Regulatory Landscape in the EU and the UK: Key Considerations for 2026

Introduction

As we enter 2026, the regulatory landscapes of the European Union and the United Kingdom continue to evolve at pace, shaped by shifting geopolitical dynamics, economic pressures, and an ongoing recalibration of strategic priorities on both sides of the Channel. While the EU's competitiveness agenda and the UK's drive toward regulatory autonomy have taken clearer form over the past year, the practical reality for businesses is an increasingly complex environment marked by divergence in some areas and renewed cooperation in others.

Against this backdrop, Steptoe's Brussels and London teams outline the key developments expected across the major regulatory pillars in 2026, from sanctions and export controls, chemicals and environmental regulation, and business and human rights, to AI, data, digital, antitrust, and financial crime.

Through concise updates across each area, this annual outlook is designed to help organizations anticipate developments, navigate compliance demands, and identify opportunities arising from legislative and policy shifts in the year ahead.

You can explore each of these areas in more detail through the articles below:

• Sanctions and Export Controls
• Chemicals Product, and Environmental Regulation
• Business and Human Rights and Sustainability
• AI, Data and Digital
• Antitrust/Competition
• Criminal Enforcement and Investigations in the UK 

Sanctions and Export Controls

Alexandra Melia, Guy Soussan, Ana Amador

UK and EU sanctions and export controls remain a key foreign policy and national security tool, with policy in these areas likely to continue being shaped in 2026 by significant new and ongoing geopolitical events. While UK and EU coordination on key areas of sanctions and export controls policy such as Russia and the control of emerging technologies is expected to continue, absolute alignment does not exist, and businesses will need to carefully navigate the points of divergence built into these increasingly nuanced and complex regimes.

The expansion of UK and EU sanctions measures targeting Russia was a consistent focus in 2025, with significant measures being taken against the Russian energy sector and supply chains making items subject to trade sanctions available for use on the battlefield in Ukraine. This is a trend that appears likely to continue into 2026 as efforts to find a resolution to the war continue. The UK and EU also increased sanctions on Iran in late 2025 following the UN Security Council snapback process. Both the UK and the EU are expected to take new restrictive measures in view of the violent repression of protests in Iran.

The differential relaxation of UK and EU sanctions on Syria following the fall of the Assad regime, however, is likely to create compliance complexity for businesses operating internationally that wish to explore entry into the Syrian market in 2026. 2025 also saw the introduction of unilateral sanctions regimes tackling novel new areas such as the UK’s world-first thematic sanctions regime targeting global irregular migration and people trafficking. 

There was a steady stream of enforcement action in 2025, with a particular focus on Russia-related enforcement. In the UK, several civil monetary penalties and compound settlements were imposed for breaches of UK financial and trade sanctions. The former Governor of Sevastopol and his brother were the subject of the first criminal prosecution for financial sanctions violations and, in late 2025, criminal proceedings commenced against a UK art gallery for alleged breaches of the UK's Russia luxury goods trade sanctions. During its first year of operation, OTSI also initiated several investigations into potential breaches of the trade sanctions within its enforcement remit. In the EU, countries started implementing Directive (EU) 2024/1226 harmonizing sanctions breach definitions, criminalizing violations and setting minimum penalties. Countries had until May 2025 to transpose the directive into national law, and the European Commission has launched infringement proceedings against 18 countries for failing to do so fully. Criminal and administrative enforcement has also significantly increased with 6,000 investigations ongoing only in Germany for breaches of Russian and Belarus sanctions regimes.

In response to growing recognition that strong enforcement of sanctions is critical to their impact, steps have been initiated to enhance enforcement processes and powers that are likely to support increased enforcement activity in 2026 and beyond. In the UK, 2025 saw an expansion in the range of businesses required to make mandatory reports of suspected sanctions breaches to OFSI (e.g., art market participants and insolvency practitioners, among others), as well as to whistleblower protections (and possible future incentivization) associated with the reporting of sanctions breaches. These steps reflect the importance of these information flows to the effective investigation and enforcement of UK sanctions breaches. Following a cross-government review of sanctions implementation and enforcement in the UK, a consultation also has been launched on potential improvements to civil enforcement processes for financial sanctions, which may result in the doubling of maximum civil monetary penalties for violations and the introduction of an early settlement scheme to deliver civil enforcement action more quickly during 2026. In the EU, the European Commission introduced a Helpdesk to provide support to SMEs implementing EU sanctions worldwide. The EU has also launched a comprehensive report on evasion tactics.

An increased focus on national security in relation to emerging technologies, and a perception of weaknesses in the traditional multilateral systems for control of these items persisted in 2025, leading to an uptick in the coordinated unilateral adoption of export controls on certain emerging technologies in the UK and EU. This continuing trend mirrors in many respects the move toward unilateral but coordinated sanctions that has been taking place over the past several years, and appears likely to continue, particularly considering China's continuing role as both an important trading partner and a systemic competitor to the UK and EU.

The evolution of UK and EU sanctions and export controls is likely to continue at pace in 2026.  The continued conflict in Ukraine, escalation and de-escalation of a range of other sanctions regimes, and an increased focus on enforcement appear poised to give rise to continuing compliance complexity for businesses operating in the UK and EU. Successfully mapping and navigating these sanctions and export controls challenges will require continued care and attention.

For further updates on sanctions visit our International Compliance Blog and dedicated Russia Sanctions Developments webpage.

Back to top

Chemicals, Products and Environmental Regulation

Ruxandra Cana, Eléonore Mullier, Darren Abrahams and Tom Gillett

European Union

2024 was a pivotal year for chemicals regulation in Europe. As the last year of the European Commission’s 2019-2024 mandate, we saw some of the flagship measures under the Chemical Strategy for Sustainability agenda make it into law while other measures stalled or were dropped altogether. 2025 will see a number of implementation measures, continued work on files started under the previous mandate, and expected new landmark initiatives.

