Commercially Connected Shorts - 15 April 2026

This week we look at:

• Cyber - improving the security of internet connected devices within businesses
• Tech - have your say on EU digital wallet certification scheme
• AI - how will the UK approach agentic AI?
• EU – round up of regulatory developments in the EU

Improving the security of internet connected devices within businesses

On 8 April 2026, the Government published the outcome of its call for evidence on improving enterprise connected device security. 

Enterprise connected devices are internet connected devices that are used by businesses and other organisations, such as printers, video conferencing systems and VoIP phones. The concern is that if these devices have security vulnerabilities they can be used to facilitate a hostile attack on the organisation’s IT systems. 

The original call focused on proposals for a voluntary code of practice to aid the design and creation of secure enterprise connected devices. Proposed additional interventions included a voluntary pledge to comply with the Code of Practice, creating a new international standard, and/or legislation (possibly expanding the scope of the Product Security and Telecoms Infrastructure Act 2022 to cover enterprise devices). 

Following review of the feedback, the Government’s next steps include:

• manufacturers are encouraged to follow the device security principles outlined on the National Cyber Security Centre (NCSC) website, ensuring their products are designed with security in mind
• a plan to evaluate whether efforts should extend beyond enterprise-connected devices as part of the continuous review of technology security
• an aim to finalise the security principles and integrate them into a broader set of secure-by-design practice codes for technology, while considering the possibility of a certification scheme for manufacturers
• exploring options for regulatory measures, including assurance or enforcement mechanisms (in response to feedback that voluntary adoption may not be strong enough)

The government sees the technology companies that manufacture and supply these products as crucial for the UK's growth and innovation. Building security into designs will lessen supply chain risks and shift responsibility away from end users, helping create a safer and stronger digital technology environment. 

Have your say on EU digital wallet certification scheme

On 3 April 2026, the EU agency for cybersecurity (ENISA) launched a consultation on its EU digital wallet certification scheme. 

Digital wallets play an essential role in providing smooth and secure identification, whether online or in person. They help protect users' privacy and personal information. A certification scheme will make sure every wallet meets strict security standards (something which has been lacking).  

ENISA have been tasked with supporting the certification process for European Digital Identity (EUDI) Wallets. This includes developing a proposed European cybersecurity certification scheme in line with the requirements of the Cybersecurity Act.  By the end of 2026, each Member State must offer at least one certified EU Digital Identity Wallet. 

The consultation is open until the end of April and seeks input on the draft scheme, its design and the security requirements before finalisation.  Thoughts on the content of accompanying guidance are also welcomed to aid implementation.  If your organisation plans to serve as or work with wallet providers, responding to this call can help shape risk allocation, certification costs, and contractual assurances around security, liability and compliance.  

It is hoped the new certification system will provide a unified cybersecurity framework, helping manufacturers comply, increasing transparency, and supporting secure digital products and services.

How will the UK approach agentic AI?

On 31 March 2026, the Digital Regulation Cooperation Forum (DRCF) published a foresight paper on the Future of Agentic AI.

The DRCF is comprised of the UK regulators: the Competition and Markets Authority (CMA), Financial Conduct Authority (FCA), Information Commissioner’s Office (ICO), and Ofcom.  In their review of Agentic AI they outline possible future trends and initial cross-regulatory insights in governance, data protection and cybersecurity, consumer rights, and market competition.  There is a clear message from the regulators that existing frameworks and regulatory principles will adapt to technological developments and they will continue to monitor progress and work together to ensure a joined up approach for the UK.  Expect the following from the regulators in the coming year:

CMA - intends to build on its agentic AI work and continue to provide practical support and guidance for businesses interested in these technologies, including through domestic and international collaboration

FCA – from encouraging testing environments with the Supercharged Sandbox and a showcase event in January, the FCA will release an AI Live Testing evaluation report by Q1 2027. Work continues alongside the Bank of England to examine AI use, risks, and opportunities in UK financial services for safe adoption.  The upcoming Mills Review will examine how advanced AI could transform retail financial services by 2030 and its implications for consumers, firms, and FCA regulation

ICO - on 31 March 2026 the ICO launched a consultation on its draft guidance on automated decision-making (ADM), including profiling, which it has updated to reflect changes to the UK GDPR made by the Data (Use and Access) Act 2025.  The ICO is also drafting a statutory code on AI and ADM that affects Agentic AI, alongside ongoing projects outlined in its AI and biometrics strategy

Ofcom – the 2026/2027 edition of Ofcom’s approach to AI is expected this year.  Work will continue on reviewing agentic AI through the Online Safety Act lens and looking at agentic AI adoption in the telecoms markets and the impact on businesses and consumers

EU legislation round up – our monthly update

Our monthly EU Legislation Roundup highlights regulatory developments with board-level impact, from tighter green claims rules and AI governance to trade, sustainability reporting and industrial policy.

With new deadlines and shifting frameworks across consumer, technology, energy and supply chains, businesses should reassess compliance priorities, timing and business impact across their EU operations.