← Back to blog

The UK's Product Rules Are Being Rewritten - Here's What Is Actually Law So Far

Mark Ripley

Mark Ripley

06/09/2026

#UKRegulation#ProductSafety#Compliance#ProductData#OPSS#SupplyChain#VendorSauce
The UK's Product Rules Are Being Rewritten - Here's What Is Actually Law So Far

From the supplier and manufacturer perspective

If you sell products into the UK, you have probably had the email by now.

New legislation. Sweeping new duties. Digital labelling is coming. Act before the deadline.

Some of it is accurate. A lot of it is not, or at least not yet. And the gap between those two things matters, because deciding what to do about a regulatory change is much harder when you cannot tell which parts are law, which parts are proposals, and which parts are somebody's marketing.

So here is a plain reading of where UK product regulation actually stands as of September 2026, what is genuinely binding, what is still only proposed, and what a supplier can sensibly do about it now.

What is actually law: the Product Regulation and Metrology Act 2025

The Product Regulation and Metrology Act 2025 received Royal Assent on 21 July 2025. It is real, it is in force, and it is on the statute book.

But it is important to understand what kind of law it is.

The Act is a framework - an enabling statute. Its long title is "An Act to make provision about the marketing or use of products in the United Kingdom; about units of measurement and the quantities in which goods are marketed in the United Kingdom; and for connected purposes."

What it does is confer broad powers on the Secretary of State to make regulations. It gives government the ability to set product requirements, to regulate online marketplaces, to designate and equip enforcement authorities, and to make provision similar to relevant EU law. The Act itself does not impose a new set of day-to-day obligations on manufacturers, importers or distributors.

The Act creates the power to make the rules. It is not, by itself, the rules.

That distinction is the single most misunderstood thing about it. Almost everything that will eventually affect how you document, label and supply a product will arrive later, as secondary legislation made under these powers.

It is worth being precise about the two kinds of law here, because the difference is doing a lot of work in this article.

Primary legislation is an Act of Parliament. It is debated and passed by both Houses and receives Royal Assent. The Product Regulation and Metrology Act 2025 is primary legislation, and it is in force.

Secondary legislation - usually a statutory instrument, or SI - is made by a minister using powers that an Act has granted them, without going through that full parliamentary process. The detailed rules on labelling, traceability, marketplace duties and enforcement would arrive as SIs made under this Act.

No such statutory instruments have been made yet. That is the whole point. The Act is the empty container. The SIs are the contents, and they have not been poured in.

Worth noting too: the Act's schedule explicitly excludes several categories from its product regulation powers, including food, agricultural products, medicines, medical devices, aircraft and military equipment.

What is proposed: the two 2026 consultations

On 31 March 2026, the Department for Business and Trade and the Office for Product Safety and Standards published two parallel consultations setting out how those powers might be used. Both closed at 23:59 on 23 June 2026. A separate consultation on domestic upholstered furniture ran alongside them.

The first proposes a new core product safety framework to replace the General Product Safety Regulations 2005 - the most significant rewrite of the UK's general product safety regime in two decades.

The second proposes a new market surveillance and enforcement framework: who enforces, with what powers, and with what sanctions.

Government has committed to publishing a single response covering both consultations within twelve weeks of closure. At the time of writing that response has not yet been published, so the timetable for any resulting secondary legislation is not yet known.

Nothing in either consultation is currently binding on anyone. They are proposals. They may change materially between consultation and statutory instrument, and some proposals may not survive at all.

With that stated clearly, here is what they propose - because the direction of travel is genuinely informative even while the detail is unsettled.

The proposals that would land on product data

Read both documents from a product data perspective and a consistent theme emerges. The proposed framework does not just ask whether your product is safe. It asks whether you can produce, on demand and in a usable form, the information that demonstrates it.

Digital by default. Producer contact details, safety information and warnings could be provided digitally rather than physically - via a QR code, for instance. But with conditions: digitally provided information would need to remain accessible for the product's expected lifetime, and producers would have to supply a physical copy free of charge on request. Product identifiers would still need to be physical, on the product or its packaging.

Online listings carry the information. Where products are sold online, the proposals would require listings to display seller and producer name and contact details, product identifiers and images, any warnings and safety information the regulations require, and compliance and standards markings. Online marketplaces would have to design their interfaces so sellers can actually provide that information.

