Skip to content

Get the monthly AI briefing: what matters for your business, in plain English.Subscribe

Menu

Practical GuideAI RegulationGetting Started

A beginner’s guide to the EU AI Act for UK businesses

What the EU AI Act is, how it reaches UK businesses despite Brexit, what applies and when, and the practical steps worth taking now.

Phil Evans

Co-Founder & CEO

The EU AI Act is not only a European concern. If your use of AI reaches EU customers, EU-based staff or EU markets, it can apply to you.

Regardless of your AI usage, if you operate in the EU you have a duty to develop AI literacy within your team. Even if they are in the UK.

This guide explains what the Act is, how it reaches UK businesses despite Brexit, what applies and when, and the practical steps worth taking now.

What the EU AI Act is, in plain terms

The EU Artificial Intelligence Act, formally Regulation (EU) 2024/1689, is described by the European Commission as “the first-ever comprehensive legal framework on AI worldwide”. It entered into force on 1 August 2024 and is being switched on in stages rather than all at once.

It does not regulate AI as a technology. It regulates the uses of AI according to the risk it poses. The Commission describes four levels:

  • Unacceptable risk: a short list of practices that are banned outright, such as social scoring.
  • High risk: uses that can seriously affect health, safety or fundamental rights, including AI in recruitment, education, credit and access to essential services. These carry the heaviest obligations.
  • Transparency risk: people must be told when they are dealing with AI, and AI-generated content must be identifiable.
  • Minimal or no risk: the large majority of AI in use, such as spam filters, for which the Act introduces no new rules.

The second idea to grasp is that obligations attach to your role, not your size. The Act distinguishes between a provider, which develops an AI system, or has one developed, and places it on the market or puts it into service under its own name, and a deployer, which uses an AI system under its authority in a professional context.

Most UK businesses using tools such as Copilot or ChatGPT at work are deployers. A business that builds an AI product, or offers one under its own name, is a provider. The same business can be both.

One common misunderstanding is worth clearing up early. The rules for general-purpose AI models that took effect in August 2025 fall mainly on the companies that develop those models, not on businesses that simply use the tools built on them. However, the ungoverned use of these models can inadvertently lead to breaches of other regulations, specifically those around data and privacy.

Why Brexit is not an exemption

Article 2 of the Act sets out who it applies to, and it is deliberately not limited to businesses based in the EU. It covers providers placing AI systems on the EU market or putting them into service there “irrespective of whether those providers are established or located within the Union or in a third country”. It covers deployers located in the EU. And it covers providers and deployers located outside the EU “where the output produced by the AI system is used in the Union”.

For a UK business, that creates three routes into scope.

  1. You supply AI into the EU. A UK software company selling an AI-enabled product to EU customers is a provider placing it on the EU market. If the product is high-risk, it must also appoint an authorised representative established in the EU before making it available there.
  2. You have a presence in the EU. An EU subsidiary or office using AI is a deployer located in the EU, wherever its parent company is based.
  3. Your AI output is used in the EU. This is the route that catches people out, because it can apply without any EU entity, EU servers or EU contract.

How far that third route reaches is less settled than many online guides suggest. The operative text refers to output “used in the Union”. The Act’s explanatory recital frames this as output “intended to be used in the Union” and explains that its purpose is to stop the rules being circumvented, for example by an EU business outsourcing a high-risk activity to an AI system run from outside the EU. Legal commentators continue to debate where the boundary sits.

Our practical reading is straightforward. If you knowingly produce AI output for EU customers, about people located in the EU, or for use in the EU, plan on the basis that the Act applies to that activity.

Northern Ireland is a live question in its own right. Under the Windsor Framework, the European Commission considers that parts of the Act apply there and has said it intends to propose that the rest should. The UK government’s position has been that its substantive provisions do not currently apply in Northern Ireland, and that they could only do so with UK agreement through the Withdrawal Agreement Joint Committee. At the time of writing, no such decision has been published. Businesses in Northern Ireland should keep this under close review.

Finally, the Act sits alongside UK law rather than replacing it. The UK has no equivalent AI statute, and commentators do not expect one before late 2027 at the earliest. UK GDPR continues to apply to personal data, and since 5 February 2026 the Data (Use and Access) Act 2025 has set out the safeguards required when significant decisions about people are made by automated means, in new Articles 22A to 22D of UK GDPR.

