In short: The UK’s open banking advantage is an infrastructure advantage, not an interface one. A shared directory, a common dispute management system and a governed API standard, built out under the Retail Banking Market Investigation Order 2017, make the rails usable at scale. That infrastructure is the platform on which successor Smart Data regimes, enabled…
In short: The European Data Protection Board published a standardised DPIA template on 14 April 2026, open for consultation until 9 June 2026. UK controllers processing EU residents’ data should review the template now. Its design-risk versus incident-risk framework offers a more rigorous structure than the ICO’s current screening checklist. By Rob Bratby, Managing Partner,…
In short: Four UK fibre altnet M&A transactions in Q1 2026 confirm the consolidation wave. The dividing line between a strategic exit at market metrics and a distressed lender-driven exit is debt repayment capacity: whether take-up generates enough recurring revenue to service the debt incurred during the build phase. Acquirers must assess CMA jurisdiction under…
In short: UK payment firms reimbursed £173 million to APP fraud victims in year one of the PSR’s mandatory regime under Specific Direction 20. The payments sector bears all reimbursement costs, but APP fraud originates across telecoms, social media and messaging platforms. The Q2 2026 FCA/PSR review will consider whether the current single-sector liability model…
In short: The Cyber Security and Resilience Bill does not impose NIS obligations on telecoms operators for their core network and service provision. NIS Regulation 8(1A) and the RMSP definition both exclude PECN/PECS providers. But the Bill catches operators’ IT suppliers as Relevant Managed Service Providers under ICO oversight, and operators running data centres above…
In short: Ofcom chair 2026: The government named Sir Ian Cheshire as its preferred candidate for Ofcom Chair on 8 April 2026, succeeding Lord Grade from 1 May 2026. Cheshire’s background in retail, consumer business and corporate governance, rather than telecoms or technology regulation, signals a regulatory emphasis on consumer outcomes during a critical period…
Quick answer. Gamma Communications confirmed on 7 April 2026 that it is in preliminary takeover discussions, commencing an offer period under the City Code on Takeovers and Mergers. Gamma reported 2025 revenue of GBP 645.8 million as a channel-led UCaaS and SIP trunking provider. The CMA will apply the UK merger control regime; a Phase…
On 3 February 2026, the Court of Appeal handed down judgment in On Tower UK Ltd v AP Wireless II (UK) Ltd [2026] EWCA Civ 43, settling a question that had divided the First-tier Tribunal and the Upper Tribunal. An operator that has been assigned only the benefit of a Code licence agreement is a…
The Information Commissioner’s Office (ICO) opened consultation on 27 February 2026 on draft updated guidance for the research, archiving and statistics (RAS) provisions of UK data protection law. Responses close on 27 April 2026. The commercial novelty for controllers running long-lived datasets, AI training sets or public-interest archives is the new disproportionate effort exemption in…
UK fibre consolidation is splitting into two paths. On the happy path, a well-positioned altnet is bought at a premium by a scaled acquirer, as in nexfibre’s agreement to acquire the Substantial Group, the parent of Netomnia and YouFibre, announced in February 2026 and analysed in our earlier note, UK Fibre Consolidation: What the Nexfibre…
The UK has no standalone AI law. Unlike the European Union, which passed the AI Act in 2024, the UK has chosen a sector-led approach under which existing regulators apply existing law to AI systems within their remit. This article sets out what that means in practice in 2026: which statutes and regulators bind AI developers and deployers, what the DUAA 2025 changed for automated decision-making, where copyright law stands after the government stepped back from its proposed training exception, and how Ofcom, the FCA, the PSR and the CMA apply existing powers to AI.
From 15 July 2026, BNPL firms must hold FCA authorisation or rely on the Temporary Permissions Regime. What PS26/1 and SI 2025/859 require now.