The amendment of the Classification, Labelling and Packaging (CLP) Regulation was adopted and published in November 2024. The publication starts the clock on the transition periods for companies to review and update their substance communication. In parallel, the European Chemicals Agency (ECHA) has published an update to its guidance on the CLP Regulation which should give some long-awaited clarity on the application of the criteria for the new hazard classes. We expect to see national authorities issue new harmonized classification and labelling proposals under the new hazard classes in 2025.

The Ecodesign for Sustainable Products Regulation (EU) 2024/1781 (ESPR) entered into force in July 2024. Work is underway to develop the ecodesign criteria that will have to be met for specific product categories to be able to be placed on the EU market. Among the sectors identified as priorities are textiles, chemicals, detergents, paints and lubricants, and we expect questions to arise (among others) on the interface between these ESPR criteria and the REACH and CLP Regulations.

In parallel, the European Parliament has announced that it will continue to progress on the following pending files with a high potential for compliance impact:

• the One Substance One Assessment package: this package of three measures proposes to streamline chemical substance assessments by (i) reattributing scientific and technical tasks currently distributed among various EU authorities to ECHA, (ii) enhancing cooperation among Union agencies (with a mechanism to resolve any divergence of scientific opinion amongst them) and (iii) establishing a common data platform, managed by ECHA, intended to group an unprecedented volume of data on chemicals. The data on this new platform would be used to inform policy making and set an early warning and action system for emerging risks, raising concerns of disclosure and misuse of sensitive and complex data;
• the Green Claims Directive: 2024 saw the adoption of a first set of measures on environmental claims through Directive (EU) 2024/825 on empowering consumers for the green transition through better protection against unfair practices and through better information. Legislative discussions will continue on its sister proposal for a Green Claims Directive, which seeks to regulate voluntary environmental claims in communications directed at EU Consumers;
• and many other important files such as the Waste Framework Directive, the Detergents and surfactants Regulation, the Toy Safety Regulation and the Regulation on public access to European Parliament, Council and Commission documents.

The revision of the REACH Regulation, anxiously-awaited, had been put on hold in the run up to the elections is. The Commission has confirmed that work has resumed on (a different version of?) the proposal to revise this cornerstone piece of EU chemicals legislation. The reveal of the proposal, expected late in the year, will be a major event in 2025 and will serve as an important marker of the Commission's new policy direction on environmental matters.

In the meantime, the ECHA committees are continuing their assessment under the universal PFAS restriction proposal. In an update published in December 2024, ECHA and the five dossier submitters confirmed that the comments submitted during the public consultation (a never seen before number of comments – 5,600) are still being considered and that the committees will publish their (draft) opinions in 2025. ECHA's committees are also considering alternatives to the two restriction options contained in the restriction proposals (i.e. a full ban or a ban with time-limited derogations where alternatives are not yet available). These developments will be closely monitored by companies given the wide range of sectors and applications potentially affected by the proposal.

On December 31, 2025, data protection for existing active substances is scheduled to expire under the Biocidal Products Regulation (BPR), long before the review programme for the evaluation of those active substances is concluded (currently scheduled for December 31, 2030). This would allow free-riding market access by companies (outside and within the EU) who have made no financial contribution to the cost of generating regulatory data. As industry and authorities grapple with the new review programme deadlines (in particular for submission of data on endocrine disrupting properties), they will also be reviewing progress under the BPR REFIT to see to what extent this revision can address the significant challenges under the BPR.

2025 was a year of fundamental shifts in EU policies dealing with chemicals, products and environmental regulations. After the European Parliament elections in 2024, in 2025 the Commission and the EU legislature focused on amending, or terminating, initiatives that had dominated the previous legislature, from 2019 to 2024. The changes were mainly pursued consistently with the new EU agenda of enhancing competitiveness.

In 2026, we expect this trend to continue: there will be significant activity in the implementation and application of large legislative files that dominated the previous legislative cycle (such as CLP or PPWR), at the EU and national level, while ideas or initiatives that may have led to new frameworks may permeate and impact companies through measures adopted under the existing legislation (such as the essential use and GRA concepts, in the plausible absence of a legislative revision of the REACH Regulation).

Some of the key legislative and policy developments in 2025 include:

• The Chemicals Industry Action Plan: introduced in July 2025 to support the modernization and competitiveness of the EU chemical sector, through four main areas:
• strengthening resilience (establishing a Critical Chemical Alliance to address the risks of capacity closures in the sector and applying trade defense measures to ensure fair competition),
• securing energy/decarbonization (swiftly implementing the Affordable Energy Action Plan to help reduce high energy and feedstock costs),
• creating lead markets (innovation for green products, highlighting fiscal incentives and tax measures to boost demand for clean chemicals),
• and simplifying regulations (Omnibus package, ECHA reform).
• CLP Regulation Amendments: The Council agreed to a "stop-the-clock" mechanism, officially delaying the date of application for certain revised Classification, Labelling and Packaging (CLP) rules until January 1, 2028. This extension provides businesses, particularly SMEs, with more time to adapt to new requirements, including those for digital labeling and updated formatting.
• Detergents Regulation Update: New EU rules were approved in December 2025 include enhanced biodegradability standards for surfactants, improved information on labels, and a ban on animal testing for detergents and surfactants. 

PFAS (Per- and Polyfluoroalkyl Substances)

The EU continued progress on a broad restriction proposal for PFAS, with ECHA publishing an updated proposal in August 2025. In April 2025, a sector-specific ban on PFAS in firefighting foams was adopted by Member States. The European Chemicals Agency plans to launch a consultation on the draft opinion of its Committee for Socio-Economic Analysis (SEAC) on the proposed EU-wide restriction of per- and polyfluoroalkyl substances (PFAS) following the Committee’s meeting in March 2026.

