The UK government has published a call for evidence on proposals which could have a significant impact on outsourcing. The proposals are designed to strengthen equal pay rights for workers on the basis of sex, gender and disability generally.  However, one of the suggestions is to introduce measures to prevent outsourcing from being used to avoid equal pay.

What is being considered?

Under the Equality Act 2010, women are entitled to the same pay as men who are doing the same work or work of equal value (and vice versa). However, the right currently only applies where the man and woman are employed by the same entity or entities under common control. The government is exploring whether it should allow outsourced workers to compare themselves with 'in-house' employees of the client for the purposes of establishing equal pay rights. This could mean that outsourced service providers and/or businesses that outsource services face equal pay claims from employees of the service provider.

On 12 May 2025, the UK Government published a White Paper setting out plans to reduce net immigration to the UK.  By making it more difficult for employers to recruit overseas workers on relatively low or minimum wage salaries, the Government hopes to drive up wages to a level where more UK citizens (particularly those not currently in work) would be attracted into the job market. 

The White Paper proposes to increase the amount of time that those already in the UK on work visas need to live here before they can apply for "settled status" from 5 years to 10 years.  This may mean that some individuals may choose to return home, in preference to seeking the right to remain in the country over the longer term.  It would also mean increased costs for employers to cover visa extension fees for employees for longer periods on temporary visas. That said, the Government has promised to consult on a faster "earned settlement" route, offering a shorter pathway to settled status based on contributions to the UK economy and society.  As regards adult social care, the White Paper states that there will be a transition period until 2028 where visa extensions will be permitted (as will changing from one visa category to another).

With a few exceptions, the exact timing of many of the proposals remains unclear.  Some of the measures - such as those relating to settlement in the UK - will require further consultation or changes to legislation.  As regards others, such as changes to the Skilled Worker visa route, the Government will need to ask the Migration Advisory Council to advise on the detail before it can act.  As a result, these may take longer to implement.  However, certain other rule changes could be made relatively quickly if the Government wished to do so.

For more detail on the proposals, see our briefing "Immigration White paper – proposed immigration changes".

The Terrorism (Protection of Premises) Act 2025 (which received Royal Assent on 3 April 2025) will require those in control of certain specified types of premises to take measures designed to protect individuals in the event of a terrorist public and to notify the Security Industry Authority.  Providers of outsourced services relating to property and/or events (e.g. facilities/event management, security etc) should consider whether their activities are caught by the legislation and if so:

• the extent to which they will be legally responsible;
• what needs to be done to comply; and
• who will pay the cost of additional compliance measures.

Which events are caught?

For an event to be caught, it must be expected to draw at least 800 attendees and be held at premises which are not subject to the enhanced duty (see below).  It must also be open to the public and there must be measures to check entry conditions are met e.g. ticket checks.

Are there any exclusions?

Yes – among other things, parks, gardens and recreation grounds are excluded, as are various transport facilities which are already subject to security regimes (e.g. certain airports, ports or railway stations).  For the full list of exclusions, see our detailed briefing.  As regards events, the exclusions are fairly limited, but events held at premises used primarily as places of worship and for primary, secondary or further education will normally be excluded (but there is no exclusion for events held in parks etc).

Who will be responsible?

The responsible person is the person who has control of the premises in relation to their specified use (see above).  In some instances, this may be the provider of outsourced property management services.  Even where that is not the case, an outsourced service provider is often likely to be regarded as having at least some degree of control over the premises – which means they will be required to cooperate with the responsible person, so far as reasonably practicable.  For more discussion of this point, see the detailed "Who is the responsible person?" section of our briefing on the Terrorism (Protection of Premises) Act 2025..

When will the legislation come into effect and what does compliance involve?

The Act is not expected to be brought fully into force for at least 24 months, to allow time for affected parties to work out how best to comply.  However, as noted above, the new obligations may have an impact on costs and some preparatory work is likely to be required, particularly for larger premises subject to the enhanced duty.  Statutory guidance is expected to be made available before implementation.

For more information on all the above (including links to helpful factsheets on the legislation), see our "Terrorism (Protection of Premises) Act 2025" briefing.

