Commercial bulletin: key developments for businesses in November 2026

Good faith in commercial contracts 

Can a duty of good faith be implied into a commercial contract? In the Bates v Post Office (2019) case1, the court held that such a duty may arise in a ‘relational contract’. A relational contract was defined as having certain characteristics such as being a long-term relationship. However, the recent case of Svella Connect v Virgin Media2 clarified that the usual test for implying terms still applies: the term must be necessary to give the contract busi

ness efficacy, as established in the Marks & Spencer v BNP Paribas 2015 case3. A party seeking to imply a good faith obligation must therefore first establish that it is necessary to imply that obligation into the contract and then show that the contract is relational. 

Extended right to work checks 

Since the 1st October4, businesses may face illegal working liability without directly employing or contracting with workers.  If, say, you sub-contract services, and the sub-contractor hires illegal workers, you may be liable if you are onward supplying those services to third parties.  Penalties reach £45,000 per worker for a first breach and £60,000 for repeat breaches. 

Climate change guidance for in-house legal counsel 

The Law Society has published climate change guidance for in-house legal counsel. In-house lawyers should consider how climate change affects regulatory compliance, contracts, litigation exposure and reputation. 

Practically, this includes advising boards on climate risks and helping businesses avoid “greenwashing”.

[1] Bates v Post Office (No. 3) [2019] EWHC 606 (QB)

[2] Svella Connect Limited v Virgin Media Limited [2026] EWHC 2223 (TCC)

[3] Marks and Spencer plc v BNP Paribas Securities Services Trust Company (Jersey) Limited [2015] UKSC 7

[4] Border Security, Asylum and Immigration Act 2025.  Guidance on rights to work checks available here.

Further enforcement action by the CMA 

The CMA is once again using its enforcement powers under the DMCC Act for breaches of consumer law. In October it imposed three fines totalling more than £6m for misleading sales practices6:

• Wayfair was fined £4.8m for false time-limited offers;

• Appliances Direct has been fined £1.2m for misleading time-limited offers and automatically opting customers into paid-for extras; and

• Gold’s Gym has received a fine of £45,000 for the banned practice of drip pricing.

In addition, Appliances Direct and Gold’s Gym are required to refund customers approximately £440,000.

It is worth noting that the CMA applied a 40% reduction to the three fines due to the businesses co-operating with the CMA.

The risk of consumer enforcement is real, and businesses should review the entire customer journey. For example, time-limited promotions and discounts must be genuine, mandatory charges must be displayed from the outset, and pre-ticked boxes should not be relied upon.

New subscription contracts regime under the DMCC Act 

The DMCC Act’s subscription regime is expected to apply from 1 January next year; draft government guidance has recently been published7.

Businesses must provide clear pre-contract information, renewal reminders, straightforward cancellation and a new 14-day cooling-off period for any sales of subscription products.

The CMA is likely to scrutinise subscriptions, with Microsoft 365 already under investigation. Non-compliance can entitle consumers to cancel without future payment obligations.

Businesses should review terms, sign-up journeys, renewal communications, cancellation processes and billing systems before the expected start date.

[5] Climate change guidance for in-house legal counsel | The Law Society

[6] CMA fines firms £6 million for misleading sales tactics – GOV.UK

CMA imposes penalties following a dawn raid

The CMA imposed £50,000 in penalties for obstructing a construction bid-rigging dawn raid, including its first civil fines on individuals for concealing evidence8.

A director instructed an office manager to remove a work phone and documents, then denied having the phone. Although returned that day, their temporary concealment was a serious compliance failure.

The penalties are separate from the ongoing competition investigation. The conduct predated the DMCC Act; equivalent conduct today could attract higher penalties.

[7] Draft Guidance on Consumer Subscription Contracts

[8] CMA fines construction firm and staff for concealing evidence during inspection – GOV.UK

The Information Commission’s call for evidence on agentic AI 

The Information Commission is seeking evidence9 on applying data protection law to agentic AI: systems that decide and act with limited human oversight.

Its six focus areas are security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness.

Developers should review whether their data protection and AI governance frameworks address these issues. Responses close on 20 November and will inform future guidance and a code of practice on AI and automated decision-making.

Is compensation payable for ‘non-material damage’?

The Supreme Court in October considered whether compensation for ‘non-material damage’ is payable to people affected by a data breach10.

The case involves current and former police offers whose pension statements were sent to outdated addresses in 2019.  Whilst the affected police officers did not suffer any financial loss, they claim that they were nevertheless distressed by the fear that personal information might have been accessed and misused.