In 2026, we expect developments in the following areas

The "One Substance, One Assessment" (OSOA) Package 

The new rules aim to streamline and accelerate the scientific safety assessments of chemicals across various EU laws. A central data platform managed by ECHA will integrate data from over 70 EU laws to avoid duplication of studies. The OSOA package comprises three proposals:

• A regulation establishing a common chemicals data platform:
  • Data and information on chemicals would be brought together on a single platform managed by the European Chemicals Agency (ECHA). This database would contain studies carried out on the products concerned, centralize human biomonitoring information generated in the EU, and include an early warning system for emerging chemical risks.
• A directive reassigning technical tasks to the European Chemicals Agency (ECHA):
  • To enhance transparency, procedures relating to the list of substances subject to restrictions in the EU would no longer be the responsibility of the Commission, but of the European Chemicals Agency (ECHA), seen as more legitimate. The Commission would nevertheless be able to review the list periodically.
• A regulation to improve cooperation in the field of chemicals:
  • Cooperation between the Commission, ECHA and other EU bodies would be strengthened, as it is seen as essential to the success of this rationalization. Exchanges between these bodies would also be facilitated, notably by a specific procedure in the event of scientific disagreements.

Chemicals ‘Omnibus’ Proposal

Published in July 2025, the chemicals omnibus proposal  is a major legislative initiative designed to reduce administrative burdens, cut red tape, and enhance the competitiveness of the EU chemical industry.  Aimed at simplifying regulations while maintaining high environmental and health safety standards, this package is expected to save the industry at least €363 million annually. The omnibus amends three key EU regulations:

• Classification, Labelling, and Packaging (CLP) Regulation: more flexibility for label formatting and the removal of fixed deadlines for label updates. The proposal also expands the use of digital labeling and simplifies information requirements for the advertising of products sold to the public.
• Cosmetic Products Regulation (CPR): Proposed changes to the Cosmetic Products Regulation aim to clarify requirements and procedures, as well as to reduce unnecessary and duplicative reporting obligations. In relation to the CMR ban, the omnibus proposal introduces specific timelines for derogation requests and transitional periods to ease industry’s adjustment to restrictions. The omnibus also proposes streamlining the derogation criteria for such bans. The prenotification requirement for cosmetics containing nanomaterials has been removed, with reliance on existing safety assessments. Procedures for amending annexes related to colorants, preservatives, and UV filters are also formalized. Additionally, the omnibus seeks to clarify the regulatory approach to natural complex substances (e.g., essential oils).
• EU Fertilizers Regulation: The omnibus removes "extended" registration requirements for certain substances, simplifying the process. It also streamlines the assessment of micro-organisms used in plant biostimulants and increases the use of digital tools for reporting.

ECHA Basic Regulation

Alongside the chemicals 'omnibus,' the Commission adopted a proposal for a European Chemicals Agency (ECHA) Basic Regulation which aims at creating an autonomous regulatory framework for the agency and simplifying its financial model. The environment committee is tentatively set to adopt its draft report on the proposal during a meeting on April 15 and 16, 2026, but the plenary vote is not yet confirmed. Member States agreed on their position on the file on December 10.

Critical Chemicals Alliance

In early January EVP Séjourné convened the first General Assembly of the Critical Chemicals Alliance which is a key element of the European Chemicals Industry Action Plan, bringing together the Commission and stakeholders and tackle the main challenges affecting the sector. The Alliance will build on the experience of the Transition Pathway for the EU Chemical Industry.

ECHA and EFSA to review environmental behavior of TFA from biocides and pesticides
ECHA together with the European Food Safety Authority (EFSA), have received a joint mandate from the European Commission to assess the fate and behavior of trifluoroacetic acid (TFA) in soil and water. The scientific findings are expected to be ready by June 1, 2027.

Medical devices

The European Commission has opened an eight-week feedback period on its proposal for a regulation to revise EU rules for medical devices and in vitro diagnostics. The proposal (COM(2025)1023) aims to simplify existing regulations and make safety requirements more cost-efficient and proportionate, whilst ensuring availability of safe and innovative devices to maintain patient safety and public health standards. The initiative seeks to enhance competitiveness of the EU medical device sector in internal and global markets, support innovation and reduce dependencies. The feedback period runs from January 7 to March 5, 2026.

United Kingdom

When the UK completed its exit from the European Union on January 31, 2020, Great Britain (England, Scotland and Wales) set itself on an independent path for chemicals and environmental law and policy. Northern Ireland continues to apply EU law, under the Northern Ireland Protocol (part of the EU-UK Withdrawal Agreement) and the Windsor Framework which modified arrangements under the Protocol from March 24, 2023.

2025 was another year in which the UK continued to grapple with its new-found power to set its own chemicals policy agenda. On May 19, 2025, the UK Government and the EU held their first joint summit since the UK left the EU, adopting a Joint Statement setting out a new UK-EU strategic partnership and a Common Understanding with commitments to work towards strengthened cooperation across a range of policy areas. While the Common Understanding confirms that the EU and the UK will work towards a separate agreement on a common UK-EU Sanitary and Phytosanitary (SPS) area, so that "the vast majority of movements of animals, animal products, plants, and plant products between Great Britain and the EU" can be undertaken without certificates or controls, it was silent on a much-anticipated reset of wider chemical management issues.

