The rise of e-commerce and entry of new service providers in the market are prompting major shifts in the way the sector is regulated. Union Postale takes an in-depth look at how changing customer needs, increasing customs pressure and data protection requirements are expected to shape postal sector regulation over the coming years.
Redefining the postal landscapeWhen state-run postal services were conceived, governments had the provision of affordable and accessible communications services as their target. It is in that context that letters have traditionally formed the basis of postal universal service obligations, how governments have upheld the right to communication for their citizens.
However, the liberalization wave of the 1980s made way for the entry of new courier, express and parcels (CEP) providers in a market where the Post had previously held a monopoly. As customers shifted interest from exchanging communications to exchanging goods with the rise of online commerce, CEP providers thrived. Additionally, the rise and vertical integration of marketplaces, which has seen them offer their own or partnered at home and out-of-home delivery services, has further increased competition in delivery markets. The operating environment of designated operators has thus become more complex in the face of these market pressures and the costs associated with meeting their universal service obligations.
Postal operators are also being confronted with demand-side pressures. Business-to-consumer e-commerce has skyrocketed, while customer expectations for transparency and control over their items – particularly parcels – has increased.
The converging trends are causing a ripple in the postal regulatory landscape, prompting policymakers and postal regulators to rethink the sector across three dimensions: what are the boundaries of the postal market; how should postal services be defined; and what falls under the regulator's watch.
How countries are responding
Policymakers and regulators are responding by moving away from a one-size-fits-all, mandated-services model of the universal service obligation and toward more dynamic frameworks that combine different distribution models and prioritize customer needs and protection.
In 2024, following an extensive public consultation process, Australia implemented reforms to its postal regulation that reduced letter post delivery frequency, eased delivery time requirements, and gave the Post the flexibility to manage priority letters in a more commercially favourable manner.
At the end of 2025, Denmark opened letters up to the free market almost entirely, with some protections for the most vulnerable populations (read more about the reform on pages 42-44 in the Union Postale Spring/Summer 2026).
In June of this year, the Swiss Federal Council launched a consultation process for the revision of its Postal Services Act. The proposed changes would allow for dynamic adaptation of the universal service obligation to changing customer needs and habits.
On a larger scale, the European Union is soon expected to launch its new EU Delivery Act, which will harmonize regulation on postal services and cross-border postal delivery services, focusing on fair pricing, fair competition and consumer protection. Consultations have been ongoing since 2025 and, while the full changes aren't yet announced, they are expected to expand the material scope of postal services.
Blurring market boundaries
This spring’s UPU Conference on Postal Regulation in Berne intended to help postal regulators identify practical, policy‑ready approaches in the rapidly changing landscape.
The first, and perhaps most fundamental, question regulators are grappling with is where the boundaries of the market lie – in other words, where genuine demand substitution exists between postal services and other forms of delivery.
Roel Gevaers, a professor with the University of Antwerp's Department of Transport and Regional Economics and keynote speaker at the conference, argues that any modern definition of the postal-parcel market must include e-commerce platforms.
"If you look to the definition of postal-parcel markets today, the power of the e-commerce market should be taken into account somewhere in the definition."
Gevaers points to the increasingly blurred line between what constitutes parcel delivery and mail delivery, and, more broadly, where these services fit between post and parcel, logistics and supply chain markets. Leaving e-commerce players out of the regulatory equation risks market cherry-picking by e-commerce platforms, says Gevaers.
This concern for consumers is shared by Brian Mwansa, Acting Executive Secretary of the Communications Regulators' Association of Southern Africa, who also spoke during the spring conference. He adds that excluding e-commerce platforms from the regulatory remit would leave consumers "open to several ills," including a lack of quality standards, a pathway for dispute resolution or basic privacy standards.
"One of the main things that regulators need to do to protect consumers is to formalize those activities which are happening on the periphery of the regulated space, bring those operators into the influence of regulatory oversight so that basic rights and obligations can be handed out to them in the interest of consumer protection," he says.
Customer-centric product approach
Policy should also center on user needs, reflecting a shift from sender-oriented to recipient-oriented regulation with an emphasis on rights and transparency.
