Rhinehart Studio

The Weekly Brief · Issue #3 · 2 November 2026

Black Friday price rules, the end of Companies House's ID grace period, and Delaware's lower privacy threshold

Sources checked: Bank of England, legislation.gov.uk, GOV.UK (Companies House, CMA, DBT, HM Treasury, MOD), Delaware General Assembly and Delaware Code, California Privacy Protection Agency, govinfo.gov (16 CFR Part 435), all checked 1 November 2026

Welcome to issue #3 of the UK Small Business Compliance & AI-Ads Brief. Black Friday is on 27 November, so this week's UK section includes the pricing rules that matter for a sale. There's also a Companies House deadline, a Bank of England decision on Thursday, and what the Budget said about public-sector buying. In the US, two state privacy changes start on 1 January 2027, and there's a reminder of the federal shipping rule before holiday orders pick up. We've also launched four free or low-cost tools this week, listed below. Every item has a one-line TLDR, a link to the original source, and one thing to do this week. This is general information, not legal or tax advice. If something affects you, read the source.

UK

1. Bank Rate decision on Thursday: what it means for interest on late invoices

TLDR: Bank Rate has been 3.75% since 18 December 2025, and the Monetary Policy Committee's next announcement is on Thursday 5 November 2026 at 12pm. If another business pays you late, statutory interest under the Late Payment of Commercial Debts (Interest) Act 1998 is 8% plus a reference rate. That reference rate is Bank Rate on 30 June for interest that starts running between 1 July and 31 December, and Bank Rate on 31 December for interest that starts between 1 January and 30 June. It is then fixed for that debt. So invoices that went overdue between 1 July and 31 December 2026 carry 11.75% whatever happens on Thursday. A change would only matter for debts that go overdue from 1 January 2027, through the rate on 31 December. You can also claim a fixed sum of £40, £70 or £100 per invoice, depending on its size. You can't claim statutory interest if your contract sets its own late-payment interest.

Do this week: List every invoice that's more than 30 days late, or late against the terms you agreed. For each one, work out the interest and fixed sum with our free late payment interest calculator, then send a new invoice adding them, as GOV.UK suggests. These rules are for business-to-business debts only, not for consumers.

Sources: Bank of England, Bank Rate history · Bank of England, upcoming MPC dates · legislation.gov.uk, Late Payment of Commercial Debts (Rate of Interest) (No. 3) Order 2002, article 4 · GOV.UK, "Late commercial payments: charging interest and debt recovery"

2. Companies House: the 12-month ID verification transition ends on 17 November

TLDR: Identity verification for directors and people with significant control (PSCs) started on 18 November 2025. Existing directors and PSCs were given a 12-month transition period, which ends on 17 November 2026. During it, existing directors confirm they've verified when the company files its next confirmation statement, and Companies House won't accept a confirmation statement until all directors are verified. PSCs have their own 14-day window. If a PSC is also a director, it starts the day after the company's confirmation statement date. If not, it's the first 14 days of their birth month. You can verify through GOV.UK One Login or through an Authorised Corporate Service Provider (ACSP).

Do this week: If you run a limited company, check your confirmation statement date on the Companies House service. Then check that every director and PSC has a Companies House personal code. Anyone who hasn't verified yet should do it now through GOV.UK One Login rather than waiting until the week the statement is due.

Sources: legislation.gov.uk, Economic Crime and Corporate Transparency Act 2023 (Commencement No. 6 and Transitional Provisions) Regulations 2025, regulation 4 · Companies House, "When you need to verify your identity for Companies House" · Companies House, "Filing your company's confirmation statement" · Companies House, "Verify your identity for Companies House"

3. Black Friday and Christmas sales: the pricing rules the CMA can now fine for

TLDR: Black Friday is on 27 November and Cyber Monday on 30 November. This is the second Christmas season under the Digital Markets, Competition and Consumers Act 2024, whose unfair commercial practices rules came into force on 6 April 2025. The CMA can now decide for itself that consumer law has been broken and fine a business up to £300,000 or, if higher, 10% of its worldwide turnover. Three rules matter most for a sale. Drip pricing (adding unavoidable fees after showing a headline price) is banned. Falsely saying a product or price is only available for a very limited time, to rush a decision, is on the list of practices that are always unfair. And the CMA's guidance on urgency and price-reduction claims says "was" prices and countdown timers must be genuine. Separately, the Prime Minister announced plans in August to crack down on misleading discounts. The new subscription contract rules are due in January 2027, and the Department published guidance on them on 19 October 2026.

Do this week: Before you set up a sale, check each "was" price is one you actually charged for a meaningful period. Make sure the price shown first includes every unavoidable fee, and that any "ends midnight" deadline really ends then. We've put the rules and official links in one free checklist: Black Friday and Christmas sale pricing rules for UK online shops.