The UK Government’s desire for further "alignment" has been a notable change in the past 12 months. While largely rhetorical and light on detail, this stated policy aim has started to make itself apparent in the black letter of product law. One such example is the Product Regulation and Metrology Act 2025, which provides powers to Ministers to introduce product regulations that allow a specific "product requirement" to be treated "as met" if a requirement of "relevant EU law" is met. It also empowers ministers to set product requirements, which correspond to or are similar to provisions of "relevant EU law," for the purpose of reducing or mitigating the environmental impact of products. Any use of this legislation by Ministers in 2026 may provide an early indication of what “alignment” really means in practice.

REACH remains the core piece of chemicals legislation in Great Britain (GB). However, despite a consultation on an alternative transitional registration model (ATRm) for ‘UK REACH,’ which ended on July 25, 2024, there remain significant uncertainties regarding the intended approach to substance registration. The stated aim of the ATRm is to reduce the estimated £2 billion costs to the chemical industry under the transition from EU REACH to a domestic regime – mostly accounted for in data access costs and registration dossier submissions. The proposed changes to registration requirements include: reducing to a minimum the hazard information required for registrations (with associated changes to Chemical Safety Reports), refining use and exposure information requirements specific to GB including, strengthening measures against unnecessary animal testing, and increasing regulator powers to request data on specific chemicals of concern. A formal response to the consultation remains outstanding some 18 months later. In fact, to date the only update on progress was published in July 2025 when DEFRA confirmed that "the ATRm is still under review" but that its expectation is that "the final information requirements will not exceed those outlined in the 2024 ATRm consultation."

In light of that delay, it has been deemed necessary to amend UK REACH such that current registration deadlines are moved further into the future. On December 22, 2025, DEFRA published its response to a 2025 consultation on extending the transitional registration submission deadlines. To the frustration of industry, DEFRA confirmed that it will move ahead with an extension of the deadlines from October 27, 2026, 2028, and 2030 to October 27, 2029, 2030, and 2031. This approach does not align with the clear request from industry to provide more time between each of the individual deadlines.

The Retained EU Law (Revocation and Reform) Act 2023 (the "REUL Act") provides powers to reform assimilated (EU) law, provided that (inter alia) such reforms do not increase overall regulatory burden for duty holders. Those powers can be used no later than June 2026. In June 2025, the HSE issued a public consultation on broad legislative reform proposals to three other core pieces of "assimilated" chemicals legislation (EU derived law, incorporated in Great Britain): GB BPR (Regulation (EU) No 528/2012 on biocidal products); GB CLP (Regulation (EC) No 1272/2008 on the classification, labelling and packaging of substances and mixtures); and GB PIC (Regulation (EU) No 649/2012 on prior informed consent). The consultation covered a range of proposals including recognition of active substances approvals and biocidal products authorizations in foreign jurisdictions under GB BPR, and removing the legal obligation under GB CLP for the HSE to automatically consider all ECHA (RAC) opinions on EU harmonized classification proposals. Some form of response to those proposals is anticipated in early 2026, given HSE’s preference to bring forward any changes to the law before June 2026 under the REUL Act (to avoid a more onerous legislative process that would otherwise be required).

On December 30, 2025, the Biocidal Products (Data Protection Periods) (amendments) Regulations 2025 came into force. The Regulations extend the data protection longstop under the GB BPR, resolving (at least temporarily) an issue that both the EU and the UK have been grappling with for many years. This provided a positive close to a year that has been largely defined by further indecision on the future of UK chemicals legislation, and evidence that the UK institutions are able to deliver timely, pragmatic solutions when required and appropriately advocated for.

Back to top

Business and Human Rights and Sustainability

Ruxandra Cana, Jonathan Drimmer, Zoe Osborne

The EU's 2026 Business and Humans Rights perspective will involve two key themes: (1) continuing to streamline business and human rights-related regulations as part of its broader focus on reducing regulatory burdens, and (2) progressing toward implementation of initiatives it has adopted. In many respects, these are continued trends from 2025.

Last year, the EU focused on revising and simplifying human rights laws. As part of the first Omnibus, it substantially narrowed the scope and substantive obligations in the Corporate Sustainability Due Diligence Directive (CSDDD), limiting its application to the largest companies based or doing business in the EU and emphasizing a discretionary risk-based approach to human rights and environmental due diligence with civil liability determined under the law of each Member State (as is the case today in those Member States where similar obligations already exist). It also narrowed the scope and specific data disclosures for the Corporate Sustainability Reporting Directive (CSRD), and sought further alignment with the reporting standards of the ISSB, which have been adopted (or are in the process of being adopted) in 36 countries. Other steps included postponing application of the EU Deforestation Regulation (EUDR) and Batteries Regulation (EUBR), requiring due diligence and disclosures regarding agricultural products and batteries, as well as potentially initiating substantive amendments to EUDR. However, it did not adjust the timing for the EU Forced Labor Regulation (EUFLR), slated to come into force in 2027 and banning the import, sale or export of goods created with forced labor.

In 2026, progress toward implementation of these laws, and continued efforts to streamline existing obligations, can be expected to continue. The CSDDD will be finalized early in the year, giving companies three years to prepare for it. The specific data point disclosures for the CSRD, guidelines for the due diligence obligations of the EUBR, and the EUFLR database will each be published mid-year. Toward the end of 2026, the EUDR will finally come online, demanding compliance as the calendar turns. How the streamlining and deregulation focus impacts other EU human rights and sustainability laws remain to be seen. However, there will be ample opportunities for companies to develop and refine compliance approaches as guidance and tools for these regulations are promulgated.

Nonetheless, as the hazy picture from last year has begun to clarify, companies might begin to reconsider how their existing strategies can be adjusted to meet these new regulatory demands, consistent with their new timelines. As part of that evaluation, it will be prudent to consider applicable overlapping regulatory requirements in specific Member States and outside of the EU, and how compliance efficiencies can most effectively be leveraged.

