Legal and regulatory changes coming in 2026: what SMEs need to know 

As 2025 draws to a close, many of the legal reforms announced over the past two years are starting to bed in, while a new wave of change is coming into view. 

This round-up highlights the legal developments most likely to affect UK SMEs in 2026 - showing where things stand now, what is already in motion, and what we expect to become clearer over the next 12 months. The focus is on what matters in practice, so you can plan ahead with confidence while staying focused on running your business. 

Key takeaways 

2026 is less about one headline reform and more about a series of incremental but meaningful changes. To navigate this well, we encourage businesses to: 

• focus on what genuinely applies to them, rather than trying to track everything 

• build legal change into commercial planning, not last-minute compliance 

• recognise where expectations from customers, investors and regulators are already rising 

• use reform as an opportunity to improve processes, governance and resilience 

The priority is not becoming an expert in every update, but understanding when to act, when to prepare, and when an issue is simply worth being aware of. 

Cashflow and tax reforms – act now 

Late payments and cashflow protections 

New rules designed to improve payment certainty for SMEs are expected to reduce maximum payment terms from 60 to 45 days and expand the Small Business Commissioner’s powers, including the ability to investigate repeat late payers. 

What this means for you: 

These changes are aimed at improving predictability, not just offering recourse after problems arise. Businesses that already track payment performance, escalation points and approval bottlenecks will be best placed to benefit. Greater senior visibility over debtor days and disputes will support more accurate forecasting and earlier intervention. 

Making tax digital for income tax (MTD ITSA) 

From April 2026, Making tax digital for income tax will apply to individuals with personal trading or property income above £50,000. 

What this means for you: 

Most incorporated SMEs won’t be affected directly. However, owner/directors with sole trader or rental income should confirm whether the new rules apply to them personally. For most companies, this is a reassurance point rather than a planning issue. 

Corporate governance and transparency – act now 

Companies House reforms under the Economic Crime and Corporate Transparency Act 

Reforms are being rolled out in stages. Many businesses are already seeing more structured filing requirements, increased queries from Companies House and early steps towards identity verification for directors and PSCs. Mandatory verification and expanded use of authorised corporate service providers will continue through 2026. 

What this means for you: 

The direction of travel is clear: greater accuracy, accountability and transparency. Treat these changes as part of maintaining strong governance rather than an administrative burden. Clean, consistent records reduce the risk of disruption and help demonstrate credibility to investors, lenders and partners. 

Digital, consumer and online safety rules – act now 

Digital Markets, Competition and Consumers Act (DMCC) 

The DMCC is being introduced in phases. Many businesses have already reviewed subscription journeys, pricing transparency and online claims. Further clarity, particularly around cancellations and renewals, is expected during 2026. 

What this means for you: 

If you sell online or use subscription models, expectations around fairness and transparency are tightening. Reviewing customer journeys now can reduce complaints, improve trust and avoid rushed changes once final guidance lands. 

Online Safety Act 

The Online Safety Act is in force, but practical obligations will crystallise as Ofcom’s codes of practice are finalised. These are being published in stages, with wider application expected through 2026. 

What this means for you: 

If your platform hosts user content or community features, 2026 will bring clearer expectations around safety measures. Using time now to assess moderation, reporting and user policies will make compliance easier to embed as part of normal operations. 

Employment, people and incentives – keep watch 

Employment Rights Bill 

The government is expected to introduce the Employment Rights Bill in 2026, with proposals covering default flexible working, predictable working patterns and extended family and carer leave. 

What this means for you: 

The operational impact will depend on the nature of your workforce. Taking time now to review your policies and identify areas that might need adjustment means you can move quickly once the final details are confirmed, without disruption to scheduling or people management. 

Enterprise management incentives (EMI) 

HMRC is consulting on reforms to EMI, with simplified rules and broader eligibility expected from 2026. It is not yet clear whether changes will affect existing schemes or apply only to new grants. 

What this means for you: 

If EMI is an important part of your talent strategy, understanding where your current scheme sits against the proposed changes will help you respond confidently once the rules are finalised. This is particularly relevant if you're planning new grants in 2026. 

Data, AI, privacy and cyber security – act now and keep watch 

Data and AI regulation will continue to evolve throughout 2026. For most SMEs, this won’t require wholesale change, but it will increasingly influence product design, marketing, procurement and accountability. 

UK updates 

Data (use and access) Act (DUAA) 

The DUAA is being phased in from mid2025 to mid2026. Early provisions on digital verification services and smart data are already live, with further changes affecting cookies, lawful bases and processing rules. 

