Retail horizon scanning: prepare for UK and EU legislative changes across technology, safety and accessibility

These regulatory developments mark a significant step in shaping the digital and physical product landscape in a number of markets, particularly those operating cross-border or dealing with emerging technologies. With many of these regulations coming into force in the upcoming months, businesses should take steps now to actively assess compliance and understand how they may impact operations.

Below, we outline the core regulations coming into force and the strategic impacts for businesses navigating this evolving legal terrain.

• AI: the EU AI Act, enacted last year, is gradually coming into effect. Since 2 February 2025, specific AI practices have been prohibited, particularly those related to facial recognition databases created through untargeted image scraping. These restrictions apply broadly to any involved parties with EU ties. On 2 August 2025, governance rules for GPAI models will demand technical documentation, copyright compliance, and training content summaries. The majority of the AI Act will be effective by August 2026. The UK is currently behind in forming analogous legislation, but a consultation on AI regulation is expected soon, influencing future business operations here.
• Cyber Security: the EU Cyber Resilience Act will be in force by December 2027. It applies to manufacturers, importers, and distributors of smart devices mandating stringent security requirements and vulnerability reporting. In the UK, the Product Security and Telecommunications Infrastructure Act 2022 parallels EU efforts, enhancing cybersecurity standards for consumer and business products alike. Ensuring adherence to these laws is paramount for maintaining customer trust and avoiding compliance challenges.
• Accessibility: as of 8 June 2025, the EU Accessibility Act mandates Member States to require increased accessibility measures for self-service terminals, e-commerce, and interactive devices. Companies must follow local law variations to meet these standards, affecting product and service provision.
• Data: from September 2025, the EU Data Act will facilitate data-sharing frameworks, encourage interoperability, and protect against unlawful data transfers. This Act, applicable to all data types, not just personal data, will influence any business dealing with connected devices. Transparency in data practices will become crucial.
• Product Safety and Liability: there is new product safety legislation through the General Product Safety Regulation (GPSR) and Product Liability Directive (PLD). The GPSR came into force on 13 December 2024 and focuses on ensuring market products are safe, covering all consumer items and strengthening surveillance. Whereas the PLD will apply to products placed on the market on or after 9 December 2026 and establishes compensation rights for damages caused by defective products, including digital and AI-driven products. It enforces strict liability, simplifying consumer claims for harm. For businesses, understanding GPSR is vital for compliance and avoiding placing unsafe products on the market, while PLD ensures consumer protection in case of product defects. Each law serves as a cornerstone for maintaining consumer trust and legal security.

Businesses should view these measures not simply as regulatory hurdles but as catalysts for innovation, consumer trust and commercial resilience. Cross-functional coordination between legal, product development, compliance and executive teams will be essential.

Fieldfisher continues to advise clients on operational readiness, risk mapping and proactive alignment with these regulatory frameworks. As legislation intensifies across digital markets, we support organisations in remaining agile, informed and compliant across both the EU and UK landscapes.

If you have any particular questions on the above developments, please contact Gordon Drakes or a member of our Retail & Consumer team.