In September 2025, the UK government announced it had launched a review into the UK's approach to responsible business conduct (RBC), focused on the global supply chains of businesses operating in the UK. The review will assess the effectiveness of the UK's current RBC measures including measures to tackle forced labor and consideration as to how to strengthen s.54 of the Modern Slavery Act, including the reporting requirements, the turnover threshold, and penalties for non-compliance. Although we may not see any new legislation in the UK in 2026, the direction of travel is clear; namely toward an eventual mandatory, risk-based due diligence and to helping protect responsible businesses from being put at a competitive disadvantage by those prepared to flout relevant laws and standards.

Back to top

AI, Data and Digital

Anne-Gabrielle Haie

AI Act, Enforcement to Begin

August 2, 2026, will mark the entry into application of most of the obligations under the AI Act, and competent authorities’ enforcement powers. These notably include requirements relating to high-risk AI and AI systems subject to specific transparency obligations.

While the European Commission presented, on November 19, 2025, a Digital Omnibus amending the AI Act, which proposed to postpone the entry into application of high-risk AI obligations and transparency obligations for certain providers of generative AI systems, there is no certainty at this stage that this proposal will be adopted before the August 2, 2026, deadline. Accordingly, these obligations may enter into application on August 2, 2026, as initially planned, despite the European Commission’s intention to postpone them. Given this uncertainty, organizations should therefore move forward with their compliance efforts rather than pausing them.

Throughout 2026, the European Commission is expected to issue detailed guidance and templates to support compliance efforts. These will notably address the practical application of the high-risk AI and transparency requirements, and the interplay between the AI Act and other EU laws.

Proposed Digital Omnibus to Dominate Policy Discussions

The Digital Omnibus Package, introduced in late 2025, and composed of the Digital Omnibus amending the AI Act referenced above and the Digital Omnibus amending EU digital laws, is expected to dominate policy discussions throughout 2026. Its primary objective is to simplify and consolidate overlapping EU digital and AI legislation, including the AI Act, the General Data Protection Regulation (GDPR), the ePrivacy Directive, data laws, and cyber incident reporting obligations.

The proposed amendments to the AI Act would not substantially alter the overall obligations but would introduce additional flexibility with respect to certain specific requirements. By contrast, the proposed amendments to the GDPR would represent a significant shift in the EU approach to data protection. In particular, the European Commission has proposed amending the definition of "personal data," introducing greater flexibility regarding the processing of personal data in the context of AI, and loosening certain transparency requirements and data subject rights.

A number of stakeholders have already expressed concerns regarding the proposed Digital Omnibus Package. This suggests that intensive policy discussions are likely and that the proposals face a low likelihood of being adopted in their current form. Accordingly, organizations should closely monitor these developments and should not yet adjust their practices or compliance efforts on the basis of the European Commission’s proposed texts.

GDPR Enforcement to Remain Steady, Particularly with Respect to AI

As initiated in late 2024, EU data protection authorities are expected to continue focusing their enforcement priorities on data protection issues arising from the development and deployment of AI. While initial enforcement actions have primarily targeted AI developers, organizations whose role is limited to the deployment of AI should not consider themselves outside the regulatory scrutiny scope. In practice, both AI developers and AI deployers should carefully assess their own GDPR compliance, as well as that of their vendors and partners, with respect to data processing activities carried out in the context of AI.

Additionally, guidelines from the European Data Protection Board highly relevant in the AI context are also expected. This will include guidelines on anonymization and pseudonymization.

International data transfers have also returned to the forefront of regulatory attention in 2025 and are expected to remain a critical issue in 2026, in particular with respect to transfers to China and the United States.

Intensified Enforcement of the Digital Services Act (DSA)

EU regulators have announced that 2026 will see intensified enforcement of the DSA. The European Commission is increasing its scrutiny of very large online platforms and very large online search engines, focusing in particular on content moderation practices and transparency obligations. Digital Services Coordinators at the national level are also expected to accelerate their enforcement. 2026 should also bring further guidance on the application of the DSA.

Data Act, Enforcement to Kick Off

The Data Act, applicable from September 12, 2025, will enter its enforcement phase in 2026. This Regulation establishes new obligations relating to access to data generated by connected products and related services, as well as obligations for data processing service providers. Organizations that are not yet prepared should accelerate their compliance efforts before being targeted by an enforcement action.

Revised Cybersecurity Framework and Compliance Readiness

On 20 January, 2026, the European Commission published its proposal for a Revised Cybersecurity Act. Its most consequential development for business would be the establishment of the first Union-wide ICT supply chain security framework.

Moreover, while most obligations under the Cyber Resilience Act will not enter into force before December 11, 2027, organizations should begin preparing for compliance, as implementation may require significant time and resources. As a reminder, the Cyber Resilience Act introduced new cybersecurity requirements for products with digital elements.

For further updates see StepTechToe: AI, Data & Digital Regulation Blog.

Back to top

Antitrust/Competition

Charles Whiddington, Ronan Scanlan 

2025 was a year which witnessed significant developments across the competition law landscape, in mergers, cartels, cartel damages and digital markets- many of which we addressed in our regular weekly blogs. The European Commission's activities and the Courts' decisions also indicate the direction of travel in a number of areas in 2026. Here we look at a number of areas at EU and UK levels where we expect to see developments in the coming year. 

