Commercially Connected - 25 February 2026

On 27 January 2026, the government’s response to the House ofLords European Affairs Committee report on the UK-EU relationreset was published setting out a programme of negotiationsthat will shape how businesses operate across UK-EU bordersin the coming years.The response confirms a shift towards more structured cooperationwith the EU, supported by a Strategic Partnership covering safety,security and economic prosperity. Negotiations are ongoing inseveral key commercial areas, including food and drink trade(the prospective sanitary and phytosanitary (SPS) agreement),carbon emissions trading (ETS), youth mobility and energymarket integration talks on UK participation in the EU internalelectricity market concluded in December with details to beshared shortly). With annual summits now planned, the Governmentexpects further agreements to be concluded throughout thisParliament.For commercial businesses, the message is clear: although the UK willnot return to the Customs Union, Single Market or free movement,sector specific deals are expected to continue and may reshaperegulatory obligations, supply chain costs and workforce mobility.On 2 February 2026 the first meetings of this year took placebetween UK and EU representatives with a focus on theWithdrawal Agreement and Trade and Cooperation Agreement.The joint statement confirmed a desire to conclude the YouthCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 4Experience Scheme, the SPS and ETS agreements by the nextEU-UK Summit later this year.On 26 February 2026, the House of Lords will debate theEuropean Affairs Committee's report, ‘Unfinished business:Resetting the UK-EU relationship’. This library briefing reviewsprogress on UK-EU summit commitments from May 2025. It alsosummarises the committee's findings and the government's response.We will continue to track these developments as negotiations progressand will provide updates on what they mean for commercialbusinesses operating across the UK-EU.UK-US partnership toboost critical mineralssupply chainOn 5 February 2026, the UK and US signed a memorandum ofunderstanding (‘MOU’) aimed at securing supplies of criticalminerals.This agreement builds on the Critical Minerals Strategy announced lastNovember and up to £50 million in funding to enhance domesticproduction and processing.The partnership aims to strengthen the resilience and security of bothcountries' critical mineral supply chains, covering areas such asmining, separation, and processing. By joining forces, the UK andUS intend to attract more private investment into sectors likemining and processing—benefiting key industries includingautomotive, defence, and clean energy. Both governments arealso streamlining their permit processes for critical minerals and rareearths (according to their respective laws). Additionally, they arecommitted to supporting recycling technologies and collaborating onmanaging scrap materials to diversify supply chains.This partnership builds on similar agreements which the UK has(e.g. with Australia and Canada) as it seeks to ensure no morethan 60% of the UK’s supply of any one critical mineral isimported from any one country by 2035. This helps reducesupply chain risks for businesses which can be impacted bygeopolitical tensions, a common occurrence in recent years.Lessons from caselawA recent Court of Appeal case considered execution of deedsunder s44 of the Companies Act 2006.Section 44(5) of the Companies Act 2006 states that, “for purchasers”,a document is considered properly executed if it appears to be signedaccording to Section 44(2)—either by two authorised signatories or bya director in the presence of a witness. "Purchaser" includes anyoneacting in good faith for valuable consideration. This provisionestablishes a presumption of valid execution for purchasers,even if the signatories' authority is uncertain, as long as thesigning aligns with s45(2).The Court of Appeal confirmed that where a purchaser knewthat a lease had not in fact been signed by a director thatpurchaser could not rely on the presumption. In this case a leaseand underlease were not validly executed under s44 of the CompaniesAct 2006 as they were not signed by a director but by his personalassistant, and therefore s44(5) could not apply as the relevantpurchasers were not "in good faith", given their knowledge of theexecution defect.Key takeaway: always ensure agreements are properlyexecuted to ensure they are enforceable.CE markings -medical devicesOn 16 February 2026, the Medicines and Healthcare productsRegulatory Agency (‘MHRA’) opened a consultation on theindefinite recognition of CE marked medical devices. (This is inresponse to previous feedback).Commercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 5Open until 10 April 2026, views are sought on the long-termapproach for CE marked medical devices on the Great Britain(GB) market, to ensure there is no interruption to the supply ofmedical devices for patients and the public. This consultation willbe of interest to medical device manufacturers and distributors, tradeassociations, regulatory experts, healthcare professionals includingthose involved in procurement of medical devices, devolvedadministrations and patient representative organisations.EU priorities to June2027 - how mightthis impact mybusiness?This item first appeared in our Commercially Connected short dated 4February 2026.Following our January review of what to expect in 2026 in the EU,the Cypriot led Council of the EU have set out their priorities forthe next 18 months. Sharing their focus with MEPs on 30 January2026, this gives us an insight on what the EU lawmakers willconcentrate on. From a commercial law perspective thisincludes:• Advancing the European Union's simplification agenda withthe objective of minimizing regulatory andadministrative burdens and enhancing competitiveness,particularly for Small and Medium-sized Enterprises(SMEs)• Drive