What can we expect from 2025?

Freeths contributors to Commercial Education Brief provide their assessments of what you should be watching out for in 2025.

While there continues to be much controversy around early decisions taken by the new government, considerable work is being undertaken to implement commitments given in the Labour party manifesto which require legislation. And of course, the new government must take ownership of some important initiatives developed by the previous government – notably, through the Procurement Act, the Online Safety Act and the Digital Markets Competition and Consumers Act.

There is much that businesses operating in the education and skills sector will want to be aware of as we move into a new year.

The Procurement Act 2023 will finally come into effect

This legislation replaces existing pre-Brexit rules to be followed by public bodies when entering into significant procurement commitments. Implementation was originally planned by the last government for October 2024. Procurements across the public sector are however, expected to take effect under the new legislation taking account of a National Procurement Policy Statement. This requirement has created a spanner in the works – the new government looks to see different priorities and launched a fresh consultation in October. We await the outcome and the detail of a new policy statement. 

February 24th is now the target date for the new procurement regime to come into effect, but it’s a case of watch this space. We are tracking developments and will report on progress as we are able to!

There are multiple developments to watch out for under the Digital Markets, Competition and Consumer Act 2024.

In the final race for legislative bills to reach the statute book as the snap July election was called this Act was a winner. There are developments on three fronts namely:

• Ensuring major digital platforms operated by the likes of Apple, Microsoft and Google act fairly and operate key parts of their businesses in a pro-competition manner. Should your business ambitions be hampered by the way these major corporates look to do business with you this legislation could be important to you
• A much needed reshaping of the business practice rules that ensures consumers receive a fair deal which will, in particular, affect businesses that operate over the internet dealing with consumers.  Unfair pricing practices, fake reviews and apparent but false incentives to act quickly on deals offered are just some examples of practices outlawed. The Advertising Code of Practice is also being updated to reflect this legislation
• A legally enforceable regime associated with goods and services sold to consumers on a subscription basis. While not slated for implementation until 2026, this reflects some considerable preparatory action that many businesses will need to initiate to ensure compliance when the day comes. New rules will, amongst other things, require pre-contract information and a regime to remind the subscriber about renewal and terms and conditions for renewal.

Parliament faces up once again to a data and data protection reform bill

In the latter stages of 2024, we saw the UK government outline its proposed reforms to UK Data Protection Law in the form of the Data (Use and Access) Bill (DUA Bill). 

The DUA Bill seeks to build upon the Data Protection and Digital Information Bill (DPDI Bill) introduced by the former government in March 2023, with an overarching strategy of enhancing the UK’s economy by utilising the power of data.

Key areas of reform highlighted by the DUA Bill (and as initially indicated in the King’s Speech 2024) include:

• Automated decision-making: The DUA Bill aims to transform the framework for automated decision-making (ADM), allowing ADM to take place in scenarios which can be considered low risk and provided that special category data is not being processed
• Digital verification: The DUA Bill proposes a new framework for the appointment of trusted providers of digital identity verification services. This includes development of a trust mark which can be used by providers to demonstrate certification against the framework. Users of an online service will be able to make more informed decisions as to which providers they wish to share their personal information with
• International transfers: The DUA Bill will introduce a new ‘data protection test’ to legally transfer personal data internationally, abandoning the more onerous EU approach. For international transfers to take place, the standards in the destination jurisdiction must not be “materially lower” than those in the UK.

The DUA Bill has already undergone first and second readings in the House of Lords, as well as a Committee Stage review. The Report Stage is expected to commence on 21 January 2025, and we expect that the remainder of its progress through UK Parliament will be completed shortly thereafter.

Regulation of AI is a current topic globally – what can we expect in the UK in 2025?

The government’s position on AI regulation in the UK remains opaque at the start of the year. But we are anticipating there will be increasing pressure on the UK to “pick a lane” between the approaches of the EU or the US. The former would involve intensifying regulatory efforts to align with our geographically closest market, where the EU AI Act is set to come into force incrementally across the year, imposing significant new burdens and risks on those looking to develop or sell AI products into the EU. The EU is certainly anticipating that there will be a similar “Brussels effect” to that which was seen after GDPR came into force, where the regulation was rapidly adopted as the gold standard in various other territories around the world.

But the position here is different, not least following the presidential elections in the US at the end of 2024. In the US, we expect to see an increasingly liberalised regulatory landscape as, with the exception of some states which have grasped the nettle already on AI regulation, the incoming President seeks to stimulate the homegrown AI market by de-regulating (perhaps even rolling back some of the Biden initiatives which were largely implemented by way of executive order) while imposing tariffs and other obstacles on products emanating from competitor markets such as China and the EU.

We can already see that some of the most prominent AI models developed in the US (with scant regard for the EU’s existing regulatory framework around privacy and automated decision-making) have proven to be very difficult for EU regulators to police or curtail the use of. This in turn has produced considerable pressure on the UK government not to stifle its own home-grown innovation by over-regulating, particularly where the success of the digital economy is so central to the government’s plans for growth. The effects of this can be seen in the recent launch of the Labour government’s AI Opportunities Action Plan, where we can see increasing emphasis upon  facilitating growth with a lower emphasis given to safety considerations. The focus of the Action Plan is to “fuel fast, wide and safe development and adoption of AI”, and it seems fairly clear that any regulation will be in service of that growth-focused approach.

Where does this leave those developing or deploying AI? We continue to recommend that a best practice approach is adopted to the development and use of this technology which shows proper consideration for the impacts (both on privacy and on other fundamental rights, as well as wider societal and environmental impacts), and guards against the risk of misuse. Even if not a mandatory regulatory requirement, being able to demonstrate proper concern for such issues is likely to be important as customers, workforces and other stakeholders become more concerned about the risks of AI usage. If developing tools to be sold into the EU market, of course, a more stringent set of obligations will need to be adhered to, regardless of the domestic regulatory landscape.