EU AI Act compliance: what UK businesses need to do

For two years, every AI vendor's webinar ended on the same slide: 2 August 2026, the day EU AI Act compliance gets real. Then, shortly before it arrived, the EU moved the biggest part of it.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted on 8 July 2026, published on 24 July and in force from 27 July. It pushed the high-risk rules back to December 2027 and August 2028. Plenty of the articles still ranking for this topic haven't caught up.

This is not legal advice; for a decision about a specific AI system, speak to a qualified lawyer.

The short answer: the EU AI Act applies to a UK business if you place AI systems on the EU market, or if the output of your AI system is used in the EU. For most UK SMEs using AI tools, compliance today means staff AI literacy, avoiding banned practices and transparency, such as telling people they're talking to a chatbot. The heavy high-risk duties start on 2 December 2027.

Key dates, as of October 2026:

• 2 February 2025: banned practices and AI literacy apply.
• 2 August 2026: transparency rules, most other provisions and enforcement apply.
• 2 December 2027: high-risk rules for Annex III uses such as hiring and credit scoring.
• 2 August 2028: high-risk rules for AI built into regulated products.

Does the EU AI Act apply to UK businesses?

Often, yes. Brexit took the UK out of the EU's rulebook. It didn't take UK businesses out of the EU market, and the Act is written to follow the market.

Article 2 sets the scope. The limbs that matter for UK firms:

• Providers placing AI systems on the EU market or putting them into service there, wherever they're established.
• Providers and deployers in a third country, such as the UK, where the output produced by the AI system is used in the EU.
• Deployers established in the EU. If you have an EU subsidiary, it's a deployer in its own right.

That second limb catches more than people expect. A UK recruitment firm scoring candidates for a client in Dublin, or a UK lender assessing applicants in Spain, is producing output used in the EU.

A UK-only workflow may fall outside the Act, but check all relevant Article 2 connections, including provider, importer, distributor and product-manufacturer roles, EU establishments and outputs used in the EU. The customer's billing address alone does not settle scope. UK obligations still apply.

What is the AI Act timeline after the Digital Omnibus?

Here's the timeline as it stands, from the amended Article 113 and the Commission's own AI Act Service Desk.

Two details are easy to miss. First, Article 50 transparency was not delayed; only existing generative systems got until 2 December 2026 for the machine-readable marking in Article 50(2). Second, under the amended Article 111, a high-risk system already on the market before its deadline is caught only if its design changes significantly after that date. The delay is a reprieve for high-risk AI, not an amnesty for everything else.

Are you a provider or a deployer?

This is the question that decides your workload, so answer it for each system separately.

A provider develops an AI system, or has one developed, and puts it on the market under its own name. A deployer uses an AI system under its authority in a professional capacity. If you use Copilot to draft proposals, Microsoft is the provider and you're the deployer.

The trap is Article 25. A deployer becomes the provider of a high-risk system if it puts its own name or trademark on it, makes a substantial modification, or changes the intended purpose of a general-purpose system so that it becomes high-risk. Wrap a general-purpose model in your own branded CV-screening product, and you may have just become a provider of a high-risk system. That's a different scale of obligation. If you're weighing that path, read build vs buy AI with this in mind.

What does EU AI Act compliance require right now?

For a typical UK business in scope as a deployer, four things apply today.

AI literacy. Article 4, as amended by the Omnibus, requires providers and deployers to take measures to support the AI literacy of their staff. The Omnibus text says this doesn't require you to guarantee any specific level of literacy for each person. Training proportionate to how people use AI, and a record that you did it, is the sensible reading. My guide to AI training for employees covers what works.

No prohibited practices. The Article 5 bans cover things like manipulative techniques that cause harm, social scoring and emotion recognition in workplaces and schools (with narrow exceptions). Few SMEs go near these, but check any HR or monitoring tool you buy.

Transparency. Article 50 requires providers to design systems so people know they're interacting with AI. Deployers must disclose deepfakes, disclose AI-generated text published to inform the public unless it has undergone human review or editorial control and a natural or legal person holds editorial responsibility, and inform people exposed to emotion recognition or biometric categorisation. If you put a branded chatbot or AI receptionist in front of EU customers, make it say what it is.

Your AI inventory. Not a named article, but you can't show compliance without knowing what you run and where its output goes.

What if your AI system is high-risk?

First confirm classification under Article 6, including its conditions and exceptions. An Annex III heading alone is not the entire test. The principal deadline for those high-risk duties is 2 December 2027; the regulated-product route has a different deadline.

Annex III lists the high-risk uses. The ones UK SMEs actually meet are employment (screening CVs, evaluating candidates, decisions on promotion, termination and performance monitoring), credit scoring, and risk assessment and pricing for life and health insurance. Education and biometrics are also on the list.

As a deployer of a high-risk system, Article 26 will require you to use it according to the provider's instructions, assign competent human oversight, check input data you control, monitor it, keep its logs for at least six months, tell workers' representatives before using it in the workplace, and inform people that it's being used to make decisions about them.

