THE EU AI ACT IS BECOMING APPLICABLE: WHY SHOULD UK BUSINESSES CARE?
The EU AI Act – formally Regulation (EU) 2024/1689 – was adopted in June 2024 and entered into force on 1 August 2024. However, its provisions have become applicable in stages.
In February 2025, the rules on prohibited AI practices and AI literacy started to apply. Other important provisions, including the transparency obligations, apply from August 2026.
And where there are obligations, possible sanctions usually follow.
But I am in the UK. Why should I mind?
This is a reasonable question.
The United Kingdom has left the European Union and, unlike the EU, has not adopted a piece of legislation equivalent to the AI Act.
However, this does not necessarily mean that UK businesses are outside its scope.
Does the EU AI Act apply to UK businesses?
The short answer is: generally no, but it may.
The AI Act may apply to a UK business where it places an AI system or a general-purpose AI model on the EU market. It may also apply to providers and deployers established outside the EU where the output produced by their AI system is used within the EU.
Therefore, if your business operates exclusively within the UK and its AI systems and outputs have no connection with the EU, you may probably stop reading here – and we wish you a pleasant day.
However, if you sell AI-enabled products in the EU, provide AI systems to EU customers, or use AI to produce outputs intended for the European market, you should continue reading.
When does a UK company need to comply?
The first step is to understand what kind of AI system your business provides or uses.
Under the AI Act, a company may be a provider, meaning broadly the enterprise that develops an AI system, or has it developed, and places it on the market under its own name or trademark.
Alternatively, it may be a deployer: a business that uses an AI system in the course of its activities.
The second step is to assess the level of risk associated with the system.
Certain AI practices are prohibited. These include harmful manipulation, exploitation of certain vulnerabilities, social scoring, emotion recognition in workplaces and educational institutions, and some forms of real-time remote biometric identification in publicly accessible spaces.
Other systems are classified as high-risk. These may include AI used for recruitment and employee management, creditworthiness assessments, access to essential services, certain biometric applications, and AI used as a safety component in regulated products such as certain medical devices or machinery.
Therefore, high-risk AI systems are not prohibited, they are subject to requirements relating to risk management, data governance, technical documentation, record-keeping, transparency, accuracy, cybersecurity and human oversight.
What if my business only uses a chatbot or generative AI?
Even where a system is neither prohibited nor high-risk, transparency obligations may apply.
For example, people interacting directly with an AI system, such as a customer-service chatbot, must generally be informed that they are interacting with AI.
The AI Act also contains specific rules for AI-generated or manipulated content. Providers of generative AI systems may have to ensure that their outputs can be detected as AI-generated or manipulated.
Deployers may also have disclosure obligations when publishing deepfakes or certain AI-generated texts intended to inform the public on matters of public interest.
What happens if we sell or use AI-enabled products in the EU?
Whether your company supplies an AI-enabled product to the European market or uses AI to provide services aimed at EU customers, it should assess its position under the AI Act.
For the most serious infringements, fines may reach €35 million or 7% of the company’s worldwide annual turnover, whichever is higher. Lower penalties apply to other categories of infringement.
The practical message is therefore quite simple: being established in the UK does not automatically place your business outside the EU AI Act.
Comments