In short: Brexit does not take UK businesses out of scope. If you sell an AI system into the EU, or the output of your AI is used in the EU, the Act can apply to you. Most everyday business AI is low risk and needs little more than transparency and staff training, but AI used in hiring, credit, education or safety-critical products carries heavy obligations.
Does the EU AI Act apply to a UK business?
The Act applies by where AI is placed on the market or used, not where the company is based. A UK business is likely to be in scope if it:
- sells or supplies an AI system to customers in the EU (you are a provider);
- uses an AI system whose output is used in the EU, for example screening applicants for an EU office (you may be a deployer or a provider);
- builds AI into a product, such as a machine or medical device, that is sold in the EU.
A business that only uses AI inside the UK, for UK customers, is outside the Act. It still has to follow UK law, including UK GDPR, the Equality Act 2010 and sector rules.
Non-EU providers of high-risk systems and of general-purpose AI models must appoint an authorised representative in the EU before placing them on the EU market.
The four risk levels
| Level | Examples | What you must do |
|---|---|---|
| Prohibited | Social scoring; harmful manipulation or deception; exploiting people’s vulnerabilities; emotion recognition at work or in education; untargeted scraping of facial images; predicting crime from profiling alone | Do not use. Eight practices banned since February 2025; a ninth (non-consensual sexual content and child abuse material generators) from December 2026. |
| High risk | AI in recruitment and staff management, credit scoring, life and health insurance pricing, education and exams, critical infrastructure, biometrics, and safety components of regulated products | Risk management, data governance, technical documentation, logging, human oversight, accuracy and security testing, conformity assessment and registration |
| Transparency | Chatbots, AI-generated images, audio or video (deepfakes), AI-generated text published to inform the public | Tell people they are dealing with AI; label synthetic content |
| Minimal | Spam filters, product recommendations, most internal productivity tools | No specific duties beyond AI literacy; voluntary codes encouraged |
Separate rules apply to providers of general-purpose AI models, such as large language models. If you use a model from a major provider through an API, those duties sit mainly with the model provider, not with you.
Key dates
- 1 August 2024: the Act entered into force.
- February 2025: the first eight prohibited practices banned; AI literacy duty begins.
- August 2025: rules for general-purpose AI models apply.
- August 2026: transparency rules apply, for example telling people they are talking to a chatbot and labelling AI-generated content.
- December 2026: a ninth prohibition, added by the AI Omnibus, applies: AI systems that generate non-consensual sexually explicit content or child sexual abuse material.
- 2 December 2027: obligations for high-risk AI systems apply, as amended by the AI Omnibus. AI built into products covered by EU product safety law follows its own timetable.
The EU's AI Omnibus changed several of the original dates in 2026. Check the Commission’s current timetable before you plan around a deadline.
Obligations if you deploy a high-risk system
Most SMEs will be deployers, using a system built by someone else. As a deployer you must:
- use the system according to the provider’s instructions;
- assign human oversight to people with the competence, training and authority to intervene;
- make sure input data you control is relevant and representative;
- monitor the system and report serious incidents to the provider and the authorities;
- keep the logs the system generates for at least six months;
- tell workers and their representatives before using high-risk AI at work, and tell people when a high-risk system makes or helps make decisions about them;
- carry out a fundamental rights impact assessment if you are a public body, provide public services, or use AI for credit scoring or life and health insurance pricing.
Penalties
Maximum fines are €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for most other breaches, and €7.5 million or 1% for supplying incorrect information to authorities. For SMEs and start-ups, each fine is capped at whichever of the two figures is lower.
Support for small businesses
- Priority, free access to AI regulatory sandboxes run by EU member states.
- A simplified form of technical documentation for small providers.
- Conformity assessment fees reduced in proportion to company size.
How the UK approach differs
The UK has no single AI law. Existing regulators, including the ICO, FCA, CMA and Ofcom, apply five principles within their own remits: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress. In practice, UK GDPR is the rule most likely to bite: you need a lawful basis for personal data used in AI, a data protection impact assessment for high-risk processing, and safeguards when decisions with legal or similarly significant effects are automated.
A five-step plan
- List every AI system you build, buy or use, including AI features inside tools such as your CRM or HR software.
- Check the EU link for each one: do you sell it in the EU, or is its output used there?
- Classify the risk using the four levels above, and stop anything that could be prohibited.
- Close the gaps: transparency notices for chatbots and generated content, human oversight and logging for high-risk uses, and supplier evidence for bought-in systems.
- Train your people: the AI literacy duty already applies to providers and deployers in scope.
Our AI governance checklist turns these steps into a one-page action list.
This guide is general information, not legal advice. For decisions about a specific system, take advice from a qualified lawyer. Sources: Regulation (EU) 2024/1689, UK AI regulation white paper, ICO guidance.