European Digital Compliance: Key Digital Regulation & Compliance Developments

To help organizations stay on top of the main developments in European digital compliance, Morrison Foerster’s European Digital Regulatory Compliance team reports on some of the main topical digital regulatory and compliance developments that have taken place in the fourth quarter of 2025.

This report follows our previous updates on European digital regulation and compliance developments for 2023 (Q1, Q2, Q3, Q4), 2024 (Q1, Q2, Q3, Q4), and 2025 (Q1, Q2, Q3)

In this issue, we highlight key EU, German, and UK developments in digital, media, and cybersecurity regulation. This includes progress on the CSAM Regulation, new EU digital initiatives and consultations, Germany’s implementation of NIS2 and media law reforms, and major UK updates on cybersecurity, online safety enforcement, and automated vehicles.

For further details, read our client alert.

EU

1. EU Council finally adopts its position on the proposed Regulation

2. Digital Fitness Check: Is the EU’s Digital Rulebook Overweight?

3. Simplification: Commission publishes proposals for Digital Omnibus Package

4. Revision of the Product Liability Directive: Implementation is Approaching

5. Commission initiated revision of the Audiovisual Media Serviced Directive

Germany

6. Germany finally adopted its NIS2 Implementation law

7. Germany adopts its draft implementation of the EU’s new Withdrawal Button

8. Digital Media State Treaty: Key Discussion Points Adopted for Second Reform Package

9. New German Minor Safety Rules in Force & raising Doubts on Extraterritorial Enforcement

UK

10. The UK Cyber Security and Resilience Bill: Scope, Key Changes and Next Steps

11. The UK Online Safety Act: Showing its teeth

12. UK Government Calls for Evidence on Automated Vehicles

EU

1. EU Council finally adopts its position on the proposed Regulation

On November 26, 2025, the Council of the European Union adopted its long-awaited general approach on the proposed Regulation laying down rules to prevent and combat child sexual abuse material (“CSAM Regulation”). The Council’s position marks a notable shift compared to the Commission’s original proposal, particularly with regard to detection obligations (see also our Q2, 2022 and Q4, 2023 updates).

What’s new?

Most importantly, the Council refrained from endorsing mandatory detection orders as proposed by the Commission. Instead, the Council advocates for an unlimited extension of the current Interim Regulation (Regulation (EU) 2021/1232). This would continue to allow providers of over-the-top (OTT) messaging and other communication services to voluntarily scan communications for known CSAM and related indicators.

By relying on a permanent extension of the interim regime, the Council seeks to preserve the status quo for providers, avoiding the introduction of a new obligation to deploy detection technologies pursuant to binding orders issued by national authorities. This approach reflects ongoing concerns around proportionality, encryption, and fundamental rights, which have dominated the legislative debate since the Commission first tabled its proposal in 2022.

What’s next?

With the Council’s general approach now adopted, trilogue negotiations between the Council, the European Parliament, and the Commission are ongoing. Given that the Parliament has also expressed strong opposition to mandatory detection orders in the form originally proposed by the Commission, further changes to the draft Regulation are likely. As a result, the final text of the CSAM Regulation may diverge significantly from the Commission’s initial proposal. 

Back to Top

2. Digital Fitness Check: Is the EU’s Digital Rulebook Overweight?

On November 19, 2025, the European Commission launched a “Digital Fitness Check” by publishing a call for evidence and opening a public consultation. The exercise is positioned as the second step in the Commission’s digital simplification agenda (alongside the Digital Omnibus proposals, see our Q3 2025 update) and is intended to “stress test” how the EU’s digital rulebook performs in practice, particularly from a competitiveness and administrative burden perspective.

What’s new?

The Digital Fitness Check takes a broad view of the EU’s “digital rulebook,” encompassing both EU legislation with a significant digital dimension and its implementation in practice. Through the call for evidence, the Commission seeks to assess how these rules operate together, with a particular focus on identifying synergies, gaps, overlaps, and inconsistencies. The exercise will examine the coherence of key legal concepts and obligations, the cumulative impact of digital regulation (including combined costs, benefits, and potential duplication), and the effectiveness of governance and supervisory arrangements at the national and EU level. It will also consider tools, guidance, and practices that enhance legal certainty, reduce administrative burdens, or support the application of rules in innovative contexts.

What’s next?

