Commercially Connected Shorts - 6 May 2026

This week we look at:

• UK: which laws might be announced in the King’s Speech?
• Consultation on EU Digital Product Passport Registry
• UK cyber security breaches survey 2025 – 26
• New EU framework for compulsory licensing of patents in crisis situations

UK: which laws might be announced in the King’s Speech?

The King’s Speech is scheduled to take place on 13 May 2026. On 29 April the House of Commons Library published a research briefing which includes details of what legislation and policy we might expect to see announced in the King’s Speech.

Items of particular interest to Commercial lawyers include:

 The briefing doesn’t mention reform of UK product safety laws, but these are likely to be included following Government consultations opened at the end of March – see the April edition of Commercially Connected for more detail.

Look out for next week’s Commercially Connected short in which we will look at the announcements made in the King’s Speech.

Consultation on EU Digital Product Passport Registry 

On 29 April 2026 the European Commission opened a consultation on the draft implementing Regulation for the operational rules of the Digital Product Passport Registry, which has to be established (under the Ecodesign for Sustainable Products Regulation 2024 (ESPR)) by 19 July 2026.

The ESPR establishes a framework for ecodesign requirements for sustainable products, so that by 2030 a significant proportion of products placed on the EU market will be durable, energy and resource efficient, repairable and recyclable. Under the ESPR in-scope products will be required to have a digital product passport that acts as a digital identity, containing standardised compliance and sustainability product information to improve product transparency and traceability. The first in-scope products will be batteries (from February 2027), toys, construction products, detergents and surfectants, with additional product groups to be phased in over time via delegated acts so that eventually the vast majority of products will be in-scope.

The Regulation that is currently being consulted on relates to the central Digital Passport Product Registry (DPPR) that will record the unique identifiers for digital product passports. The Regulation includes details of proposed access controls, as well as verification, registration, security and governance measures for the DPPR.

Consultation closes on 27 May 2026. Manufacturers and other stakeholders in the supply chain of products that will – or may in the future – require a digital passport should review the draft Regulation and consider responding to the consultation to ensure that using the DPPR will be practical and user-friendly.

UK cyber security breaches survey 2025 – 26 

On 30 April 2026 the Department for Science, Innovation and Technology published the results of the cyber security breaches survey 2025-26.

The survey shows that cyber risk remains widespread but broadly stable across UK organisations. Around 43% of businesses and 28% of charities reported a cyber breach or attack in the past year, with phishing continuing to dominate as both the most common and most disruptive threat. While average financial impacts remain low, a minority of organisations experienced significant costs, particularly where breaches lead to operational disruption, reputational damage or revenue loss.

According to the survey, larger organisations are more exposed but also better prepared: they are far more likely to have formal cyber strategies, board‑level accountability and incident response plans. In contrast, small businesses have fallen back on several basic cyber hygiene measures after improvements last year, including risk assessments and continuity planning. Notably, a significant number of businesses said they did not have formal procedures in place to review supply chain cyber risk, with rates being lower amongst smaller organisations.

The results of this survey reinforce the need for organisations to ensure that cyber resilience is high on their agenda. Organisations should ensure that they have effective cyber security policies, incident response planning and staff training in place. Cyber resilience in the supply chain should also be addressed in both procurements and contract terms.

New EU framework for compulsory licensing of patents in crisis situations

The EU has passed a new regulation allowing compulsory licensing of patents and related rights during declared crises. The mechanism is designed as a measure of last resort to secure access to essential products when voluntary licensing cannot deliver timely or adequate supply. In this article we explore what is required in order to comply and the effect it will have on rights holders: New EU framework for compulsory licensing of patents in crisis situations.

With thanks to Dr Anette Gartner, Marta Gonzalez Diaz, Kiko Carrion, Anna Maria Stein and Chloe Gastrell