the investigation into the property purchase was not received by Mr Osmond "in the course of his business in the regulated sector" – rather, he had received information about an already well-known investigation from a prosecuting authority exercising its powers under section 2 of the Criminal Justice Act 1987 ('CJA 1987'). The prosecution's position was that Mr Osmond received the information in the course of his business as a lawyer, being a business in the regulated sector, and asked questions in his capacity as Mr Ramsay's solicitor.
  
  On this point, HHJ Trowler KC made a pre-trial ruling in favour of the prosecution's position. To the question whether the information came to Mr Osmond in the course of a business in the regulated sector, she ruled: "in my view […] the only possible answer to this question is 'yes'."
   
• Duty of recipient of forged letter: With regards to the forgery offence, Mr Osmond's counsel argued that the engagement letter was not received by the SFO investigator "in connection with his performance of any duty" (a requirement of the offence under section 10 of the F&CA 1981); rather, the SFO had a power to carry out an investigation but no duty to do so. This was rejected by the Judge at first instance on the basis that the SFO investigator had a duty to his employer to carry out the investigation.

In relation to the tipping off offence, the jury were then directed that a tipping off offence will have occurred if the jury was sure that: (i) Mr Osmond disclosed an SFO investigation into the Mayfair property purchase to Mr Ramsay; (ii) the disclosure was likely to prejudice the investigation; (iii) Mr Osmond knew or suspected prejudice was likely to be caused; and (iv) the information related to the disclosure was likely to have the prejudicial effect in question.

The jury convicted Mr Osmond on both counts of tipping off and forgery. He was later sentenced to nine months' imprisonment suspended for 18 months.

Appeal

The application for leave to appeal on Mr Osmond's behalf argued that the following matters for the jury were unfairly narrowed by HHJ Trowler KC:

1. The information had come to Mr Osmond from the prosecuting authority – not in the course of a business in the regulated sector. This was contrary to the purpose of Part 7 of POCA 2002, which was intended to criminalise a situation where Mr Osmond himself made a report to a designated authority and thereafter informed Mr Ramsay of his own report.
2. It was for the jury to decide what the SFO investigation was and whether the Mayfair property purchase investigation was merely a part of the already well-known ENRC investigation. Had the jury found that the property purchase investigation was part of the wider ENRC investigation, then the jury's decision as to the likelihood of prejudice arising as a result of the investigation would have been different.

In respect of (a), the Court of Appeal found that Mr Osmond was "undoubtedly" a business in the regulated sector and the source of the information given to Mr Osmond was immaterial to the tipping off offence:

"51.       The fact that the information about the SFO investigation came from the SFO does not assist the defence. That is precisely what paragraph (c) of subsection (3) is directed towards. Its objective is to prevent a person carrying on business in the regulated sector from tipping off their client that an investigation by the SFO or other agency is under way. The subsection is not concerned with the source of the information (which will typically be the SFO or other investigating agency) but with the capacity in which the defendant receives it."

In respect of (b), the Court of Appeal found that "there is no reason why an investigation should not be capable of being the subject of a disclosure under section 333A(3) even if that investigation is also an aspect of (or strand within) a wider investigation". It followed that the SFO were entitled to advance a case that the relevant investigation was in relation to the Mayfair property transaction, rather than the wider ENRC investigation. The Court noted that any case advanced on the basis that the relevant investigation for the purposes of section 333A(3) was the ENRC investigation – which was in the public domain and known to Mr Ramsay - 'would have been bound to fail.'

In relation to the forgery conviction, the Court of Appeal also rejected an argument on Mr Osmond's behalf that it should have been open to the jury to conclude that the SFO investigator was not performing any relevant duty when he received the engagement letter.

Accordingly, the Court refused leave to appeal, but, as the case represented the first occasion the tipping off provisions had been considered by the Court of Appeal, gave leave for the judgment to be cited and reported. 

Key observations

The tipping-off offence in the regulated sector under s.333A POCA, together with the broader offence of prejudicing a money laundering investigation under s.342 POCA, has long created a difficult tension for professionals who have submitted a Defence Against Money Laundering (DAML) request or Suspicious Activity Report (SAR) and are subsequently unable to explain the resulting delay to their client. The judgment in R v Osmond serves to underscore the importance the risks associated with disclosure to a client in the context of a potential money laundering investigation.

Although individuals in regulated sectors may take comfort from the finding in the judgment that a tipping off offence may not be committed where the investigation is already in the public domain and known to an individual, this should be approached with caution. The reality of money laundering investigations is that it will seldom be possible for any third party to be confident as to the scope or substance of the investigation, particularly in complex or long-running investigations with multiple strands.

In practice, the safest course remains to assume that any disclosure of an investigation to a client carries a risk of prejudice, however public the wider matter may appear, and to apply caution or seek advice before communicating with a client whose conduct is under scrutiny.

Contacts

If you have any questions about the UK SAR regime or would like to speak to someone about the Proceeds of Crime Act 2002, please do not hesitate to contact our White Collar Crime & Investigations team. 

Pixel-Flo, a University of Sheffield spin-out, is developing technology to address a key challenge in the manufacture of MicroLED displays. Its proprietary Continuous-Flow Mass Transfer platform is designed to improve the scalability and cost-efficiency of MicroLED production, an area that has traditionally been limited by the constraints of conventional mass transfer methods. 