European Union

Big Picture: Economics v.  Politics

In past years, European competition law practice has been economics-led. With a strong economics team at the heart of the Commission, the focus has been on seeking to protect the competitive process (not competitors) and without stifling innovation. The emergence of the digital age has presented Europe with challenges which, in addition to Article 101 and Article 102 investigations by the Commission, it has met with measures like the Digital Markets Act, the Digital Services Act and the AI Act. However, arguably this more economic/technocratic approach is being eroded, in particular following the systemic shocks of the Covid pandemic, the energy crisis resulting from the Ukrainian invasion and the current disruption of the global trading order (and consequent increased national rivalries and tensions). The strategic industrial imperatives outlined in the 2024 Draghi Report have taken on greater urgency and amidst these concerns, we are already seeing calls for new instruments to empower Europe to achieve energy security, strategic independence and foster European-wide champions. We expect to see some of these undercurrents continue to play out during this next year and in succeeding years.

Mergers

Through the Summer of 2025, the Commission’s Executive Vice President Ribera launched a review of the 2004 Merger Control Guidelines.  Her mandate draws on the Draghi Report in its stressing of innovation and future competition (echoing also the UK government’s message to the UK's CMA to focus on fostering growth and innovation).  EVP Ribera is focused on 7 key themes: competitiveness, market power, digitalization, sustainability, innovation, efficiencies and public policy issues such as the appropriateness of jobs and defense for inclusion in a merger review process.  The results of the consultation will be announced during this year, including whether to propose any amendments to the merger regulations themselves, with the proposed adoption of new guidelines in the first quarter of 2027. It remains to be seen whether (as appears to be the case in the UK) the EU will tolerate increased convergence/market concentration.

Alongside this review, we are seeing continued interest at EU level and national level (post Illumina/Grail) in below-threshold mergers (so-called killer acquisitions) which may be called in.  At national level, some ten member states have the power to call-in such mergers and others are likely to follow. Nvidia has challenged a referral of its acquisition of Groq to the Commission by the Italian competition authority and this will continue to be a hot topic especially in the field of digital technologies, AI, data centres.

FSR

With the Foreign Subsidies Regulation (FSR) in force now for over two years, it has clearly played an increasingly important role in both public procurement and in M&A deals.  Hundreds of notifications have been made to the Commission in both the merger stream and in the public contract stream. Yet very few have led to Phase II investigations, and the files have been invariably closed by way of short closure letters, with little or no reasoning. This leaves businesses without guidance on the Commission’s thinking (other than from short press statements). To counter this the Commission has indicated that during 2026 it will publish formal guidelines on its approach to key principles under the FSR and may propose amendments to the FSR to allow for simplified notifications in low-risk areas.

Cartels and Enforcement

2025 was an active year for the European Commission which adopted a number of cartel decisions, several of which were firsts of their kind:

• In June, Delivery Hero and Glovo were the first to be fined (€329M) for no-poach arrangements and it also held that a minority stake (here 15%) could be a structural link which could facilitate collusion;
• In July, Alchem International was fined for price-fixing and quota allocation in relation to an active pharmaceutical ingredient – the first in an upstream pharma supply chain;
• In other cases, fines were imposed for cartels in end-of-life vehicle recycling, luxury goods RPM and vehicle starter batteries.

The European Courts have also been active and there are a number of strands which will continue to play out in the coming year, for example:

• The scope of the essential facilities doctrine in digital markets;
• Are tying practices by a dominant company presumptively abusive;
• What is the scope of predation as an abuse;
• What is the Commission’s burden of proof in showing that clauses are capable of restricting competition;
• The choice of law to be applied in a cartel damages case involving multiple national laws.

Lastly, the Commission is finalizing its draft guidelines on exclusionary abuses which will replace the A.102 Guidance Paper dating from 2009.

AI

The Commission has not been alone in expressing concern about the potential for anti-competitive behavior through the deployment of AI tools. The Commission has identified concerns about high entry barriers, risks of vertical integration (including through strategic partnerships and the hiring of key staff)). Authorities also see AI as a tool for policing compliance and as an investigation tool. There are understood to be a number of investigations which the Commission has launched recently into algorithmic collusion. It has also recently launched two investigations:

• into Google’s use of publishers' web content to power its AI Overviews and AI Mode without proper compensation and exclusion of rival AI developers from using You Tube videos which it uses to train its generative models; and
• into Meta’s WhatsApp policy which restricts third party developers from offering WhatsApp users their own AI Chatbot support, which enables Meta to self-preference.

Steptoe has published five blogs on AI and antitrust, addressing issues both in Europe and in the US: Antitrust & Artificial Intelligence: A Four-Part Series; Data Centers and AI: Antitrust Compliance in a World of New Energy Regulations

United Kingdom

2025 was the year of a hard "reset" in the United Kingdom antitrust arena, starting with the sacking of the UK Competition and Markets Authority's (CMA) Chair in January, accepting of remedies in an unprecedented approval of a 4:3 telecoms merger (Vodafone / Three) in March, a voluntary settlement in a cartel case (the Homebuilders Investigation) in July, the closure of a three-year investigation (into Cloud Services) also in July and more new guidance documents than you could shake a stick at. By the end the CMA had found some renewed swagger in the consumer enforcement space, announcing eight new investigations in late December. However, by the close, the antitrust, cartel and merger dockets remained significantly lighter than in recent years, causing some to question whether the pendulum had swung too far in the other direction.

As we start 2026, we will continue to see the UK competition enforcement and merger control landscape evolve against the backdrop of a new economic and political reality (both at home and abroad). The government has set a clear direction to focus on UK issues, do a better job at engaging with business, ensure more stable and certain markets and mergers regime, and use its tools to encourage greater growth and investment. What the latter means in practice is still to be determined and direct government intervention in future mergers involving national champions or national issues has not been ruled out. A more permissive mergers regime is likely to embolden greater consolidation, leading over time to more challenging edge cases coming before the agency. 