industrial modernisation, strengthen value chains, andimprove the business environment in the COMPET Council. Astronger Single Market will see focus on green anddigital shifts, securing raw materials and reducingenergy vulnerabilities. Work will continue on thenegotiation of the Industrial Accelerator Act andplanned revision of the Chips Act• The Presidency will prioritise the 2030 Consumer Agenda,enhance online protection for minors, and takemeasures against deceptive consumer practices. Publicprocurement will be under the lens to further reduceadministrative burdens• An IP agenda which seeks to advance EU rules onpatents and a robust copyright framework adapted tonew technologies. The research focus will continue withHorizon Europe, advancing discussion on the EuropeanInnovation Act and work on the AI Continent Action Plan• Continue simplifying legislation while maintaining theEU’s environmental goals and advancing the shift to acircular economy to lessen reliance on raw materials.Additional priorities include revising CO2 standards for carsand vans. Cyprus will be negotiating the automotivepackage presented in December 2025. This envisagedoverturning the 2035 combustion engine ban and included aregulation that would set national targets for zero emissionscorporate fleets. The file has already sparked fierce debatewith large Member States like Germany and France takingopposing views• Digital sovereignty and digital leadership goals will seecontinued attention on AI, cloud infrastructure andcybersecurity together with the digital simplificationomnibus. The Presidency will advance the Cybersecurity Actand the Digital Networks Act for telecom upgrades (5G/6G),implement age checks for online child safety, and supportresearch to foster innovation and retain talent• Expanding the network of trade agreements to delivertangible benefits to all in the EU (especially SMEs) and theconclusion of reform of the Customs Union• Work to further enhance EU-UK relations through theimplementation of agreed frameworks (WithdrawalAgreement and Trade and Cooperation Agreement) andCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 6building on the positive momentum of the London Summit ofMay 2025This will be of interest to all organisations who operate in andacross the EU as it sets the direction for upcoming legislativeactivity for digital, consumer, trade and sustainability themes inthe coming year. Businesses should continue to track these EUlegislative priorities to assess compliance risks and identifywhere contractual or operational changes may be required.Future EU digitalcompany law rules setto transformcorporateadministrationThis item first appeared in our Commercially Connected short dated 11February 2026.Around this time last year, the EU brought into force a newDirective on the use of digital tools and processes in companylaw. Over the next three years, it will reshape how businessesare formed, managed and recorded across the EU.For businesses, this law marks a significant shift towards fully onlinecorporate administration, cross‑border recognition of digital documentsand deeper interconnection of national business registers. If yourbusiness operates in more than one EU jurisdiction (or plansto) this Directive will affect the way you file documents, verifyidentities, appoint directors, register branches and maintainstatutory records.The Directive has not yet been transposed into national law (currentlyexpected by 31 July 2027). As a result, practical requirements mayvary by jurisdiction and will only become clear closer to that date.Key Takeaways: the Directive is expected to:• Expand digitalisation rules - businesses must be able toform online and file key changes digitally. Nationalregisters will be required to accept electronically verifieddocuments, removing the need for paper submissions for corefilings• Introduce the EU Company Certificate - this will be amultilingual digital certificate confirming a company’s legalstatus, representatives and incorporation details• Create an EU digital power of attorney - businesses will beable to authorise representatives in other member stateswithout notarisation• Strengthens the Business Registers Interconnection System(BRIS) and “once only” principle - information filed in onemember state will be reusable across others, reducing theneed to resubmit the same data when registering subsidiarieselsewhereTo get some early visibility on how businesses might prepareand understand the implementation timetable see our briefing:EU: Future digital company law rules set to transform corporateadministrationWith thanks to Holger Holle, Yasman Ekrami, Katherine Martineau andKirath BharyaKey legaldevelopmentsimpacting the globalIndustrials sectorThis item first appeared in our Commercially Connected short dated 4February 2026.Our Global Industrials Bulletin brings together our quarterly impactreview of developments affecting businesses in the industrialssector across the US, EU, Asia and UK. In this edition wehighlight:China is driving major green and industrial policy shifts,including a new green factory standard and steps to boost domesticchip and battery capabilitiesCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 7Asia-wide battery and mineral supply chains are beingreshaped, with Korea investing heavily in next generation technologyand China reviewing its export and trade controlsThe EU is accelerating trade liberalisation, in signing two majorfree trade agreements with India and the Mercosur bloc (Argentina,Brazil, Paraguay and Uruguay), although the latter now faces delaypending ECJ reviewEU regulatory reforms continue at pace, including updated ETSstate aid rules, new automotive emissions and vehicle circularitymeasures, and tighter raw materials and chemicals controlsUK plans have an environmental and simplification theme withfocus on long duration energy storage, their latest policy on criticalminerals and simpler export licensing for defence (working withFrance, Germany and Spain)Activity in the US mirrors themes elsewhere in the world withenvironmental protection updates, import controls and funding tostrengthen rare earth supply chainsCompetition andtrade round up• On 3 February 2026, the Competition and MarketsAuthority (“CMA”) issued its consolidated marketsguidance, introducing a more transparent andengagement-focused framework that embeds the 4Ps(pace, predictability, proportionality and process) intoall market review work. The new approach launches eachproject with a detailed Roadmap, and increases early andongoing engagement through state-of-play meetings andoutreach activities. It also replaces routine working paperswith earlier interim reports, and clarifies the CMA’s use ofundertakings in lieu, remedy trials, sunset clauses and periodicreview.