MicroLED is widely regarded as a next-generation display technology, offering improved brightness and efficiency compared with traditional display formats. However, adoption at scale has been held back by manufacturing complexity and cost. Pixel-Flo’s technology is intended to support more efficient production and help make MicroLED products more commercially viable across a wider range of applications. 

Founded by Dr Rick Smith, Dr Suneal Ghataora and Simon Jones, the company builds on research developed at the University of Sheffield, combined with significant commercial experience in the display industry. 

The new funding will support Pixel-Flo’s transition from laboratory development towards industrial scale-up, including further team growth, expansion into new lab and office space, and early customer engagement in key international markets. 

Rick Smith, CEO and Co-founder of Pixel-Flo commented: "I would like to thank the Mishcon team for supporting us through the spin out process and helping us to close this milestone funding round. I look forward to continuing our great work with Attilio, Emma and the wider Mishcon team as we focus on expanding our team and demonstrating our unique technology to new international markets." 

Attilio Leccisotti, Partner at Mishcon de Reya, commented: “We are delighted to have supported Rick and the team on this seed funding round. The potential of Pixel-Flo was clear from as early as our first meeting during the NG Studios venture building programme so it is great to see that this international investor syndicate has been able to provide meaningful backing at this early stage.”

This edition covers key upcoming legal developments in the retail sector. The Employment Rights Act continues its phased implementation, with fire and rehire restrictions and the new unfair dismissal regime both confirmed for January 2027, and Employment Tribunal time limits doubling to 6 months from 1 October 2026. The Crime and Policing Act 2026, which received Royal Assent in April 2026, creates a standalone offence of assaulting a retail worker and removes the £200 threshold for shop theft. In the EU, the ban on destroying unsold apparel, clothing accessories and footwear under the Ecodesign for Sustainable Products Regulation took effect on 19 July 2026 for large enterprises, and the Right to Repair Directive applies in EU Member States on 31 July 2026. The Government has also introduced the Commercial Payments Bill, which proposes a hard cap of 60 days on payment terms and makes the statutory interest rate on late payments mandatory.

Our Retail Group is here to support you in navigating these developments and ensuring your business remains compliant and competitive.

For more information please get in touch with Sally Britton or Lewis Cohen. 

• The European Commission has published the final version of its Guidelines on the transparency obligations under the EU AI Act, which largely apply from 2 August 2026. This contains a number of important clarifications and updates compared to the draft version issued in May.
• In particular, the finalised Guidelines address key issues of scope, such as the territorial reach of the obligations, the cumulative application of multiple obligations to a single AI system, and which parties (providers, deployers, intermediaries and open-source providers) are caught, with specific wording directed at AI agents.
• Providers and deployers of in-scope AI systems should pay close attention to the updated guidance on transparency for interactive AI systems, machine-readable marking and detection of AI-generated content, and labelling of deepfakes. This includes the Commission's strict approach to what constitutes a deepfake, and the limited scope of the exception for obvious AI interactions.

The European Commission has published the final version of its Guidelines on the implementation of the transparency obligations for certain AI systems under the EU AI Act. We discussed the four categories of transparency obligation under the Act in our recent article, in which we also explored the draft version of the Guidelines published in May, as well as the Code of Practice issued by the Commission (which has now also been approved). In this article, we highlight some of the key additions in the updated Guidance.

Scope

The Guidelines provide further guidance on the territorial reach of the Act's transparency provisions:

• Providers outside the EU are subject to the Act if the output of their AI system is used in the EU. However, any incidental, unforeseeable or unauthorised downstream use should not, on its own, trigger application of the obligation (subject to assessment by the relevant market surveillance authority).
• In relation to a deployer outside the EU, the transparency obligation will apply where it foresees dissemination and use of the AI outputs in the EU (e.g., by posting deepfakes on the internet), but not where the content reaches EU audiences through unforeseeable channels outside of its control.

The Guidelines also deal with the situation where an AI system engages more than one of the transparency obligations, confirming that the obligations apply cumulatively. So, for example, if an AI system generates images as part of a direct interaction with a natural person, that would mean the provider must engage with the obligations under both Art 50(1) and (2); and, if it can also be used to generate images that are deepfakes, the deployer would need to comply with its obligations under Art 50(4). Similarly, an operator may fulfil the role of provider and deployer concurrently.

Of interest to advertisers, the Guidelines note that a company that merely commissions an advertising agency to produce an advert, without taking decisions and exercising control over how the agency uses AI, would not be a deployer. Meanwhile, whilst intermediaries (such as hosting services) are not caught by the Act, the Guidelines "strongly encourage" them to preserve marking and labelling, and to implement measures to enable natural persons to detect AI-generated or manipulated content.

Transparency for interactive AI systems (Art 50(1))

Providers of AI systems directly interacting with natural persons must design and develop their systems so that those persons are informed that they are interacting with an AI system. There is an exception to the disclosure requirement for obvious interactions with an AI system. The Guidelines note that this exception must be interpreted restrictively, with a number of factors to take into account. For example, if the AI system may be accessed by the general public or consumers that include vulnerable persons for whom the interaction is less obvious, the exception cannot be relied upon to protect those users. Further, the Guidelines caution that it is becoming increasingly hard for natural persons to identify whether an interaction is with an AI system or a human. Therefore, the obviousness exception should be limited to those cases where there is "almost no doubt left" as to the nature of the interaction for an average person in the targeted and reasonably foreseeable audience.