The call for evidence and the public consultation will be conducted in parallel over a sixteen-week period, with submissions open until March 11, 2026, during which all stakeholders are invited to share their views. After evaluation, the Commission will organize further consultation activities in this context, including “reality checks” and implementation dialogues, focusing on specific issues. The Commission adoption is planned for Q1 2027.

Back to Top

3. Simplification: Commission publishes proposals for Digital Omnibus Package

On November 19, 2025, the European Commission published its long-awaited proposal for a Digital Omnibus package (see our Q3 update, 2025). The package includes (i) the Digital Omnibus on AI and (ii) the Digital Omnibus on the Digital Acquis, proposing amendments to data, privacy, and cyber laws.

What’s new?

The Digital Omnibus on AI proposes, inter alia,

• Making the application of high-risk AI rules conditional on the adoption of harmonized standards, and introducing specific transparency requirements for generative AI;  
• Extending simplified quality management system requirements to SMEs and other SME-related privileges to small mid-caps;
• Broadening and lowering the threshold for processing special categories of personal data to detect and correct bias;
• Removing the registration requirement for non-high-risk systems; and
• Removing enforceable AI literacy requirements on providers and deployers.

Through the Digital Omnibus on the Digital Acquis several existing instruments would be repealed and consolidated with the Data Act. Furthermore, it proposes targeted amendments, including:

• Streamlining data and cyber incident reporting by creating a single-entry point;
• Increasing reporting thresholds and timeframes for personal data breaches;
• Facilitating the processing of personal data in AI development, training, and operation;
• Introducing a subjective approach to the definition of personal data;
• Allowing data controllers to reject or charge for abusive data subject access requests; and
• Expanding the available legal bases beyond consent for non-essential cookies.

What’s next?

The Digital Omnibus package is currently under consideration by the European Parliament and Council. The text is expected to be heavily debated and likely to be amended during the legislative process. 

Back to Top

4. Revision of the Product Liability Directive: Implementation is Approaching

On November 18, 2024, the EU published in the Official Journal the revised Product Liability Directive. It replaces the 1985 Product Liability Directive and aims to make the EU’s strict (no-fault-based) regime workable for software-enabled and AI-driven products, as well as modern supply chains.

What’s new?

The Product Liability Directive, which entered into force on December 8, 2024, extends liability to digital products. The “products” explicitly include software (including AI systems and updates), digital manufacturing files, and digital services treated as components. Manufacturers may be held liable where damage results from missing or inadequate software updates or insufficient cybersecurity safeguards. The New Directive also removes the current deductibles and maximum liability limits and substantially modified products are treated as new products.

What’s next?

The Directive applies to products placed on the market or put into service after December 9, 2026. Member States must transpose it into their national laws and implement changes by December 2026. The 1985 Directive continues to apply to earlier products. Businesses should use the runway to inventory in-scope products and services, harden software update and cyber governance, and revisit documentation, supply-chain traceability, contractual allocations, and insurance.

Back to Top

5. Commission initiated revision of the Audiovisual Media Serviced Directive

The European Commission has initiated the formal evaluation process for the Audiovisual Media Services Directive (AVMSD), with a view to a potential revision. The initiative aims to assess whether the existing framework remains fit for its purpose in light of the rapid technological, market, and behavioral changes since the last revision in 2018.

What’s new?

The evaluation is currently ongoing, following the Commission’s publication of the call for evidence.

The Commission aims to assess the AVMSD’s effectiveness, efficiency, relevance, EU added value, and coherence, including its interaction with newer horizontal legislation such as the Digital Services Act (DSA). The evaluation covers a broad range of core elements of the Directive, including its scope, prominence of media services of general interest, audiovisual commercial communications, rules on the protection of minors applicable to video-sharing platforms and promotion of European works.

From a substantive perspective, the evaluation examines whether the existing framework remains fit for purpose in light of evolving markets, and technological and regulatory developments, in particular whether the current rules continue to be appropriate given:

• The growing dominance of on-demand services and user-generated content;
• The emergence of influencers as major market players; and
• Increasingly personalized, targeted, and algorithm-driven content formats.

What’s next?

The Commission plans to continue its preparatory work in Q1 2026 and to publish a factual summary report. A possible proposal for revisions is expected to follow in Q3 2026.