• On 9 February 2026, the European Commission publishedan updated timeline mapping recent and plannedcompetition policy reviews and reforms across antitrust,merger control, State aid, the Digital Markets Act andthe Foreign Subsidies Regulation for the period 2024-2029. The timeline confirms a heavy legislative and guidancepipeline through 2026-2028, with multiple parallel reviewsacross core competition instruments. The key focus areasinclude antitrust enforcement reform, updates to blockexemptions and guidelines (including technology transfer,motor vehicles, merger control and exclusionary abuses), andsubstantial revisions to State aid guidance. The Commissionalso plans post implementation reviews of the Digital MarketsAct and the Foreign Subsidies Regulation, signalling anincreased emphasis on evaluating effectiveness alongsideenforcement. Overall, the timeline points to continuedregulatory change and sustained policy activity,requiring businesses to manage overlapping reformsand evolving guidance across several competitionregimes.• On 19 February 2026, the European Commission published asummary of the responses to its consultation on thereview of Regulation 1/2003 (a proposal to revise EUantitrust procedural rules to ensure that theenforcement of EU rules on competition remainseffective and fit for purpose). In summary:o Stakeholders support modernising enforcement butflag the high and variable cost and burden of RFIs,driven by short deadlines and reliance on externaladvisers.Commercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 8o Views are mixed on expanding investigative tools(including evidence preservation orders, remoteinspections and compulsory interviews); regardless ofapproach, respondents emphasise the need for strongsafeguards for defence rights, legal professionalprivilege, privacy and proportionality.o Respondents call for clearer, faster and morepredictable procedures, including greater use ofcommitments, better tested and monitored remedies,and targeted access to file solutions that reduceredaction burdens without weakening rights; mostfavour procedural improvements over changes tointerim measures standards.The Commission aims to table a legislative proposal in Q32026.• Refunds, trade agreements, and new tariffs: What’s next afterthe Supreme Court struck down President Trump’s IEEPAtariffsWith thanks to Annabel BorgPublic SectorProcurement lawupdatesOn 26 January 2026 the draft Procurement (Amendment)Regulations were published. These confirm variousamendments in relation to below-threshold contracts such aswhat payment information is publishable for contracts over £30,000(s70 of the Procurement Act), contents of the tender notice andrequirements on supplier registration on the central digital platformtogether with removal of reference to the Contracts Finder system andadding a national security safeguard with respect to the termination ofhealth contracts (amending Health Care Services (Provider SelectionRegime) Regulations 2023). Accompanying guidance is alsoavailable focussing on contract payment information, scope andhow to comply. The amendments come into force in two phases(1 April 2026 and 1 October 2026).On 4 February 2026, the Local Government (Exclusion of Noncommercial Considerations) (England) Order 2026 (SI2026/94) came into force. This amendment removes the limitationspecified in section 17(5)(e) of the Local Government Act 1988 (“the1988 Act”), which previously prohibited local authorities from factoringin contractor location when awarding contracts below the threshold. Asa result, local authorities are now permitted to reserve thesebelow-threshold contracts exclusively for contractors based inthe UK or within designated local areas (whether or not theyare SMEs or VCSEs). Relevant authorities who rely on thisprovision need to include this in their tender notices. Thisapplies to England.FSR in Practice: Callsfor Greater Clarityand Proportionality inDeals andProcurementOn 20 February 2026, the European Commission published asummary of the responses to its consultation on the ForeignSubsidies Regulation (‘FSR’). Respondents support the FSR inprinciple, but criticise its execution, pointing to low thresholds, overlybroad and burdensome information requirements, and uncertaintyaround distortion assessments and the balancing test. Duplicationwith merger control and FDI regimes, combined with delays, costs andlimited transparency, is seen as undermining deal planning andtime-sensitive procurement. The clear message is a call for clearerguidance, higher or more targeted thresholds and a moreproportionate, streamlined framework.With thanks to Annabel BorgCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 9You may also beinterested inUK Retail Finance Horizon Scanner - December 2025 to January2026Global payment matters - January 2026A reminder to take care with adviser engagement lettersManaging M&A uncertainty in the EU’s evolving regulatorylandscapeNewsletter: EU Roundup: January 2026 - highlighting the EU legaland regulatory developments businesses need to be aware ofLinks Visit our Strategic Contracts hubCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 10ESGDevelopment Summary ImpactOmnibus I gets theCouncil of the EU’sgreen lightOn 24 February 2026, the Council of the EU gave the “greenlight” to the Omnibus I simplification package which simplifiesthe directives on corporate sustainability reporting andcorporate sustainability due diligence. This follows the EuropeanParliament’s approval of the text in December.Once the Omnibus I text is published in the Official Journal it will comeinto force after 20 days. Member States will have 1 year to transposethe provisions (save for article 4 on harmonisation (CS3D) where thedeadline is 26 July 2028).For a reminder of the changes brought forth by Omnibus I seeour December CC.A new course forwater?The UK Government’s recently published White Paper marksthe most ambitious overhaul of England’s water sector in ageneration.In our latest briefing, Peter Harper, Alison Short, Claire Carroll, PawelChmiel and Hugh Durant consider the sweeping reforms proposedby DEFRA, from the creation of a single, integrated waterregulator to major shifts in supervisory oversight, assetresilience, customer accountability and long‑term investmentplanning. They explore how the move to a new supervisory model,enhanced enforcement powers, expanded competition mechanismsand far‑reaching planning reforms will reshape operationalexpectations for water companies, investors and other stakeholders: ANew Course for Water?Commercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 11UK’s first “foreverchemicals” planThis item first appeared in our Commercially Connected short dated 4February 2026.On 3 February 2026, the UK government unveiled the first PFASPlan which provides a framework for governments, businesses,and regulators to identify PFAS sources, track their spread, andlimit public and environmental exposure.Per- and poly-fluoroalkyl substances (PFAS), known as ‘foreverchemicals,’ are a major environmental concern. Whilst PFAS havesupported economic growth and climate goals through their use inmanufacturing and low-carbon technologies, evidence shows theirwidespread use poses lasting risks to people and the environment.To safeguard public health, the plan sets out a range of measures andinterventions, which includes:• Creating clear guidelines for regulators and industries toaddress legacy PFAS contamination in land and coastalwaters, ensuring consistency and practicality• Consulting on setting a statutory PFAS limit in England’s publicwater supply to improve drinking water quality• Conducting tests on everyday products such as foodpackaging and materials which are water, heat and oilresistant to detect PFAS and help inform potential futureregulations and develop viable alternatives• Launching a website to increase public awareness of PFAS andimprove government transparency• Issuing new guidance to regulators and industrialoperators to better manage, monitor, and dispose ofPFAS at sites, reducing emissions• Finalising review of PFAS restrictions in firefighting foamsunder the REACH chemicals regimeManufacturing businesses face increased scrutiny acrossproduct composition, supply chains, emissions and watermanagement. Companies should begin preparing for tighterregulation, supply chain due diligence and possiblereformulation requirements.EPR guidance onmergers and transfersThis item first appeared in our Commercially Connected short dated 18February 2026.On 10 February 2026, the UK government published guidance on“what to do if your company merges with another company, oracquires a brand or business from another producer” in respectof extended producer responsibilities for packaging (‘EPR’).Key points for mergers:• if any merged company was a large producer, the newcompany is considered large; otherwise, it is small• registration time limits apply• the new company is responsible for all packaging supplied bymerged companies before the merger and by itself afterward• newco must pay all current and previous fees and maintain allrecords• PRNs and PERNs from merged companies can be transferred toand used by the new company for recycling obligationsFor business or brand transfers:• notify the regulator within 28 days and register for EPR.• in the transfer year and next two years adjusted criteriadetermine if the new owner is a large or small producer• if the previous owner was large, both parties must (re)submitpackaging data for four reporting periods• the scheme administrator calculates fees and the new ownerassumes recycling obligationsCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 12This guidance is relevant if at least one of the companiesinvolved was previously registered for EPR for packaging. Ifneither company was registered but, after merging, theycollectively meet the thresholds, then standard registrationrules should be followed.Updates on UK CBAM On 10 February 2026, the government published a summary ofCBAM policy and draft regulations for consultation (open until24 March 2026). The core policy framework will be establishedthrough the primary legislation in the Finance (No.2) Bill 2025 to 26,with further specifics provided in the draft secondary legislation andnotices.As CBAM will commence on 1 January 2027, this will be ofinterest to:• importers and downstream producers using aluminium,cement, fertilisers, hydrogen, or iron and steel in theirsupply chains• overseas operators processing or manufacturing goodsin the aluminium, cement, fertiliser, hydrogen, and ironand steel industries• independent emissions verifiersoffering an opportunity to provide feedback on the draft approach.Operating in Wales?Welsh round upOn 27 January 2026, draft Waste Separation Requirements(Wales) (Amendment) Regulations 2026 were published. They willbring in a requirement for workplaces to present small waste electricaland electronic equipment (sWEEE) separately for collection andonward recycling from 6 April 2026. The final version of the