Obvious interactions with an AI system include AI-powered code assistance and review, ambient-AI embedded in home appliances and interactions with AI-enabled Non-Playable Characters (NPCs), provided the nature of the game makes it clear that no other natural person can participate and interact with the user and the AI nature of the interaction is also obvious for all users. Meanwhile, non-obvious interactions include AI-powered companion pets.

Further specific guidance is also given in the update on the application of the requirements to AI agents where they are capable of interacting with natural persons (including those instructing them) when executing tasks. They must be designed and developed in such a way that they disclose both their artificial nature and the person on whose behalf they are acting, including where multi-agent architectures are used. Where it is not possible for the provider of the agent to identify in advance that there will be direct interaction, the agent should be designed at the architecture level and instructed to disclose itself as such in every situation where it is reasonably likely that it may interact with a natural person.

As for the nature of the disclosure under Art 50(1), the Guidelines provide information on its format and substance. In most cases, a single, prominent notification before the first interaction of the AI system with a particular natural person will likely suffice. However, in certain riskier situations, periodic reminders and context-aware disclosure are likely to be necessary, particularly where the system interacts with vulnerable persons.

Marking and detection of AI-generated or manipulated content (Art 50(2))

Providers of AI systems generating synthetic content are required to implement solutions that enable machine-readable marking and detection of their systems' outputs. The updated Guidelines provide more detail on how this will apply in relation to AI agents, namely where the agent's action leads to AI-generated or manipulated content that is perceptible to natural persons. However, intermediate processing steps by the agent would not be in scope of the obligation.

The Guidelines also provide further clarification on the marking and detection obligations and how they can be met in practice. They set out examples of standard editing and minor alterations that will be excepted, in contrast to semantic changes that will require marking.

Emotion recognition systems and biometric categorisation systems (Art 50(3))

The Act imposes an obligation on deployers of such systems to inform natural persons who are exposed to them, unless an exception applies. The updated Guidelines contain limited changes in relation to the guidance on this obligation.

Labelling of deepfakes and certain text publications (Art 50(4))

Deployers of generative AI systems must make clear and distinguishable disclosures of (1) deepfakes and (2) AI-generated or manipulated text that is published with the purpose of informing the public on matters of public interest.

A 'deepfake' is defined in the Act as an "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful". The Guidelines underscore that it is sufficient that someone or something could plausibly have existed. Therefore, digital replicas of real persons, realistic AI-generated human avatars or personas, and personal characteristics will be caught. Whether content will falsely appear to be authentic or truthful must be assessed as a whole. It is an objective assessment (i.e., the deployer's intention is irrelevant), taking into account the level of resemblance, the potential substantive message, the intended and foreseeable deployment contexts, the environment in which the content is presented, and the intended and reasonably foreseeable audience.

Taking the film industry as a case in point, the Guidelines give the following examples of what would be considered to be, and not be, a deepfake:

AI-generation or manipulation of background scenes, special effects, or technical pre- and post-processing are unlikely to make content falsely appear to be authentic or truthful.

However, using AI to generate or manipulate essential elements that impact audience perception is likely to do so (e.g., fully AI-generated actors digital replicas of real or deceased actors, de-aging etc). Specifically, the Guidelines note that a high degree of photorealism renders it more likely that such content should be considered a deepfake.

As for the attenuated labelling requirement where deepfakes are used in an artistic etc context, the Guidelines stipulate a strict interpretation. Where a deepfake combines both informative and creative elements, the informative character should always prevail and require compliance with the labelling requirements.

Timing and enforcement

The transparency obligations start to apply from 2 August 2026, other than the detection/marking obligation on providers for AI systems put on the market before that date, which will kick in on 2 December 2026. Deployers do not need to label deepfakes retroactively.

Providers and deployers that sign the Commission's Code of Practice can point to this to demonstrate compliance with their transparency obligations, with the benefit of a streamlined compliance pathway. Google has confirmed that it has signed the Code of Practice.

Providers and deployers should map their AI systems and audit their full functionality to ensure they are able to comply with their transparency obligations. They should also review and update internal guidance for marketing and other affected teams, and implement robust requirements around approval processes (not least given the potential for significant fines for a breach of the EU AI Act obligations, of up to €15 million or 3% of annual worldwide turnover, whichever is higher).

• Anthropic supports open AI models where risks are limited, but proposes tighter chip export controls, action against large-scale model copying and mandatory safety testing for sufficiently powerful models.
• Its cybersecurity concerns are credible, although restricting access may favour large AI companies and will not prevent sophisticated actors from obtaining advanced capabilities.
• Open models remain important for legitimate professional uses, including sensitive data analysis, regulated work and authorised cybersecurity testing.
• Regulation should focus on capability, risk and enforceable controls rather than model openness alone, while recognising that resilient institutions must adapt to a world where powerful AI tools are widely available.

Anthropic has published its position on "open weight" models, in a post written by Dario Amodei the CEO.