With most of the consumer law provisions of the Digital Markets, Competition and Consumers Act 2024 (DMCC Act) now in force, the risks for both customers and service providers involved in consumer-facing outsourcings – such as call centre operations – have increased dramatically.  Among other things, businesses found to have infringed consumer law face the prospect of substantial fines of up to 10% of annual turnover (for more detail, see section 2 of Outsourcing Spotlight Autumn/Winter 2024).

Who will be liable?

In an outsourcing context, one of the key questions is: who will be liable under the new regime?  In particular, will enforcement focus primarily on outsourcing customers with consumer-facing businesses – or will service providers be targeted as well?  Legally, it is certainly possible for enforcement action to be taken against service providers.  This because the concept of "trader" in the Act includes "a person acting in the name of, or on behalf of" the outsourcing customer, for purposes relating to that customer's consumer-facing business. 

But in practice, how likely is it that the UK Competition and Markets Authority (CMA) or other regulators would look to enforce against, say, the service provider for an outsourced call centre?  Our view is that for the most part, regulators will tend to focus their enforcement efforts on the outsourcing customer – but there are plausible scenarios where service providers could be in the firing line:

This example also serves to highlight the importance for outsourcing customers of ensuring that service providers take adequate steps to comply with the new legislation – and are alive to risks such as fake reviews which may arise from their own staff.  

In October 2024, a new duty was imposed on employers in the UK to prevent sexual harassment – including an obligation to take reasonable steps to protect employees from such harassment by third parties.

As we explain in our recent "Preventing sexual harassment: Are you doing enough?" briefing, it is important for both customers and service providers to be alive to the risks and take appropriate steps to mitigate them. These may include:

• communicating anti-harassment policies to third parties;
• including appropriate wording in contracts/codes of conduct;
• considering whether indemnities in relation to third party sexual harassment claims are appropriate; and
• putting processes in place so that victims of third party sexual harassment can report it (and are encouraged to do so). 

Service providers in particular may increasingly face questions from existing and potential customers about what they have done to comply – and they should also consider asking the same questions of their customers (particularly given that, in terms of the dynamics of the relationship, staff at the customer may see themselves as holding a degree of power over staff providing an outsourced service).

Long term outsourcings can be high risk.  If they don't work out, the customer may find itself locked into a deal which is poor value and doesn’t meet its needs, whilst the service provider may struggle to make the relationship profitable.  So it's worth looking at the lessons from a similar type of long term contract, namely PFI deals – where the Government-commissioned White Fraiser report provides some interesting food for thought for both customers and suppliers.

Lesson 1: maintaining goodwill and some degree of flexibility is key

The report recognises that complex, long term contracts often encounter issues that were not fully anticipated at the time of drafting – and that as a result, a degree of flexibility is generally needed to ensure that the relationship between the parties continues to work effectively over time.  This typically requires the maintenance of a reasonable level of goodwill – because over the life of the contract, both parties are likely to have occasions where one will need to ask the other to refrain from standing on their strict contractual rights.

As regards PFI, the report notes that where customers have suddenly switched to a more rigorous approach to contract management, sometimes with little explanation, such goodwill has often been lost.  This in turn has prompted suppliers to adopt a less flexible approach.

At the same time, the report warns suppliers against underestimating the degree to which customers become frustrated by issues such as "variations taking too long and not being addressed with any urgency" or long delays in addressing problems which are not subject any penalties or deductions for under-performance. It points out that such behaviour often exhausts the goodwill of customers, leading them to conclude that they have no choice but to resort to stricter enforcement of the contract.

Lesson 2: both sides need to put effort and resources into active contract management

A key recommendation of the report is that, in order to maintain goodwill, both parties need to invest in contract management.  In particular, it notes that whilst PFI contracts are self-reporting i.e. the supplier is obliged to provide various performance metrics to the customer (as is the case with many outsourcings), that does not mean that they are self-monitoring.  Insufficiently rigorous monitoring by customers has in some cases allowed problems to continue unaddressed, with customers only taking an active interest once matters have reached crisis point.  

