UK
The CMA’s coordinated push against fake and misleading consumer reviews lands the new Part 3 direct enforcement powers in the DMCCA 2024 on the consumer reviews supply chain. Five cases opened on 27 March 2026 reach across that supply chain at the same time and signal that consumer review compliance is now a discrete deal due diligence item.
CityFibre’s intervention in the CMA’s nexfibre/Substantial inquiry turns on local market definition. Why that question shapes Phase 2 risk and the altnet consolidation pipeline.
In short: The ICO wrote to Meta in March 2026 over outsourced human review of audio-visual data captured by Ray-Ban Meta smart glasses. The enquiry tests controller/processor allocation under UK GDPR Article 28, lawful basis for AI training data, and whether the DUAA 2025 “meaningful human involvement” standard is met where reviewers validate AI outputs…
DSIT’s Compute Roadmap envisages £2bn of UK AI compute investment by 2030. The data protection regime that attaches to organisations building, procuring or operating that infrastructure is not in the Roadmap. This post sets out the four obligations under UK GDPR and DUAA 2025: DPIA, automated decision-making, international transfers, and Article 28 processor agreements.
In short: The CMA has accepted the first voluntary commitments under the Digital Markets, Competition and Consumers Act 2024, from Apple and Google in respect of aspects of their UK mobile platforms. The commitments cover app review, app ranking, data use and iOS interoperability. They are legally binding and signal how the new digital markets…
In short: The CMA opened its invitation to comment on the £2 billion nexfibre/Substantial transaction on 23 April 2026. The case is in pre-notification; the statutory 40-working-day Phase 1 clock has not started. The deal is publicly targeted at Q3 2026 completion; that timeline carries real Phase 2 risk, and mandatory NSI Act 2021 notification…
After a year of testing frontier AI models and legal-specific platforms, the problem was not capability but structure. A law firm cannot be built around a model. It needs a method in which AI operates under controlled, auditable workflows, with the lawyer as the final gate.
In short: Ofcom has written to UK Communications Providers on 21 April 2026 to assess cyber risks from frontier AI, citing the AI Security Institute’s evaluation of Claude Mythos Preview. The duties already sit in section 105A of the Communications Act 2003 and the Telecommunications (Security) Act 2021 framework. CPs must now document assessment of…
Ofcom’s consultation on how high-density areas are defined for Upper 6 GHz (6425-7125 MHz) subnational mobile licences closes on 6 July 2026. What MNOs and enterprise campus operators must know.
Competition Appeal Tribunal [2026] CAT 11 Trial 2 pass-on findings and the Administrative Court ruling in [2026] EWHC 64 (Admin) on the Payment Systems Regulator’s power under section 54 FSBRA 2013 to cap cross-border interchange fees.
The DSIT joint open letter on AI cyber threats, updated on 22 April 2026 alongside the Cyber Resilience Pledge, does not create new law. It sharpens how the ICO, Ofcom and FCA will judge existing Article 32 and sector security obligations.
HMT’s 22 April 2026 response to the SM&CR reform consultation, with FCA PS26/6 and PRA PS12/26, sets a package aimed at a 50% compliance burden reduction. The scope question comes first: pure APIs and EMIs sit outside SM&CR because the regime attaches to FSMA Part 4A authorised persons. Only dual-regulated firms are in scope.