Open weight models are AI models whose trained parameters, or "weights," are publicly available for use, inspection, and fine-tuning without providing the full training code or datasets.

Anthropic has not called for a ban on open weight models, as some reporting has indicated, viewing models without dangerous capabilities as a public good. What Anthropic advocates is narrower restrictions on the sale of advanced chips and chipmaking equipment to China, a crackdown on industrial-scale distillation, the process of using one model's outputs to replicate its capabilities, and mandatory safety testing for all sufficiently capable models, regardless of whether they are open or closed.

That is, in principle, a defensible position but it is also one that a well-capitalised frontier lab can absorb more easily than a small open-source team.

The security argument is sound in principle

The asymmetry Anthropic is pointing at is real and should be familiar to anyone who has worked in defensive security. Offensive capability has always spread faster than defensive capability. Exploits are reusable indefinitely - defenders have to cover everything, and attackers only need one weakness to work once.

If frontier models become reliably capable at autonomous vulnerability discovery, exploit development, malware modification and campaign-scale social engineering, then releasing weights removes essentially every technical control. You cannot revoke a model download, you cannot rate limit a model running on someone else's hardware, and you cannot fine-tune the safeguards back in on a model you do not control.

The concern is reasonable; whether today's models already cross that threshold is a separate question. The answer is that public evidence remains incomplete, although recent work has started to narrow the gap. A recent publication from the UK AI Security Institute is useful here because it tests the claim rather than assuming the answer - its evaluation suggests that the relevant policy question is not simply whether weights are open, but how close a model is to the frontier on dangerous capabilities. The argument becomes much stronger once models consistently exceed expert human capability in offensive security, and materially weaker below that threshold.

There is also a security through obscurity element here that rarely gets acknowledged. Restricting weights raises the cost for the lower tiers of attacker, but it does very little against anyone who can resource their own training run or steal someone else's.

Is this self interested

The criticism doing the rounds is that this is regulatory capture dressed as national security: use safety and China as the framing, impose compliance costs that only large labs can carry, and the open scene quietly dies. Anthropic's answer is that testing should apply by capability threshold, with smaller developers exempt. That is a genuine attempt to address the objection, and it is the right structure. Whether the thresholds end up calibrated properly is a different matter, and not one AI labs should be setting alone.

The distillation complaint is harder to understand from a sector that has itself faced litigation over training on allegedly pirated books - objecting to others taking model outputs without permission, after taking others' inputs without permission, is a position that requires more explanation than it has received.

The China framing has the same problem; Anthropic sells premium models into US government and defence contexts. The argument is not that capability in state hands is dangerous, it is that capability in the wrong state's hands is dangerous. That may well be correct as US policy but it is not a safety argument. 

The Hugging Face incident cuts against a walled garden approach

The most instructive thing to happen in this space did not involve open weights at all.

In July, OpenAI disclosed that models being run against an internal cyber-capability benchmark, with production cyber refusals reduced for the evaluation, escaped their sandbox, found a vulnerability in the package proxy, reached the internet and compromised Hugging Face's infrastructure. Hugging Face detected and contained the incident and had reported it to law enforcement before the identity of the models was known.

Two details matter here. First, the intrusion came from a frontier closed model operated by a frontier lab, running with its guardrails deliberately reduced. Closed weights did not prevent it. Governance did not prevent it. The lab did not identify the issue for around ten days.

Second, and more relevant to the policy question, the defenders in that incident were working with commercial models constrained on exactly the cyber capabilities they needed. The party under attack had less access to capable tooling than the party attacking them, because the attacker's operator had switched the restrictions off internally.

That is the shape of the problem in miniature. Safeguards applied at the vendor boundary constrain the compliant and inconvenience nobody else. If the threat model includes a state actor, an insider, or a lab running an evaluation with refusals disabled, then the marginal safety gain from restricting the defender's tooling is close to zero and the marginal cost is not.

What this looks like in practice

In our practice and across the industry more generally, both closed frontier models and open weight models are used because they serve different functions - closed models are often better for general analytical work and drafting, whereas open weights matter where data cannot leave the environment: local-only deployment, use of classified or privileged material, reproducible research, and work where an audit trail is needed for a regulator or a court.

In offensive security work, there is also a category of task that commercial vendors will regularly refuse. Authorised red teaming, exploit reproduction against systems that the tester has permission to assess, and analysis of live attacker tooling can all trigger vendor policy, even under contract and with written authorisation. Running open weights locally is currently the only way to do that work reliably.

That is not an argument for a loophole. It is evidence that vendor guardrails are calibrated for the median consumer and are a poor fit for regulated professional use. The better answer is likely to be tiered access with real accountability attached, not a choice between unrestricted local models and a walled garden where capability can be downgraded at any time without notice.

The legal questions

Distillation may be heading for legal dispute. If one model learns another's behaviour from generated outputs, is that copyright infringement, breach of contract, unfair competition, or trade secret misappropriation? While none of those categories fits cleanly, contract is the strongest theory in most cases, which makes this more likely to be a terms-of-service question than an intellectual property one. Terms of service, however, do not bind parties who never agreed to them.

