Outlook
Part of Press release distribution outlook: planning announcement routes with owners and review triggers
Press release distribution in England for 2027: four developments to recheck
Recheck four developments for England's 2027 press release distribution plans: Companies House identity checks, PECR guidance, ICO updates and AI security.
An England announcement team planning for 2027 can use four documented developments as recheck points, rather than treating them as a forecast of media reach or distribution demand. They concern company identity verification, email marketing guidance, an ICO guidance update and voluntary AI cyber security guidance. Keep them alongside the distribution outlook when reviewing plans.
Key takeaways
Four checks frame a 2027 review of press release distribution: Companies House identity verification, PECR marketing, ICO guidance status and voluntary AI cyber security guidance. Treat dates, legal duties, review notices and voluntary material as separate signals. Record the page checked and the decision it informed.
This is a compliance and process review, not a media-reach forecast. For each change, identify whether it affects identity obligations, recipient handling, contact-data processing or security controls. Then decide whether the release workflow, media-list practice or supplier brief needs a documented adjustment.
Company identity verification
Record the Economic Crime and Corporate Transparency Act 2023 by its full title, then check the applicable Companies House timetable. The voluntary identity-verification period began on 8 April 2025. Identity verification became a legal requirement from 18 November 2025. Keep the two dates distinct in an internal schedule.
The date of legal commencement marks the start of a 12-month transition period, not a single deadline. During the transition, directors and people with significant control (PSCs) must verify by their own due dates. Do not treat the commencement date as the date every person must complete verification.
An individual can verify online with GOV.UK One Login if they have one of the listed types of photo ID. An Authorised Corporate Service Provider (ACSP) can also verify a person's identity on their behalf. Keep this check separate from editorial review or delivery performance when assessing a service.
A UK rules guide can sit alongside the organisation's due-diligence record. Keep identity checks separate from judgements about a distributor's editorial quality or delivery performance, because the verification process answers a different question in a supplier review. Assign a separate reviewer where useful.
Email marketing and PECR
The full name to record is the Privacy and Electronic Communications Regulations 2003 (as amended), known as PECR. For an announcement team, the practical first step is to classify the intended recipient before selecting an email-outreach approach. A UK media list can support that review.
The ICO's Business-to-business marketing guidance is under review due to changes made by the Data (Use and Access) Act and may be subject to change. Record that status beside the version checked, and separate it from the recipient classification used for a campaign.
PECR's rule on direct marketing by electronic mail does not apply to corporate subscribers. Sole traders and some partnerships are treated as individual subscribers, so email marketing to them is allowed only with specific consent or where the soft opt-in applies. The recipient type therefore belongs in the contact review.
If an organisation collects an individual's contact details in their business capacity and intends to send direct marketing, it must tell them and have a lawful basis under the UK GDPR for processing. Keep this processing check distinct from the PECR subscriber classification, even when both are reviewed for one campaign.
The ICO's planned guidance update lists the PECR advice for small organisations update at Drafting, with public consultation marked No and the final version due in Autumn 2026. Treat this status as a review signal, not published replacement wording. Keep the data protection workflow aligned with current recipient and contact-use checks.
Voluntary AI cyber security guidance
The AI Cyber Security Code of Practice publication is dated 31 January 2025. Its document is titled Code of Practice for the Cyber Security of AI and is described as voluntary. Use it as a security-monitoring signal for announcement workflows, not as a legal requirement.
The Code and its implementation guide are to be submitted to the European Telecommunications Standards Institute (ETSI). They will form the basis of global standard TS 104 223 and implementation guide TR 104 128. The Government will update the Code and Guide to mirror the future ETSI standard and guide.
If a distributor or agency proposes AI for drafting, list handling or monitoring, specify the task, information entered and human approval point before deciding whether the tool fits. The AI applications framework can help define bounded tasks. Record the security guidance and version used.
A practical 2027 recheck
Use the table as a compact evidence register. It separates fixed dates and stated statuses from the next check, so a legal commencement date, guidance under review, a drafting-stage update and a voluntary code remain distinct. Record the exact page title and date checked before taking action.
| Signal | Verified position | Recheck focus |
|---|---|---|
| Companies House identity verification | Voluntary period began 8 April 2025; legal requirement began 18 November 2025; 12-month transition | Directors' and PSCs' due dates |
| B2B marketing guidance | Under review following changes made by the Data (Use and Access) Act | Review notice and current wording |
| PECR advice for small organisations | Drafting; public consultation marked No; final version due in Autumn 2026 | Published update |
| AI cyber security code | Voluntary; future ETSI standard and guide are planned | Updated Code and Guide |
A release quality checklist can keep evidence and claim review in the release workflow. Recheck guidance before changing a supplier brief, media-list process or AI workflow. Keep a record of the decision, the page version reviewed and the reason for any change.
- Record the named source page and the date it was checked.
- Keep identity verification, email marketing and AI security as separate review questions.
- Recheck review-stage and drafting-stage guidance before changing the workflow.
Questions to settle before changing a workflow
Use these questions to keep the four signals attached to a decision, rather than treating them as a general forecast. A useful record names the source page, the status observed, the owner of any follow-up and the change made to the announcement process.
Does 18 November 2025 set one completion deadline?
No. It marks the start of the 12-month transition period. Directors and PSCs verify by their due dates during that transition, so the organisation's schedule should track those dates rather than use commencement as a universal deadline. Keep each person's entry distinct.
Should voluntary guidance or a planned update be treated as a new legal rule?
No. The AI cyber security code is described as voluntary, while the PECR advice update is listed as Drafting with a final version due in Autumn 2026. Record each status as stated and recheck before revising an announcement workflow. Assign responsibility for that check.