When it comes to postal products, Antonia Niederprüm, Head of Postal Services and Logistics at WIK Consult, highlights the benefits of new players.
"The entry of very different players in the wider delivery market is first a good thing because it has extended the choice for consumers, for businesses and drives quality and innovation," she says. "But for designated operators, this is obviously a challenge."
Here, data can and should play an important role to determine what exactly customers want and how often it needs to be delivered.
"I think that analyzing data, for example, using AI tools to analyze what customers want, what type of e-commerce needs to be delivered on a daily basis, which other types of parcels are delivered in another way. I think data technology, analysis of consumer data can help a lot in [developing] this legislation," says Gevaers.
For Niederprüm, customer protection is also a concern. She adds that these in-demand products should be included in the USO to protect against exclusion in more costly, but less profitable rural and remote areas.
"Here I see that there is a need for affordable basic postal services, including parcel services in rural areas, too, at affordable prices and this could be a challenge.”
The right remit, with the right competence
The challenge, then, is to find the right regulatory remit to manage these dimensions. Competent authorities need to be equipped with adequate mandates, tools and powers to promote competition, define and analyze markets, impose access conditions and to collect comprehensive industry data – including revenue, volumes and environmental metrics such as carbon emissions – to support ongoing sector analysis and strengthen regulatory competences.
Gevaers points out that there's also a balancing act between consumer protection and regulatory flexibility to enable innovation. While there are many rules about the use of consumer data, he explains that enabling the limited use of this data can also provide valuable insights for logistics, supply chains and postal services to make them more sustainable in the long term.
"Regulating nothing is not OK, but over-regulating might kill innovations and forecasting. It's always about finding a balance," he says.
This forecasting will be essential to determining regulation that will protect consumers, enable fair competition and ensure a market that can not only meet but anticipate its users' needs.
The conference also highlighted the potential for horizontal regulatory approaches with agency’s responsible for adjacent areas, like trade and digital affairs.
Mwansa highlights a major gap in expertise for many regulators, noting the lack of formal education in this area. He added that the UPU could be the pathway needed to determine common approaches to regulatory frameworks.
Support for regulators and policymakers
The UPU is working to help develop and provide guidance for postal policymakers who might not have the expertise to manage these majors shifts on their own.
First, the UPU is closely monitoring the trends with a view to modernizing the global postal policy and regulatory framework. Some of this work is being carried out within the Council of Administration, under the Postal Sector Reform Standing Group, which works on four fronts: to provide harmonized definitions for the postal sector, to develop conceptions of the universal postal service, to further the alignment with customs policy and regulatory regimes being implemented around the globe, and to provide good governance models and best-practice recommendations for AI governance, data protection and security.
Beyond the global policy and regulatory framework, the UPU has also developed and approved three integrated plans – the Integrated Product Plan, the Integrated Remuneration Plan and the Integrated Quality of Service Plan – which together provide a unified roadmap to modernize products, ensure fair and sustainable remuneration, and raise service standards globally. These reforms aim to keep postal services reliable, affordable and customer-centric while securing the long-term sustainability of universal service.
The UPU is also actively working to support policymakers and regulators to define tailor-made regulatory reform plans, based on the recently released Postal Reform Plan (PRP) policy advisory assistance framework. The framework provides a structured, evidence-based approach to reform planning, supported by substantive information, theoretical and practical models, best practices and guidelines relevant to different areas of postal sector policy available in the UPU's Postal Reform Guide.
Learn more about the UPU’s policy advisory services: https://www.upu.int/en/members-centre/policies-regulation/policy-advisory-assistance
Managing changing trade dynamics
E-commerce isn’t just raising questions about how postal services are defined – it’s also drawing them into broader trade policy reform, prompting countries to remove de minimis exemptions that once protected low-value postal consignments from usual customs procedures and payments.
There are multiple motives behind the shift. While de minimis thresholds were initially put in place to ensure efficient customs processes for items with low value, the rapid rise in low-value e-commerce items has changed the dynamics. According to the European Union, 98% of goods handled by customs in 2025 were low-value small packages – a volume of nearly 6 billion items. Dropping the threshold is one way to capture revenue for handling while ensuring foreign goods undergo the same level of tax and compliance scrutiny as domestic goods.