Back to Top

Germany

6. Germany finally adopted its NIS2 Implementation law

On December 6, 2025, Germany’s Act implementing the NIS2 Directive (Directive (EU) 2022/2555) entered into force, more than one year after the Directive’s transposition deadline expired. The Act completes Germany’s NIS2 legislative package by comprehensively revising the BSI Act (BSI-Gesetz) and formally integrating the NIS2 framework into the country’s existing cybersecurity regime centered around the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik or BSI), see also our Q2, 2025 update) and our BSI deep dive).

For many organizations operating in Germany, the Act introduces new and expanded compliance obligations, including mandatory registration, enhanced cybersecurity risk management measures, and strengthened governance and enforcement mechanisms.

What’s new?

• Integration into the BSI Act and expanded scoping: Unlike several other Member States, Germany did not adopt a standalone NIS2 implementation law. Instead, it amended the existing BSI Act, which already governed the KRITIS regime under the original NIS Directive. As a result, the revised Act layers the NIS2 categories of “particularly important entities” and “important entities” onto the pre-existing KRITIS framework. All entities classified as “critical” under German law are automatically deemed “particularly important entities” for NIS2 purposes, resulting in a more granular scoping model than envisaged at EU level.
• Ancillary activity exemption: A notable deviation from the NIS2 Directive is the ancillary activity exemption in Section 28(3) of the BSI Act. Entities are excluded from scope where their engagement in regulated activities is considered “negligible.” While potentially relevant for companies whose core business lies outside NIS2-relevant sectors, the Act provides no binding definition of “negligible,” leaving considerable legal uncertainty and raising questions as to compatibility with the Directive’s minimum harmonization approach.
• Registration and ICT component disclosure: In-scope entities must register with a joint reporting office operated by the BSI and the Federal Office for Civil Protection and Disaster Assistance within three months after falling into the scope of the Act for the first time. The Act also preserves Germany’s far-reaching powers to prohibit specific ICT components on public order or national security grounds in relation to critical entities.
• Enforcement, sanctions, and management liability: The revised BSI Act significantly expands the BSI’s supervisory and enforcement powers. Sanctions are aligned with NIS2, with fines of up to EUR 10 million or 2% of global turnover for particularly important entities and up to EUR 7 million or 1.4% for important entities. In addition, members of management bodies may be held personally liable for failure to implement and oversee cybersecurity risk management measures.

What’s next?

In-scope entities will now need to register within three months of the Act’s entry into force, i.e., before April 2026. Companies that were not previously subject to KRITIS or sector-specific cybersecurity rules should now assess whether their existing cybersecurity programs meet the new requirements under the BSI Act and address any gaps promptly.

Back to Top

7. Germany adopts its draft implementation of the EU’s new Withdrawal Button

Following a delayed transposition beyond the EU deadline of December 19, 2025, the Act amending German consumer contract law and insurance contract law, as well as certain provisions of treatment contracts (Gesetz zur Änderung des Verbrauchervertrags- und des Versicherungsvertragsrechts sowie zur Änderung des Behandlungsvertragsrechts), was published in the Federal Law Gazette on February 5, 2026. The Act implements, inter alia, Directive (EU) 2023/2673 (the “Directive”) amending the Consumer Rights Directive 2011/83/EU, which we previously covered in our Q1 2023 and Q4 2023 updates. Most importantly, it provides for an electronic withdrawal function, also often called a withdrawal button, in a new section 356a of the German Civil Code (BGB).

What’s new?

The adopted legislation requires traders, inter alia, to provide consumers with an electronic withdrawal function for all distance contracts implemented by means of an online interface, such as a website or app. Consumers must be able to exercise their right of withdrawal via the same interface used to enter into the contract.

Withdrawal must be enabled by a clearly identifiable function, like a button, that is permanently available throughout the withdrawal period. The function must be clearly visible, easily accessible, and prominently placed, and it must be labeled in a legible manner using the wording “withdraw from contract here” or an unambiguous equivalent. Once a withdrawal is submitted via the withdrawal function, traders are required to immediately confirm its receipt on a durable medium. These requirements are intended to ensure that consumers can withdraw from a contract just as easily as they can start it.

In Germany, the withdrawal function will apply alongside the cancellation button (Kündigungsbutton) that has been in place for several years. While the requirements for the function and the button may appear similar at first glance, they differ in important details, including that the existing design and implementation approaches for the withdrawal function cannot be the same as the cancellation button.

What’s next?

The provisions introducing the withdrawal button will enter into force on June 19, 2026, meaning that Germany will at least meet the application deadline set out in Directive (EU) 2023/2673. Affected businesses will have until June 19 to implement the withdrawal function.

