Guide
The EU AI Act: A UK Business Guide
The EU AI Act is the world's first comprehensive law regulating artificial intelligence. It can apply to UK businesses even though the UK has left the EU. It works on a risk based system: the more potential an AI use has to affect people, the more obligations it carries. As of August 2026, the ban on prohibited AI practices and the rules for general purpose AI models are already in force. The toughest obligations, for high risk systems, were pushed back by a 2026 reform. They now land in December 2027 and August 2028. This guide explains what it means for a UK business in plain English. We keep it updated as the timeline moves, because it has already moved once this year.
Key takeaways
The EU AI Act can apply to a UK business if your AI touches people in the EU. It does not matter whether you have any EU presence
Most businesses are not building the high risk systems the Act is toughest on. Establishing that clearly is often most of the work
The toughest deadlines were pushed back in 2026
High risk obligations now land in December 2027 and August 2028, not August 2026 as first planned.
The bans on prohibited practices and the rules for general purpose AI models are already in force. Those models include the ones behind tools like ChatGPT and Claude
What the EU AI Act actually is
The EU AI Act is formally Regulation (EU) 2024/1689. It is the first comprehensive AI regulation anywhere in the world. It entered into force on 1 August 2024. Its obligations arrive in phases rather than all at once, which is a large part of why it causes confusion. It can reach beyond the EU's own borders. So many UK businesses now call it "the UK AI Act question", even though there is no separate UK AI Act. The UK currently regulates AI through existing law and sector specific guidance rather than a single dedicated statute.
The Act does not ban AI, and it does not require a licence to use it. Instead it takes a risk based approach. Nearly every use of AI is permitted. The law asks how much freedom the AI has, in what context, and how much it could affect a person's rights, safety or opportunities. Systems judged higher risk carry more obligations. Most everyday business uses of AI sit well below that line.
The regulation is significant, but for most UK businesses the practical work is establishing where you sit. It is not a huge compliance programme. A large share of businesses find, correctly, that their AI use falls into the lower risk categories with comparatively light obligations.
Does the EU AI Act apply to UK businesses?
Yes, it can. This catches a lot of UK businesses off guard. It is easy to assume that leaving the EU means EU law no longer touches you. The EU AI Act has extraterritorial scope, similar in principle to GDPR. It applies based on where the AI's effects land, not where the company is based. If your business offers a product or service that uses AI to people or organisations in the EU, the Act can apply to you. The same is true if the output of your AI system is used within the EU. It does not matter where your company is headquartered.
A UK software company selling an AI powered tool to EU customers is in scope. A UK retailer with no EU customers and no EU operations, using AI only internally on UK data, generally is not. The honest, practical answer for most UK SMEs is "probably not yet, or only lightly". It is still worth checking properly rather than assuming. The businesses that need to pay close attention fall into three groups. They sell AI enabled products into the EU. They process EU customers' data through AI. Or they run AI systems that EU based users interact with directly.
The four risk tiers, explained
| Tier | What it covers | What it means for you |
|---|---|---|
| Unacceptable risk | Banned outright. Examples: social scoring by public authorities, exploiting children or vulnerable groups, most real time biometric surveillance in public, emotion recognition in workplaces and schools | Already banned since February 2025. Almost no ordinary business is anywhere near this tier |
| High risk | AI used in things like recruitment decisions, credit scoring, critical infrastructure, medical devices, and law enforcement | The heaviest obligations: documentation, testing, human oversight, conformity assessment. Deadlines pushed to December 2027 and August 2028 |
| Limited risk (including general purpose AI) | Chatbots, AI generated content, and general purpose models like the ones behind ChatGPT and Claude | Mainly transparency duties: telling people they are interacting with AI, labelling AI generated content. Already in force since August 2025 for providers of general purpose AI |
| Minimal risk | The vast majority of everyday business AI use: spam filters, recommendation features, most internal productivity tools | No specific obligations beyond general good practice. Most SME use of AI sits here |
Most UK businesses using AI day to day sit in minimal or limited risk. That covers an assistant for drafting, a chatbot for support or an internal automation. High risk is a smaller, specific category. It covers AI making or strongly influencing decisions about people's access to jobs, credit, essential services or safety.
