Environmental non-compliance exposure is widening
Department for Environment, Food and Rural Affairs (DEFRA) has issued multiple updates to the EPR packaging framework in rapid succession and has updated pollution-prevention guidance for businesses, including refined guidance on plastic subtypes. At the EU level, the European Commission adopted a regulation approving restricted substances in February 2026, tightening what products can lawfully be placed on the market across the block.
Environmental litigation – brought by regulators, NGOs, and increasingly by shareholders – is one of the fastest-growing areas of commercial litigation globally. The pattern across UK and EU jurisdictions is consistent: regulators issue guidance, set deadlines, then enforce. Businesses that are behind on EPR obligations, packaging compliance, or restricted substances rules are sitting targets. The EU's tightening on restricted substances adds a product liability dimension that extends well beyond UK borders.
What to watch: Regulatory enforcement notices under the EPR framework, civil claims by environmental groups, and shareholder derivative actions alleging failure to manage environmental regulatory risk.
Data breach vulnerability alerts are a precursor to enforcement
On 12 February 2026, the Dutch Data Protection Authority issued a public alert on vulnerabilities in data processing systems. Separately, the EDPB and EDPS issued a joint opinion on the Digital Omnibus on 11 February 2026, reflecting coordinated regulatory attention on digital and data governance at the highest European level.
The publication of vulnerability alerts by national data protection authorities is itself a warning sign. It indicates that regulators are actively identifying systemic weaknesses, and enforcement typically follows. The EDPB and EDPS joint opinion signals that the EU's most senior data protection bodies are aligned on digital governance priorities – a hallmark of coordinated enforcement action to come. Businesses that have not stress-tested their data protection controls, reviewed consent mechanisms, or updated vendor data processing agreements face growing exposure – both to regulatory fines and to private claims from data subjects.
What to watch: Regulatory investigations triggered by published vulnerability alerts, group litigation from data subjects, and cross-border enforcement actions arising from the EU's coordinated approach to digital governance.
The employment rights overhaul is creating new grounds for claims
The UK Department for Business and Trade published guidance on Employment Rights Act implementation on 3 February 2026 and launched a consultation to modernise agency worker rules on 6 February 2026. A further consultation on enhancing access to flexible working was opened on 5 February 2026.
Simultaneously, the Employer Pensions National Insurance Contributions Bill is advancing through Parliament, increasing the financial pressure on businesses and creating incentives to restructure workforces in ways that carry their own legal risks.
Where employment law changes, claims follow. Businesses that fail to update contracts, policies, and practices in time create direct exposure to Employment Tribunal claims, class actions, and regulatory investigations. The warning sign is not any single piece of legislation – it is the speed and breadth of change happening all at once.
What to watch: Agency worker misclassification claims, flexible working refusal disputes, and redundancy challenges arising from workforce restructuring triggered by increased employer cost obligations.
This content has been prepared based on regulatory and legislative updates identified across UK and EU jurisdictions as of March 2026. It is intended for awareness purposes and does not constitute legal advice.