Back to Top

8. Digital Media State Treaty: Key Discussion Points Adopted for Second Reform Package

Following the publication of the discussion draft for the first part of the Digital Media State Treaty (DMStV) in June 2025, the key discussion points adopted by the Broadcasting Commission of the Federal States in Germany on October 22, 2025 now constitute the basis for the second part of the reforms under the DMStV, further consolidating and modernizing Germany’s existing Interstate Media Treaty (MStV).

What’s new?

As previously mentioned in our Q2 Update, 2025, the first part of the DMStV primarily addresses the implementation of EU media legislation, in particular the European Media Freedom Act (EMFA). By Comparison, the changes discussed under the second reform package aim to adapt media regulation to technological developments, safeguard freedom of expression and media pluralism in the digital environment, and address emerging questions relating to AI oversight.

Key points outlined by the Broadcasting Commission include:

• Strengthening content providers and refinancing journalistic offerings: The Federal States seek to establish a level economic playing field for journalistic media by reviewing and potentially loosening advertising rules and securing the monetization of media content. The proposals further aim to adapt media regulation to the AI age by enhancing transparency and accountability for AI services (e.g., source attribution and plausibility checks), improving the findability of journalistic and public-value content in digital environments, and reinforcing journalistic standards.     
• Guaranteeing free communication spaces and effective supervision: The Federal States propose stronger protection of digital communication spaces against manipulative content, alongside enhanced transparency and safeguards for editorial independence. Media supervision is to be modernized through clearer allocation of responsibilities and reduced administrative burdens, including streamlined reporting obligations and greater digitalization of supervisory processes.  
• Enabling business growth and safeguarding diversity of opinion: The third set of measures promotes enhanced market monitoring and a comprehensive reform of media concentration law, extending its scope beyond a television-centered approach to also capture platform power, including obligations for dominant platforms to allow outlinks without discriminatory treatment.

What’s next?

The discussion points adopted in October 2025 do not yet constitute binding law but serve as reform proposals and options for the drafting of concrete legislative provisions for Part II of the DMStV. The Broadcasting Commission has tasked the state representatives with further developing these proposals and has announced its intention to adopt a formal decision in summer 2026.

Back to Top

9. New German Minor Safety Rules in Force & raising Doubts on Extraterritorial Enforcement

The revised amendment to the Interstate Treaty on the Protection of Minors in the Media (Jugendmedienschutz-Staatsvertrag, “JMStV”) entered into force on December 1, 2025. The amendment strengthens youth protection obligations for providers of media services and platforms, including obligations applicable to services commonly used by minors (see our previous Q4, 2024 update).

Shortly after its entry into force, new administrative case law has addressed the applicability of the JMStV to providers established outside Germany.

What’s new?

In recent interim proceedings, the Administrative Court of Düsseldorf (VG Düsseldorf, case no. 27 L 1350/24) ruled on enforcement measures taken against a pornographic website operated by a provider established in Cyprus, based on a claim brought against an internet access provider that was ordered to restrict access to that website. German authorities had prohibited the offering of the website in Germany on the grounds that the content was not made available within a closed user group, as required under Section 4(2) sentence 1 no. 1 in conjunction with sentence 2 JMStV. In addition, the authority issued a blocking order against Germany-based internet access providers.

Without consideration of the JMStV’s rules on territoriality under Section 2 JMStV, the court found the relevant JMStV provisions to constitute an abstract and generally applicable rule that directly imposes obligations on all service providers, including those established in other EU Member States. Referring to recent case law of the Court of Justice of the EU (Airbnb Ireland, Cases C-662/22 and C-667/22; Google Ireland, Case C-376/22), the court held that abstract-general obligations are not compatible with Article 3(4) of the e-Commerce Directive, which permits derogations from the country-of-origin principle only on a case-by-case basis.

What’s next?

The decision raises questions as to how the revised JMStV can be enforced against providers established in other EU Member States. It remains to be seen how German media authorities will apply the JMStV in cross-border cases and whether higher courts will further clarify the relationship between the JMStV and the country-of-origin principle under EU law.

Back to Top

UK

10. The UK Cyber Security and Resilience Bill: Scope, Key Changes and Next Steps

The first draft of the Cyber Security and Resilience Bill (the “Bill”) has landed! First introduced to UK Parliament on November 12, 2025, the Bill aims to strengthen cyber defenses for essential public services like healthcare, transport, and energy. It arrives with a policy paper outlining its objectives.

