Commercially Connected shorts - 4 November 2026

This week we look at:

• UK: CMA open letter warning online retailers against drip pricing
• UK: ASA publishes updated AI-assisted collective ad regulation strategy for 2024-2028
• EU Customs Reform: new measures applying from 1 November 2026
• UK: NCSC “state of the cyber nation” report published: cyber security warning for organisations

UK: CMA open letter warning online retailers against drip pricing

On 2 November 2026 the Competition and Markets Authority (CMA) published an open letter to online retailers, reminding them of the Digital Markets, Competition and Consumers Act 2024 (DMCC) requirements for delivery fees to be included in the total price for a product and for the total price to be shown to consumers throughout the sales process.

The DMCC requires pricing to be clear, so that the price the consumer sees is the total price they will have to pay, including mandatory fees, taxes and charges. This total price has to be visible at every stage of the sales process, including ads, product pages, shopping carts and baskets, checkout and payment pages. If delivery charges are optional, this also has to be made clear. Online marketplaces, search engines and comparison sites that show prices charged by different retailers for the same product also have to ensure that the prices shown are total.

Online retailers are urged to review the CMA’s price transparency guidance for more information and examples of compliant and non-compliant practices. They should then review their own websites, apps and ads to make sure that they are complying with DMCC requirements.

UK: ASA publishes updated AI-assisted collective ad regulation strategy for 2024-2028

On 30 October 2026 the Advertising Standards Authority (ASA) published an updated version of its AI-assisted collective ad regulation strategy for 2024-2028, following a mid-point review.

The ASA’s strategy is centred on 6 themes:

• people: aiming to be the frontline regulator of UK ads, prioritising the protection of vulnerable people and intervening in the most serious cases of offence caused by ads

• planet: focusing on dealing with misleading green claims and helping businesses to make responsible environmental claims

• online: given the prevalence of online advertising in general and the increase in AI chatbots as advertising platforms, as well as targeted advertising, using its Active Ad Monitoring system to identify and act quickly against irresponsible online ads and its Scam Ad Alert system to tackle ads involving fraud, as well as considering the impact of AI on advertising

• awareness and buy-in: raising awareness of, and trust in, its role and remit, and charging for its premium bespoke copy advice

• collective ad regulation: continuing to support a targeted and proportionate approach to collective ad regulation

• operational transformation: becoming more proactive and prioritising proactive regulatory projects, with a particular focus on protecting vulnerable people and on age-restricted ads

Businesses advertising to consumers should be aware of the ASA’s strategy, which signals an increased focus on proactive scrutiny of ads – in any medium – against CAP/BCAP Code requirements, with faster intervention against non-compliant ads and increased focus on areas such as targeted advertising, green claims and protection of vulnerable consumers.

EU Customs Reform: new measures applying from 1 November 2026

From 1 November 2026, two key e-commerce measures under the new EU customs reform package came into force, bringing important changes for businesses involved in low-value imports. 

The EU customs reform legislation, set out in Regulation (EU) 2026/2108, entered into force on 20 September 2026, establishing a new Union Customs Code (nUCC). It is the EU’s most ambitious customs reform since the creation of the Customs Union in 1968 and rests on three pillars: smarter risk management and controls, a modern e-commerce framework and a stronger partnership with business.

From 1 November 2026, a €2 Union handling fee applies to goods sold in distance sales into the EU, irrespective of the value of the consignment, and product identifiers will become mandatory in customs declarations for relevant low-value e-commerce imports. These measures apply in addition to the temporary €3 customs duty on low-value consignments that has applied since 1 July 2026.

In addition, from 1 July 2028, the nUCC will treat either the person supplying goods through a distance sale or the person facilitating that sale (such as an online platform), depending on the arrangements in place, as the "importer for distance sales" in respect of each consignment. The importer for distance sales will be responsible for the obligations of an importer, including providing customs data, paying customs duties and the handling fee, and ensuring that the goods comply with EU product requirements and other requirements enforced by customs. The nUCC also introduces a dedicated penalties regime for operators that breach these obligations, with the most serious infringements attracting fines of up to 6% of the operator’s annual import value in the preceding year, the withdrawal of certain customs facilitations and restrictions on access to online platforms.

While the 1 November 2026 measures are the immediate priority, they are only the first stage of much wider structural changes at EU level. Over the coming years, customs compliance will depend increasingly on the quality of the data that businesses supply. With the EU Customs Authority coordinating risk management and the EU Customs Data Hub gradually replacing 27 national systems, that data will be visible and comparable across the whole of the EU.