We now await the Supreme Court judgment.  A decision in favour of the police officers is likely to lead to a significant increase in data protection claimant litigation.

AI and cyber risk: containment in minutes, not days 

October’s global news coverage highlighted how AI had discovered critical vulnerabilities11 affecting an estimated 70% of websites. These flaws had escaped detection for years and might otherwise have remained undiscovered. But AI can also help attackers exploit flaws within minutes, leaving businesses little time to respond.

Breach containment plans must now operate in minutes, not days, with clear authority and tested capability to take affected systems offline when necessary.

Separately, a compromised ASOS supplier enabled unauthorised app notifications12, underscoring supplier-related data protection, contractual and reputational risks.

It’s critically important that businesses, review cyber response plans, supplier contracts, access controls, and cyber insurance in the light of these developments.

For information and adice on AI and cybe risk, explore our AI governance toolkit.

[9] Agentic AI call for evidence | ICO

[10] Michael Farley and 431 others (Respondents) v Paymaster (1836) Limited (trading as Equiniti) (Appellant) – UK Supreme Court

[11] Critical security issue affecting PHP | National Cyber Security Centre

[12] Latest ASOS Security Incident Update | ASOS Customer Care

Consultations and codes of practice

Fire and re-hire 

The Government has confirmed that the new ’fire and rehire’ measures in the Employment Rights Act 2025 will now come into force in March 2027. It has also published a package of documents advancing the ‘fire and rehire’ reforms, as follows:

• a draft revised Code of Practice on Dismissal and Re-engagement;

• an accompanying consultation on the draft Code (closing 17 December 2026);
• a response to its earlier consultation on expenses, benefits in kind and shift patterns15.

Government launches consultation on employment status reform 

The Government has launched a consultation on employment status reform16 to tackle bogus self-employment and misuse of substitution clauses.

A worker is someone who has a contract with a third party which is not a client or customer of the worker’s business, and who is required to provide services personally to the third party. Although workers have fewer employment rights than employees, they are entitled to some rights including the national minimum wage and paid annual leave.

Tribunals apply a three-stage test to determine if an individual is a worker:

• is the individual required to perform the services personally?

• Does the third-party exercise control over the individual and the way the services are performed?

• Is the third party a client or customer?

Personal service is an important requirement, often determined by whether the individual has the right to offer a substitute to carry out the work.

The key proposals are to:

• Modify the three-step test, so that where significant control exists, a valid right to provide a substitute does not automatically prevent someone from qualifying as a worker.

• Presume that an individual is a worker unless the employer proves otherwise.

The Government also proposes to introduce protections for the genuinely self-employed, including a right to a written statement of key contract terms.

Consultation closes on 8 January 2027.

Consultation on whistleblowing reform 

The Government is seeking evidence on how the existing whistleblowing framework under the Employment Rights Act 1996 operates and views on options for reform17. Currently, workers and employees are protected against detriment, and employees are protected against dismissal for having blown the whistle.

The key proposals include:

• Extending protection to others (such as the self-employed), and

• Introducing mandatory whistleblowing procedures and policies.

Consultation closes on 8 January 2027.

Recent cases

Individual liability for failure to make reasonable adjustments 

Under the Equality Act 2010, employers must make reasonable adjustments to avoid a disadvantage to a disabled employee which is caused by a provision, criterion or practice, or by a physical feature, and must provide auxiliary aids where these would prevent the disadvantage.

In this case18, the employee was disabled and requested reasonable adjustments that she alleged were not made. She brought claims against the employer and four individual staff members.

The Employment Tribunal struck out the claims against the individuals, holding that the obligation to make reasonable adjustments rests with the employer.

On appeal, the EAT held:

• The duty rests with the employer, however a company can only act through its employees.

• Employers are vicariously liable for discriminatory acts carried out by their employees in the course of their employment.

• Where an employee commits an act of discrimination for which their employer is vicariously liable, the individual is also personally liable.

This case confirms that managers and HR may face personal liability for their own acts in the adjustment process. Employers should avoid blanket responses to requests for reasonable adjustments, train managers and introduce guidelines on when to involve HR and get legal support.

[13] Revised code of practice on dismissal and re-engagement

[14] Consultation on the revised code of practice on dismissal and re-engagement

[15] Make Work Pay: fire and rehire – changes to expenses, benefits, and shift patterns – GOV.UK

[16] Make Work Pay: employment status reform and protections for the self-employed  – GOV.UK

[17] A consultation on whistleblowing

[18] Ms C Merriman v (1) 1st Staff Ltd and Others: [2026] EAT 128 – GOV.UK