The search for a new chair of the CMA is ongoing and, once that is confirmed, this may also lead to a broader change in the senior leadership team. We also welcome a New Year with an unprecedented number of root-and-branch reviews by government and into the CMA and its statutory remit, as well as that of the United Kingdom's other regulators (including in data protection and financial services).

So, with all that in mind, here are six significant UK antitrust developments to keep a close eye on in the coming months:

The Next Markets Investigation

The CMA's market investigation regime enables the agency to launch in-depth investigations of markets where it believes that competition is not working well. These have traditionally focused on UK-specific markets (airports, banking, ferry services, infant formula, road fuels, etc.), which is nicely in line with the government 2025 steer to re-orient the CMA's work to focus on home markets. No triggering event is required (i.e. a suspected antitrust violation or merger) making it a wide-ranging (and unique) tool at the CMA's disposal.

The UK government instructed the CMA in November 2025 to make its next market investigation into private dentistry, which is experiencing somewhat of a similar march of roll-ups and consolidation as other markets that have caught the CMA's eye in recent years (e.g. Veterinary Services, and, previously, Care Homes) and is a mix of individual ownership, corporate healthcare providers and private equity owners. Eventual remedies could include divestiture to address concentration concerns but more likely will result in commitments to improve price transparency or, potentially, price controls. Remedies could also involve the insurers themselves.

The Next Digital Markets Investigation 

Despite gaining expansive new powers to investigate suppliers of digital services, the CMA has not opened a "strategic market status" (SMS) investigation since last February (when it kicked off the regime with the App Stores and Search and Search Advertising (SMS) investigations, which remain ongoing). A three-year market investigation into cloud concluded in summer 2025 with a recommendation to make that the next SMS case but as yet, no announcement has been made, and it is an open question whether that is the right market that the CMA – with its new domestic focus – should be looking at. Questions of comity in this sector have recently gained heightened relevance following the European Union's announced investigations into cloud in November 2025.

It is fair to say that these new digital markets powers, which specifically target United States tech companies (turnover of £1 billion in the United Kingdom or £25 billion globally is required to qualify as an SMS candidate) could not have come at a worse time for the CMA, which is under strict orders to focus on UK-specific issues and leave global and especially US-centric markets to other regulators. The CMA (and the UK Government) have little political cover to be seen to lead in the regulation of US tech and must tread extremely carefully given that the US administration is laser-focused on perceived overreach by foreign regulators of US tech firms.

This leads to significant uncertainty about if and when there will be another SMS investigation conducted by the UK CMA's Digital Markets Unit. The possibility has even been mooted that the regime will be mothballed altogether after conclusion of the existing two investigations. This makes it an essential "one to watch" in the coming months.

The Next Antitrust or Cartel Investigation

2025 was also very quiet for the CMA on the antitrust and cartel side, with only one new antitrust case opened (into waste management services) and no cartel investigations announced.

It was a year for case closures, however. The CMA settled its investigation into collusion in the UK government bond auctions market in February 2025 and also accepted voluntary commitments in an investigation into suspected breaches of competition law in the homebuilding market in October 2025. The CMA also reached a settlement with Vifor Pharma in its disparagement case in May 2025. The CMA's investigation into Google's Privacy Sandbox was also closed in October 2025. The CMA also fined broadcasters for exchanging information in labor markets and 15 car manufacturers and a trade association for a long-running cartel in the end-of-life vehicle recycling sector.

We will all be watching closely to see whether this will change in 2026 and what pipeline, if any, the CMA is currently working with.

Reform to the Jurisdictional Reach of the CMA in Merger Cases

The UK Government has previously acknowledged the need to reform the CMA's share of supply test in merger control, which has, coupled with the "voluntary" nature of the regime, led to deep uncertainty as to where the axe will fall. The further introduction in January 2025 of a hybrid test for larger companies with significant shares in their core markets, where no increment with the target is required, has added further nervousness. The CMA's decision to investigate six AI partnerships, acqui-hires and investments as "mergers" in 2023-2025, only to clear them all unconditionally (or acknowledge that they did not qualify for investigation in the first place) further engendered confusion and uncertainty, elements antithetical to the new imperative to encourage inward investment to the United Kingdom.

Businesses will therefore welcome efforts to clarify the CMA's jurisdiction through the adoption of more brightline tests (for example, focused on turnover or transaction value) and potentially a move to a mandatory regime, which would remove the discretionary element of the UK merger control regime that has generated so much uncertainty and align the UK with other major jurisdictions.

The United Kingdom Government announced in October 2025 that it was working with CMA leadership to formulate proposals to increase certainty here, so expect a consultation soon.

Reform to How the CMA Takes Decisions on Merger Cases

This was trailed in a recent UK Government "action plan," which acknowledged that the CMA's panel system (where independent experts were appointed at Phase 2 to take decisions, a throwback to the days before the CMA when an entirely separate organization, the Competition Commission, undertook the Phase 2 investigation) was no longer working well. The experience in recent cases, most notably Microsoft / Activision, where the CMA had to effectively undo the decision of the panel was the most stark example of this.

These planned reforms throw the doors open to all manner of alternative approaches to decision-making, including a requirement for the CMA to prosecute merger prohibitions in court (akin to other common law jurisdictions) or – where the CMA keeps decision-making in-house – move merger decisions to full-merits appeals. We are expecting this consultation to launch in the next couple of months.

The Outcome in Getty / Shutterstock

The anticipated merger of Getty Images / Shutterstock is an important test of the new "wait and see" mantra espoused by the CMA for global deals. This merger is currently under in-depth review by the UK CMA and US Department of Justice (among others) with the UK having identified concerns in stock photos and editorial photos in November 2025 and due to publish its interim Phase 2 report in February 2026. That report will also provide an indication of what remedies the CMA will be willing to consider.