Building on the UK Network and Information Systems Regulations 2018 (UK NIS), the Bill expands the scope of regulated entities, tightens incident reporting requirements, and increases enforcement powers and penalties. While UK NIS broadly mirrored the EU’s NIS1 regime, the Bill aligns more closely (although not entirely) with the EU Network and Information Systems Directive (EU) 2022/2555 (EU NIS2).

What’s new?

• More regulated entities: Similarly to EU NIS2, the Bill expands the scope of the regime by adding new categories of regulated entities (though the categories themselves are not an exact match between the Bill and EU NIS2):
• Relevant managed service providers (RMSP), e.g., medium and large third-party IT providers, IT help desk support, and cyber security services.
• Data center operators will be classed as operators of essential services (OES), if they are at or above 1MW capacity, unless they are enterprise data centers, in which case the threshold is at or above 10MW capacity.
• “Large load controllers” in energy will be classed as OES, i.e., those entities controlling ≥300MW of electrical load, such as remote smart grid controllers.
• Extension across the supply chain: Going beyond EU NIS2, the Bill empowers relevant regulators to designate certain suppliers as “critical” where regulated entities materially depend on them. Once designated, those suppliers are brought within the Bill’s oversight as if they were an OES, relevant digital service provider (RDSP), or RMSP. EU NIS2 does not directly grant regulators such a power, or extend its scope to the supply chain of its regulated entities.
• Incident reporting and notifications:
• Broader incident definition. Like the EU NIS2 definition, the Bill expands the interpretation of “incident” to include any event having, or capable of having, an adverse effect on the operation or security of network and information systems.
• Faster reporting timelines. While the Bill aligns with EU NIS2 in requiring a 24-hour initial notification and a 72-hour follow-up, it does not require a subsequent final report within one month.
• Mandatory incident reporting. Regulated entities must notify the UK National Cyber Security Center at the same time as their sector regulator.
• Customer notification duty. Regulated entities must inform affected customers “as soon as reasonably practicable” after notifying the regulator where an incident could adversely affect the customer. This differs from EU NIS2, where customer notification must be without undue delay in applicable circumstances, or where the competent authority requires it.
• Penalties: There is now a GDPR-style upper limit on the fines that can be imposed under the Bill, which will be determined by reference to global turnover: the greater of £10 million (previously £8.5 million), or 2% of global turnover for standard breaches, and the greater of £17 million or 4% of global turnover for serious breaches, alongside daily fines of up to £100,000 for continuing non-compliance. This is a major increase for larger entities who may generate significant turnover.
• Enforcement: The Bill strengthens the powers and resources of sector regulators and the Information Commissioner’s Office (ICO). Regulators can now recover the costs of their regulatory functions through charging schemes and periodic fees.
• Increased powers of the Secretaries of State: The Bill confers broad powers to the Secretaries of State (SoS) to maintain and enhance cyber resilience on an ongoing basis. This means the SoS can amend and enhance the regime through secondary legislation.

Unlike EU NIS2, the Bill does not introduce personal liability for board or management members or mandatory cyber security training.

What’s next?

The Bill is progressing through Parliament and is expected to come into force in phases from the first half of 2026. Certain provisions will take effect on Royal Assent, with some regulatory powers commencing one month later. The remaining measures will be brought into force through secondary legislation, and of course, the SoS will have the power to extend the regulations as they see fit.

However, the Bill is subject to further consultations with stakeholders. The ICO’s response indicates broad support for the Bill, while flagging areas likely to be refined during parliamentary scrutiny. Notably, the definition of “significant impact,” assessment criteria for critical suppliers and the scope of enhanced information-gathering powers.

Back to Top

11. The UK Online Safety Act: Showing its teeth

Since our last update, the UK’s regulator for the Online Safety Act (OSA), Ofcom, has shifted its emphasis away from establishing and clarifying the OSA’s regulatory architecture, towards active supervision and enforcement. Ofcom has not abandoned its prior objectives (in Q4 2025 alone, Ofcom published three sets of guidance in fairly short order), but its commencement of early enforcement action and implementation of the OSA’s fees and penalties framework via the Qualifying Worldwide Revenue (QWR) threshold indicates that the focus is now on showing the OSA’s teeth.

What has Ofcom been doing? 