Last August, the United States of America suspended its duty-free de minimis threshold for goods arriving in the country, including through the postal network. The change meant that now all items containing goods would have to go through customs procedures and, for the first time, taxes and duties would have to be remitted before arrival and through specified qualified parties, not the destination postal operator.
The change prompted a near stop in inbound traffic to the US for the weeks following, until the UPU and other providers were able to implement the first iteration of a delivered duty paid solution (DDP) meeting the new requirements.
Now, as of 1 July, the European Union has dropped its de minimis threshold and applies an automatic EUR 3 per-item duty on low value consignments. Sending postal operators will now also have to provide additional pre-arrival data on items to ensure they meet new customs compliance rules. As an added layer of complexity, each of the EU’s 27 countries is implementing slightly different import procedures to meet the new criteria.
The trend is expected to continue, with other UPU member countries signalling similar reforms in the near future.
Expected impact
Jean-Paul Forceville, who represents France as Chair of the UPU’s Postal Operations Council, describes the trend as a “systemic change”.
Opening a recent UPU webinar that sought to give UPU member countries a forum to interface with EU representatives on the reform, Forceville explained that simplified customs treatment frameworks formerly in place had enabled the rapid growth of e-commerce. Postal operators benefited from that growth, playing a central role connecting businesses to consumers.
“That era is now coming to an end,” he said.
When de minimis thresholds are removed, every parcel becomes subject to customs duties, controls, and data requirements. While the full impact of the changes in the EU won’t be clear right away, Forceville highlighted three known risks: the expected financial impact on postal operators, a shift in liability for compliance, and, more worryingly, a complete change of the postal business model.
These types of customs reforms are increasingly requiring postal operators to advance duties and taxes on behalf of customers. At the same time, they lack visibility on the customer’s transaction with the responsible party, the retailer or e-commerce marketplace. It’s not always clear whether costs will be recovered when items cannot be delivered or must be returned.
As customs authorities tighten requirements for low-value postal consignments, postal operators are finding themselves more legally exposed. As they become key actors in the customs compliance process, they are not only becoming focal points for settling customs debts, but also potential targets for penalties over non-compliant goods, inaccurate data, and other regulatory breaches. This concern has been shared by transport partners, such as airlines, who worry that the postal items they are carrying may not be accepted once they reach their destination country.
These customs reforms are also necessitating the formation of new bilateral agreements for data-sharing between postal operators and new partners like customs brokers and DDP solution providers.
Finally, these reforms are forcing what Forceville refers to as a “profound transformation” of postal business models as postal operators scramble to adapt their processes and technology to their new role. This requires time and a financial investment at a moment when postal operators are balancing the cost of delivering on their USO while working to innovate.
“We are moving towards a model where data quality becomes critical, duties and taxes must be anticipated and integrated upfront and customer experience must remain seamless despite increased regulatory complexity. This is a difficult balancing act,” Forceville explained.
“At the same time, expectations from customers – both senders and recipients – remain unchanged. They continue to demand speed, transparency, predictability, and affordability. The challenge, therefore, is not only regulatory compliance, but also maintaining a strong customer-centric approach in a far more complex environment,” he added.
These changing conditions are weakening the postal value proposition, which relied on its affordability and smooth customs clearance. One risk is that customers move over to private carriers, who have more end-to-end visibility on the processing of items because they manage their supply chains independently. The other risk is that more retailers switch to cargo channels with the intent of filling local warehouses, rather than relying on the postal network to deliver single items from abroad.
Underscoring this is the challenge that e-commerce sellers are quick to find new channels to reach foreign markets, making efforts to adopt tailored solutions for each destination country unsustainable.
“The pace of regulatory change we are experiencing today is extremely fast – sometimes faster than the capacity of operators to adapt. This creates a real risk of disruption, both for businesses and for end customers,” Forceville warned.
Preparing the network
Discussions during the spring Council sessions highlighted that the rapid fragmentation of rules across different markets has put pressure on the Union’s regulatory model and forced the organization into a reactive posture. The message was clear: the focus must shift from fragmented responses to a coherent global approach, with strong support from both the Postal Operations Council and the Council of Administration, as well as the active involvement of regulators.