revisedCode of Practice, which sets out practical guidance on how to complywith the amended separation requirements will be published after 6April 2026.On 30 January 2026, the Welsh government opened a consultationseeking views on the way in which the extended producerresponsibility for packaging scheme (pEPR) should be developed toaccount for ‘on the go’ packaging waste which is placed in public binsor littered in Wales. Depending on responses, this could make theproducer responsible for disposal costs of such waste. Have your saybefore 24 April 2026.On 3 February 2026, a Green Paper was published proposing reformsto Wales' water system, following recommendations from theIndependent Water Commission (in July 2025). Key proposals includeestablishing a dedicated Welsh regulator for water, backed by new lawsand an updated framework to promote investment and environmentalprotection. Consultation responses are due by 7 April 2026.On 12 February 2026, the Deposit Return Scheme (DRS) for DrinksContainers (Wales) Regulations 2026 were introduced to the Senedd.The scheme covers PET plastic bottles, aluminium and steel cans, andglass bottles, promoting recycling and reuse to improve waste reductionand address litter. Wales' DRS will “follow international best practices”and align with the UK rollout in October 2027. Additional regulations,including targets for reuse, will follow. An implementation taskforce hasbeen proposed to ensure cooperation across the UK DRS. Subject toSenedd approval, DRS will launch in Wales from 1 October 2027.On 20 February 2026, the Welsh government published Sustainablefinance for nature’s recovery | GOV.WALES. The principles of:• supporting integrated land, freshwater and marine use• delivering public private benefits• engaging and collaborating with communities• ethical and transparent investingCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 13are intended to facilitate responsible investment within nature marketsand broader financing.Energy updates • UK: Government to proceed with switch from RPI to CPIindexation for existing renewable subsidy schemes• Clean Energy partnership: On 4 February 2026, the UK signeda historic clean energy security pact, the HamburgDeclaration, with leaders from across Europe to secure 100GWof joint offshore wind projects• Switched on to the energy transition• UK: CfD AR7a (non-offshore wind technologies) resultsannounced• Simplification of energy efficient products legislation: On 12February 2026, the European Commission opened a call forevidence on this legislative proposal planned for Q2 2026.This Omnibus would seek to reduce administrative burdens(promoting digital documents) and address non-compliantproducts (often sold online) and represents an opportunity toshape the scope of the proposed legislationEU rules on forcedlabour - whatguidelines arerequired?This item first appeared in our Commercially Connected short dated 11February 2026.On 6 February 2026, the European Commission published a callfor evidence in connection with the Forced Labour Regulation(‘FLR’) (which applies from 14 December 2027).By way of reminder, this regulation prohibits economicoperators from placing, selling, or exporting products made withforced labour in the EU, using a risk-based approach. This willimpact anyone interacting with the EU market.According to Article 11 of the FLR, the Commission must releaseguidelines by 14 June 2026 to assist competent authorities, businesses,and stakeholders in implementing the FLR effectively and practically.The planned approach is for 3 categories of guidance aimed at:• competent authorities of Member States who are theguardians of the regime• organisations who will need to undertake due diligenceof their supply chains• other stakeholders on how to submit information onnon-complianceFeedback is sought on the investigation process and documentsrequired, best practice for conducting forced labour related due diligence(including risk assessment and remediation) and what training /information is required by organisations to aid compliance. If yourorganisation is likely to be impacted by compliance responsesare invited to 6 March 2026.Commission invitesviews on post 2030climate policyOn 9 February 2026, the European Commission launched twoconsultations focussing on climate targets, flexibilities andinternational credits.These consultations are key to preparing legislative proposals for late2026, as outlined in the Commission Work Programme. Responses areinvited until 4 May 2026. This process will assist in evaluating hownational climate targets and EU policy operate post-2030 to help meetthe EU’s proposed 2040 climate goal of reducing net greenhouse gasemissions by 90% by 2040 compared to 1990 levels (a measureadopted by Parliament on 10 February and awaiting Councilendorsement).Commercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 14You may also beinterested inFCA consultation on sustainability disclosures for listed companiesGlobal sustainability and ESG themes for 2026Global Sustainability & ESG Insights | Eversheds SutherlandLinks Visit our ESG hubCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 15Consumer lawDevelopment Summary ImpactDon’t be caughtgreenwashing - ourtop tipsThis item first appeared in our Commercially Connected short dated 11February 2026.Last month, we highlighted the new CMA guidance in respect ofGreen Claims. The purpose of the guidance is to help clarifywhere in the supply chain responsibility for makingenvironmental claims lies so we’ve been chatting to ourenvironmental and consumer colleagues about what this means inpractice. Here are their top tips:What should businesses do?Every business in a consumer supply chain should ensure that theyare complying with consumer law to ensure they are notconsidered to be greenwashing. The Guidance read together withthe Greens Claim Code is designed to support this. In particular:• Map where environmental claims arise and are