Providers carry far more: risk management, technical documentation, conformity assessment and registration. A UK provider of a high-risk system also needs an EU-based authorised representative under Article 22, appointed in writing before the system goes on the EU market. The Omnibus eased some of this for SMEs and the new small mid-cap category, including simplified technical documentation and a lighter quality management system.

Fines under Article 99 reach up to €35 million or 7% of worldwide turnover for prohibited practices, and up to €15 million or 3% for most other breaches, including transparency. For SMEs and qualifying small mid-cap enterprises, the amended rule uses the lower applicable cap.

Is there a UK equivalent of the EU AI Act?

The UK approach described here uses existing sector and data-protection rules rather than treating the EU AI Act as UK law. Its approach, set out in the government's February 2024 response, asks existing regulators such as the ICO, FCA and CMA to apply five principles: safety, transparency, fairness, accountability, and contestability and redress.

The rule with real teeth is data protection. Section 80 of the Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A to 22D, in force since 5 February 2026. Significant decisions made solely by automated means are allowed in more cases now, but you must give people information about the decision and let them make representations, obtain human intervention and contest it. Decisions based on special category data stay tightly restricted. The ICO consulted on draft guidance on automated decision-making from 31 March to 29 May 2026.

So a UK firm using AI to screen job applicants already has UK duties today, and EU high-risk duties from December 2027 if the output reaches the EU. Build one process that satisfies both.

My take

Most UK SMEs are deployers with modest duties. If your AI use is drafting, summarising and a disclosed chatbot, compliance is literacy, transparency and good records. Anyone selling you a five-figure "AI Act readiness programme" for that profile should explain exactly which obligations it covers.

The risk sits in HR and finance. A failure pattern to watch for: a business buys an HR platform with AI candidate ranking switched on and nobody records it as an AI system. That's an Annex III use. Find those now, while you have time to talk to the vendor about their compliance plans.

Don't read the delay as permission. The Omnibus moved dates. The obligations themselves are still in the text, and more Commission guidance is on its way. A year is a short time to fix a hiring process you didn't know was high-risk.

How to get ready for EU AI Act compliance

1. Map your EU exposure. List EU entities, EU customers, and any AI output that lands in the EU.
2. Build the AI inventory. Every tool and feature, what it does, which data it touches. My AI governance framework guide has a register template.
3. Label each system provider or deployer. Watch for Article 25: your own brand, substantial changes or a new high-risk purpose make you the provider.
4. Flag anything on Annex III. Hiring, performance, credit and insurance pricing first.
5. Close today's gaps. Record AI literacy training, make chatbots disclose themselves, label deepfakes and unedited AI public content.
6. Ask your vendors. For each high-risk tool: their AI Act classification, their compliance plan for December 2027 and what instructions for use they'll give you.
7. Align with UK automated decision-making rules. Build information, representation, human review and challenge into any significant automated decision.
8. Diarise the dates. 2 December 2026 for generative marking, 2 December 2027 for Annex III, and a review each time the Commission publishes guidance.

Frequently asked questions

Does the EU AI Act apply to UK companies after Brexit? It can. It applies to UK providers placing AI systems on the EU market and to UK providers and deployers whose AI output is used in the EU. Customer location alone is not a complete scope test; check the roles and connections listed in Article 2.

Was the EU AI Act delayed? Partly. The Digital Omnibus moved high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products. The bans, AI literacy and Article 50 transparency rules were not delayed.

Do I need to tell customers they're talking to an AI chatbot? Under Article 50, providers must design AI systems that interact with people so those people know it's AI, unless that's obvious. If you build or brand a chatbot used by people in the EU, plan to disclose it clearly at the start of the conversation.

What are the fines under the EU AI Act? Up to €35 million or 7% of worldwide turnover for prohibited practices, and up to €15 million or 3% for most other breaches. SMEs face whichever of the two amounts is lower.

Is there an EU AI Act compliance checker? The European Commission's AI Act Service Desk publishes the official timeline and guidance and is the safest starting point. Treat third-party checkers as a first pass, then confirm classification against the Act's text or with a lawyer.

Sources

• Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union, 24 July 2026
• Timeline for the implementation of the EU AI Act, European Commission AI Act Service Desk
• EU AI Act Article 2, Article 4, Article 22, Article 25, Article 26, Article 50, Article 99 and Annex III, European Commission AI Act Service Desk
• Data (Use and Access) Act 2025, section 80, legislation.gov.uk
• Data (Use and Access) Act 2025 commencement regulations, SI 2026/82, February 2026
• Consultation on draft guidance about automated decision-making, including profiling, ICO, 2026
• A pro-innovation approach to AI regulation: government response, DSIT, 6 February 2024

If you need to work out which of your AI systems the Act touches, and what to do about the ones that matter, let's talk.