Brexit Policy Writing for Business

Brexit Policy Writing

This article covers Brexit Policy Writing.

In our post Policy Writing for Brexit, written earlier on in 2020, we discussed the main areas of impact that we considered would require analysis in companies and subsequent policy writing for compliance with governing bodies and supplier or client approval.

We are now able to offer Brexit policy or impact statement writing services. Also, we can confirm the areas which will require compliance. At this time, you should consider policy statements:

If you access personal data from the EU, Norway, Iceland or Liechtenstein.
If you employ workers from the EU, Switzerland, Norway, Iceland or Liechtenstein.
If you employ workers who were born outside of the UK, specifically in an EU country.
If you need to appoint a representative in the EU.
If you Broadcast Licensed Content, Satellite Broadcasting and Video on Demand.
If you provide online eCommerce services.
If you are an entity with EEA subsidiaries or a presence in the EEA.
If any of your IT Infrastructure is in the EEA or you retain data outside of the UK in the EEA.
If you are dependent on the EEA for any goods and services.

The above list is not exhaustive. However, it broadly covers the areas of concern for UK companies. If you would like assistance reviewing or writing your Brexit policies and procedures, please contact us to see how we can help.

Where We Are in 2026

Five years on from the Trade and Cooperation Agreement, the regulatory consequences of Brexit continue to ripple through UK policy documentation.

The position has stabilised in some areas (data protection, employment law) and is still moving in others (product safety, environmental and chemicals regulation).

The most important development for policy writing in 2026 is the Retained EU Law (Revocation and Reform) Act 2023, which renamed retained EU law as "assimilated law" and removed the principle of supremacy from 1 January 2024.

UK courts now interpret assimilated law on standard UK common-law principles.

Areas of Material Change

Data protection. UK GDPR and the Data Protection Act 2018 remain the framework. International transfers post-Brexit rely on the UK Addendum or the UK IDTA, and on the UK-US Data Bridge for in-scope US transfers.
Product compliance. The UKCA mark is now the recognised conformity mark for most goods placed on the GB market, with continued recognition of CE marks in defined sectors.
Chemicals. UK REACH operates separately from EU REACH; suppliers and users have parallel duties.
Customs and supply chain. The UK Border Target Operating Model (BTOM) is rolling out through 2024-2026 for imports of food, plant and animal products.
Environmental. The Environment Act 2021 and the Office for Environmental Protection set the new domestic enforcement framework.

What This Means for Your Policies

Most policies written before 2021 contain references to "EU Regulation", "EU Directive", or specific EU bodies (such as ECHA or EFSA) that need updating.

Policies should now refer to the assimilated law name, the relevant UK regulator, and the post-Brexit version of any underlying technical standard.

Examples of common rewrites: GDPR references should reference UK GDPR; ECHA references should reference HSE for UK REACH; CE marking references should reference UKCA where applicable; references to the European Court of Justice should be removed unless the case predates 2021 and is still binding.

Frequently Asked Questions

Is GDPR still in force?

Yes. UK GDPR sits alongside the Data Protection Act 2018 and is interpreted by the ICO and UK courts. EU GDPR continues to apply to data flowing between the UK and the EU.

Do we still need EU representatives?

UK businesses processing personal data of EU residents in scope of EU GDPR may need an EU Article 27 representative; UK businesses placing goods on the EU market typically need an EU-based authorised representative.

What Policy Pros Delivers

Our Brexit Policy Refresh service updates legacy policy libraries to reflect assimilated law, the UK regulators, and the post-Brexit operating model. Typical scope is 8 to 25 documents and takes two to four weeks.