In the meantime, the POC, its subsidiary Customs Group, and the secretariat have been doing their utmost to prepare the network for expected changes by providing a platform for discussion, collecting and distributing pertinent information to operators, and developing technical solutions to meet the demands.
The UPU has been proactive in ensuring its DDP solution is kept up to date with all regulatory requirements. Its US import-specific solution was launched at the beginning of October and helped get mail flowing to US-based customers after weeks of delays.
In the weeks ahead of the EU changes, the team collected the needed import process information from the region’s 27 countries to prepare tailored solutions for each case.
Looking to the near future, the UPU intends to integrate its DDP solution with UPU*Clearing, resulting in a centralized settlement system through which origin postal operators can pay customs debts in all countries via one invoice. The addition is expected to cut payment complexity, processing time and costs.
UPU is also working to interconnect with other DDP solutions on the market to ensure full coverage for users.
“The postal sector is fully committed to this transformation. It understands the stakes. It embraces the need to evolve. But it also needs the time and the conditions to do so in a sustainable way,” Forceville urged.
Growing cybersecurity expectations
As postal operators move more of their business online – from the exchange of personal data related to e-commerce to the exchange of money via online payment networks – they are finding themselves increasingly more exposed to debilitating cyber attacks.
Threat landscape
Massimiliano Aschi, Cybersecurity Lead, Poste Italiane, and Chair of the UPU Cyber Resilience Expert Team, explains that, while the UPU has not yet published its study that gives a view on the global postal sector’s cybersecurity posture, a few emerging trends are clear.
"The postal sector is not immune to the growing global threats to digital services and is actually more exposed than other sectors due to its cross-sectoral business nature and its role as an international cooperation and logistic network,” says Aschi.
He points first to an emergence of phishing-as-a-service providers targeting postal delivery services and financial institutions. Sectoral studies like Cyble's Transport & Logistics Threat Landscape Report 2025 and Aon's Global Risk Management Survey 2025 have reported a significant increase in ransomware attacks impacting various parts of the post and logistics supply chain, he says. Data breaches and supply chain attacks involving third parties are also on the rise.
The adoption of AI has complicated the situation, explains Filipe Beato, Manager, Technology and Innovation, World Economic Forum (WEF).
“The increased adoption of AI has accelerated both cybercriminal capabilities and cyber defense efforts, while simultaneously introducing new challenges to digital infrastructure resilience.”
He highlights the results of WEF’s Global Cybersecurity Outlook survey, which found that 87% of respondents identified AI-related vulnerabilities as the fastest-growing cyber risk, while 94% expect AI and machine learning technologies will have the greatest impact on cybersecurity in the coming years.
AI has reduced the time it takes for criminals to compromise systems from days to minutes.
Tadas Jakštas, who leads the Cyber Security Capacity Building Team at NRD Cyber Security consultancy in Lithuania, adds that generative AI has enabled malicious actors to produce convincing, personalized scams communications in any language at volume – a high risk for an industry whose customers are accustomed to receiving regular delivery notifications and payment requests.
“More structurally concerning is the attack surface created by IoT-enabled sorting and logistics equipment,” says Jakštas. “This is operational technology that was never designed with security in mind and is now internet-connected and increasingly integrated into live operational environments. As these systems become more deeply embedded in day-to-day postal operations, the potential for a cyberattack to cause direct disruption to physical infrastructure, such as sorting facilities, delivery networks, logistics hubs becomes very real."
This increased threat exposure is now colliding with a wave of new regulation.
Regulatory catch-up
Around the world, governments are rewriting the rules on how critical infrastructure – increasingly including postal and logistics networks – must detect, report, and withstand cyberattacks. The result is a sector being pulled, often unevenly, from a culture of quiet internal handling into one of mandatory disclosure and hard compliance deadlines.
Jakštas sees real upside in this: "On the benefit side, designation brings stronger frameworks for incident response coordination and intelligence sharing with national security agencies, an access that most operators could not obtain independently. It also elevates cybersecurity to a board-level and governmental priority, which can unlock funding, regulatory support, and in some cases direct state investment in resilience."