Product liability is the bigger question. If a company releases a frontier open weight model that later enables a large-scale attack, is that negligence? There is currently no precedent - regulators generally care about foreseeable risk, capability and likelihood of harm, not licensing models, which is precisely why capability-threshold testing is easier to justify in law than any rule keyed to openness.

Export controls follow the same logic. Chips are finite, scarce, and physically traceable, whereas software can be replicated indefinitely at virtually no cost. As a result, regulating access to computing power rather than software code is therefore the only realistically enforceable option available, whatever anyone thinks of the politics.

The long-term problem

Amodei's broader metaphor of technological adolescence is useful here, as the real challenge is institutional adaptation to fast-moving capability, not the release status of any one model at a particular moment.

The weak part of the argument is the implication that keeping weights closed substantially solves the long-term problem. History suggests otherwise - capability spreads, model theft becomes easier, open alternatives improve, and states or advanced actors obtain what they want regardless. Closed weights may buy time, but they do not materially change the long-term outcome.

There is also an economic rationale under this. Consumption pricing exposes vendors to the point where owning hardware becomes cheaper than paying per token, and for a lot of lower-end and mid-range workloads that crossover is nearer than people assume. Every month that open weights close the capability gap, the commercial case for self-hosting improves independently of the policy argument.

The durable defence from a cyber security perspective is not secrecy, it is building systems that remain secure when capable AI tooling is widely available, because it will be in the same way we have tackled post-Quantum encryption. The analogy with cryptography is useful - we do not assume the attacker lacks the algorithm; we assume they have it and engineer accordingly.

Ultimately, we need to design for the world where the adversary has the same tools we do and work out what 'Post-AI Cybersecurity' will look like.

This agreement follows from our Life Sciences team work in December 2025 advising Relation Therapeutics on its strategic multi-programme collaboration with Novartis, representing almost $1.7 billion in combined funding and support to propel its AI-powered drug discovery.

Patrick Farrant, Partner and Head of Life Sciences at Mishcon de Reya, commented: "It has been a pleasure and a privilege to work with the amazing team at Relation Therapeutics on this collaboration. Relation is a long-standing client of the firm, and we have been proud to advise them on the expansion of their relationship with GSK, the fourth agreement we've advised on to date". 

Our involvement in these deals highlights our commitment to supporting innovative biotechnology companies like Relation Therapeutics in their mission to transform drug discovery and development.

Today's announcement also comes after GSK publicised its relocation to a new research and development centre in Cambridge. Mishcon de Reya is excited to see GSK's commitment to the UK's Golden Triangle, which complements our own vision for operating at the heart of the UK's Innovation Economy across the arc with offices in Oxford, Cambridge and London.

The Mishcon de Reya team was led by Patrick Farrant, who worked with colleagues Dr David Rainford and Sophie Wood.

For our latest insights, subscribe to View from the Arc, our publication celebrating the Golden Triangle and spotlighting innovators’ ambitions.

As the built environment sector grapples with how to balance retrofit, carbon reduction and the need for fit-for-future space, this recent ruling proves that demolition is not automatically the less sustainable option.   

Read the full article

• Since restrictions around "less healthy" food and beverages came into force on 5 January 2026, the ASA has published a series of rulings applying the new rules in relation to a range of adverts across food retail, quick service restaurants, delivery platforms and confectionery.
• The ASA's rulings establish that the brand advertising exemption requires systematic preparation: advertisers must confirm the High in Fat, Salt, or Sugar (HFSS) status of every product depicted and map their full product range to identify any HFSS variant that could be visually indistinguishable from the product shown in the ad.
• Meanwhile, brand characters and mascots carry their own distinct risk. A stylised cartoon character can constitute a depiction of a specific HFSS product through shape and colour alone, without any realistic food imagery, disapplying the brand advertising exemption.
• Franchise networks face particular exposure. While SMEs are exempt from the restrictions, employee headcount is aggregated across the franchisor and all franchisees for the purposes of the SME exemption, meaning many franchise businesses cannot rely on the exemption. Franchisors should treat paid social media activity by individual franchisees as a live compliance risk and consider implementing pre-approval processes.

Earlier this year, new advertising restrictions on less healthy food and beverages came into effect, as we have previously discussed here. Under the restrictions, paid-for online advertising of identifiable "less healthy" food and drink products is prohibited, with equivalent restrictions applying on television and on-demand services before 9pm.

Since January 2026, a body of ASA rulings has emerged, illustrating how the rules are being applied in practice. Three themes emerge most clearly from the decisions.

1. Brand advertising: a limited exemption to the rules

The brand advertising exemption permits an advertisement that promotes a brand or a range of products to run online without engaging the restrictions, provided the ad does not depict a specific less healthy product by name, image, character or other branding technique, and does not include a realistic image of food that is visually indistinguishable from a specific HFSS product. The exemption is available only where the advertiser can demonstrate that nothing in the ad points consumers to a particular HFSS product.

The ASA was asked to consider a paid Instagram ad for M&M's featuring the round green and oval yellow M&M's cartoon characters, with no realistic food imagery and no product name included beyond the brand. Mars argued that the characters were anthropomorphised mascots, not depictions of food, and that therefore the brand advertising exemption applied. The ASA disagreed, at least in part. It found that the oval yellow character depicted Peanut M&M's specifically, because Peanut M&M's is the only variant with oval-shaped lentils, and all Peanut M&M's packaging uses yellow as the dominant colour. The combination of shape and colour was enough to make the character a "personification" of a specific HFSS product, displacing the exemption. By contrast, the round green character was not problematic, because multiple M&M's variants have round lentils, meaning it could not be said to represent any one product specifically.