In our experience, this type of scenario is not uncommon in an outsourcing context, because part of the customer’s rationale for the transaction is often to allow it to concentrate on other, core activities. Understandably, therefore, the customer does not want to have to spend significant amounts of time continuing to supervise the activity which has been outsourced.  However, as the report points out, the reality is that complex, long-term contracts typically require oversight by staff at the customer with some understanding of the issues facing the supplier – and that customers which divest themselves of all expertise in this area often come to regret it.  

Lesson 3: pick your battles carefully when it comes to strict compliance with the contract

A common complaint from customers was that some PFI suppliers were overly focussed on achieving strict compliance with the contract, at the expense of responding to the customer's operational priorities at the time.  An example would be a supplier insisting on its contractual right to access a particular area to carry out a repair at a time when the customer is undergoing a significant internal reorganisation.  Whilst the supplier may be legitimately concerned about failing to meet its contractual obligations, the customer may prefer to have the work delayed until that exercise is complete.  In many cases, the customer is unlikely to be able to impose penalties where the cause of the delay was its own failure to grant access – so the supplier's concern here may be misconceived.  However, it may be an understandable reaction if the customer has been engaging in overly strict enforcement of the contract.

Lesson 4:  Disputes: make sure you have a strategy

Although maintenance of goodwill is clearly important, the report recognises that there will be occasions where the terms of the contract need to be enforced – including by reference to dispute resolution mechanisms.  At the same time, it acknowledges that formal disputes are typically damaging to goodwill – and have often resulted in a situation where, after the dispute, “one or both parties…managed the [contract] in a strictly contractual (rather than relational manner), leading to a significant reduction in willingness of the relevant party to ‘go the extra mile’ or find solutions to unforeseen circumstances.”  

Lesson 5:  Think carefully about exit at the drafting stage and keep it under review

Most complex, long term outsourcing transactions require consideration to be given to what should happen on exit.  Whilst not specifically highlighted by the White Fraiser report, one problem that has arisen with PFI deals is that the contract typically only requires a survey of assets to be undertaken 18-24 months before they are due to be handed back to the customer.  In practice, this is generally too late to allow remedial action to be taken to rectify problems.  From the customer’s perspective, the exit provisions would ideally have provided for a survey around 5 years prior to expiry (as highlighted in Government guidance to public sector customers on PFI expiry).  This underlines the importance of thinking carefully about the practicalities around exit and keeping it under review (so that if deficiencies become apparent at a later stage, action can be taken to address them and the parties do not remain locked into an inadequate exit framework).

Whilst artificial intelligence has the potential to be a game-changer when it comes to technology-focussed outsourcings, it also carries risks. This has led some jurisdictions (such as the EU) to regulate, whereas others (notably the US and the UK) have been slower to act, favouring reliance on existing legislation and expressing more concern about the potential chilling effect of regulation – see below for more discussion of this aspect.   The upshot is that the onus remains very much on the parties to outsourcing transactions to manage the risks appropriately – see the "AI in service supply and outsourcing contracts: managing the risks" briefing for more detail on the key issues to consider.

What is the UK doing about AI regulation?

There is still no UK AI Bill. Given the current geopolitical climate (see above), it is likely to be delayed (a timeframe of "within 18 months" was mentioned by the data minister, Chris Bryant, in March 2025) and we can expect it to focus on the largest general-purpose AI models.

At the start of the year, the UK Government announced a new drive in its AI Opportunities Action Plan to accelerate the UK’s AI development economy and to promote broader and more rapid AI adoption by the public and private sectors.

While we may not see specific AI legislation in the UK for some time, there is nevertheless a steady flow of AI guidance emerging from UK regulators to help organisations develop and use the technology in compliance with existing laws. For example, from a data protection law perspective, in recent months the Information Commissioner's Office published its response following an extensive consultation on generative AI models, specific guidance on AI's use in recruitment, and its views in response to the Government's consultation on data scraping.

Don't forget the EU AI Act

Finally, don't forget that whilst the UK seems to be taking its time on AI, the EU has already put regulation in place.  Parties involved in outsourced services directed at individuals or businesses in the EU should note that the following aspects of the EU AI Act came into effect from 2 February 2025:

• The AI literacy requirement (an obligation to educate and train staff interacting with AI); and
•  the ban outlawing unacceptable systems under the EU AI Act.