What this means for you: 

If you’re planning new products or major marketing initiatives, building DUAA considerations into early design will be more efficient than retrofitting later. 

AI oversight and generative AI expectations 

The UK is not introducing a single AI Act. Instead, sector specific guidance will continue to emerge through 2026, focusing on accountability, transparency and fairness in AI-assisted decision-making. 

What this means for you: 

This is a good time to formalise light touch AI governance. Even a simple internal record of where AI is used, and who owns related risks, will support better decision-making as expectations mature. 

Cyber governance and resilience 

Cyber risk continues to move up the business agenda. Government and NCSC guidance increasingly frames cyber resilience as a governance issue, not just an IT matter. 

What this means for you: 

If customers already ask about cyber assurance, expect this to become more common. Being able to demonstrate resilience and ownership will support procurement and commercial discussions. 

EU updates 

EU–UK data transfers 

The UK’s adequacy decision will be reviewed. While the DUAA is designed to minimise risk, businesses handling EU personal data should be prepared for change. 

What this means for you: 

If EU data flows are critical, ensure alternative transfer mechanisms could be implemented without disruption. 

EU AI Act (high-risk obligations from August 2026) 

From August 2026, high-risk AI systems - including some HR, credit and monitoring tools - must meet enhanced compliance requirements. 

What this means for you: 

If you sell AI enabled products or services into the EU, factor documentation and oversight into product planning early. 

EU Data Act 

User access rights apply from September 2025, with further obligations affecting product design and contracts during 2026. 

What this means for you: 

If you develop connected or data driven products for EU markets, consider whether these rules affect your commercial model. 

Commercial property and sustainability – act now and plan ahead 

Minimum EPC standards for nondomestic property are expected to tighten from 2026, with many buildings needing to reach EPC B by 2030. 

What this means for you: 

If you are planning relocations, renewals or refurbishments, factoring energy performance into early decisions is usually more cost-effective than reactive upgrades. 

Business immigration – act now and plan ahead 

The UK is moving towards a digital-by-default immigration system. Online right-to-work checks, eVisas and modernised sponsor processes will become the norm by 2026. 

What this means for you: 

If you recruit internationally or sponsor workers, embedding digital checks into HR processes now will help avoid delays later. 

Commercial contracts and risk allocation – keep watch 

Across many sectors, businesses are seeing tougher contractual positions become the norm. Larger customers and partners are pushing more risk down the supply chain through pricing mechanisms, termination rights, audit clauses, information obligations and liability caps. This is driven by a combination of regulatory pressure, increased reporting obligations and economic uncertainty.

What this means for you: 

Contract terms increasingly reflect governance, data, cyber and ESG expectations already covered elsewhere in this update. Taking a more joined-up view of contracting, rather than treating it as a one-off legal exercise, will help protect margins, reduce disputes and avoid unintended commitments that are difficult to unwind. 

Financial services and fintech – plan ahead 

Regulatory change continues across payments, lending and cryptocurrency-related services. Buy now pay later regulation, strengthened safeguarding rules, and EU reforms such as DORA, PSD3 and MiCA will affect UK firms operating internationally.

What this means for you: 

If you plan to launch or expand regulated services, allow for longer lead times and build compliance into early commercial decisions. 

Intellectual property – plan ahead 

IPO fee changes and the end of series trade marks may bring forward filing activity in early 2026. Meanwhile, cloned EU trade marks become more vulnerable to revocation, as EU use will no longer support UK rights. 

What this means for you: 

If your brand relies on EU derived rights or planned filings, early review may reduce risk or cost. 

Insolvency – keep watch 

HMRC is taking a more active approach to enforcement, particularly around historic tax liabilities. 

What this means for you: 

If cashflow is under pressure or tax issues have been deferred, engaging early will preserve options and improve outcomes. 

ESG and reporting – keep watch 

The UK’s sustainability disclosure standards align reporting with ISSB frameworks. While mandatory reporting will initially apply to larger organisations, SMEs will feel the impact through supply chain expectations. 

What this means for you: 

If you work with larger corporates, expect more structured ESG data requests. Starting to measure key metrics now can make future reporting smoother and strengthen your competitive position. 

2026 is shaping up to be a big year for UK businesses, with some of the most notable legal and regulatory changes in recent years. These shifts will require businesses to adapt quickly to stay compliant and competitive. They also create opportunities to improve processes, strengthen your foundations, and build greater trust with customers and partners.