European Union trading partner
2024European Commission, EU–UK tradeHome / Jurisdictions / United Kingdom
Country file
United Kingdom
The United Kingdom remains closely tied to the European market while now constituting a third country. Trade, data and supplier assurance must be aligned without being conflated.
Relationship with the European Union
EU–UK Trade and Cooperation Agreement in force
The adequacy decision renewed in December 2025 concerns data transfers. It constitutes neither a cyber certification nor an exemption from supplier audit.
Sources reviewed on 14 August 2026
of services exported by the EU to the United Kingdom
2024European Commission, EU–UK tradeof services imported by the EU from the United Kingdom
2024European Commission, EU–UK trade01
Economy and sectors
177,2 Md£
of value added in the digital sector
2024, provisional estimate6.8% of UK gross value added
GOV.UK, digital sector value added 202463 %
of information and communication companies report a breach or attack
2025–2026 surveyDeclared prevalence over 12 months
GOV.UK, Cyber Security Breaches Survey 2025–202654 %
in professional, scientific or technical services
2025–2026 surveyDeclared prevalence over 12 months
GOV.UK, Cyber Security Breaches Survey 2025–202602
Incidents, fraud and impersonation
43 %
of businesses report having observed a breach or attack
2025–2026 surveyAround 612,000 companies extrapolated
GOV.UK, Cyber Security Breaches Survey 2025–202638 %
of companies report a phishing attack
2025–2026 surveyAll companies surveyed
GOV.UK, Cyber Security Breaches Survey 2025–202612 %
report impersonation of the organisation or its staff
2025–2026 surveyEmail or online presence
GOV.UK, Cyber Security Breaches Survey 2025–202603
Points to check within your organisation
Data adequacy
It simplifies certain transfers but demonstrates neither operational security, nor compliance with client commitments, nor the scope of an audit.
Sector of the supplier and the client
Reported rates vary significantly by sector and size; the file should retain only the comparisons that are genuinely relevant.
Impersonation and phishing
Make domain protection, reporting procedures and independent confirmation of sensitive requests verifiable.
Developments to be aware of
The topics that may change your answers
EU–UK Agreement
The commercial agreement is distinguished from data mechanisms and the client's audit rights.
Adequacy decision
Adequacy does not create general recognition of the supplier's controls.
Prevalence by sector
Information, professional services and company size change how priorities are read.
Significant incidents
429 incidents required NCSC support, of which 204 were significant or highly significant.
Proximity to the Union facilitates exchanges but must not obscure third-country status. UK data allows for a useful sectoral reading, provided the sampling basis and the self-reported nature of the results are preserved.
Official sources
Confidential exchange