UK Legal Update - Spring 2024

• Published date: 05 April 2024
• Law Firm: Travers Smith LLP
• Author: Travers Smith LLP

Our round-up of recent and forthcoming developments in UK law and practice for our international stakeholders.

Highlights

• Beyond Brexit - New border controls for importing EU goods into the UK and the latest on the revocation of retained EU Law
• UK signs the 2019 Hague Convention heralding the reciprocal recognition and enforcement of judgments
• AI regulation, data and cybersecurity - UK's approach to AI regulation, data-sharing and improving cyber resilience
• ESG - we discuss mandatory climate-related disclosures and reporting standards, new sustainability due diligence requirements and anti-greenwashing measures
• ECCTA now in force - new UK corporate governance measures
• UK employment law - ethical workplace issues and new rules on holiday entitlement and pay
• Digital Markets Competition and Consumers Bill - a tougher regulatory environment for digital platforms in the UK
• Private equity - increased scrutiny by UK and US competition authorities
• Investing in the UK - recent National Security and Investment Act trends
• Real estate - biodiversity net gain planning requirement for new UK developments and reforming the UK leasehold ownership regime
• UK tax - recent announcements in the UK Spring Budget, including the Non-Dom regime reforms and the latest on personal taxation and incentives for UK-based employees

AI, data and cybersecurity

1. The UK's approach to AI regulation

Governments across the globe are still grappling with how to balance promoting innovation and economic growth with protecting citizens' privacy, safety and other human rights.

In contrast to the approach adopted by the European Union, last year's UK AI White Paper proposed relying on the existing regulatory framework to address the risks posed by AI, with regulators guided by five cross-sectoral principles.

A year on, and the UK Government is still in no rush to regulate. Overall, the UK Government continues to believe that a non-statutory, context-based approach to regulating AI is the best way forward because it offers "critical adaptability" but acknowledges that the risks posed by general-purpose AI could still fall through the cracks. Read this update for more.

Smart AI Regulation

Our Smart AI Regulation series of briefings explores the UK's approach to the regulation of AI, highlighting its key differences from the EU's proposed AI Act.

2. EU Data Act now in force: what's the impact for UK data holders?

The EU Data Act (EDA) sets out new data-sharing rules in respect of connected products and came into force in January 2024. While its provisions are not yet applicable, we are advising our UK business clients to plan for the impact that the EDA will have on product designs, commercially sensitive information, terms and conditions, costs and GDPR compliance. Read this briefing for more.

3. Cybersecurity update

As the digital economy and emerging technologies, continue to grow at an exponential rate, so do cyber security risks.

Earlier this year, the UK Government called for views on its Cyber Governance Code of Practice, urging boards and directors to place the same importance on governing cyber risk as they do with other principal risks.

The EU's "NIS2" aims to strengthen cybersecurity for essential services and infrastructure and will be implemented by member states by October 2024. There has been no similar progress on the UK equivalent - the Network and Information System Regulations - initially announced by the Government in November 2022. However, cyber resilience for connected products is making headway, with the publication of regulations under the Product Security and Telecommunications Infrastructure Act in the UK for consumer connectable products (see our briefing) and the EU reaching political agreement on the Cyber Resilience Act, which covers similar ground.

As well as gearing up to comply with new legislation, we are advising businesses on their cyber incident response plans. Find out more about responding to cyber incidents and data breaches with our Mitigating a Data Breach: Insider Threats podcast series.

DORA: Cybersecurity for financial entities in the EU

Companies based in the UK or elsewhere who provide tech services to EU asset management firms should be factoring in new measures, coming into force in January 2025, designed to improve the operational resilience of the financial services industry.

Under the far-reaching EU Regulation on Digital Operational Resilience (DORA), "critical" providers of ICT services to financial services firms will be subject to EU oversight and UK and other non-EU entities may face restrictions in providing these services to EU financial firms. Firms have a substantial "to do" list to prepare for DORA over the coming months and, to be ready in time, they should be identifying and triaging their ICT contracts, reviewing them against those requirements and negotiating with service providers any contract amendments necessary to comply. Read our briefing for more.

