UK Corporate Liability Expanded as New Crime Act Provisions Take Effect

UK employers face a significantly broader criminal liability landscape following the introduction of Section 250 of the Crime and Policing Act 2026. The provisions, which came into force on June 29, 2026, mean companies can now be prosecuted for any offense committed by a senior manager acting within their actual or apparent authority — a major shift that removes a key defense previously available to firms.

Senior Manager Conduct Now Attributable to Companies

The new regime replaces sections 196 to 198 of the Economic Crime and Corporate Transparency Act (ECCTA) 2023. Under the previous framework, companies could argue they had adequate procedures in place to prevent misconduct. Section 250 removes that statutory defense entirely.

The legislation defines senior managers broadly, meaning the actions of high-ranking individuals are now attributed directly to the organisation. This expansion applies to all offenses within domestic scope, though conduct occurring entirely outside the UK remains excluded.

For UK employers, the practical implication is clear: leadership conduct now carries direct corporate criminal exposure across the full range of offenses, not just economic crime.

With leadership conduct now directly attributable to your organisation, documenting your safety management systems has never been more critical. A free toolkit provides 41 ready-to-use templates and checklists to help you demonstrate robust risk management practices. Download the free Risk Assessment Toolkit

Cyber Security Rules Tighten Alongside

The legislative shift coincides with regulatory pressure from the UK Cyber Security and Resilience Bill. This updates the existing Network and Information Systems (NIS) framework, broadening its scope to include data centers, managed service providers, and critical suppliers.

The updated framework requires faster incident reporting and introduces severe penalties for non-compliance. Companies found in breach face fines of up to 4% of their global turnover, reflecting a wider trend of tightening oversight across both criminal law and sector-specific resilience standards.

Global Enforcement Intensifies

The expansion of UK corporate liability comes as regulators worldwide sharpen their focus on enforcement and data-driven investigations. In April 2026, the US Department of Justice launched the FOCUS initiative, inviting data miners to help identify pandemic-era relief fraud. By July, the Small Business Administration had expanded its use of AI analytics to detect fraudulent activity in the same programs.

The scale of these efforts is evident in recent enforcement data. During the 2025 fiscal year, more than 200 pandemic-related False Claims Act settlements and judgments were recorded, totaling over $230 million. The SBA has also suspended more than 150,000 borrowers.

Recent settlements involving corporate entities have ranged from $2.6 million to $4 million, underscoring the ongoing financial risks for firms with historical compliance gaps.

With regulators intensifying scrutiny and penalties rising, ensuring your workplace safety documentation is watertight has never been more important. Over 37,000 UK businesses already use this free toolkit to stay compliant with the Health & Safety at Work Act 1974. Get the free Health & Safety at Work Act Toolkit

Liability Boundaries Tested in High-Value Projects

In the private sector, disputes over large-scale infrastructure continue to test the limits of corporate liability. On August 24, 2026, AECOM denied liability in a $17 million claim alleging design defects at a Google data center. The firm suggested the claimant was attempting to pass on overvalued settlements related to project delays — a reminder that liability questions in high-value corporate projects remain complex and contested.