https://www.noxia.co.uk/field-notes/eleven-duties-one-grid · printed from noxia.co.uk · sources checked 23 September 2026
Field note · What we found
Eleven new duties in fifteen months. Which reach you?
Every one of these has been covered properly somewhere, usually by a trade body writing for the firms most affected. What nobody publishes is the grid — which of them reaches a four-person letting agency, and which are somebody else’s problem entirely.
The short answer
Eleven duties land between February 2026 and 2030. Only three reach almost every firm: automated decision-making safeguards, already in force since 5 February 2026; the Employment Rights Act changes, two live and the unfair dismissal threshold falling on 1 January 2027; and Companies House verification, ending mid-November 2026. The rest are scoped by sector, size or activity, and most firms are out of scope for most of them.
On this page · 5 sections
The reason this grid is worth drawing is that compliance anxiety is badly calibrated. A small firm reads about eleven changes, assumes some apply, cannot tell which, and does nothing — which is the worst available response and the commonest.
The three that reach almost everyone
Automated decisions. Articles 22A to 22D of the UK GDPR replaced Article 22 on 5 February 2026. If any software you run makes a significant decision about a person — who gets a callback, whose application progresses, what somebody is offered — the safeguards apply, and most firms have not looked.
Employment. Two measures landed on 6 April 2026 and the qualifying period for unfair dismissal falls to six months on 1 January 2027. That one collides with the probation review, which is where it becomes a documentation problem.
Verification. Every UK director. The transition ends mid-November 2026 and it is an offence to act as a director without being verified once the duty applies.
What the grid is for
Not for planning. For stopping. An empty cell is permission to close a tab, and most of this grid is empty cells for most readers — which is the honest and reassuring finding underneath a year of alarming headlines.
The two rows that reward a careful look are the ones that arrive indirectly. The Cyber Bill reaches most firms through a supplier's revised contract rather than through law. The Accessibility Act reaches a UK firm through its EU customers rather than its own address. Both are duties you acquire without a regulator ever writing to you.
What this does not tell you
It is a map, not advice, and the columns are crude — "any firm" contains a sole trader and a two-hundred-person business, and several rows treat them differently. Each row is a simplification of a note that is itself a simplification of a statute.
Coverage is deliberately partial too: the grid holds only changes we have read the primary source for. Sector-specific duties, anything devolved, and anything we could not source are absent rather than judged irrelevant.
Each row has its own note with the source attached. The three universal ones are automated decisions, employment and verification. The indirect pair are the cyber clock and the accessibility reach. If you would rather have the arithmetic than the map, the triage tool and the adoption calculator both answer "do nothing" more often than not.
Questions people actually ask
Which new UK duties reach almost every firm?
Three. The automated decision-making safeguards in Articles 22A to 22D of the UK GDPR, in force since 5 February 2026; the Employment Rights Act changes, two live since 6 April 2026 with the unfair dismissal qualifying period falling to six months on 1 January 2027; and Companies House identity verification, whose transition ends mid-November 2026.
Do small firms need to worry about all the 2026 regulatory changes?
Most of them, no. The majority are scoped by sector, size or activity, and for most small firms most of the grid is empty. The value of mapping them is knowing which tabs to close rather than which projects to start.
Which duties arrive without a regulator contacting you?
Two in particular. The Cyber Security and Resilience Bill reaches most small firms through a supplier’s revised contract schedule rather than through law, and the European Accessibility Act reaches a UK firm through its EU customers rather than its own address.
Is this grid a substitute for advice?
No. The columns are deliberately crude — "any firm" spans a sole trader and a two-hundred-person business, and several rows treat them differently. Each row simplifies a note that itself simplifies a statute, and the grid covers only changes whose primary source we have read.
Sources
- Each row is sourced in its own note on this site, and every one of those carries the primary document: Data (Use and Access) Act 2025 s.80 and SI 2026/82; Acas on the Employment Rights Act 2025; Companies House management information and press releases; FCA PS25/22 on targeted support; FCA good and poor practice on Consumer Duty board reports; HMRC guidance on Making Tax Digital; Pensions Dashboards Programme; European Commission and Bird & Bird on Directive 2019/882; GOV.UK factsheets on the Cyber Security and Resilience Bill; GOV.UK guide to the Renters’ Rights Act; GOV.UK consultation on privately rented home energy performance; ProtectUK on the Terrorism (Protection of Premises) Act 2025. noxia.co.uk ↗ — primary throughout, by way of the individual notes. The grid itself is our arrangement and carries no source of its own re-checked every 6 months
- The grid is incomplete by design: it covers only changes whose primary source we have read. Sector-specific duties, devolved variations and anything we could not source are absent rather than judged irrelevant. — a stated limit on the coverage above
- The column headings, the shading, and the claim that three rows reach nearly everybody are ours. — our own argument, labelled as such. Not legal advice
Checked 23 September 2026. Next scheduled check 22 March 2027. Numbers that move — leaderboards, live indices — are re-checked every 30 days; annual datasets and rules in force every six months; dated research once a year. If something here has gone stale before we got to it, tell us and we will correct it and say what changed.
Cite this note
Noxia, “Eleven new duties in fifteen months. Which reach you?”, Field notes, 23 September 2026; sources checked 23 September 2026. https://www.noxia.co.uk/field-notes/eleven-duties-one-grid
Most of this grid is empty for you. That is the useful part.
Tell us what you do and how many people you employ and we will fill in your column — which of the eleven reaches you, which arrives by contract rather than by law, and which you can stop reading about. It is a short conversation and it usually ends with fewer things to do.
Talk to us about thisRead next
Employment
Two employment changes already landed. The big one is January 2027.
Sick pay from the first day of illness and day-one paternity leave started on 6 April 2026. The unfair dismissal qualifying period falls to six months on 1 January 2027.
Supplier checks
In November, a name on the register starts meaning something.
At 30 June 2026, 55.33% of director appointments were verified, up from 7.79% at the end of December. The transition ends in mid-November and the register starts carrying a different kind of claim.
Advice & compliance
What your agent is allowed to decide on its own, since February.
Article 22 of the UK GDPR was replaced on 5 February 2026 by Articles 22A to 22D. The rule on automated decisions flipped from prohibition-with-exceptions to permission-with-safeguards.