Ofcom has taken a number of steps that collectively demonstrate its intention to move rapidly from guidance into supervision and enforcement, including the following:

• Enforcement. Ofcom’s early enforcement actions in Q4 2025, summarized below, have focused primarily on age-assurance failures, particularly in relation to adult content services and online forums. There have also been additional penalties levied for failing to engage with Ofcom and provide information. The early enforcement actions include the following:
• Investigations into 20 more pornography sites and the issuance of fines for non-compliance, such as failure to implement effective age-checking on adult content services.
• A £1 million fine for an operator of multiple adult websites for failing to install robust age checks, and an additional £50,000 for ignoring information requests from Ofcom in December 2025.
• A £50,000 fine on an adult content provider for failing to use highly effective age assurance to protect children from encountering pornographic content, alongside an additional £5,000 penalty for non-compliance with a statutory information request.
• New administrative fees. In October 2025, Ofcom introduced the Online Safety Act 2023 (Qualifying Worldwide Revenue) Regulations 2025, which determines liability for regulatory fees and places caps on financial penalties for larger platforms. The OSA imposes fees on providers who have QWR above a certain threshold of certain in-scope services to cover Ofcom’s operating costs, with the regulations setting out relevant calculations and potential financial penalties. In November 2025, Ofcom published final guidance on QWR and notification requirements, consolidating its approach for providers to calculate their QWR, and the regime then came into force on December 11, 2025.

This is not to say that Ofcom has entirely stopped supporting in-scope companies. It is clear that the regulator wants to encourage compliance and is still seeking to make it as easy as possible for companies to engage with and adhere to their obligations, as demonstrated by the following:

• New guidance
• Gaming services. In October 2025, Ofcom released guidance explaining: (1) how the OSA applies to online gaming services; (2) the main safety risks arising from user interaction (such as chatting and content sharing); and (3) the key compliance steps gaming providers must take, including risk assessments, protections for children, and record-keeping.
• Women & girls. In late November 2025, Ofcom published guidance focused on online safety for women and girls, which sets out enhanced expectations for platforms in addressing online harms that disproportionately affect women and girls (such as intimate image abuse, misogynistic harassment, cyberflashing, and coercive behavior). Ofcom suggests that in-scope organizations can help mitigate these risks by embedding stronger governance, risk assessments, safety-by-design measures, safer default settings, and better user controls into their services. Although this has prompted many platforms to review how they address gender-based harms, Ofcom indicated that levels of positive action vary significantly across different sectors.
• File-sharing. In November 2025, Ofcom also issued guidance related to file-sharing and file-storage services, focusing on the heightened risk of illegal content and outlining the legal duties on providers to assess risks, implement appropriate detection and removal measures, and comply with reporting and record-keeping obligations.

Are there any imminent deadlines for in-scope companies?

• Risk assessments. In-scope companies must: (1) submit their second risk assessment records on request between May 1 and July 31, 2026, with a description of how potential risks have been evaluated and consequently whether there have been any material changes in their services; and (2) provide full summaries of risk assessments by October 2026, identifying the individuals responsible for online safety risk governance.
• Fee regime. Following the introduction of the QWR regulations, larger platforms have focused on assessing their exposure and ensuring internal reporting structures can support ongoing engagement with Ofcom. This is of increasing importance since December 11, 2025, when the OSA fees regime became active, requiring providers to calculate and notify Ofcom of their QWR for the initial 2026/27 charging year (if their revenue exceeds the threshold set by the Secretaries of State) by April 11, 2026 (within the four-month notification window).

What’s next?

Ofcom has signaled that the work to implement and enforce the OSA will continue in 2026, with further provisions becoming live, and guidance, regulatory tools and supervisory activity planned, as follows:

• New duties. As of January 2026, cyberflashing has become a priority under the OSA and platforms will be required to detect and block unsolicited sexual images. This designation means that relevant service providers must: (1) assess the likelihood of users encountering unsolicited sexual images on their platform; and (2) implement preventative and proportionate measures to mitigate any risks; guided by Ofcom’s Codes of Practice.
• New procedures. The Ofcom super-complaints regime is expected to come into force early this year, granting eligible entities the right to raise systemic issues relating to online safety. Ofcom expects to publish the final guidance for this regime in February 2026.
• More clarification. As part of Phase 3 of the OSA, which is expected to be rolled out in summer 2026, Ofcom will be introducing additional requirements for the largest service providers (including enhanced duties beyond the baseline illegal-content and children’s safety duties that apply to all regulated services, depending upon categorization). A final version of the Register of Categorized Services (which will confirm the placement of providers’ categories) is due to be released in July 2026.
• More publications. Ofcom has committed to maintaining transparency around investigations and enforcement by publishing and regularly commenting on industry compliance, this includes publishing: (1) data and analysis on children’s online experiences by May 2026; and (2) a report on the deployment and effectiveness of age assurances by July 2026. 