What applies, and when

The Act’s timetable was changed by an amending regulation, the Digital Omnibus on AI (Regulation (EU) 2026/1744), which came into force on 27 July 2026. Its main effect was to delay the high-risk rules. Many guides published before then still show the old dates, so it is worth checking the date on anything you rely on.

  • 1 August 2024. What applies: The Act enters into force. Nothing is yet enforceable against businesses.
  • 2 February 2025. What applies: Banned practices take effect, together with the AI literacy duty.
  • 2 August 2025. What applies: Rules for general-purpose AI models apply, alongside the governance and penalties framework.
  • 2 August 2026. What applies: Most of the Act applies, including the transparency obligations. The Commission’s AI Office and national authorities begin enforcement.
  • 2 December 2026. What applies: New bans apply to AI systems designed to create non-consensual intimate imagery or child sexual abuse material. Generative AI systems already on the market before 2 August 2026 must meet the machine-readable marking requirement.
  • 2 December 2027. What applies: High-risk rules apply to standalone uses listed in Annex III, such as recruitment, credit scoring, and life and health insurance pricing.
  • 2 August 2028. What applies: High-risk rules apply to AI built into products already covered by EU safety legislation, such as lifts and toys.

What this looks like in practice

Four short scenarios show how the Act can reach an ordinary UK business. Each turns on what the AI is used for and where its output goes, not on where the business is registered.

The campaign video

A UK firm uses AI to produce a video in which its managing director appears to deliver a message in French and German that she never recorded, for a campaign aimed at clients in Paris and Frankfurt. The Act defines a deep fake as AI-generated or manipulated content that resembles existing people, places or events and would falsely appear authentic. Under Article 50, a deployer publishing a deep fake must disclose that it has been artificially generated or manipulated. That has applied since 2 August 2026. Where content is evidently artistic, creative or satirical, the duty is lighter, but it does not disappear.

The recruitment tool

A UK professional services firm uses an AI tool to screen applications for its Dublin office. AI used to recruit or select people is listed as high-risk. From 2 December 2027, as deployer the firm must use the tool in line with the provider’s instructions, give human oversight to people with the competence and authority to exercise it, keep the system’s logs for at least six months, and tell candidates that AI is involved in decisions about them. If it also used the tool to make decisions about existing staff, it would need to inform them and their representatives before doing so. If the firm had built the tool and sold it to others in the EU, it would be the provider, with considerably heavier obligations and the need for an EU authorised representative.

The life and health insurance pricing model

A UK insurer uses an AI model to assess risk and set premiums for life or health cover sold to EU residents. That use is high-risk under Annex III. From 2 December 2027, before first use the insurer must also complete a fundamental rights impact assessment, an extra obligation that applies specifically to deployers of credit scoring and of life and health insurance pricing. The Commission’s draft guidance on high-risk classification indicates that adding a fraud-detection feature does not take such a system out of the high-risk category. Pricing for general lines, such as motor or home cover, is not on this list, although data protection law still applies to it.

The wellbeing tool

A UK firm with staff in an EU office trials software that analyses faces or voices on video calls to gauge stress or engagement. Using AI to infer the emotions of people in the workplace has been prohibited since 2 February 2025, except for medical or safety reasons. The Commission’s guidelines treat that exception narrowly: general wellbeing monitoring, including stress or burnout detection, does not qualify. This is a tool some businesses could buy with good intentions and find they cannot lawfully use.

It is equally important to recognise where the Act does not reach. A UK business that uses AI only internally, serves only UK clients, has no staff in the EU and produces no output intended for use there is unlikely to be in scope. Its obligations come from UK law instead.

AI literacy: the duty most likely to apply to you

Of everything in the Act, the AI literacy duty in Article 4 reaches the widest range of businesses, because it applies to every provider and deployer in scope, whatever the risk level of their AI. It has applied since 2 February 2025.

Its wording was revised in July 2026. Providers and deployers must now “take measures to support the development of AI literacy” of their staff and of others operating or using AI systems on their behalf, taking into account their knowledge, experience and training and the context in which the systems are used. The revised text adds that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”. The original wording required businesses to ensure, to their best extent, a sufficient level of AI literacy.

The duty, then, is to act sensibly and in proportion, not to certify every employee. A useful test is whether you could explain what you did, who it covered and why it suited the tools your people actually use.

What happens if you get it wrong

Penalties are set and enforced by EU Member States, within ceilings fixed by the Act:

  • up to €35 million or 7% of worldwide annual turnover for using a prohibited practice;
  • up to €15 million or 3% for breaching most other obligations, including the transparency rules;
  • up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information to authorities.

For most businesses the higher of the two figures is the ceiling. For SMEs, including start-ups, it is the lower. The Commission has also opened public channels for complaints and whistleblowing, so concerns can now be raised by customers, competitors or employees, not only by regulators.

Large numbers attract headlines, but they are not the best reason to act. When something goes wrong, the real questions will be whether you recognised the issue, whether you took reasonable and proportionate steps, and whether you can show that you did.

Simple actions every UK business should take now

  1. Map where your AI output goes. List the AI tools in use, including AI features added to software you already own, and note which ones touch EU customers, EU-based people or EU markets.
  2. Work out your role for each use. Are you building or branding AI as your own, which makes you a provider, or using someone else’s, which makes you a deployer? Putting your name on a high-risk system, or substantially modifying one, can turn a deployer into a provider.
  3. Rule out the banned practices now. These have applied since February 2025. Pay particular attention to any tool that claims to read emotions at work.
  4. Get transparency right for EU audiences. If you have built or branded a chatbot that EU customers use, make sure it is clear they are dealing with AI. If you publish deep fakes to EU audiences, disclose them.
  5. Flag high-risk uses early. Recruitment, credit scoring, and life and health insurance pricing are the uses most likely to matter to UK firms. December 2027 sounds distant, but contract renewals and supplier changes made in the meantime will shape your position.
  6. Put proportionate AI literacy measures in place, and record them. Short, role-relevant guidance on what AI can and cannot do, what must never be entered into it and when human judgement is required will go a long way.
  7. Ask your suppliers how they are meeting the Act. Where is your data processed, and how are their obligations being met? Expect your own EU clients to start asking you the same questions.
  8. Keep UK law in view. UK GDPR, and the Articles 22A to 22D safeguards for significant automated decisions, apply whether or not the EU Act does.

The EU AI Act is long and in places dense, but its core ideas are sensible ones: know where AI is being used, be open with people about it, take more care where lives and livelihoods are affected, and make sure the people using it understand it. A UK business that does those things well will already be most of the way there.

Legal position checked against the consolidated text of Regulation (EU) 2024/1689 as at 27 July 2026, incorporating the amendments made by Regulation (EU) 2026/1744. Reviewed October 2026. Application dates and the position in Northern Ireland are subject to change and should be re-checked before reliance.

This article provides general information for business leaders and does not constitute legal advice. Whether and how the EU AI Act applies to a particular business depends on its specific facts, and qualified legal advice should be taken where that is uncertain.

References

The Act and its amendments

Interpretation and guidance

Northern Ireland

UK law

ShareLinkedInEmail

Keep learning

ExplainerAI Adoption

AI agents explained: what businesses need to know

A chatbot tells you something. An AI agent does something. What agents are, why adoption is accelerating and what real incidents teach about the risks.

Phil Evans

Co-Founder & CEO

Getting Started

ExplainerAI Governance

AI governance vs compliance: what’s the difference?

Governance and compliance are often treated as the same thing. They are not, and mixing them up leads businesses to invest in the wrong thing first.

Phil Evans

Co-Founder & CEO

Getting Started

ExplainerAI Regulation

EU AI Act implementation: key dates and milestones

Every EU AI Act milestone, updated for the July 2026 Digital Omnibus: what already applies, what starts next and who each date affects.

Phil Evans

Co-Founder & CEO

Building Capability

Put it into practice

The AI Jargon Buster

Starter PackAI Adoption

The AI Jargon Buster

Twenty words you will hear in every AI conversation, in plain English. What each one actually means, and a way to picture it

Isaac Ward

AI Practitioner · 14 Oct 2026

Free downloadGetting Started

Stay informed

A short monthly briefing on the AI developments that actually matter for your business. No sales pitches.

Monthly. Unsubscribe in one click. We never share your details.