repeated(product, pack, web, retail signage, ads)• Collect and retain robust, current evidence for each claim(e.g., composition certificates, test reports)• Build and follow an internal claims process: pre clearance,periodic re checks, supplier attestations, and escalation routes• Avoid absolute terms (e.g., ‘100% recycled’) unless trueacross the whole product; say exactly what is recycledand to what extentCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 16• Give key information close to the claim (e.g., disposalroutes for ‘compostable’ items) and don’t hide it behindlinks or QR codes• Put contract levers in place: warranties on claimaccuracy, audit rights, update obligations on supplychain changes, and consequences for non compliance• When evidence is missing or uncertain, change or drop theclaim; do not rely on supplier assurances alone• Set up range governance so category claims (e.g., ‘eco range’)match product attributes; verify before grouping• Prepare for CMA enquiries: keep decision logs, evidencefiles and a corrective action playbook (label edits,takedowns, consumer redress)Is there anything else to be aware of?Liability can attach at multiple points: the business that makesthe claim and those that repeat it in the supply chain whetherthat is the retailer, brand, manufacturer etc. The CMA will targetpractices that risk broad consumer harm, lack internal controls, orignore prior guidance and decisions by the Advertising StandardsAuthority. The Guidance also explains that the CMA will decide itsenforcement approach based on all the facts before it, its currentpriorities, resources and powers.The CMA can order conduct changes and redress, and imposesignificant fines without having to take a business to court under theDMCC Act. Proactive fixes before an investigation may mitigatepenalties. Also, if you collaborate with competitors on sustainabilityinitiatives, use the CMA’s Green Agreements Guidance to staycompetition‑law safe.With thanks to Matthew Gough, Eve England, Louise Howarth andLuisa ZukowskiNew best practiceguide for using genAIin advertisingThis item first appeared in our Commercially Connected short dated 11February 2026.On 5 February 2026, the Online Advertising Taskforce published aBest Practice Guide for the responsible use of GenAI inadvertising (and an SME version).Aligning with the ASA requirements and UK regulations, theguide provides 8 core principles for advertisers, agencies andmedia personnel to take account of on a voluntary basis.The core principles embrace transparency, responsible data use, biasand fairness, human oversight and accountability, societal wellbeing,brand safety and reputation, environmental factors and continuousmonitoring.This guide will be of interest to all those involved in marketingand tech providers supporting the industry as it containspractical suggestions and a checklist of issues to ensure allbusiness processes and communications are legally compliantand ethical. Ideas for business adoption include:• embed AI governance within your business• adopt a risk matrix approach with an eye on consumerharm• think about ethics at the design stage so these areembedded in any AI systems and undertake duediligence on proposed suppliers• undertake staff training and develop audit processes forAI toolsCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 17CMA speech on DMCCprogress andprioritiesOn 10 February 2026 the Acting Executive Director, ConsumerProtection at the Competition and Markets Authority (CMA) gave aspeech on progress and priorities in relation to the Digital Markets,Competition and Consumers Act 2024 (DMCC).This indicates that the CMA will be taking further action againstbusinesses that are not compliant with DMCC rules on fakereviews, unfair contract terms or drip pricing, using tech and AIto help detect issues. The CMA also intends to carry on engagingwith both businesses and consumers and to ensure that its guidance isclear and up to date to aid compliance.CMA issues firstDMCCA fine forinformation noticefailureOn 13 February 2026, the UK’s Competition and Markets Authority(CMA) issued its first-ever DMCCA fine. The CMA has fined EuroCar Parks £473,000 (75% of the maximum) for failing to comply withan Information Notice under the new Digital Markets, Competition andConsumers Act 2024.The CMA made seven attempts to deliver the notice, including byregistered mail, hand delivery and emails to directors. No responsewas received until the CMA signalled its intention to fine. Claims thatemails were blocked as “fraudulent” were not accepted as a reasonableexcuse.What this means for businesses:- don’t ignore regulatory correspondence—even if you suspectfraud. Always verify- internal delays or staff unfamiliarity with the CMA won’tprotect organisations- fines may be imposed even without an open investigationFor more - see our Flash UpdateProduct safety This month:• The Office for Product Safety and Standards (OPSS) launchedresources aimed at older people covering shopping online andproduct recalls• The OPSS also updated its guidance on product safety andnon-compliance notifications for businessesLinks Visit our Consumer hubCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 18Cyber securityDevelopment Summary ImpactEU cyber updates:New ICT SupplyChain SecurityToolbox andconsultationThis item first appeared in our Commercially Connected short dated 18February 2026.On 13 February 2026, the European Commission launched an ICTSupply Chain Security Toolbox to help identify and mitigatecybersecurity risks in ICT supply chains.The toolbox recommends assessing critical suppliers, adoptingmulti-vendor strategies, and reducing reliance on high-riskvendors. It aims to help Member States and other stakeholdersenhance supply chain security, as outlined in the revised CybersecurityAct of January 2026 (see below). Accompanying risk assessments forconnected vehicles and detection equipment are also published anddetail key