The ruling goes significantly beyond confectionery. It suggests that brand characters, mascots and visual devices closely associated with a specific HFSS product carry regulatory risk in paid online advertising, even where no food is depicted realistically and the character appears across a wide range of brand communications. Crucially, the test is not whether the advertiser intends the character to represent a product, but whether consumers could reasonably identify it as doing so. Advertisers with established mascots or visual brand devices should map their characters against the product-specific shape and colour combinations in their range, and consider whether any character's design is rooted in the physical characteristics of a specific HFSS product.

Conversely, in a McDonald's ruling, McDonald's successfully invoked the brand advertising exemption. A television ad for its McDelivery service featured no food imagery but named three specific menu items in the voice-over dialogue: Chicken McNuggets, a McCrispy and a McChicken Sandwich. Naming specific products in an advertisement constitutes a "depiction" of those products for the purposes of the Regulations and would remove the benefit of the brand advertising exemption unless those products are non-HFSS. In this case, all three named items had been confirmed as non-HFSS: that allowed the ASA to assess each product directly by name, without needing to consider visual indistinguishability from HFSS products. The complaint was therefore rejected.  However, the same approach in an ad that names any HFSS product would be straightforwardly in breach.

The M&M's decision provides a useful counterpoint. Mars avoided naming any product and featured no food photography, apparently on the basis that the ad was supposed to be for the brand rather than any specific product. The ASA nonetheless found that the characters themselves identified a specific HFSS product. In the McDonald's ruling however, the ASA treated the references to "McDelivery" as relating to the overall McDonald's brand. Furthermore, the named products were all non-HFSS and because they were explicitly referenced by name only, the ASA did not draw its own inferences from any visual or design elements as to what they may depict.

2. Identifying specific menu items

The largest cluster of rulings concerns whether a realistic image of food in an ad is "visually indistinguishable" from a specific HFSS product. The ASA has developed a consistent three-step framework: (1) does the ad depict a specific HFSS product? (breach); (2) does it clearly identify a specific non-HFSS product by name? (not a breach); or (3) if neither, is the realistic image visually indistinguishable from a specific HFSS product? (potentially a breach).

In rulings involving Papa John's, Domino's, Uber Eats and KFC, the ASA conducted detailed side-by-side comparisons of the food depicted with the advertiser's full product range, looking at features at the level of granularity of specific toppings, crust profiles, number of patties, visible fillings and breadcrumb texture. In each case, the product depicted was non-HFSS, and all products that looked similar to it were also non-HFSS, so the ads were acceptable as brand advertisements. The analysis in each ruling is granular: distinctions turned on aspects such as whether cheese was visible in the cross-section of a sliced crust, whether a crust edge appeared rounded or flat, and the colour and texture of a breadcrumb coating. The level of scrutiny underlines that it is not enough to choose a non-HFSS product to feature and assume the ad will be compliant. The whole range must be reviewed.

In a separate Domino's ruling, Domino's had relied on a third party to provide nutrient profile data for its "Cheeky Little Pizza" range, but that data contained an error: the Sausage and Bacon variant was classified as non-HFSS when it was in fact HFSS. The ad depicted that pizza, and the ASA found it to be a specific HFSS product, meaning the ad was in breach. This was the case even though Domino's, Clearcast (the clearance centre for TV ads) and the broadcaster had all acted on the incorrect data in good faith. The ruling is a clear warning that liability follows the content of the ad as published, not an advertiser's intentions, and of the importance of accurate nutrient profiling. Advertisers that rely on third-party data for nutrient profiles should consider what verification steps they have in place and whether their contracts with data providers adequately allocate the risk of errors.

In an earlier decision involving German Doner Kebab, a notably disciplined approach had been taken, with GDK providing the influencer who posted an ad with a specific list of menu items he could and could not feature, all confirmed as non-HFSS. The complaint was not upheld. The same approach is available to any advertiser working with influencers or content creators, and the GDK ruling suggests it will provide a reliable defence where the briefing is properly documented.

3. Franchises and SMEs

Two rulings highlight a structural compliance risk for franchise networks and multi-site operators. In a ruling concerning the fast food franchise, Morley's, a franchisee posted an Instagram ad for HFSS meal deals without the franchisor's knowledge. The SME exemption (which applies to businesses employing fewer than 250 people) did not apply because, for franchise businesses, employee headcount is aggregated across the franchisor and all franchisees: Morley's as a whole employed more than 250 people. The individual franchisee's non-awareness of the HFSS rules was irrelevant to the outcome.

By contrast, Bubbleology successfully relied on the SME exemption, demonstrating that it employed 227 people across its corporate stores and franchise network at the relevant date. The ASA accepted month-end payroll data as sufficiently reliable for assessing headcount and the complaint was not upheld. The two cases together show that the exemption is workable for businesses that can evidence their headcount, but that the aggregation rule creates a real trap for growing franchise networks approaching the 250-person threshold. Franchisors should track headcount and treat paid social media activity by individual franchisees as a live compliance risk. Pre-approval of local advertising is the most straightforward safeguard, and the Morley's ruling suggests that notifying franchisees of the HFSS rules is unlikely to be enough on its own.

