Does the EU AI Act Apply to UK Businesses?

Guidance, not legal advice. This article explains the EU AI Act in plain English for UK organisations. It reflects the position at the time of publication, including the AI Omnibus amendments. For decisions about your own obligations, take legal advice.

When the EU AI Act was passed, many UK businesses filed it under "European problems". Brexit, after all, meant EU law no longer applied here. For a growing number of organisations, that assumption is wrong.

The AI Act is written to follow AI wherever it goes. If you sell an AI product to customers in Paris, if your chatbot answers questions from people in Dublin, or if your team in Amsterdam uses AI to screen job applicants, the Act can apply to you. Being based in Manchester does not change that.

This guide explains when the Act reaches UK businesses, how to work out your role, what the risk tiers mean, how the UK's own approach differs and five practical steps to take this quarter.

The Short Answer: Often Yes, if Your AI Touches the EU

Like GDPR before it, the AI Act has extraterritorial reach. Article 2 sets out who is covered, and three routes matter most for UK organisations:

• You place AI on the EU market. Providers that sell or supply AI systems or general purpose AI models in the EU are covered wherever they are established.
• Your AI output is used in the EU. Providers and deployers outside the EU are covered when the output of their AI system is used in the EU. A UK firm running an AI credit check on EU applicants is an example.
• You operate in the EU. An EU office or subsidiary that uses AI in its work is a deployer in its own right.

Three quick examples show how this plays out in practice:

• A Leeds software company sells an HR platform with an AI feature that ranks candidates. It has customers in Germany. It is a provider of a likely high-risk system on the EU market.
• A London lender uses an AI model to assess credit applications from customers in Ireland. The output is used in the EU, so the lender is in scope as a deployer, and possibly as a provider if it built the model.
• A Bristol retailer uses a generative AI chatbot on a website that only serves UK shoppers. On those facts, the Act is unlikely to apply directly.

Importers and distributors that bring AI products into the EU are also covered. If none of these apply, the Act is unlikely to bind you directly, although EU customers may still ask how you govern AI as part of their own due diligence.

Providers, Deployers and Importers: Which Are You?

The Act assigns duties by role, so the first job is to work out which role you play for each AI system. Many organisations play more than one.

Most UK businesses that buy AI tools will be deployers. That is the lighter role, but it still carries duties, particularly for high-risk uses: following the provider's instructions, assigning human oversight, monitoring how the system performs and keeping logs.

The line between deployer and provider is easier to cross than many people expect. If you put your own brand on an AI system, make a substantial modification to it or change its intended purpose so that it becomes high risk, you can take on the provider's obligations. A team that takes a general purpose model and builds it into a hiring tool sold to clients is a provider of that tool.

Providers based outside the EU that place high-risk systems on the EU market must also appoint an authorised representative in the EU, who acts as the contact point for regulators. Providers of general purpose AI models have a similar duty.

The Risk Tiers in Plain English

The Act does not regulate all AI in the same way. It sorts AI uses into four tiers based on the harm they could cause, and the obligations rise with the risk.

Unacceptable Risk

A short list of practices is banned outright, and has been since February 2025. It includes social scoring, AI that exploits people's vulnerabilities, untargeted scraping of facial images to build recognition databases and emotion recognition in the workplace or in education, with narrow exceptions. From 2 December 2026, the AI Omnibus adds bans on AI that generates child sexual abuse material or non-consensual intimate images of real people.

High Risk

This is where most of the compliance effort sits. High-risk systems include AI used in recruitment and managing workers, credit scoring, access to education, access to essential services, critical infrastructure and some biometric uses. Providers must run a risk management system, use high quality data, keep technical documentation, build in human oversight and logging, and complete a conformity assessment before placing the system on the market.

Limited Risk

Some AI carries transparency duties rather than heavy controls. People must be told when they are talking to a chatbot, deepfakes must be labelled and AI generated content must be marked in a machine-readable way. These duties have applied since August 2026, although generative systems already on the market before then have until 2 December 2026 to add marking.

Minimal Risk

Most everyday AI, such as spam filters, recommendation engines and AI in games, falls here and carries no new legal duties. The AI literacy duty, which asks organisations to support staff in understanding the AI they use, applies more broadly.

When Each Obligation Applies

The Act is being phased in. In 2026 the EU adopted the AI Omnibus, Regulation (EU) 2026/1744, a set of amendments that pushed back the high-risk deadlines to give standards and guidance time to catch up. The timeline below shows the dates as they stand after those changes. The next milestone is highlighted automatically.

The delay to the high-risk rules is welcome breathing space, not a reason to wait. Building an inventory, assigning owners and assessing risk takes months, and EU customers are already asking these questions in procurement.

How the UK Approach Differs

The UK has taken a very different route. Rather than one AI law, it relies on existing regulators, such as the ICO, the FCA, the CMA and Ofcom, to apply a set of cross-sector principles within their own areas: safety, transparency, fairness, accountability and the ability to challenge decisions.

There is no UK equivalent of the AI Act at the time of writing. Successive governments have discussed legislation focused on the most powerful AI models, but no government AI bill has been passed. In the meantime, data protection law does a lot of the work. The Data (Use and Access) Act 2025 updated the rules on automated decision-making, and the ICO is developing a statutory code of practice on AI and automated decision-making.

For UK businesses with EU exposure, the practical result is that the EU Act is often the stricter standard. Many organisations choose to build one AI governance programme that meets the EU requirements and maps easily onto UK expectations, rather than running two.

Five Steps to Take This Quarter

You do not need to solve everything at once. These five steps give you a defensible position and a clear plan.

1. Build an AI inventory. List every AI system and model in use, including tools staff have adopted on their own. Our 90-day plan for shadow AI shows how to find them.
2. Map your EU touchpoints. For each system, note whether it is sold into the EU, used by EU staff or produces output used in the EU.
3. Assign a role and a risk tier. Decide whether you are a provider, deployer, importer or distributor for each system, and whether any use could be high risk.
4. Give every AI use an owner. Someone senior should be accountable for each system, its risks and its documentation.
5. Put a management system around it. Policies, risk assessments, supplier checks and staff training turn one-off answers into a repeatable process. ISO/IEC 42001 provides a recognised framework for this.

Those steps also reduce security risk. AI tools that nobody knows about are a common route for sensitive data to leave the organisation, as our research into shadow AI shows.

How Cybergen Can Help

Cybergen helps UK organisations govern AI in a way that satisfies customers, regulators and their own boards, without slowing the business down:

• AI governance, risk and compliance: inventory, classification against the EU AI Act and a prioritised plan
• ISO consultancy, including ISO/IEC 42001 gap analysis and certification support
• AI security testing and controls for the AI systems you build and use
• Supplier risk management for the AI vendors you rely on

If you would like a clear view of where the AI Act touches your business, speak to our team.

EU AI Act application dates and the UK's approach to AI regulation are subject to change. This guidance reflects the position as at 11 November 2026 and is not legal advice.

Frequently Asked Questions