But the designation comes with strict compliance regimes and significant financial penalties.
"The burden is immediate and concrete while the benefits tend to materialize over a longer horizon. Compliance brings costs in terms of mandatory security audits, investment in monitoring and reporting infrastructure, staff training, certification, and in some cases costly system upgrades to meet baseline requirements. For financially stretched operators, these obligations could be difficult to manage," he adds.
With that said, Jakštas concludes that the designation is apt and recommends that governments ensure that additional obligations are matched with meaningful technical and financial support, particularly for small- and medium-sized operators.
This shift toward formal critical infrastructure designation is matched by a shift toward mandatory reporting.
Many postal operators have historically been hesitant to share information on attacks, instead positioning incidents as IT-related disturbances. That posture is no longer tenable; governments are transforming corporate cyber incidents into real-time national intelligence inputs.
Much of this scrutiny is now falling across the supply chain. Regulators are pushing liability onto the manufacturers of digital infrastructure and heavily restricting the use of geopolitically risky tech vendors. According to WEF's Global Cybersecurity Outlook survey, 65% of large organizations identify third-party and supply chain vulnerabilities as their greatest challenge to cyber resilience, with the inability to adequately safeguard third-party software, hardware, and services cited as a primary concern.
"In the current geopolitical environment, cyber risk is increasingly shaped by geopolitically motivated activity, supply-chain vulnerabilities and the growing dependence on digital infrastructure. These trends are relevant for critical infrastructure operators, including postal and logistics networks, because disruptions can affect the continuity of essential services," explains Beato.
Jakštas adds, "Due to complex interdependencies within the sector, third-party logistics integrations are also heavily exploited as attackers often find it easier to compromise a smaller supply chain partner than the operator directly."
Posts often work with smaller IT partners and customs brokers to manage e-commerce processes. These smaller companies are not usually subject to the same regulation as postal operators, so it falls to the operator to ensure their partners uphold a rigorous standard.
"You can require partners to implement security measures that are proportionate and appropriate to the context being protected, so that everyone does their part in a financially and operationally sustainable way,” explains Aschi, adding, “The UPU has active instruments to support standardization and certification efforts and to deploy state-of-the-art infrastructures and technologies that help operators and their partners achieve secure, resilient digital interactions and exchanges."
One such instrument is the UPU-TechCert programme, which validates both a provider's compatibility with the UPU's global postal IT solutions and its compliance with UPU standards.
Preparing the network
Cooperation through the UPU will play a vital role in helping postal operators keep pace with changes globally – this will be vital to a sector working to grow cross-border business, while navigating inter- and intraregional readiness disparities.
“International organizations play a unique role due to their broad reach, convening power, and ability to facilitate collaboration at scale. In an increasingly interconnected digital environment, organizations such as the Universal Postal Union can provide strategic guidance, facilitate information sharing, promote best practices, and foster collaboration among postal operators, governments, and industry stakeholders,” Beato explains.
WEF’s research has shown that more resilient organizations are more likely to engage with government agencies and information-sharing groups, he adds. UPU is in the right position to make both connections.
Aschi envisions an exchange where Posts advanced in their cyber resilience journey invest in supply chain security, while those in the beginning stages focus on agility, autonomy and adaptability to come up to speed. “Together, these actions can build a more resilient, reliable, and future-ready postal network."
The UPU's 2026–2029 strategic plan mandates the organization to provide member countries and wider postal sector players access to cybersecurity tools and platforms that will help protect the network from emerging threats.
Central to this push is POST-ISAC, an information sharing and analysis centre for the postal sector recently established by the UPU. The collaboration enables stakeholders to share intelligence on current threats, as well as their best practices, with the goal of drawing up shared standards, guidelines and rules on information security.
The long-term goal is to establish a fully-fledged cybersecurity certification programme for postal operators and other wider postal sector partners – giving the network a common baseline of resilience even as the pace of threats and regulation continues to accelerate.
Learn more about POST-ISAC here: isac.post.
This article first appeared in Union Postale Spring/Summer 2026.