Commercial bulletin: key developments for businesses in July 2026

Reasonable notice for terminating long-term contracts

The Court’s decision in a recent case[1] highlights the risks of relying on arrangements without express termination rights. Despite a 40-year exclusive distribution relationship that has been agreed orally, the Court held that it could be terminated on just 3.5 months’ notice. The Court ruled that reasonable notice is intended to allow an orderly transition, not protect future profits, and factors such as the relationship’s length, importance, investment, third-party obligations and practicality of continued cooperation will be relevant.

Extending corporate criminal liability.

Since 29 June, section 250 of the Crime and Policing Act 2026 significantly expanded corporate criminal liability in the UK. Previously, companies could be liable only for certain economic crimes committed by senior managers. The new regime extends attribution to all criminal offences committed by a senior manager acting within their actual or apparent authority.

The Act applies to UK and non-UK organisations of any size, including charities, and defines ‘senior manager’ by influence and decision-making authority rather than job title. Unlike existing ‘failure to prevent’ offences, there is no statutory reasonable procedures defence.

New published guidelines on high-risk AI systems

The European Parliament and Council have adopted the AI Omnibus, amending the EU AI Act and introducing a ban on explicit deepfakes. High-risk AI obligations have also been delayed. Annex III obligations (covering high-risk AI systems used in areas such as employment and law enforcement) will apply from December 2027 and Annex I obligations (covering AI safety components in regulated products such as medical devices and motor vehicles) from August 2028.

Additionally, the European Commission has published draft guidance[2] on how to determine whether an AI system is high-risk.

No contract, no problem?

A recent High Court case acts as a reminder of the different types of intermediaries and how they can impact payment rights[3].

In this case, the claimant introduced investors to the defendant and claimed commission when an investor invested in the project. The claimant’s arguments for contractual commission failed as its contract did not cover the investment that was made and it’s claim for implied commission under the Commercial Agent regulations also failed because it did not meet the definition of a Commercial Agent.

Instead, the court found the claimant acted as an introducer and even though it had no contractual entitlement to commission, the court held that it would be unjust for the defendant to benefit from the claimant’s services without payment and ordered that the claimant be paid a fair amount for its efforts.

The Court of Appeal’s guidance on confidentiality

In Logix Aero Ireland v Siam Aero Repair Company[4], a fraudster intercepted emails during an aircraft engine sale, changed bank details and diverted Logix’s payment. Logix claimed Siam had breached a confidentiality clause by enabling the fraud, but the Court of Appeal held that the fraudster, not Siam, caused the loss, and the clause did not impose a duty to prevent cyber fraud. The case confirms that standard confidentiality clauses usually protect commercial information, and do not guard against fraud, so parties should consider express payment verification, fraud-risk and cybersecurity obligations.

[1] Anheuser-Busch International Inc and another (Respondents) v Commonwealth Brewery Ltd (Appellant) (The Bahamas) – JCPC
[2] Draft Commission guidelines on the classification of high-risk AI systems | Shaping Europe’s digital future
[2] Artificial Intelligence: Council gives final green light to simplify and streamline rules – Consilium
[3] DMA Resources Limited v Brazilian Nickel Limited
[4] Logix Aero Ireland Ltd v Siam Aero Repair Co Ltd

The ASA’s new guidance on the use of AI-generated content in advertising

The ASA has published new guidance on the use of AI-generated content and deepfakes in advertising[5]. It confirms that this content is still subject to the CAP Code like traditional marketing materials.

The key message is that using AI does not diminish the advertiser’s responsibility. Advertisers remain responsible for ensuring that adverts are not offensive or misleading.

AI-generated content of individuals (such as celebrities) must not mislead consumers into thinking there is a real endorsement.

Whilst AI may be a powerful marketing tool, advertisers still need to apply the same level of human oversight as with any other advertisement before publishing.

[5] AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit “Run” – ASA | CAP

Government response to the subscription contracts regime under the DMCCA

The government has published its response to the consultation on the new subscription contracts regime, with implementation expected in Spring 2027[6].

The subscription contracts regime is designed to give consumers greater transparency and control over auto-renewing contracts.

It has been confirmed that:

• there will be an initial 14-day cooling off period when a subscription starts, and
• a second 14-day period when a free or discounted trial converts into a paid subscription; or when a subscription renews for 12 months or more.

With less than one year until the anticipated implementation date, it’s important that businesses identify and review any subscription contracts that they provide.

Consumer law enforcement

The consumer law regulators have again been flexing their muscles in recent weeks.

• StubHub UK[7] has been fined £889,200 for ‘drip pricing’ by the CMA and ordered to refund 50,000 customers.
• Marks Electrical[8] has been fined £720,000 by the CMA and ordered to refund 40,000 customers for automatically opting customers into paid add-on services including appliance recycling and packaging removal through pre-ticked boxes.
• Ofcom has fined Virgin Media £28m after finding its cancellation and switching processes created unreasonable barriers, including excessive call transfers, dropped calls and retention practices that delayed cancellations.

These cases follow the CMA’s £4.2 million fine imposed on AA and BSM in April 2026 and signal continued scrutiny of consumer-facing businesses.

[6] Government response to consultation on the implementation of the new subscription contracts regime (web accessible version) – GOV.UK
[7] StubHub UK: consumer protection enforcement case – GOV.UK
[8] Marks Electrical: consumer protection enforcement case – GOV.UK

An automatic breach of competition law?

The Court of Appeal has recently handed down an important judgment on competition law, overturning an earlier ruling that found Deckers to have unlawfully restricted competition[9].

