Does the EU AI Act apply to your UK business?
The EU AI Act is now in force, with obligations landing in stages through 2026 and beyond. Many UK owners assume it stops at the Channel. For a good number of them, it does not. Here is a plain English guide to whether it touches your business, and what to do about it.
Why a UK business can still be caught
The Act can reach beyond the EU. If you sell products or services into the EU, or the results your AI produces are used by people in the EU, you can fall within its scope even though you are based in the UK. Businesses that serve customers in Ireland and across Europe should look closely.
Alongside this, the UK is shaping its own approach to AI. So even where the EU Act does not reach you, the direction of travel is clear. Getting your house in order now is far easier than scrambling later.
How the Act sorts AI by risk
Banned uses
A small set of uses are simply prohibited, such as certain kinds of manipulation and social scoring. Most ordinary businesses will never go near these.
High risk uses
AI used in sensitive areas such as recruitment, credit and safety carries the heaviest obligations. If this is you, it needs proper attention.
Limited risk
Many everyday uses simply require you to be transparent, for example telling people when they are dealing with AI.
Minimal risk
The large majority of business uses fall here, with few formal obligations beyond good practice.
The dates that matter
The Act arrives in phases. The first prohibitions and some duties have already taken effect, rules for general purpose AI have followed, and the heavier obligations for high risk systems phase in across 2026 and into 2027. Exact dates continue to be confirmed, so the sensible move is to check where your own use sits rather than assume a single deadline.
The point is not to panic about one date. It is to know which category your use falls into, because that decides whether you have a little to do or a lot.
What most SMEs actually need to do
Know where you use AI
Make a simple list of where AI touches your business. You cannot manage what you have not mapped.
Check your risk category
For each use, work out whether it is minimal, limited or high risk. Most will be low.
Be transparent
Where people interact with AI, tell them. Clear labelling covers a lot of the limited risk duties.
Keep humans accountable
Make sure a person remains responsible for decisions that affect people, not the software.
Keep records
Note what you use, why, and how you keep it safe. Good records make any future check simple.
Watch the UK rules too
Keep half an eye on the UK approach as it develops, so you are never caught out.
How we help
We help you map where you use AI, work out which category each use falls into, and put the transparency, oversight and records in place so you can adopt AI with confidence rather than worry. This page is general guidance and not legal advice, so for a formal opinion we will point you to a suitable specialist, but for the practical work of getting ready, we can do the heavy lifting with you.
Common questions
Does the EU AI Act apply to UK companies?
It can. If you sell into the EU, or the output of your AI is used by people in the EU, you may fall within its scope even though you are UK based. Businesses serving Irish and European customers should look carefully.
We only sell in the UK, are we affected?
You are less likely to be directly caught by the EU Act, but the UK is developing its own approach, so good practice now saves trouble later. It is still worth mapping where you use AI.
What counts as high risk AI?
AI used in sensitive areas such as recruitment, credit scoring, education and safety tends to be high risk. Everyday uses like answering enquiries usually are not.
What are the penalties?
Penalties for the most serious breaches can be significant, which is why it is worth knowing your category. Most ordinary business uses sit in the low risk band with light obligations.
Is the UK bringing in its own AI law?
The UK is shaping its own approach to regulating AI. It is sensible to keep an eye on it as it develops, even while the EU Act is the immediate focus for firms trading into Europe.
What should we do first?
Make a simple list of where AI touches your business and work out the risk category of each use. That one step tells you whether you have a little to do or a lot.
More from our consultancy
Adopt AI with confidence
Book an AI compliance review and we will help you work out what, if anything, the rules mean for your business.