cybersecurity threats, their potential impacts, and necessarymitigation steps.In other cyber news, following the European Commission’sadoption of a regulation to revise the Cybersecurity Act(“Cybersecurity Act 2”) in January, it is now inviting feedbackuntil 10 April 2026 on the proposals.The intervention aims to strengthen the EU’s resilience against growingcyber and hybrid threats targeting essential services, democraticinstitutions and critical infrastructure and includes• supporting security of ICT supply chains• enhancing the European cybersecurity certification framework• easing cybersecurity compliance• empowering ENISACommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 19For more see our January CC.ENISA CybersecurityExercise MethodologyOn 16 February 2026, the European Union Agency for Cybersecurity(‘ENISA’) published The ENISA Cybersecurity ExerciseMethodology.pdf - an “end to end guide on how to plan, run andevaluate an exercise”.This methodology helps cybersecurity professionals, organisations, orgovernments plan cybersecurity exercises and test skills, threatresponse, resilience, and compliance.Links Visit our Data Privacy, Security and Technology hubCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 20Data protection and privacyDevelopment Summary ImpactWhat’s the latest onthe Data (Use andAccess) Act 2025?This item first appeared in our Commercially Connected short dated 18February 2026.On 5 February 2026, a number of DUA Act provisions came intoforce under The Data (Use and Access) Act 2025(Commencement No. 6 and Transitional and Saving Provisions)Regulations 2026. This includes the provisions on:• clarifying what processing entails for research and statisticalpurposes, as well as simplifying how valid consent for scientificresearch is obtained. Introducing stronger protections forprocessing activities related to research (s67-68 and 86)• "recognised legitimate interest" is introduced as a newlawful base for processing (s70)• data protection by design obligation concerningenhanced safeguards for children. This requires controllersoffering information society services to take into account theneeds of minors when developing processing operations thatare likely to be accessed by children (s81)• a simplified test for transferring personal data to thirdcountries or international organisations (s85)• changes to direct marketing by charities (s114)alongside changes to data subject rights (s75-77), automated decisionmaking (s80) and ICO powers.Ahead of new DUA requirements in force on 19 June 2026 (s103and schedule 10 - complaints), the ICO has published goodCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 21practice guidance setting out what organisations need to do tobe compliant with data protection complaints processes.All organisations should prepare now by ensuring:• individuals have the means to submit data protectioncomplaints• complaints are acknowledged within 30 days of receipt• appropriate steps will be taken to address complaints ina timely manner, including conducting necessaryenquiries and keeping complainants informedthroughout the process• the outcome of each complaint will be communicated tothe relevant individuals without undue delayFor more on legal, regulatory and enforcement activity across UK,Europe, APAC, the Middle East, Africa and the United States see ourlatest edition of Updata: Your quarterly privacy & cybersecurity updateExtent of technicaland organisationalsecurity measuresconsidered by Courtof AppealOn 19 February 2026, the ICO welcomed a Court of Appeal decisionin its favour on the requirement of appropriate security measures to betaken even in cases where hackers cannot identify individuals from thestolen personal data.Following a cyber attack in 2017/2018 where hackers obtained cardnumbers and expiry dates, the ICO issued a monetary penalty noticeto DSG Retail for failing to implement appropriate technical andorganisational security measures. DSG unsuccessfully appealed to theFirst Tier Tribunal and then were successful at Upper Tribunal whichfound Principle 7 of the Data Protection Act 1998 should be judgedfrom the perspective of a third party: the attackers were unable toidentify individuals using chip-and-pin data so there was no breach ofpersonal data and therefore no violation of security duties.The Court of Appeal reversed the UT's decision, finding that under theDPA 1998 and the UK GDPR, security obligations are evaluated fromthe viewpoint of the data controller. Data controllers are required toput suitable security measures in place to safeguard all the personaldata they possess—even when attackers are unable to identifyindividual subjects. This approach offers enhanced protection againstrisks such as cyber-attacks, ransomware, and data theft. The FirstTier Tribunal will now determine the case based on the CoA judgment.DSG Retail Limited -v- The Information Commissioner - Courtsand Tribunals JudiciaryEDPB WorkProgramme for 2026-2027On 11 February 2026 the European Data Protection Board (EDPB)adopted its 2026-27 Work Programme. This reflects the EDPBstrategy priorities and the most critical stakeholder needs. It focuseson four pillars:• enhancing harmonisation and promoting compliance,through guidance to promote GDPR compliance andadvice to the EU legislature• reinforcing a common enforcement culture and effectivecooperation, through information exchange and thedevelopment of tools to facilitate enforcement and cooperation• safeguarding data protection in the developing digitaland cross-regulatory landscape, including throughguidance on gen-AI and data scraping and on theinterplay between the AI Act and GDPR• contributing to the global dialogue on data protection, with afocus on international cooperationEDPB views on DigitalOmnibus proposalsOn 11 February 2026, the European Data Protection Board (EDPB) andthe European Data Protection Supervisor (EDPS) issued a JointOpinion regarding the Digital Omnibus