Cyber incidents, including ransomware attacks, data breaches, and IT outages, remain the top risk for businesses globally, and the UK is no exception. With its digital economy contributing over £150 billion annually, the UK is particularly vulnerable to these threats. ¹

The 2024 Cyber Security Breaches Survey, conducted by the Department for Science, Innovation & Technology, reveals that 50% of UK businesses have faced some type of cyber security breach or attack. The incidence is notably higher among medium-sized and large businesses. 

Phishing is the most prevalent type of breach, affecting 84% of businesses. Other common issues include impersonation in emails or online (35%), followed by viruses or other malware (17%). ²

In 2025, businesses are set to experience significant changes as new UK and EU regulations redefine compliance standards. ⁶  

A large proportion of the new regulations in the EU revolve around sustainability, creating new burdens for the companies. Among them is the Corporate Sustainability Reporting Directive (CSRD), which strengthens the rules concerning the social and environmental information that companies have to report. ⁷

For the UK businesses that fall outside of the scope of the CSRD, it’s crucial to understand its broader impact. The CSRD serves as a leading model for global sustainability efforts and may lead to further regulations. With increasing emphasis on ESG, the UK government stresses the need for a robust ESG strategy. Meanwhile, the Financial Conduct Authority (FCA) has launched the UK Sustainable Disclosure Regulation (SDR) to provide investors with clearer sustainability information. As sustainability regulations are likely to grow, early adaptation will better equip companies for future requirements. ⁹ 

The CS3D obligations, on the other side, apply equally to both EU and non-EU companies if they fall within its scope. The CS3D applies to companies, broadly defined as those meeting specific quantitative thresholds for turnover, employee numbers, and royalties over at least two consecutive financial years. ¹⁰ 

AI regulation and cybersecurity are combined areas of focus for the UK, as both sectors experience significant legislative developments. While risk-based approaches to AI regulation remain prevalent, new laws are emerging to help users and consumers identify AI-generated content and its origins. ¹¹ 

The introduction of Cyber Security and Resilience Bill, to the UK Parliament in 2025, aims to bolster cyber defences by broadening regulatory frameworks to safeguard supply chains following the rising large-scale incidents. 

The effects of the Autumn Budget on businesses and the UK economy are yet to be determined, but the rise in NICs and regulations on smoking products and soft drinks might significantly strain businesses and hinder growth in crucial sectors like retail and hospitality. Companies will need to strategically manage these changes while balancing growth and compliance expenses.

The global picture
Changes in legislation and regulation is 4th global risk in the Allianz Risk Barometer (25% of responses).

Read more from the UK 
Read our legal advice article about protecting businesses in a time of uncertainty.