Sources: CMA, "Direct consumer enforcement guidance and rules" (CMA200) · CMA, "Unfair commercial practices" (CMA207) · legislation.gov.uk, DMCC Act 2024, Schedule 20 · CMA, "Using urgency and price reduction claims online" · Prime Minister's Office, "PM starts roll out of everyday fixes on the cost of living" · GOV.UK, "Subscription contracts" guidance, 19 October 2026

4. Public-sector buying: Budget plans and new MOD offsets policy

TLDR: The Budget on 28 October set out several procurement changes. A new National Procurement Policy Statement is to be laid in March 2027, a new definition of a "UK supplier" is planned by January 2027, there will be new guidance on social value in central government procurement, and there's a target of at least 3% apprenticeships on large infrastructure contracts. Separately, on 30 October the Ministry of Defence published an Offsets policy. Overseas defence contracts worth £50 million or more will be considered for offsets, with the aim of helping UK small and medium-sized firms get into the supply chains. None of this changes how tenders work today.

Do this week: If you bid for public-sector work, keep a one-page note of your social value evidence (local jobs, apprentices, suppliers you use) so it's ready when the new guidance arrives. Before you write your next bid, run it through our free bid or no-bid tender scorecard. It's ten questions and tells you whether the tender is worth your time.

Sources: HM Treasury, Budget 2026 document (HTML) · Ministry of Defence, "Defence contracts to prioritise British jobs and skills", 30 October 2026

US

5. Delaware lowers its privacy law threshold from January 1, 2027

TLDR: Delaware has amended its Personal Data Privacy Act (HB 380, signed September 2, 2026, effective January 1, 2027). From January 1, 2027, the law applies to businesses that, in the previous calendar year, controlled or processed the personal data of at least 10,000 Delaware consumers (not counting data used only to complete a payment), or at least 5,000 consumers while getting more than 20% of gross revenue from selling personal data. The previous thresholds were 35,000 and 10,000. Third parties that get personal data from a controller are covered too. Many small online shops, newsletters and service businesses with Delaware customers could now be covered for the first time.

Do this week: Count your Delaware customers and subscribers for 2026. If you're near 10,000, plan to have a privacy notice, an opt-out of targeted advertising and sale, and a way to answer requests in place by January 1. Our free US state privacy law checker compares your numbers with the thresholds in 24 state laws in about two minutes.

Sources: Delaware General Assembly, HB 380 bill detail · Delaware Code, Title 6, Chapter 12D (§ 12D-103)

6. California: automated decision rules start January 1, 2027

TLDR: The California Privacy Protection Agency's regulations on automated decision-making technology (ADMT), risk assessments and cybersecurity audits took effect on January 1, 2026, with later compliance dates. Businesses that use ADMT to make significant decisions about consumers must comply from January 1, 2027. Risk assessment attestations are due by April 1, 2028. Cybersecurity audit certifications are due by April 1, 2028, 2029 or 2030, depending on revenue (over $100 million, $50–100 million, or under $50 million). These rules only apply to businesses covered by the CCPA.

Do this week: If you're covered by the CCPA, list any software, including vendor tools, that makes or substantially shapes significant decisions about people, such as jobs, lending, housing, education or healthcare. Ask each vendor what notice and opt-out support they'll provide before January 1.

Source: California Privacy Protection Agency, announcement of approved regulations, September 23, 2025

7. Holiday orders: the FTC's 30-day shipping rule

TLDR: The FTC's Mail, Internet, or Telephone Order Merchandise Rule (16 CFR Part 435) applies to online orders. You must have a reasonable basis to expect you can ship within the time you advertise. If you don't state a time, that means within 30 days of a properly completed order (50 days if the buyer applies to you for credit to pay). If you can't ship on time, you must tell the buyer, give a revised date and offer them the choice of agreeing to the delay or cancelling for a prompt refund. Refunds by cash, check or money order are due within 7 working days, and credit refunds within one billing cycle.

Do this week: If you dropship or use print-on-demand, check your supplier's real December lead times, and make the delivery estimate on your product pages match them. Write a short delay email now so you can send it the same day a supplier slips.

Source: govinfo.gov, 16 CFR Part 435, Mail, Internet, or Telephone Order Merchandise (2025 edition, PDF)

New on rhinehartstudio.com

From Rhinehart Studio (our own services)

This is a house ad for our own services. We don't take paid sponsors yet, and if we ever do, they will always be labelled "Sponsored". This week we're featuring our privacy checks and Tender Radar.

Questions or a topic you'd like covered? Reply to this email or write to hello@rhinehartstudio.com.

Rhinehart Studio

General information, not legal advice. Corrections: hello@rhinehartstudio.com.