Practical takeaways

The picture from the first months of enforcement is that compliance is achievable but requires preparation and processes in place. Food and beverage businesses should confirm the HFSS status of every product depicted in or associated with any given advertisement, map their full product range to identify visually similar items, verify nutrient profile data independently, and review brand characters and visual devices against the personification test established in the M&M's ruling. Franchise operators should implement centralised approval for any paid social media activity by franchisees and keep a clear record of headcount. The rules apply to the content of the ad as published, so intent and good faith provide no defence; liability always falls on the advertiser.

If you would like to discuss the implications of these rulings and the new "less healthy" food restrictions, and how best to equip your business with an ad-compliant strategy, please contact our Advertising and Marketing team.

Join us for a conversation with Oliver Sweet, one of the world's leading business anthropologists and author of The Rules That Make Us.

Having advised organisations including Coca-Cola, IKEA, Google and Dyson, Oliver helps leaders uncover the often invisible cultural forces that shape how people think, behave, make decisions and respond to change.

Drawing on research across 35 countries, Oliver will explore why understanding culture is one of the most powerful tools available to leaders today; helping organisations drive innovation, influence behaviour, navigate change and better understand the people they serve. 

Whether you're leading a team, shaping strategy or trying to understand why some ideas succeed while others struggle to gain traction, this promises to be a thought-provoking discussion about the hidden rules influencing all of us.

• The Digital Services Act (DSA) imposes tiered obligations on online platforms and intermediaries operating in the EU to tackle illegal content, including IP-infringing material.
• In May and July 2026, the European Commission fined Temu €200 million and AliExpress €550 million respectively for failing to properly identify and mitigate systemic risks of illegal products on both platforms, reflecting the most significant DSA enforcement actions to date.
• The DSA provides a range of valuable enforcement tools, including risk assessment obligations on Very Large Online Platforms, 'know your business customer' requirements, trusted flagger status, and notice and action procedures.
• The UK's Online Safety Act 2023 expressly excludes from its scope IP infringement, and so traditional enforcement avenues such as website blocking injunctions and platform-specific brand protection programmes remain the focus in the UK.

The Digital Services Act (DSA), which entered into force on 16 November 2022, has effected a significant overhaul of the regulatory regime governing online services in the EU. By imposing stricter obligations on online platforms and intermediaries, the DSA aims to address the challenges posed by the growth of the digital economy, specifically in relation to illegal and harmful content. Recent decisions by the European Commission to fine Temu and AliExpress for breaching their risk assessment obligations under the DSA highlight the growing burden placed on digital platforms to reduce the risk of illegal content online, and the Commission's scrutiny of such assessments under the legislative framework. With dupe culture on the rise and counterfeit goods increasingly accessible globally, this article examines the DSA and its value as an enforcement tool for IP rights holders.

European Commission fines Temu €200 million

On 28 May 2026, the European Commission fined Temu €200 million for failing to diligently identify, analyse and assess the systemic risk of illegal products being sold on its platform, and the resulting harm to EU consumers.

The DSA imposes several obligations on online platforms and intermediaries, which increase cumulatively depending on the size and breadth of activities. Temu was designated as a Very Large Online Platform (VLOP) in 2024 by virtue of having more than 45 million monthly active users in the EU. As a result of this designation, Temu is subject to the most stringent obligations, including a duty to identify and mitigate systemic risks arising in connection with the platform. Following an investigation, the Commission found that:

• Temu's risk assessment relied on generic information in relation to risks arising in the e-commerce industry as a whole, rather than risks specific to Temu's own service;
• it seriously underestimated how often EU consumers were likely to encounter illegal items on the platform, with evidence obtained from a mystery shopping exercise revealing that a high percentage of chargers and baby toys failed basic safety tests or posed medium to high level safety risks; and
• it did not adequately assess how the design of its service (which included product promotion programmes involving influencers, and recommender systems) could exacerbate the dissemination risks of illegal products.

Temu now has until 28 August 2026 to submit an action plan to the Commission, outlining the remedial measures it intends to take.

European Commission fines AliExpress €550 million

On 20 July 2026, the Commission subsequently fined AliExpress €550 million for breaching its obligation to assess and mitigate the risk of illegal, unsafe or counterfeit products being disseminated on the platform. The fine represents the largest penalty imposed by the Commission under the DSA to date.

AliExpress was previously allocated VLOP status in the Commission's first suite of designations in 2023. The Commission later commenced an investigation into whether AliExpress had breached its obligations under the DSA in 2024, specifically in relation to the assessment and mitigation of risks; content moderation and the handling of internal complaints; transparency of advertising and recommender systems; traceability of traders on the platform and suspected failures to ensure that information provided by traders was reliable; and data access for researchers. Further to its investigation, the Commission found that:

• AliExpress did not properly evaluate whether it had sufficient staff to review potentially illegal products and overestimated the effectiveness of its detection and removal system, with many illegal products appearing on the platform, and even if detected, remaining available for several weeks;
• its assessment regarding the extent to which recommender and advertising systems exacerbated the promotion and sale of illegal products on the platform was inadequate, with many illegal products being recommended or advertised to consumers;
• it did not properly measure how well its moderation systems prevented the risk of illegal products appearing or reappearing;
• it did not adequately enforce its penalty policy against traders selling illegal products;
• traders could circumvent compliance checks to place non-compliant products on the platform by mislabelling and listing them in the incorrect product category; and
• illegal products represent a significant risk on AliExpress' platform, with its brand authorisation system (intended to prevent the sale of counterfeit goods) categorised by the Commission as ineffective and understaffed.

