UK and EU updates on forced labour, sustainability, Artificial Intelligence, and privacy

This weekly roundup covers the UK government’s response to a forced labour inquiry, new sustainability and ESG developments, fresh steps from UK digital regulators on agentic Artificial Intelligence, and a global data privacy and cybersecurity update.

Eversheds Sutherland’s latest Commercially Connected shorts highlights four developments across UK and EU commercial law. The UK government has published its response to the Joint Committee on Human Rights’ July 2025 report on forced labour in international supply chains. While the committee urged reforms including stronger Section 54 Modern Slavery Act reporting, mandatory human rights due diligence, an import ban on goods linked to forced labour, and a duty to prevent, the government deferred concrete policy choices pending an ongoing review of responsible business conduct under its Trade Strategy. The response notes potential strengthening of the Section 54 regime, references a National Baseline Assessment on the UN Guiding Principles on Business and Human Rights, confirms the creation of the Office for Responsible Business Conduct to tackle supply chain harms, and flags a forthcoming Critical Minerals Strategy. It cautions that significant long-term reform will take time.

The edition’s Global Sustainability and ESG Insights for August and September 2025 tracks a wide agenda. Highlights include the Global Reporting Initiative’s work on new pollution standards, progress on the EU Carbon Border Adjustment Mechanism, updates to the EU Waste Framework Directive, a delay to the EU Deforestation Regulation, and a new EU measure to reduce microplastic pollution. In the UK, key sustainability disclosure consultations have closed, draft Environmental Protection regulations for wet wipes containing plastic have been published, and the Welsh government is consulting on the future drinks container deposit return scheme.

On digital regulation, the UK’s Digital Regulation Cooperation Forum, comprising the CMA, ICO, Ofcom and FCA, reported on its Artificial Intelligence and Digital Hub pilot, which offered free, informal, cross-regulatory advice to innovators over one year. The pilot is deemed a success and will evolve into a Thematic Innovation Hub to provide joined-up regulatory insight on priority technologies. The first theme is agentic Artificial Intelligence, defined as systems capable of autonomous decision-making and initiating actions without direct human prompts. The DRCF has opened a call for views on agentic Artificial Intelligence and regulatory challenges, seeking input on the balance between regulation and adoption, sector-specific issues, risks, opportunities, and useful forms of regulatory support. Responses are due by 6 November 2025.

Rounding out the newsletter, the firm’s Updata quarterly compiles data, privacy, Artificial Intelligence and cybersecurity developments worldwide. Topics include new transparency guidelines under the EU Artificial Intelligence Act, the final GPAI Code of Practice, California’s Transparency in Frontier Artificial Intelligence Act, and national Artificial Intelligence laws in Italy. It also covers smart data laws such as EU Data Act implementation, EDPB guidance on data sharing, and the UK’s Data (Use and Access) Act 2025. Additional coverage spans increased cybersecurity scrutiny, new incident reporting in Italy, China and Hong Kong, major fines in Italy and Spain, a proposed UK ransomware payment ban, case law on pseudonymous data and the GDPR right of access, developments affecting children’s data and biometrics, progress on NIS2 and ENISA guidance, and ongoing consultations on the Digital Markets Act, Digital Services Act, and Chips Act 2.0.

60

Impact Score

What businesses need to know about the EU cyber resilience act

The EU cyber resilience act is turning product cybersecurity into a legal requirement for companies that sell digital products into the European Union. A key compliance milestone arrives in September 2026, well before the full regulation takes effect in 2027.

Claude Mythos and cyber insurance’s next inflection point

Claude Mythos is being treated by governments and regulators as a potential systemic cyber risk with implications for financial stability and insurance markets. Its emergence is intensifying pressure on insurers to clarify whether Artificial Intelligence-enabled cyber losses are covered, excluded, or require new stand-alone products.

OpenAI expands ChatGPT ads with self-serve manager

OpenAI is widening its ChatGPT ads pilot with a beta self-serve Ads Manager, new bidding options and broader measurement tools. The push signals a deeper move into advertising as the company expands the program into several international markets.

OpenAI launches Artificial Intelligence deployment consulting unit

OpenAI has created a new consulting and deployment business aimed at helping enterprises build and roll out Artificial Intelligence systems. The move mirrors a similar push by Anthropic and signals a broader effort by model providers to capture more of the enterprise services market.

SK Group warns DRAM shortages could curb memory use

SK Group chairman Chey Tae-won warned that customers may reduce memory consumption through infrastructure and software optimization if DRAM suppliers fail to raise output. Demand from Artificial Intelligence data centers is keeping the market tight as memory makers weigh expansion against the long timelines for new fabs.

Contact Us

Got questions? Use the form to contact us.

Contact Form

Clicking next sends a verification code to your email. After verifying, you can enter your message.