What Policy Shifts Mean for Telcos Regulation Today

The European Union has accelerated its ambition to create a harmonised regulatory framework for the digital economy.

A central development is the EU Data Act, which becomes fully applicable on 12 September 2025.

The act sets the rules for fair data access and sharing, creating new compliance obligations for businesses offering data-intensive products and services.

Telecom operators, as both custodians of consumer data and enablers of data-driven ecosystems, will be significantly affected.

The European Commission has begun reviewing the Digital Markets Act (DMA).

The review will determine whether the regulation, first applied in 2023, is still suited to dealing with new digital challenges, particularly those linked to the rapid upsurge of AI-based services.

Alongside data regulation, cybersecurity obligations are intensifying.

Member states are transposing the NIS2 Directive into national law, establishing stricter risk management and incident reporting obligations for operators deemed critical to Europe's security.

Technical guidance issued by the EU Agency for Cybersecurity (ENISA) highlights the seriousness of the regulatory shift.

Juhan Lepassaar, Executive Director of ENISA, explains: "The NIS2 Directive is a turning point.

"Telecoms are no longer just communication providers; they are part of the critical nervous system of Europe's economy and security.

"Companies must prepare for an era of proactive cybersecurity compliance."

The EU  continues to promote consumer-centred initiatives.

In July, the Council approved a proposal to bring Ukraine and Moldova into the "Roam Like at Home" scheme from January 2026, extending Europe's connectivity integration beyond the Union's borders.

The UK charts a post-Brexit course

Outside the EU, the UK is carving out a more flexible approach.

The Data (Use and Access) Act 2025, which came into force on 19 June, marks a pivotal update to its data protection and governance framework.

The Information Commissioner's Office (ICO) has begun consultations on updated guidance and is exploring a risk‑based approach to matters such as cookies and online advertising.

Unlike the stricter EU model, the approach could remove the requirement for explicit consent in activities deemed low risk to privacy.

UK Information Commissioner John Edwards says: "What we are aiming for is smart regulation — proportional, risk‑based and innovation‑friendly.

"If we can reduce burdens while still protecting people's rights, businesses and consumers alike will benefit."

For telcos, the UK's regulatory pathway offers the potential for reduced compliance burdens, yet introduces complexity for companies operating across markets.

Security dominates the US agenda

In the US, attention concentrates on securing its national communications infrastructure.

Earlier this month, four leading telecom trade groups urged federal agencies — including Homeland Security and the FBI — to strengthen protection for network assets in light of mounting physical and cyber threats.

Spectrum management remains a high policy priority.

The National Telecommunications and Information Administration (NTIA) recently commissioned research on improving receiver performance and efficiency.

In August 2025, the agency submitted recommendations to the Federal Communications Commission (FCC) on optimising C‑band spectrum use, highlighting an ongoing push to safeguard spectrum as a strategic national resource.

Strategic dilemmas for global operators

The divergence between regions is evident.

The EU favours a prescriptive, rights‑driven framework.

The UK moves towards flexibility and risk‑based oversight.

The US leans heavily on infrastructure protection and efficient spectrum management.

For multinational telcos, such divergence fuels a strategic challenge: adopt the EU's high standards globally, known as the "Brussels Effect”, or manage multi‑track compliance regimes at significant cost.

The answer may shape R&D investment, service delivery models and even decisions on where to locate new data‑intensive operations.

As networks become increasingly defined as critical infrastructure, governments expect operators to assume greater accountability in both privacy and security.

The trend signals that compliance will not only be a legal obligation but a core dimension of competitiveness and trust in the years ahead.