The timeline, and what changed in 2026
| Date | What happens | Status |
|---|---|---|
| 1 August 2024 | The Act enters into force. The regulation becomes law, with obligations phased in over the following years rather than applying at once. | In force |
| 2 February 2025 | Prohibited practices are banned. The unacceptable risk category becomes illegal. That covers social scoring, manipulative AI and most public biometric surveillance. | In force |
| 2 August 2025 | General purpose AI rules apply. Transparency obligations take effect for providers of general purpose AI. That covers the models behind tools like ChatGPT, Claude and Gemini. | In force |
| 2 August 2026 | Enforcement begins in earnest. National authorities and the EU AI Office start actively enforcing what is already in force. This is where we are now. | In force |
| 2 December 2027 | High risk obligations (Annex III). Originally due August 2026. A 2026 simplification package, the "Digital Omnibus", pushed this back by 16 months to give businesses more time to prepare. | Changed in 2026 |
| 2 August 2028 | High risk obligations (Annex I, AI built into regulated products). This covers AI in medical devices, machinery and lifts. It was also pushed back by a year under the same reform. | Changed in 2026 |
What a UK business should actually do
Work out if it applies to you
Do you serve customers or users in the EU with anything AI powered? If not, your exposure is limited. If yes, it is worth a proper check rather than a guess.
Map what AI you actually use
You cannot assess risk tier by tier without a real inventory of the AI in use across the business. Include tools staff have adopted informally.
Classify honestly
Most businesses find that most of their AI use sits in minimal or limited risk. Establishing that clearly, and writing down why, is valuable in itself.
Address what is already in force
If you use tools built on general purpose AI, check that you are meeting the transparency obligations that have applied since August 2025.
Plan for what is coming, calmly
If you do have high risk uses, you now have until December 2027 or August 2028. That is real time to prepare properly rather than scramble.
Get it checked properly
An AI compliance review gives you a clear, honest position rather than a guess.
Penalties for non compliance
The fines are set so that GDPR's penalties look modest. Breaching the ban on prohibited AI practices carries fines of up to €35 million or 7% of global annual turnover, whichever is higher. Most other breaches carry fines of up to €15 million or 3% of global turnover. These are maximums, not typical outcomes. They do show how seriously the framework is meant to be taken.
For most UK SMEs, the realistic risk is not a dramatic fine out of nowhere. It is the more everyday cost of an unclear position. A client or partner asks during due diligence whether your AI use is compliant, and you have no clear answer. That is usually the moment this becomes urgent. It is entirely avoidable with a proper assessment done in advance.
Questions people ask about the EU AI Act
What is the EU AI Act?
The EU AI Act is formally Regulation (EU) 2024/1689. It is the world's first comprehensive law regulating artificial intelligence. It takes a risk based approach and sorts AI systems into four tiers: unacceptable, high, limited and minimal risk. Obligations grow with how much the AI could affect people's rights, safety or opportunities. It entered into force on 1 August 2024, with obligations phased in over several years.
Does the EU AI Act apply to the UK?
It can. The Act has extraterritorial scope, similar to GDPR. It applies based on where the AI's effects land rather than where the company is based. A UK business can be in scope even with no EU presence. That is the case if it offers an AI powered product or service to people or organisations in the EU. A UK business using AI only internally on UK data generally is not.
When does the EU AI Act come into force?
It entered into force on 1 August 2024, but obligations arrive in phases. Prohibited practices were banned from February 2025. General purpose AI rules applied from August 2025. Enforcement began in earnest on 2 August 2026. The toughest high risk obligations were pushed back during 2026 to December 2027 and August 2028. This page is kept updated as those dates move.
Is the EU AI Act in force right now?
Yes, in part. The ban on prohibited practices and the rules for general purpose AI models are already in force and being enforced. The high risk obligations are the heaviest part of the Act. They are not yet in force. A 2026 reform deferred them to December 2027 and August 2028.
What does the EU AI Act regulate?
It regulates AI systems by risk tier. It bans unacceptable risk uses outright. It sets strict requirements for high risk uses, such as AI in recruitment or credit decisions. It requires transparency for limited risk uses, like chatbots and general purpose AI models. It leaves minimal risk uses, which are most everyday business AI, largely unregulated beyond general good practice.
Do we need to do anything right now?
Most UK SMEs should at least work out honestly whether the Act applies to them. If it does, they should work out which risk tier their AI use falls into. If you use general purpose AI tools, check that you are meeting the transparency obligations in force since August 2025. Anything in the high risk category has a realistic runway to December 2027 or August 2028 to prepare properly.
Get a clear, honest position on where you stand
This guide gives you the general picture. A free consultation gets you a specific read on your business. We will tell you whether the Act applies to you and what risk tier your AI use falls into. We will also tell you what, if anything, you need to do.
Check where you stand on the Act
The first call is free. We tell you whether the Act touches your business and what to do first.