Read our "The EU AI Act: the countdown begins – what you need to know" briefing for details of what and who are in scope. The extensive obligations on new high-risk systems and transparency requirements do not apply until 2 August 2026.  However, organisations will need time to prepare to meet these requirements.

UK data reforms in the pipeline

The Data (Use and Access) Bill (DUAB) is currently making its way through Parliament. It sets out limited data protection reforms, scaling back on some of the reforms from the previous government's Data Protection and Digital Information Bill. It is likely to require few changes to data protection compliance on the ground but introduces greater flexibility to rules around automated decision-making to support AI adoption and innovation. It also aligns the penalties under the Privacy and Electronic Communications Regulations (marketing and cookie laws) with those under the GDPR. Our "The Data (Use and Access) Bill – limited data protection reforms in the pipeline" briefing describes the key changes from a data protection perspective.

EU adequacy decisions in favour of the UK extended

The EU's adequacy decisions in favour of the UK, which allow the free flow of personal data from the EU to the UK, were due to expire on 27 June 2025. The Commission has proposed to extend the effect of the decisions until 27 December 2025 to allow the UK time to finalise the Data (Use and Access) Bill.

Ransomware consultation

Ransomware is currently very much in the news, with high profile names such as Marks & Spencer suffering considerable disruption from cyber-attacks apparently motivated by ransom demands.  In January 2025, the UK Government launched a consultation on three measures, which aim to undermine the ransomware business model – making UK businesses less profitable for cybercriminals to target - and improve the Government's intelligence around ransomware threats. The proposals are:

• a targeted ban on ransomware payments, covering public sector bodies and owners/operators of critical national infrastructure (although the consultation asks if the ban should cover essential suppliers to those sectors too);
• a payment prevention regime which requires ransomware victims to report their intention to pay a ransom to enable to Government to prohibit certain payments; and
• a mandatory incident reporting regime.

Our "Will the UK legislate to curb ransomware payments?" briefing describes the proposals and their implications in more detail.

EU pulls ahead with cyber legislation

The UK is lagging behind the EU in the cybersecurity sphere: the implementation deadline for the NIS2 Directive was October 2024, the Cyber Resilience Act, which regulates the security of products with digital elements, came into force in December 2024 and the Digital Operational and Resilience Act (DORA) began to apply to in-scope financial services firms in January 2025.

Jurisdiction clauses: impact of 2019 Hague Convention

On 1 July 2025, the 2019 Hague Convention on Recognition and Enforcement of Judgments in Civil and Commercial Matters comes into effect between the UK, the EU (except Denmark), Ukraine and Uruguay.  Whilst this shouldn't require you to take any action, it is an important and welcome development for cross-border outsourcings involving those jurisdictions.  Here's why:

• At present, where one of the parties obtains an English judgment against the other party, it only receives "near automatic recognition" in most EU states if (i) the agreement contained an exclusive jurisdiction clause in favour of the English courts; and (ii) the agreement itself was made after 31 December 2020 (i.e. after the UK left the EU).
• As such, the current state of affairs leaves a "gap" when it comes to near-automatic recognition in most EU states – because such treatment is not extended to English judgments arising out of cross-border outsourcings which either (i) contain non-exclusive or asymmetric jurisdiction clauses; or (ii) were entered into before 1 January 2021.  From July this year, however, that "gap" will be plugged – provided that the proceedings giving rise to the eventual judgment commenced on or after 1 July 2025.

In late 2024, the UK Government announced its intention to "crack down on late payments" and outlined several measures intended to support this. It proposes to step up enforcement of the late payment disclosure regime for larger businesses and to consult on further changes designed to promote additional transparency and scrutiny. Alongside this, a revised voluntary code has been published together with a more demanding prompt payment standard for many suppliers to the public sector. One key takeaway is that late payment is increasingly being seen as an ESG issue – and businesses that fail to take it seriously face an increasing risk of significant reputational damage. See our "Late payment in the UK: what's changed and why should you care?" briefing for more detail.

We regularly advise both customers and suppliers on outsourcing transactions in a broad range of sectors.  Recent examples include: