Explainer
The UK has no AI Act, but the EU one reaches across the Channel. If you sell into the EU, serve EU customers or run group companies there, parts of it already apply to you. Here is a plain account of who is caught, what the obligations are and when they apply now that the 2026 delay has been agreed.
By Christopher Fagan, Managing Partner, PEF Consulting Partners
The EU AI Act applies to providers who place an AI system on the EU market, to deployers established in the EU and, importantly for UK businesses, to providers and deployers outside the EU where the output of the system is used in the EU. A UK firm that sells software with AI features to EU customers, uses an AI tool to screen candidates for an EU subsidiary or produces AI generated analysis that an EU client relies on can be in scope without ever having an office in the Union. The penalties are set as the higher of a fixed sum or a share of global turnover, up to 7 per cent for the prohibited practices, which concentrates minds.
The Act sorts AI systems by risk. A short list of practices is prohibited outright, such as social scoring and manipulative systems that cause harm. High risk systems, which include AI used in recruitment, credit, education, critical infrastructure, insurance pricing and law enforcement, carry the heavy obligations: a risk management system, data governance, technical documentation, logging, human oversight, accuracy and security requirements and a conformity assessment before use. Limited risk systems, such as chatbots and generated content, carry transparency duties: people must know they are dealing with a machine or seeing synthetic content. Everything else is minimal risk with no new obligations, although every organisation using AI is expected to support AI literacy among the staff who use it.
The Act entered into force in August 2024. The prohibitions and the AI literacy duty applied from February 2025, and the rules for general purpose AI models from August 2025. The high risk obligations were due in August 2026, but the Digital Omnibus on AI, agreed in May 2026 and formally approved in June, moved them to fixed later dates: 2 December 2027 for the stand alone high risk uses listed in Annex III, such as recruitment, credit and education, and 2 August 2028 for AI built into products that are already regulated, such as medical devices and machinery.
The transparency duties were not delayed and have applied since 2 August 2026, with providers of generative systems already on the market given until 2 December 2026 to add machine readable marking to their output. The same package softened the AI literacy duty, which now asks organisations to support the literacy of the staff who use AI rather than guarantee a particular level. The extra time is for building compliance properly, not for postponing it: a high risk system has to be documented, tested and governed before December 2027, which for most organisations means starting now.
Most UK businesses are deployers rather than providers: they buy AI tools and use them. For a deployer the practical steps are an inventory of AI in use, a view of which systems touch EU people or markets, a check of whether any fall into the high risk categories, and for those, the human oversight, logging, staff training and vendor documentation the Act expects. Ask your vendors for their conformity position in writing. Put the transparency notices in place for chatbots and generated content, because those duties have applied since August 2026. And train the staff who use AI: the literacy duty has applied since February 2025, and a training record is the easiest thing for a customer or regulator to ask to see.
If you build AI into a product sold in the EU you carry the provider obligations: classify the system, and if it is high risk, build the risk management, data governance, documentation, logging and post market monitoring the Act requires, appoint an EU authorised representative and prepare for conformity assessment. The work overlaps heavily with ISO 42001 and with good engineering practice, so providers who already run a proper AI governance framework find the gap smaller than they feared. Providers who do not tend to discover the gap when a large EU customer sends a procurement questionnaire.
The UK has chosen principles enforced by existing regulators rather than a single statute, so the ICO, FCA, CMA and Ofcom apply the five principles within their remits, and UK GDPR already governs personal data in AI and automated decisions. A UK company that builds one governance framework covering UK GDPR, the UK principles and the EU AI Act obligations that apply to it will satisfy all three with one set of evidence. Our AI governance framework guide sets out what that framework contains.
Related reading: a practical AI governance framework, AI readiness, governance and implementation consultancy, the free AI policy template, AI consulting explained.
Yes, where they place AI systems on the EU market, deploy them through an EU establishment, or produce outputs that are used in the EU. Many UK firms with EU customers or subsidiaries are in scope for at least the transparency and literacy duties, and some for the high risk obligations.
Systems used in the areas listed in the Act, including recruitment and worker management, access to credit and insurance, education, critical infrastructure, migration and law enforcement, plus AI that is a safety component of regulated products. The classification depends on the use, not the technology.
From 2 December 2027 for the stand alone uses listed in Annex III, such as recruitment, credit and education, and from 2 August 2028 for AI built into regulated products. The dates were set by the Digital Omnibus on AI in 2026. The prohibitions, the literacy duty, the general purpose model rules and the transparency duties already apply.
No, but it is the closest management system standard and covers much of the same ground: governance, risk management, data, documentation and monitoring. Certification does not prove compliance with the Act, but an organisation running ISO 42001 properly will have most of the evidence the Act requires.
If you are not sure whether the EU AI Act reaches your business, a short confidential conversation will usually settle it in half an hour.