Beyond Brexit/Regulatory reform

1. Retained EU law: what's changed and why does it matter?

From 1 January 2024, EU law which was retained on the UK statute book (previously referred to as "retained EU law") has a new name in the UK, "assimilated law", and different rules apply when interpreting it (as a result of the Retained EU Law (Reform and Revocation) Act 2023). This is important because there are still over 4,000 EU-derived measures on the UK's statute book - and following these changes, some of those laws may not mean quite the same as they did before the start of this year. For example, from 1 January 2024, UK legislation implementing EU Directives no longer has to be interpreted in line with the EU concept of direct effect.

Our briefing explains what has changed and what the impact on businesses in the UK and elsewhere is likely to be. It also provides a handy glossary of the new terminology, together with a timeline highlighting key dates in the development of retained EU law. For a "deeper dive", see our updated client guide Retained EU law: 10 key questions.

2. Importing EU goods into the UK: what's changing?

After much delay, the UK is finally introducing full border controls on imports of goods from the EU.

Since the end of the Brexit transition period on 31 December 2020, goods imports from the EU have continued to be treated differently from imports originating in the rest of the world but not for much longer. The following changes are expected to be introduced this year:

All EU goods (including agri-food)

Safety and security declarations to be required from 31 October 2024; this will bring EU imports into line with the documentary requirements for imports from elsewhere.

EU agri-food products only

Phasing in of additional controls to bring the following EU imports into line with the requirements applied to imports from elsewhere: (i) medium risk animal products, plants, plant products and (ii) high risk food and feed of non-animal origin:

• 31 January 2024: health and/or phyto-sanitary certificates required;
• 30 April 2024: documentary and risk based identity and physical checks to be extended to the same range of products (NB for medium risk products, physical checks will only be carried out in 1-30% of cases, as compared with the 100% inspection rate for high risk products).

EU suppliers need to be prepared for these changes. If goods arrive at the border without the correct documentation, they may be refused entry, leading to delays and extra costs.

Beyond Brexit Hub

For more on navigating the post-Brexit legal framework and business environment, including what's changed on retained EU law and why it still matters, visit our Beyond Brexit Hub.

3. Looking ahead: improvement to the UK-EU Trade and Cooperation Agreement (TCA)?

Following the next UK general election (likely to be in autumn 2024), should they win, a Labour government may seek improvements to the UK's trading relationship with the EU. These measures could include an agreement to ease imports/exports of agri-food, a better deal on temporary visits for business purposes and a youth mobility scheme to ease labour shortages for certain sectors, for example hospitality. Our guide to the TCA, as it stands, is here.

Spotlight on Regulatory reform

Take a look at Spotlight on Better Regulation, where we explore the opportunities and challenges for the UK as it looks to reform its regulatory framework following Brexit. The latest briefings in the series include:

• Directors' duties and corporate purpose re-examined: should directors be obliged to prioritise people and planet?
• Non-competes: 3 month cap proposed in drive for economic growth
• Post-Brexit employment law: evolution, not revolution?
• How proposed Solvency II reforms for insurers affect de-risking options for defined benefit pension schemes

Sign up to be notified of more content in this series. You can also use our Regulatory reform portal to check for the latest updates on changes to regulation across all areas on which we advise.

Company law

1. ECCTA: what's the latest?

All UK business organisations will be impacted by the Economic Crime and Corporate Transparency Act 2023 (ECCTA), a significant new piece of companies' legislation designed to clamp-down on the misuse of corporate entities in the UK, which passed into law in October 2023.

Key changes include:

• extensive new powers for the UK's register of companies Companies House, to check, query, remove or decline information submitted to, or already on, the companies register and share information with law enforcement bodies, where appropriate;
• changes to the rules for registered office addresses and a new requirement for a registered company email address;
• enhanced measures to improve the quality of financial information on the register;
• new compulsory identity verification for all new and existing registered company directors, PSCs, LLP members and those delivering documents to the Companies House registrar; and
• greater protection of personal data...