The EU AI Act and UK Businesses: What Actually Applies to You

The most common thing UK businesses believe about the EU AI Act is that it does not apply to them. For many it genuinely does not. For a meaningful minority it very much does, and the reason is the same one that caught people out with GDPR: the regulation follows the market and the affected person, not the company’s registered address.

This is a plain-English read of who it reaches, what the timeline actually is after the Digital Omnibus changes, and what a proportionate response looks like.

Does it reach you?

Three tests. If any one of them is true, the Act is in scope for that system.

You place it on the EU market You sell, licence or otherwise supply an AI system or a general-purpose model into the EU, whether directly or through a distributor. You are a provider.

You use it and the output lands in the EU You operate an AI system from the UK but its output is used in the EU. This is the test that surprises people. Screening EU-based candidates from a London office qualifies.

You are in someone else's chain You supply a component, a dataset or a service into a system that a client puts on the EU market. Your obligations arrive through their contract long before any regulator writes to you.

That third route is how most UK businesses will actually first encounter the Act: as a set of new clauses in a client contract, arriving with a deadline attached.

The four risk tiers

The Act does not regulate AI. It regulates uses of AI, sorted into four tiers with very different consequences.

Unacceptable risk. Banned outright. Social scoring by public authorities, certain biometric categorisation, emotion inference in workplaces and schools, untargeted scraping of facial images to build recognition databases, and manipulative techniques that exploit vulnerability. These prohibitions have applied since 2 February 2025. The workplace emotion inference ban catches more HR technology than vendors tend to admit.

High risk. Permitted, heavily conditioned. Annex III covers employment and worker management, education access and assessment, essential private and public services including creditworthiness, law enforcement, migration, justice, and safety components of critical infrastructure. Obligations include a risk management system, data governance, technical documentation, logging, human oversight, accuracy and robustness, and conformity assessment.

Limited risk. Transparency obligations only. Users must be told they are interacting with an AI system. Synthetic image, audio and video content must be machine-readably marked as artificially generated. Deepfakes must be disclosed.

Minimal risk. Everything else, which is most of it. Spam filters, recommendation engines, the AI features inside ordinary business software. No obligations beyond general law.

For a typical UK professional services or ecommerce business, almost everything sits in the bottom two tiers. The exception, and it is a real one, is anything touching recruitment or worker management, which Annex III puts squarely in high risk.

The timeline, including what moved

The dates have shifted, so a 2024 or 2025 summary will mislead you on the high-risk deadlines. The Digital Omnibus on AI postponed them.

1. 01Feb 2025Prohibitions and AI literacy obligations applied. Done, and enforceable.
2. 02Aug 2025General-purpose AI obligations activated. Member states set up national authorities.
3. 03Aug 2026The majority of rules take effect. Enforcement begins for transparency and general-purpose AI. This is now.
4. 04Dec 2026New prohibitions on deepfakes and child safety material. Transitional deadline for synthetic content providers.
5. 05Dec 2027Annex III high-risk rules apply, postponed from the original schedule. Annex I embedded high-risk follows in August 2028.

Dates per the European Commission AI Act implementation timeline as at August 2026, reflecting the Digital Omnibus postponements. Verify before relying on any of them.

Two things worth drawing out of that.

Transparency enforcement is live now. As of August 2026, the disclosure obligations are in force and enforceable. If you generate synthetic media for EU audiences or run a customer-facing chatbot serving EU users, that applies to you today.

The high-risk breathing room is real but finite. December 2027 sounds distant. Conformity assessment, technical documentation and a functioning risk management system are not things you assemble in a quarter, and if you supply into someone else’s high-risk system their contractual deadlines will land well before the regulatory one.

Provider or deployer

This distinction determines most of your obligations, and it is easy to get wrong.

Provider

You develop the system, or put it on the market under your own name or trade mark. The heavy obligations sit here: conformity assessment, technical documentation, quality management, registration, post-market monitoring.

Deployer

You use a system supplied by someone else. Lighter, but not nothing: use it per the instructions, assign competent human oversight, keep logs, monitor operation, and inform affected people where required.

The trap is that a deployer can become a provider without noticing. Put your own brand on a system, substantially modify it, or use it for a purpose the original provider did not intend, and you may have taken on the provider obligations in full. White-labelling a third-party recruitment screening tool is the textbook example.

A proportionate response

The compliance industry has a strong incentive to tell every business it needs a programme. Most do not. What most need is to find out where they actually stand, which is a week of work rather than a quarter.

Inventory first. List every AI system you build, buy or embed. Include the AI features inside software you already licence, because that is where the surprises are. If you have an AI use register already, you have done this.

Classify each one. Which tier, and are you provider or deployer? Most rows will be minimal risk with no obligations, and writing that down is genuinely valuable because it stops the conversation restarting every quarter.

Check the EU nexus. For each row, does anything touch the EU market or an EU-based person? Be specific. “We might sell there one day” is not a nexus. “We screen candidates in Dublin” is.

Deal with transparency now. It is in force, it is cheap, and it is visible. Label AI-generated content, disclose your chatbot, mark synthetic media.

Read the contracts. If you supply into anyone else’s product, the obligations reaching you will be contractual and their timetable will be tighter than the regulation’s.

Then stop. If nothing is high risk and nothing touches the EU, document that conclusion with the evidence behind it and revisit it in six months. That document is your answer when procurement asks, and it costs you a week rather than a programme.

How this sits alongside UK rules

The UK has no equivalent statute. The framework here is sector-led, built on existing law and existing regulators, and as of May 2026 no UK AI Bill sits before Parliament.

What UK businesses do have is the Data (Use and Access) Act 2025, in force from February 2026, which replaced UK GDPR Article 22 with Articles 22A to 22D and set out safeguards for solely automated decisions. From 12 May 2026 the ICO carries a statutory duty to produce a Code of Practice on AI and automated decision-making, with final guidance expected during summer 2026 and the Code itself more likely in 2027.

In practice the two regimes overlap heavily in the areas that matter most to ordinary businesses. A system that makes decisions about people needs documentation, human oversight and a route to contest the outcome under both. Build once, satisfy both, and treat the EU Act’s extra machinery as the increment you add only for systems that genuinely need it.

The short version

The EU AI Act reaches UK businesses through the EU market and through EU-based affected people, not through where you are registered. Most of your systems are minimal risk. Transparency obligations are live now. The high-risk deadlines moved to December 2027 and August 2028, which is useful breathing room rather than a reason to ignore them. And your first real deadline will most likely arrive in a client contract rather than from a regulator.

Inventory, classify, check the nexus, fix transparency, read the contracts. For most UK businesses that is a week of work and a document that answers the question for the next six months.

If you would rather have that inventory and classification done independently, it forms part of our AI readiness audit, and the pricing page sets out what that costs.

This article is general information about a complex and moving regulation. It is not legal advice, and anyone with a genuine high-risk system should take specialist counsel.