Back to Top

12. UK Government Calls for Evidence on Automated Vehicles

The Department for Transport and Centre for Connected and Autonomous Vehicles has published a call for evidence (“Consultation”) on developing the regulatory framework for automated vehicles (AVs).

The Consultation is likely to be particularly relevant for organizations in the automotive, insurance, technology, manufacturing, or logistics sectors. In particular, liability for AVs is expected to shift from human drivers to authorized organizations and vehicle keepers, which will undoubtedly have an existential impact on the accountability chain.

What is the background?

The Automated Vehicles Act 2024 (the “Act”) established the foundation for the authorization, deployment, and use of AVs on roads, including the safety and transparency measures required for usage on public roads. However, the Act itself largely relies on implementation by secondary legislation and governmental guidance. The Consultation forms part of the transition from high-level legislation to practical implementation, with its purpose being to inform the secondary legislation, regulatory guidance, and oversight mechanisms that will govern AVs.

The Consultation seeks the input of those within the AV industry (including equipment manufacturers and technology providers), experts (including road safety experts and academics), and users.

What does the Consultation cover?

The Consultation is split into two main chapters:

Chapter 1: “Getting AVs on the Road”

• Type approval: AVs must be approved under the Type Approval Regime, which assesses whether a vehicle has met certain technical, performance, environmental and safety standards, in accordance with UN international automated driving regulations. The questions presented to stakeholders seek to assess whether the existing EU approval frameworks for non-AVs remain fit for purpose or require amending to accommodate AVs.
• Authorization requirements: AVs will need to be authorized to check that they can operate safely and legally without a driver, therefore passing the self-driving test created by the Act. Each AV must have an Authorized Self-Driving Entity responsible for safety and regulatory compliance throughout the vehicle’s operational life. Self-driving features will be classified as either User-in-Charge or No-User-in-Charge, with the latter requiring a licensed operator to oversee and assess journeys where no human safety driver is present. Accordingly, the questions in the Consultation invite views on whether further authorization requirements are necessary, how the suitability and adequacy of Authorized Self-Driving Entities should be assessed, whether Users-in-Charge should be subject to training requirements and what obligations should apply to No-User-in-Charge vehicles and their licensors.
• Insurance and data access: The Act requires motor insurers to cover both conventional and automated driving, and as such, the Consultation poses questions around access to data stored in the vehicle’s Automated Driving System (ADS) to assist motor insurers in adjusting their policies, premiums, and claims.

Chapter 2: “Once AVs are on the Road”                                                

• In-use regulatory scheme: The Consultation requests input on how the Act’s enforcement and sanctioning powers should operate, including when to apply regulatory versus civil sanctions, whether to vary or suspend authorizations, and how to set monetary penalties.
• Incident investigation: The Consultation covers what factors should be considered during the investigation and determination of AV-related traffic infractions.

• Cyber security: The government will develop a set of requirements to align with UN Regulations 155 and 156 (which focus on the risks from connectivity and remote operations and how vehicles can be protected against cyber-attacks). Given that these UN Regulations were originally created for conventional vehicles, the Consultation is seeking input on whether there are any bespoke risks associated with AVs (that are not addressed by the Regulations), and how suppliers, operators, and licensors can report, detect, and respond to these effectively.

What’s next?

The Consultation is open until March 5, 2026, after which the government is expected to publish a summary of responses in July 2026 (i.e., within 12 weeks of the end of the consultation period).

Additional formal consultations are expected once more detailed proposals are developed, contributing to full implementation of the Act in 2027, with the enactment of secondary legislation due by the second half of 2027.

Back to Top

We are grateful to the following member(s) of MoFo’s European Digital Regulatory Compliance team for their contributions: Diya Gupta and Elena Pourghadiri, London office trainee solicitors; Darius Schulz, Felicitas Lampe and Mireille Thierfelder, Berlin office research assistants.