Traceability and records. Supply chain actors would keep documentation enabling a product's origin to be traced, retain information on sales and sellers, and maintain complaint registers and records of corrective action. Producers and marketplaces would nominate a single point of contact for safety communications with authorities.

Duties pushed down the chain. Onward suppliers - distributors, in current language - would be expected to act with due care: to understand the main hazards of what they supply, to check for safety alerts and recalls, and to require safety information from their suppliers. Overseas distance sellers would be treated as producers. Fulfilment service providers would be brought into scope.

Enforcement with teeth that are not criminal. The enforcement consultation proposes moving away from reliance on criminal prosecution towards civil sanctions: enforcement undertakings, civil monetary penalties on fixed, variable and escalating models, public admission of fault and compensation. It also proposes powers for authorities to require businesses to provide information and documents.

The definition of safe would broaden. The proposals retain the existing definition but add considerations including cybersecurity risk, AI and machine learning functionality, and gender-based health impacts.

What is not true, and please do not let anyone tell you otherwise

To be explicit, because this is where a lot of the current noise is coming from:

  • None of the proposals above is a statutory duty. Not one.
  • The General Product Safety Regulations 2005 remain the applicable general regime today.
  • There is no compliance deadline attached to the consultations, because there is nothing yet to comply with.
  • Digital labelling is not mandatory. It is a proposed permission, not a proposed obligation.
  • Sector-specific regimes are untouched by all of this. If you supply PPE, the existing PPE regulations, the harmonised standards and the UKCA and CE marking rules apply exactly as they did last year.

Anyone selling you software on the basis that the Act obliges you to buy it is misreading the Act.

Where the real pressure comes from, and why it arrives first

Here is the part that matters commercially, and it has very little to do with commencement dates.

Your customers have read the same consultations you have.

A distributor or marketplace looking at proposed due care obligations - understanding hazards, checking recalls, requiring safety information from suppliers, verifying seller details - does not wait for a statutory instrument before protecting itself. It writes the requirement into the supplier onboarding pack. It adds mandatory fields to the data template. It starts asking for the certificate, the expiry date and the responsible person, and it declines to list the product until it has them.

That is exactly what happened with the EU's general product safety rules. The contractual requirements landed on suppliers well ahead of any enforcement activity, and they landed as data requests.

The regulatory change may be years away. The data request is a purchase order condition, and it can arrive next quarter.

What is worth doing now regardless

The useful thing about the direction of travel is that preparing for it costs nothing if the proposals change, because the same capability makes you easier to buy from today.

  • Hold product information as structured attributes, not as prose. A cut level, a battery chemistry, a standard reference and a test result should each be a field. If they only exist inside a paragraph of description or a PDF, you cannot filter them, validate them, or send them anywhere in a format a customer can ingest.
  • Give every product a durable identifier and keep it stable. Traceability proposals assume you can say which product, from which batch, went where. That starts with not quietly changing your own codes.
  • Link certificates and declarations to products, with expiry dates. A certificate sitting in a shared drive is not linked to anything. A certificate attached to a product record, with a date that can be reported against, is the thing you will be asked for.
  • Keep version history. Being able to say what you published, and when, is the difference between answering a query and reconstructing one.
  • Be able to reissue to every channel at once. If the answer changes, every customer holding the old answer needs the new one. Doing that by email, one customer at a time, is where the risk actually sits.

None of that is a regulatory response. It is just what good product data looks like. The regulatory direction of travel simply raises the cost of not having it.

The honest summary

The Product Regulation and Metrology Act 2025 is law, and it is a framework that grants powers rather than a rulebook that imposes duties. Two substantial consultations proposing how those powers would be used closed in June 2026, and a government response is expected shortly. Until secondary legislation appears, consults on transition, and commences, the proposals are proposals.

But the shape of what is coming is clear enough to act on. It is a regime that assumes product information is structured, current, traceable and available on request - and your customers will start asking for it on that basis before anyone from an enforcement authority does.

If you would like to talk about what your product data would need to look like to answer those questions without a scramble, we are happy to have that conversation.

This article is a summary for general information and is not legal advice. If you need to know how these developments apply to your specific products, take proper advice.

Sources