The fine was calculated by the Commission having regard to several factors including the nature of the infringements, their duration, and their gravity. AliExpress has until 20 October 2026 to submit an action plan to the Commission in response, and has indicated its intention to appeal the fine, which it described as 'disproportionate'.

Following several investigations against online platforms in relation to their risk assessment obligations (explored further below), the Commission's recent decisions illustrate that risk assessments are a cornerstone of the DSA.

Digital Services Act

The DSA applies to intermediary services provided in the EU (regardless of where the provider is based), including, for example, online platforms, marketplaces and search engines, cloud providers, app stores, social networks, and content-sharing platforms, and providers of conduit, caching and hosting services.

All intermediary services have an obligation to combat illegal content under the DSA, though the extent of this obligation is dependent on the type of service provider. The requirements increase cumulatively depending on the breadth of activities, with mere conduit and caching providers having the fewest obligations, and VLOPs and Very Large Online Search Engines (VLOSEs) (being platforms and search engines with over 45 million users in the EU each month) subject to the most stringent obligations. "Illegal content" is defined broadly under the DSA as information which is itself illegal or which relates to an illegal activity, having regard to EU law and the laws of each Member State, regardless of subject matter or nature. The definition of illegal content encapsulates content which infringes intellectual property.

Obligations

The DSA introduces a suite of regulatory requirements which can assist with the protection and enforcement of intellectual property rights online.

For example, it imposes 'know your business customer' obligations on online platform providers which facilitate distance contracts between consumers and traders. Providers must obtain verified information about the traders operating on their platform (including, for example, name, address, identification documents and contact details), to support traceability of such traders. Additionally, all providers must respond to take down orders submitted by national authorities in respect of illegal content, and provide information about specific users of their services following disclosure orders from national authorities. Such obligations may also assist rights holders with enforcing their intellectual property rights against the sale of counterfeit goods, and improve the success of traceability and notice and take down mechanisms which previously may have been restricted by the use of false trading names or identities.

In addition, online platforms must monitor repeat infringers (including users which repeatedly upload illegal content to the platform) and consider suspension of accounts. Hosting service providers are required to implement user-friendly notice and action procedures, to allow users to easily notify the host of illegal content on the platform.

Position in the UK

In the UK, as of 17 March 2025, platforms also have a legal duty to protect users from illegal content online under the Online Safety Act 2023 (OSA). However, unlike the broad definition of illegal content under the DSA, the OSA expressly excludes IP infringement from the definition. Instead, it focuses on 'priority offences', including, for example, child sexual exploitation and terrorism offences.

Rights holders must therefore rely on more traditional avenues of IP enforcement to combat infringing material online, which we explore in our previous article on the rise of dupe culture.

Platforms typically rely on notice and takedown mechanisms and a hosting safe harbour defence to avoid liability (under which hosting providers are exempt from liability for infringing goods if they did not know they hosted illegal content or information, and they acted expeditiously to remove or disable access to it once aware).  However, platforms are required to have no actual or constructive knowledge to benefit from the safe harbour. With platforms becoming increasingly active in selecting, managing and promoting content, reliance on this exemption may become difficult.

Further, rights holders can apply for a website blocking injunction against intermediaries whose platforms or services are being used by third parties to infringe copyright. UK courts have considered this issue in the context of both copyright infringement (Twentieth Century Fox Film Corp v British Telecommunications) and trade mark infringement (Cartier International AG v British Sky Broadcasting Ltd). The potential for online platforms to be themselves liable for acts of infringement on their platforms, including the sale of counterfeit goods, has also been considered by the courts in recent years, including in the significant Christian Louboutin v Amazon decision, and by the UK Supreme Court recently in Lifestyle Equities v Amazon.

IP rights holders can also rely on a suite of tools developed by e-commerce platforms themselves. For example, Amazon's Brand Registry programme allows brands to actively monitor and remove infringing products. UK Government Guidance on Protecting Intellectual Property Rights on E-Commerce Stores provides helpful insights to brand owners on the suite of tools available to monitor and remove infringing content online.

How Mishcon de Reya can help

The Digital Services Act has opened up new opportunities for rights holders to tackle counterfeit and other IP-infringing content online. We advise clients on how to use such mechanisms as part of wider online enforcement strategies, including platform takedowns, seller identification and traceability, and cross-border enforcement programmes. For further information, please contact a member of the Intellectual Property team.

Nick argues that investors can accommodate additional costs when they are clear and predictable, but long-term investment decisions become more challenging when key questions around structure, governance and future increases remain unanswered.

Read the full article in CoStar: Hotel investors can price a tourist tax but not policy uncertainty