Supplying to UK companies? Here's what UK SRS, SECR, and the Modern Slavery Act mean for your business.

The UK's endorsed versions of IFRS S1 and S2, published by the UK Endorsement Board on February 25, 2026. UK SRS supersedes TCFD (formally disbanded October 2023). The FCA is consulting on mandatory adoption for listed companies from January 1, 2027. Large UK companies will be required to disclose climate-related risks, opportunities, and Scope 1, 2, and 3 emissions — driving supply chain data requests.

SECR requires large UK companies to report their energy use and carbon emissions in their annual reports. Companies must disclose Scope 1 and 2 emissions and an intensity ratio. Many companies also request Scope 3 data from their supply chains.

UK companies with an annual turnover of £36 million or more must publish an annual Modern Slavery Act statement. Suppliers may be asked to complete due diligence questionnaires on their labour practices, supply chain transparency, and anti-slavery policies.

TCFD was mandatory for UK-listed companies and large private companies from April 2022. The TCFD was formally disbanded in October 2023, with its climate disclosure framework being superseded by the UK Sustainability Reporting Standards (UK SRS S2). Existing TCFD-aligned disclosures remain valid during the transition period.

Under UK GDPR Article 33, organisations must notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a personal data breach that is likely to result in risk to individuals. If the breach is likely to result in high risk to individuals, affected persons must also be notified without undue delay. The ICO can impose fines of up to £17.5 million or 4% of global annual turnover for serious breaches. Report at: report.ico.org.uk

The UK NIS Regulations require operators of essential services (energy, transport, water, health, digital infrastructure) and relevant digital service providers to implement appropriate security measures and notify their competent authority of significant incidents without undue delay. The UK Cyber and Resilience Bill (announced 2025) will expand NIS scope and introduce new supply chain security requirements. Suppliers to essential services operators should prepare for increased cybersecurity due diligence requests.