Compliance Management
Risk Management
Third Party Risk Management
Data Privacy Management
Internal Auditing
Business Continuity Management
Continuous Control Monitoring (CCM)
Trust Center
AI Governance
- Compliance Management
- 10th Sep 2026
- 1 min read
UK SOX Scrapped: What It Means for Compliance Teams
- Written by
In Short..
TLDR: 4 Key Takeaways
- UK SOX is officially dead: the government confirmed on 20 January 2026 that it is abandoning the Audit and Corporate Governance Reform Bill, citing the cost of the changes to large businesses.
- The reforms went further than internal controls: they would have broadened the definition of a public interest entity and created a new director accountability and enforcement regime, alongside the internal-controls reporting rule that earned the bill its "UK SOX" nickname.
- The government is prioritising other work instead: a Modernising Corporate Reporting consultation and a firmer statutory footing for the Financial Reporting Council, mainly a funding and information-access change rather than new enforcement powers.
- Provision 29 hasn't gone anywhere: UK-listed boards must still formally declare whether their internal controls were effective at year-end under the UK Corporate Governance Code, with first declarations due in 2027 annual reports.
The UK's Audit and Corporate Governance Reform Bill, informally known as UK SOX, won't go ahead. The government confirmed on 20 January 2026 that it wouldn't proceed with the reforms, citing the cost to large businesses of implementing them. For compliance teams working from guidance that treated the bill as imminent, the practical question now is what still applies, and the answer is UK Corporate Governance Code Provision 29, a narrower, already-live requirement with its own deadline.
If your organisation had started building groundwork for UK SOX, redirect it toward Provision 29 readiness instead of setting it aside.
Expert View
Matt Davies Chief Product Officer, SureCloud |
What our experts say about Provision 29
"Parliament's timetable made this outcome predictable well before January. Provision 29 is what matters now. UK boards need one paragraph in the annual report, backed by evidence they can defend when a shareholder raises it at the AGM." |
What happened to UK SOX?
On 20 January 2026, the UK government confirmed it would not proceed with the Audit and Corporate Governance Reform Bill, the legislation informally nicknamed UK SOX for its resemblance to the US Sarbanes-Oxley Act's internal-controls reporting requirement. ICAEW's coverage of the announcement and Deloitte UK's newsflash on the decision both point to the same reasoning: the government said the changes would place significant new costs on large businesses at a time when it's pursuing a wider deregulation agenda.
A government letter to the Business and Trade Committee's chair put the timing in context too: ministers judged that "the need for major reform is less pressing than it was", given the progress made since Carillion's collapse in 2018.
The scrapped reforms would have broadened the definition of a public interest entity and created a new director accountability and enforcement regime, alongside the internal-controls reporting requirement that earned the bill its UK SOX nickname.
What's replacing it
Two things are moving forward instead:
- Financial Reporting Council (FRC) is still getting a firmer statutory footing, a change the government says is mostly about funding and information access rather than new enforcement powers, timed to when parliamentary time becomes available
- The Modernising Corporate Reporting consultation is now the Department for Business and Trade's immediate priority in this space
Why there's still plenty to do
If your organisation had started planning for UK SOX-style internal controls reporting, that's off the table now. A related, narrower obligation is in force and moving toward its first deadline. UK Corporate Governance Code Provision 29 requires UK-listed boards to formally declare whether material internal controls, financial, operational, reporting and compliance, were effective at year-end, with first declarations due in 2027 annual reports.
SureCloud's Provision 29 readiness guide walks through the four-phase approach boards are using to build that evidence base across a full year, rather than scrambling for it at year-end. It's worth starting that work now, well before the final quarter when the first declaration is due.
What this means for your compliance programme
If you were building control documentation, a steering committee, or cross-team processes in anticipation of UK SOX, most of that work still counts. Standardised documentation, clearer control ownership and reduced duplication are worth having regardless of which regulation drove the project in the first place. Point that same infrastructure at Provision 29 readiness and get more out of work you have already done.
Gracie AI Agents with Personas and Skills can pick up a good share of that evidence-building work automatically, turning existing control documentation into structured, audit-ready records instead of a fresh evidence hunt each reporting cycle.
Found this useful?
Choose SureCloud as a preferred source in Google and you will see more of our GRC guidance in Top Stories, AI Overviews and AI Mode. It takes one click and you can undo it at any time.
