Commercially Connected shorts - 11 November 2026

This week we look at:

• UK Government announces mandatory human rights due diligence regime
• Tech law shorts
• Global AdVocate: advertising and marketing international newsletter
• Updata: quarterly data, privacy and cybersecurity update

UK Government announces mandatory human rights due diligence regime

On 4 November 2026 the UK Government announced, via a written statement by the Secretary of State for Business, Innovation, Science and Trade, plans to introduce a mandatory human rights due diligence regime.

This follows its review of the UK’s approach to Responsible Business Conduct (RBC), part of the UK Trade Strategy. The outcome of this review has been awaited for some time and the Government has consistently cited the review when deferring detailed comment on calls for a UK human rights due diligence regime, including in its response to the UK Joint Committee on Human Rights’ inquiry into forced labour in international supply chains (reported on in July 2025, with the Government response in October 2025).

The plans announced on 4 November are in addition to reform of the Section 54 Modern Slavery Act 2015 reporting regime via the Immigration and Asylum Bill, which is currently working its way through Parliament (see the July edition of Commercially Connected for details).

The new regime will:

• apply in the UK for services and in Great Britain for goods, with Northern Ireland applying the EU Forced Labour Regulation (under the Windsor Framework)

• apply to UK businesses with global turnover of over £350 million and non-UK businesses with a UK-generated turnover of more than £350 million

• require in-scope businesses to identify, assess and address risks of human rights abuses and labour exploitation in their operations and supply chains

• align with existing international standards, including the OECD Guidelines for Responsible Business Conduct and UN Guiding Principles on Business and Human Rights

• enable a regulator to investigate businesses suspected of placing goods made with forced labour on the Great Britain market and, where due diligence requirements have not been met and forced labour is identified, direct the withdrawal of those goods

The Government also intends to establish a centralised RBC guidance hub on GOV.UK to support compliance, containing guidance, tools and templates.

A timetable for reform has not been provided, but legislation will be introduced “as soon as parliamentary time allows”. As the EU Forced Labour Regulation will apply from 14 December 2027, the Government intends to ensure that the UK regime is in force by that date.

In December 2025 the Independent Anti-Slavery Commissioner produced a report which recommended a UK mandatory human rights due diligence and anti-forced labour regime, and included draft recommended legislation. It may be that this draft will be used as a starting point, although no indication that this is the case has been given.

Organisations with a turnover above the proposed thresholds should monitor developments and consider whether existing internal controls, supply chain due diligence and contractual controls are likely to meet requirements. To prepare, businesses should:

• map existing human rights process risks across supply chains

• benchmark due diligence against international standards

• review controls relating to goods that may be linked to forced labour

Tech law shorts

Technology Law Shorts - November 2026: in our latest quarterly update, we highlight:

• Technology and M&A: our new report on why technology now sits at the heart of deal value, and what that means for due diligence and deal terms

• AI and litigation: our four-part series on how AI use is shaping evidence, privilege and contractual risk

• EU Cyber Resilience Act: incident reporting is now live, and we set out what manufacturers need to have in place

• AI-enabled cyber threats and global AI regulation: lessons from a reported autonomous AI attack

• Regulatory round-up: our round-up of AI regulatory developments across Asia-Pacific, Europe, the UK and the US

For global technology businesses, the key takeaway is to ensure that technology, data and AI risk is addressed early and embedded in core governance, rather than treated as a compliance afterthought. In commercial contracts and procurement, businesses should secure robust due diligence and clear contractual protections in transactions, and close gaps in AI risk allocation between the protections available from upstream model providers and the commitments given to downstream customers.

Global AdVocate: advertising and marketing international newsletter

Global AdVocate: advertising and marketing international quarterly newsletter: providing insights on key legal developments impacting advertising and marketing activity worldwide.

This edition highlights major updates across multiple jurisdictions. These include the continued roll-out of the EU Empowering Consumers for the Green Transition Directive and a contested transitional exemption adopted in the Czech Republic; the EU AI Act’s transparency and labelling obligations for AI-generated and deep fake content; China’s new measures on the online marketing of financial products, alongside draft rules on micro short dramas, pyramid schemes and cited content in advertisements; new consumer credit advertising requirements implementing the revised Consumer Credit Directive in Italy, Latvia and the Czech Republic; France’s move to an opt-in regime for telemarketing; and, in the UK, the Sporting Events Bill’s ambush marketing protections, new restrictions on marketing automated vehicles, and further measures under the Tobacco and Vapes Act 2026.

We also cover Bulgaria’s new licensing regime for gambling affiliates and its proposed near-total ban on gambling advertising, the liberalization of online spirits marketing in Finland, Hong Kong’s proposed cooling-off rights for beauty and fitness services, Ireland’s new vaping legislation and broadcasting reforms, the transfer of financial services advertising supervision to the Bank of Latvia, the 72nd edition of Italy’s IAP Code, and regulatory guidance from authorities including the DGCCRF and ARPP in France, the ASA, HPRA, Central Bank and Coimisiún na Meán in Ireland, AGCOM and the Garante in Italy, the Consumer Rights Protection Centre in Latvia, the Dubai Health Authority, and the ASA, CAP and Ofcom in the UK.

This edition also features recent case law and enforcement actions, addressing topics including influencer and covert advertising, reference pricing and discount claims, greenwashing, sexist and discriminatory advertising, health claims, gambling advertising, the promotion of prescription-only weight loss medicines, the “less healthy” food rules, drip pricing and telemarketing breaches.

Updata: quarterly data, privacy and cybersecurity update

Updata: Your quarterly data, privacy and cybersecurity update: Updata provides you with a compilation of data, privacy, AI and cybersecurity regulatory and legal developments from our contributors around the globe over the past quarter.

Our latest edition covers July to September 2026, highlighting significant legal, regulatory and enforcement developments across Europe, Asia Pacific and the United States.

This quarter’s key themes include:

• AI regulation moves into implementation – EU AI Act enforcement began, new transparency requirements took effect and countries continued developing national AI frameworks and legislation

• cyber resilience requirements take effect – new Cyber Resilience Act reporting obligations apply, while NIS2 implementation continues across Europe and Singapore strengthens requirements for critical infrastructure

• AI creates new cyber risks – regulators and cybersecurity bodies are responding to the growing use of AI by malicious actors, including AI-assisted attacks and risks from increasingly autonomous AI systems

• children’s privacy and online safety remain in focus – developments include new and proposed measures on age assurance, child safety, AI companions and platform design across the EU, UK and US

• enforcement continues to raise the stakes – regulators have taken action on automated decision-making, data security, ransomware, biometrics and other data protection issues

• smart glasses, wearables and biometric surveillance attract scrutiny – regulators across Europe are examining the privacy implications of smart glasses, facial recognition and other emerging technologies

Explore the full edition for practical commentary and jurisdiction-specific updates.