The most immediate impact falls on e-commerce operators, with the handling fee and product identifier responsibilities. Businesses operating high-volume, low-value business-to-consumer models should expect a material increase in landed costs, and those with high return rates will feel this most, as the handling fee is non-refundable. For online platforms and sellers, mapping how these changes affect their operations should therefore be the first key task.

Looking further ahead, from 1 July 2028 the “importer for distance sales” regime will place customs liability squarely on whichever of the seller or the facilitating platform acts as importer, rather than on the consumer receiving the products.

The reform will reshape customs compliance for all importers. Greater data availability to the EU Customs Authority and national authorities will enable EU-wide risk analysis, making inconsistencies in classification, valuation, and origin considerably easier to detect, and is likely to strengthen the enforcement of trade defence measures, sanctions and other restrictions.

While some of these changes are still several years away, early planning is likely to pay off. Businesses should consider who in their supply chain will act as importer, whether their product and transaction data is fit for the new regime, how their broker and customs representative arrangements allocate liability, and whether Trust and Check status may be available to them.

For more information see our briefing: EU Customs Reform: new measures applying from 1 November 2026.

With thanks to Monika Zejden-Erdmann, James Lindop and Robert Waterson

UK: NCSC “state of the cyber nation” report published: cyber security warning for organisations

On 3 November 2026 the National Cyber Security Centre (NCSC) published The state of the cyber nation, its annual review covering developments between 1 September 2025 and 31 August 2026. Its key message is that the UK's cyber threat is increasing more quickly than organisations' defensive capabilities, with AI making cyber-attacks faster, cheaper and easier to conduct at scale and exposing existing security weaknesses. Whilst AI does not fundamentally change what good cyber security looks like, it increases the urgency of implementing controls and of treating cyber resilience as an organisation-wide governance and supply chain issue. The economic imperative is clear: malicious cyber activity costs UK organisations around £14.7 billion per annum.

Key themes running through the report include:

• Basic vulnerabilities remain a major source of risk. Of incidents involving large organisations in the year reviewed, 88% arose from four initial access vectors: exploitation of external public-facing applications, phishing, misuse of valid accounts and exploitation of external remote services. Organisations with legacy systems and “accumulated technical debt” (a backlog of unresolved tech issues) are particularly at risk. This highlights that foundational cyber controls remain key to building cyber resilience, such as timely patching of known vulnerabilities, access control including adoption of passkeys rather than passwords, and effective monitoring and incident response. The starting point for any organisation should be the 5 controls covered by the NCSC’s Cyber Essentials: firewalls, secure configuration, security update management, user access control and malware protection.

• AI is accelerating existing cyber threats. AI acts as a "force multiplier", increasing the scale, speed and efficiency of malicious cyber activity. AI-assisted vulnerability discovery and exploitation are expected to increase pressure on organisations to identify and deploy security patches more quickly. Conversely, AI can also be used by organisations to develop, test and enhance their cyber security measures.

• Supply-chain security is increasingly important. The review highlights organisations' reliance on suppliers and service providers and the potential for vulnerabilities in one organisation to impact others in the supply chain. The NCSC's Cyber Essentials Supply Chain Playbook specifically encourages the incorporation of cyber-security requirements into procurement and supplier-management processes, and the Supplier Check Tool enables organisations to check the Cyber Essentials certification of supply chain members.

• Cyber risk is a board-level issue. Cyber security should be managed as a business risk rather than an IT issue, with boards seeking evidence of preparedness, recovery capability and resilience rather than relying simply on the existence of policies.

• Regulatory expectations are strengthening. The review references the Cyber Security and Resilience Bill as an important part of the UK's cyber resilience framework, describing this as a “more comprehensive, flexible and enforceable regulatory framework”. International partnerships with like-minded nations are also key, as cyber resilience is a global issue.

The report is a call to arms to galvanise organisations to review and improve their own cyber hygiene, as well as their arrangements with technology providers and other critical suppliers. Contracting teams should consider whether cyber-security provisions in supply contracts adequately cover minimum security standards, security updates and vulnerability remediation, incident notification and cooperation, access controls, and business continuity and recovery.

The Ministerial Foreword to the report indicates that a National Cyber Action Plan will soon be released; we will report on this when it lands.