The dispute arose after Deckers, the authorised distributor of Hoka shoes, refused to allow one of its franchisees, Up & Running, to sell HOKA shoes through a separate discount website. Previously the Competition Appeal Tribunal (‘CAT’) concluded that Decker’s motive was to restrict discounting and was therefore automatically anti-competitive removing the need for the CAT to consider whether the restriction had caused any anti-competitive effects. However, the Court of Appeal disagreed.

The Court of Appeal’s decision clarified that restrictions on discounting are not automatically anti-competitive. Instead, the wider context must be considered, including the scope of the restriction, market conditions and level of competition between brands.

In this case, the restriction was narrow, affected a small amount of stock and operated in an otherwise competitive market.

[9] Deckers UK Limited v Up & Running (UK) Limited – Find Case Law – The National Archives

ICO’s fine on South Staffordshire water business

The ICO has fined a South Staffordshire water company £963,900 following a cyber-attack which led to the personal data of more than 600,000 individuals being published on the dark web[10].

The attack originated from a phishing email in 2020, with attackers remaining on the system’s network for almost two years undetected.

The ICO concluded that the water company had failed to implement appropriate technical and organisational measures, including inadequate access controls, insufficient security monitoring, reliance on outdated systems and poor vulnerability management.

ICO updates

The ICO has published new guidance on cookies following changes brought in by the Data (Use and Access) Act 2025[11] that have permitted three new exceptions where consent is no longer required including for statistical purposes, website appearance preferences and emergency assistance.  Whilst the relaxation of rules is welcome, compliance is more important than ever as fines have been increased.

The new complaint-handling obligations under the Data (Use and Access) Act 2025 is now in-force[12]. This is a significant change; organisations subject to UK data protection legislation must now have a formal process for handling data protection complaints from individuals. This process must be followed before escalating the complaint to the ICO.

[10] Fine of nearly £1m issued against South Staffordshire Plc and South Staffordshire Water Plc following major cyber attack and data breach | ICO
[11] Guidance on the use of storage and access technologies | ICO
[12] How to deal with data protection complaints | ICO

Fair Work Agency

The Fair Work Agency (FWA) was established on 7 April. It consolidates several labour market enforcement functions into a single body responsible for protecting workers and tackling non-compliance. The government has now published the FWA’s enforcement policy¹³. Enforcement tools include guidance, warning letters, civil penalties, naming employers, and criminal prosecution in serious cases.

More recently, the government has launched a consultation seeking views on how the FWA should enforce holiday pay rights from 2027¹⁴. Consultation closes on 22 September.

Government consultations

The government is also consulting on:

• The reforms of zero hours contracts, seeking views on the rules for the new rights to be offered guaranteed hours, to reasonable notice of shifts, and to payment where shifts are cancelled, curtailed or moved at short notice¹⁵. Consultation closes on 25 August.
• The rights of unpaid carers and parents of seriously ill children, including whether they need stronger employment rights and workplace support¹⁶. Consultation closes on 1 September 2026.
• Expanding the right to time off for public duties, seeking views on eligible roles and operation of the right. Consultation closes on 4 September 2026.

Finally, the government has published its response to consultation on strengthening tipping legislation¹⁷ and a revised draft statutory Code of Practice¹⁸. Subject to parliamentary approval, the changes will come into force in October 2026 and will introduce new obligations for the hospitality sector.  You can read more about the response and the Code of Practice in

EHRC publishes updated draft Code of Practice for Services, Public Functions and Associations

The EHRC has published an updated draft Code of Practice for services, public functions and associations¹⁹, reflecting the Supreme Court’s decision in For Women Scotland that references to “sex” in the Equality Act 2010 mean biological sex. While the Code does not apply directly to employment, employers providing services to the public should review policies and practices, particularly those relating to single-sex facilities and services.

Recent cases

No vicarious liability for acts of genuinely independent contractors

In Burger v Risk Solutions BG Ltd & anor²⁰, the Court of Appeal held that JD Wetherspoon was not vicariously liable for an assault committed outside one of its pubs by door staff employed by Risk Solutions, because Risk Solutions was a true independent contractor. Risk Solutions recruited, trained and managed its own staff, accepted responsibility for their conduct, operated as a separate profit-making business and could provide services to other clients. The court confirmed that vicariously liability does not usually extend to the acts of genuinely independent contractors or their employees.

Employers cannot change bonus conditions retrospectively

An employee issued a claim for unlawful deductions from wages when his employer retrospectively introduced a cap on a discretionary bonus, after he had already met the agreed bonus criteria and qualified for the full bonus. The EAT held that the employer could not retrospectively impose previously undisclosed conditions and a bonus cap. Once entitlement had crystallised, the employer was bound to pay the full bonus²¹.

[13] Fair Work Agency enforcement statement – GOV.UK
[14] Make Work Pay: holiday pay compliance and enforcement – GOV.UK
[15] Make Work Pay: ending one-sided flexibility – reforms of zero hours and similar contracts – GOV.UK
[16] Make Work Pay: employment rights for unpaid carers and parents of seriously ill children – GOV.UK
[17] Make Work Pay: strengthening the law on tipping – GOV.UK
[18] Distributing tips fairly: revised statutory code of practice – GOV.UK
[19] Equality Act 2010: Draft Code of Practice for services, public functions and associations, 2026 – GOV.UK
[20] Burger v Risk Solutions BG Ltd
[21] Mr_P_Chandrashekarappa_v_Wipro_Ltd__2026__EAT_73.pdf