On the face of it, this case could be a good candidate for the US to lead on concerns in regard to stock photos (a global market) with the CMA bringing up the rear with a UK-specific remedy agreed for editorial photos (a national market). However, given the somewhat unpredictable nature of current United States merger enforcement, the CMA could again be left in the invidious position of being the only international competition authority finding concerns on wider than UK markets. 

The parties have already offered a structural divestiture of the affected UK business in editorial but a remedy for the CMA's global concerns could be harder to agree. With the parties holding a combined share of up to 80% of the relevant markets (on the CMA's read), the nature and scope of remedies will also be a real-world test of the CMA's new remedies guidance, published in October 2025.

Looking Ahead

Here in the Steptoe London office, we will be keeping a close eye on how the CMA puts words into practice across its myriad functions and how this may impact business, positively or negatively. This is a moment of significant and fundamental change in competition enforcement in the United Kingdom but also across many other regulatory regimes and there is significant opportunity for affected businesses to have their voices heard.

For further updates see StepAhead: Antitrust & Competition Insights and subscribe to CMA's Critical Friend¸ a LinkedIn newsletter.

Back to top

Criminal Enforcement and Investigations in the UK

Zoe Osborne

Financial crime was high on the UK's agenda in 2025, with the introduction of new laws and guidance relating to, among other things, money laundering, terrorist financing, fraud, and market abuse. Against that background, we expect to see an increase in enforcement activity in these areas in 2026, with prosecutors and regulators having a greater armory at their disposal particularly in relation to corporate liability and accountability for senior management.

Financial Crime Enforcement

September 2025 saw the coming into force of the UK's new failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023, accompanied by Guidance on Failure to Prevent Fraud Offence ." Under the new offence, larger companies and partnerships may commit a criminal offence where: (i) a specified fraud offence is committed by an associated person (an employee, agent or subsidiary, an employee of a subsidiary, or a person who otherwise performs services for or on behalf of the organization), (ii) for the organization's benefit, and (iii) the organization did not have reasonable procedures in place. The UK Serious Fraud Office (the SFO) has made no secret of its desire to prosecute someone for this offence and for someone to "feel the bite."

Money laundering has also been in the spotlight in 2025 with, among other things, the UK Financial Conduct Authority (the "FCA") and the National Crime Agency identifying money laundering as one of their priorities, and the UK government accelerating amendments to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 in relation to, among other things, cryptoasset regulation and customer due diligence. We expect to see increased enforcement activity in 2026, in part to put the financial services sector on notice that it must significantly improve anti-money laundering systems and controls.

Finally, we expect increased activity by the FCA in relation to market abuse, particularly in relation to crypto assets, transaction reporting and insider dealing.

Albeit likely to be lower on the priority list, we expect some enforcement activity in relation to tax evasion and bribery. 

For the first time, in 2025, an accountancy firm was charged in relation to the 2017 failure to prevent tax evasion offence. As His Majesty's Revenue and Customs (HMRC) becomes more confident and experienced in prosecuting the failure to prevent tax evasion offence, we can expect to see HMRC looking to identify more cases for prosecution. 

Similarly, bribery enforcement also remains a risk, with the SFO, France's Parquet National Financier (the PNF) and the Office of the Attorney General of Switzerland (the OAG) announcing in 2025 a new alliance to tackle international bribery and corruption. The formation of the taskforce appears in part to be due to a recognition that the European agencies' roles in international bribery cases will need to increase and that, with or without the involvement of the United States, European agencies plan to continue in their efforts to tackle bribery and corruption.

Expanded Corporate and Personal Liability

In the first half of 2026, it is expected that the Crime and Policing Bill will receive Royal Assent. If it does, the new legislation is likely to have a very significant impact by expanding corporate criminal liability as well as the personal liability of certain key senior executives. 

If passed, the new legislation will likely mean that a company can be prosecuted for almost any criminal offence (currently this is generally restricted to (only) economic crimes), where a senior manager commits a crime within the scope of their authority. This means that an organization could be liable for acts including terrorism, child exploitation, and certain weapons offences. It is also likely to increase the potential personal liability for certain key senior people, where the crime occurred with the consent or connivance, or because of the negligence, of the executive.

Raising the Bar for Compliance Programmes

Finally, we expect to see a renewed focus on the efficacy of compliance programmes, with significant higher expectations imposed on compliance policies and procedures. This expectation will itself significantly contribute to enforcement decisions and resolutions, with authorities increasingly basing their decisions on whether to prosecute, negotiate or not prosecute on the maturity of a company's compliance programme.

In 2025, the SFO issued new guidance setting out what it expects a corporate compliance programme to look like in practice. The SFO provided a detailed roadmap for how, when and why prosecutors will assess a company's compliance programme, and sent another strong message to businesses: compliance must be embedded, evidenced, and continuously improved. 

Similarly, in June 2025, the FCA published an updated version of its Enforcement Guide, in which it signaled its continued focus on a firm's compliance culture.

For further updates see our Investigations & Enforcement Blog.

Back to top

Conclusion

2026 is set to be another year of significant regulatory movement across the EU and the UK. Enforcement activity is poised to intensify in several areas, particularly sanctions, financial crime, digital regulation, and competition, while long‑running legislative reforms, from chemicals and sustainability frameworks to AI governance, will begin to crystallize. At the same time, broader political and economic pressures continue to influence policy choices, shaping the degree of alignment or divergence between London and Brussels.

For businesses operating in or connected to these jurisdictions, maintaining visibility across these developments and adapting compliance strategies accordingly will be critical. As ever, our teams in Brussels and London will continue to monitor these fast‑moving areas and stand ready to support clients in navigating the regulatory challenges and opportunities that lie ahead.