Regulation proposal. ThisCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 22proposal is designed to streamline the EU's digital regulations, lessenadministrative complexity, and boost the competitiveness oforganizations within Europe. In summary the EDPB and EDPS:• advise against proceeding with the suggested changesto the definition of personal data, as they believe thesechanges could narrow the protections available for individuals• are in favour of the suggested steps that would reducenotification burdens and ease the notification processfor organisations• consider some of the AI proposals need adjustment toclarify their scope• support the need for a regulatory solution to addresscookie banners and user consents• support simplifying Data Acquis by integrating DataGovernance Act and Open Data Directive rules on re-use ofpublic sector data and documents into the Data ActRight to be forgotten- top tips from EDPBreviewOn 18 February 2026, the European Data Protection Board (EDPB)released a report on its Coordinated Enforcement Framework (CEF)project focusing on the right to be forgotten (Article 17 of the GDPR).This topic was chosen because it's one of the most commonlyused rights under the GDPR and is often the subject ofcomplaints to Data Protection Authorities.The main goals of this initiative are to make sure individuals in Europecan effectively exercise their right to have personal data erased, andto see how organisations handle this process in reality. The reportdetails identified problems and gives recommendations for controllersto help them carry out the right to erasure. Top tips for controllersinclude:• to manage erasure requests set up internal processeswith timelines for managing requests• provide training so there is organisationalunderstanding of the approach• review your privacy notice regularly so data subjectsunderstand their rights• legal and compliance teams should be involved in therefusal or postponement of requests• clearly justify retention periods for personal data• ensure personal data in the context of back-ups is beingerased properly and securely in a timely manner• in anonymisation, ensure personal data cannot be linkedto an identifiable individualThe EDPB will consider further templates / guidance in supportof the above and suggests supervising national authoritiesconsider the same.Global jointstatement on privacyand AI-generatedimageryOn 23 February 2026, the ICO issued a joint statement on theapproach of it and other global data authorities (including theEDPB) towards AI systems that generate images / videoswithout an individual’s knowledge or consent. This places anexpectation on organisations to consider data protection laws whendeveloping / using gen-AI and in particular:• implement robust safeguards• be transparent about the AI systems capabilities• have processes in place for individuals to object to harmfulcontentCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 23• address specific risks to childrenYou may also beinterested inData Protection Day Conference 2026Links Visit our Data Privacy, Security and Technology hubCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 24IPDevelopment Summary ImpactSupreme Courtoverhauls UK patentlaw for AIThis item first appeared in our Commercially Connected short dated 18February 2026.The Supreme Court has delivered a landmark judgment thatfundamentally reshapes how UK patent law treats artificialintelligence and computer-implemented inventions.In Emotional Perception AI Limited (Appellant) v Comptroller Generalof Patents, Designs and Trade Marks (Respondent), a unanimousCourt held that the long-established Aerotel framework forassessing excluded subject matter should no longer befollowed. In its place, the Court has aligned UK law with theEuropean Patent Office's approach.Why this matters:• The decision has immediate implications for patentapplicants, particularly those working with AI, machinelearning and software innovations• AI and software claims that once failed on“contribution” may now clear the first gate but facetougher scrutiny at following stages• ANNs count as computer programs, but are not excludedas computer programs “as such” where hardware isused• Expect closer UK - EPO harmonisationFor more information and analysis see Supreme Court overhaulsUK patent law for AICommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 25With thanks to David Wilkinson and Chloe GastrellYou may also beinterested inFlash Update: Oatly loses its battle over “POST MILK GENERATION”:LinkedInLinks Visit our IP hubCommercially connectedUK and EU commercial law updatesImmediate impact Short-term impact On the horizon 26Technology lawDevelopment Summary ImpactDeepfake detectionframeworkOn 5 February 2026, the UK Government announced it wascollaborating with leading tech companies to create a framework toidentify gaps in deepfake detection - hailed as a ‘world first’.The framework will assess how technology can identify harmfuldeepfake content from any source. After development, it will setindustry standards for deepfake detection. This follows newlegislation banning the creation or request of non-consensual deepfakeintimate images of adults, effective 6 February.UK AI round up • On 6 February 2026, the UK Government published aresponse to the consultation on the design, content anduse of a new AI Management Essentials tool(‘AIME’).The objective of AIME was designed to help allorganisations assess and implement the basics for responsibleAI management systems and processes. However thefeedback highlighted that it is difficult to distil the keyprinciples of AI governance in a way that works for allorganisations and therefore, going forwards, the tool andguidance will support SMEs on their AI adoptionjourneys• On 16 February 2026, a week of discussions began in Indiabuilding on the work of the Bletchley, Seoul and Paris AIsummits and focussing on AI’s impact on people, growthand sustainability