1. Employment tribunal time limits double – from 1 October 2026
On 1 September 2026, the UK Official Gazette published Statutory Instrument SI 2026/954, bringing into force from 1 October 2026 an extension of the time limit for bringing Employment Tribunal claims from three months to six months. The extended limitation periods apply to a wide range of claims, including unfair dismissal, discrimination, unlawful wage deductions, working time rights, flexible working, TUPE obligations, agency worker rights, and trade union protections.
This is already law — it is not a consultation or a proposal. From 1 October 2026, workers have twice as long to bring claims that previously time-barred before employers had adequate opportunity to investigate. For businesses, this significantly extends the window of litigation exposure. Any incident, dismissal, or employment decision made on or after 1 October 2026 carries a six-month claims horizon rather than three. HR processes, documentation standards, and legal hold procedures need to be updated accordingly.
2. UK carbon border adjustment mechanism – interest regime active from 1 January 2027
On 8 September 2026, the UK Official Gazette published Statutory Instrument No. 994, appointing 1 January 2027 as the date from which HMRC's existing interest regime will apply to amounts due under the UK Carbon Border Adjustment Mechanism (CBAM) and related penalties. From that date, late-payment interest provisions will apply to unpaid CBAM amounts and associated penalties, while repayment interest provisions will apply to eligible amounts payable by HMRC. Separately, the UK Official Gazette published the Carbon Border Adjustment Mechanism (Emissions and Verification) Regulations 2026, establishing the framework for calculating, monitoring, verifying, and reporting greenhouse gas emissions embodied in goods subject to the UK CBAM, also coming into force on 1 January 2027.
The Emissions and Verification Regulations require annual emissions monitoring, independent verification by accredited verifiers, and the retention of verification records for six years. Businesses importing goods subject to CBAM must ensure that their emissions data collection, verification arrangements, and CBAM return processes are fully operational before 1 January 2027. The interest regime means that errors and delays will carry an immediate financial cost from day one.
3. EU revised sustainability reporting standards – adopted, applicable from 2027
On 21 September 2026, the European Commission adopted Delegated Regulation (EU) 2026/1563, revising the European Sustainability Reporting Standards (ESRS) under the Corporate Sustainability Reporting Directive (CSRD). The Regulation simplifies sustainability reporting obligations by reducing mandatory disclosure datapoints, clarifying the application of the materiality principle, distinguishing between mandatory and voluntary disclosures, and introducing reporting reliefs for value-chain information, acquisitions and disposals, and sustainability metrics. The revised standards apply to financial years beginning on or after 1 January 2027, with optional early use for financial years beginning during 2026.
Alongside the revised ESRS, the EU Official Journal published Commission Delegated Regulation (EU) 2026/1560, establishing voluntary sustainability reporting standards for undertakings outside the scope of mandatory CSRD requirements — including SMEs and entities with up to 1,000 employees — while also introducing a value chain cap limiting sustainability information requests made by CSRD-reporting entities to smaller value-chain partners. Taken together, these two instruments reshape the EU's entire sustainability reporting architecture. Organisations must reassess their reporting frameworks, materiality assessments, and data collection processes against the revised standards before the 2027 financial year begins.
4. EU deforestation regulation – product scope expanded from December 2027
On 17 September 2026, the EU Official Journal published Commission Delegated Regulation (EU) 2026/2102, amending Annex I of the EU Deforestation Regulation to revise the list of commodities and products subject to deforestation-related due diligence requirements. The Regulation adds certain products, including soluble coffee, frozen cattle tongues, and specified palm-oil-derived chemicals and soaps, while removing selected cattle, leather, rubber, vehicle seat, aircraft seat, and soybean-related products. Newly added products will become subject to EUDR requirements from 30 December 2027.
While the operative date is December 2027, building the supply chain traceability and due diligence infrastructure that the EUDR demands takes considerable time. Businesses in food manufacturing, retail, chemicals, and agricultural supply chains whose product mix now falls within the revised scope cannot defer this work. The simultaneous removal of certain product categories also means that businesses should reassess their existing EUDR compliance scope — some obligations may have been removed, while new ones have been added.
5. EU Cyber Resilience Act – reporting obligations now in force
On 11 September 2026, the European Union Agency for Cybersecurity (ENISA) announced the launch of the Cyber Resilience Act (CRA) Single Reporting Platform, the EU's central reporting mechanism for actively exploited vulnerabilities and severe cybersecurity incidents affecting products with digital elements. The platform enables manufacturers and open-source software stewards to submit a single report automatically shared with ENISA and relevant national CSIRTs, with reporting obligations under the CRA having taken effect on 11 September 2026. Broader cybersecurity product requirements under the CRA will apply from 11 December 2027.
The CRA's reporting obligations are already live. Manufacturers of products with digital elements — hardware, software, IoT devices, and connected products of any kind — are now required to report actively exploited vulnerabilities and severe cybersecurity incidents through the ENISA platform. Businesses that are not yet familiar with the platform or have not established internal processes for identifying and reporting qualifying events are already operating at regulatory risk.
This content has been prepared based on regulatory and legislative updates identified across UK and EU jurisdictions as at September 2026. It is intended for awareness purposes and does not constitute legal advice.
