We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Does the EU AI Act apply to a UK firm?

It can, even with no EU office, and what applies depends on your role and the date.

The EU AI Act can apply to a UK firm with no EU office. It does if the firm supplies AI in the EU, or if the AI's output is used there. Its first bans have applied since 2 February 2025, and its transparency rules since August 2026.

On this page
  1. What to do if the EU AI Act covers your UK firm
  2. The EU AI Act and UK firms: common questions
  3. Where next
  4. The 66 providers

Under the EU AI Act, you are a provider if you build AI and offer it under your own name. You are a deployer if you use AI at work.

The first question is whether you are covered, in which role, and for which systems. The dates matter too. The EU moved the high-risk deadlines in a change that came into force on 27 July 2026. Older guidance may carry the old dates.

When the EU AI Act applies

  1. 2 February 2025EU Bans on certain AI practices apply.
  2. 27 July 2026EU A change to the Act comes into force and moves the high-risk dates.
  3. August 2026EU Transparency rules apply, such as telling people they are talking to a chatbot.
  4. 2 December 2027EU High-risk rules apply in listed areas, such as employment and education.
  5. 2 August 2028EU High-risk rules apply to AI built into products, such as lifts or toys.
The EU dates that matter for a UK firm whose AI is offered or used in the EU.

AI use cases that can pose serious risks to health, safety or fundamental rights are classified as high-risk.

European Commission
Read original

What to do if the EU AI Act covers your UK firm

  1. List the AI systems you build, sell or use at work.
  2. For each one, note whether it is offered in the EU, or whether its output is used there.
  3. Decide your role for each: provider if you offer it under your own name, deployer if you use it at work.
  4. Check every date you are given against the European Commission's timeline.
  5. If your AI uses personal data in the UK, check UK data protection law as well.
  6. If you bring in help, ask whether the person holds an AI governance qualification, such as the IAPP's AIGP.

The EU AI Act and UK firms: common questions

What applies to us right now?

If the EU AI Act covers you, its bans and transparency rules apply now. Certain AI practices have been banned in the EU since 2 February 2025. Since August 2026, people who use an AI chatbot must be told it is a machine. The first high-risk rules start on 2 December 2027.

Do we need ISO 42001 for the EU AI Act?

The EU AI Act does not ask for ISO 42001 by name. Under Article 40 of the EU AI Act, a high-risk system that meets EU-approved standards counts as meeting the rules they cover. Article 40 does not name ISO 42001. ISO 42001 can still give your AI governance a structure.

What applies to our AI in the UK itself?

In the UK, data protection law applies to your AI where it uses personal data. The UK's Data (Use and Access) Act 2025 changed the rules on automated decisions. Its data protection parts were in force by 19 June 2026. UK regulations also require the UK data protection regulator to write a code of practice on AI and automated decisions.

Sources

  1. European Commission, AI Act, checked 29 September 2026
  2. European Commission, AI Omnibus, checked 29 September 2026
  3. AI Act Service Desk, checked 29 September 2026
  4. AI Act Service Desk, checked 29 September 2026
  5. AI Act Service Desk, checked 29 September 2026
  6. ICO, checked 29 September 2026
  7. legislation.gov.uk, checked 29 September 2026

The 66 providers for this situation

Grouped by type, alphabetical inside each type. Three of the six scores are shown here. Each profile has all six, with the evidence for each.

Advisory firms (34)

Provider Qualifications Fee information Help when things go wrong
Ametros Group Advisory firm Relevant if you want a budget figure before you call, and a DPO the firm says it employs
1/5 4/5 2/5
Anekanta Consulting Advisory firm Relevant if your board uses higher-risk AI, such as biometrics, and needs an EU AI Act risk assessment
4/5 1/5 1/5
AvISO Consultancy Advisory firm Relevant if you are already working towards several ISO certificates and want DPO support alongside
2/5 1/5 2/5
BABL AI Inc. Advisory firm Relevant if you sell hiring software and need a New York City Local Law 144 bias audit
3/5 3/5 3/5
BD Emerson LLC Advisory firm Relevant if you want a named privacy lead with IAPP credentials for DPO or AI-governance work
4/5 2/5 2/5
Bird & Bird LLP Advisory firm Relevant if you face a breach, a regulator investigation or EU AI Act exposure and need lawyers
5/5 2/5 4/5
Bratby Law Advisory firm Relevant if you run a telecoms or AI-product business and want a partner's advice at an agreed fee
4/5 4/5 2/5
Bridewell Advisory firm Relevant if you run critical infrastructure or a regulated business and want privacy help inside a security firm
3/5 1/5 3/5
DataGuard Advisory firm Relevant if you want software with consultants attached for ISO 27001 or several frameworks at once
2/5 3/5 2/5
DCI Consulting Group, Inc. Advisory firm Relevant if you use an AI hiring tool and need a bias audit under a specific law
4/5 2/5 4/5
Deloitte LLP Advisory firm Relevant if you are a large organisation with EU AI Act duties and want a named privacy partner
4/5 2/5 3/5
Elevate Consult Advisory firm Relevant if you are preparing for ISO 42001 or a New York City hiring-tool bias audit
3/5 1/5 2/5
Eticas.ai (Algorithmic Auditing Inc., US entity of Eticas Research and Consulting S.L.) Advisory firm Relevant if you want an outside audit of a specific AI system, such as a hiring tool
4/5 1/5 3/5
Evalian Advisory firm Relevant if you want data protection, cyber security and ISO support from one firm with named, qualified leaders
5/5 3/5 3/5
EY (UK), Ernst & Young LLP Advisory firm Relevant if you need AI governance advice from a mixed team of lawyers, risk experts and data scientists
4/5 1/5 2/5
Fieldfisher LLP Advisory firm Relevant if you want regulated solicitors whose data protection team has run a High Court claim
4/5 2/5 3/5
Forvis Mazars Advisory firm Relevant if you want privacy and AI governance advice from a large firm that names its indemnity insurer
3/5 1/5 3/5
Gowling WLG (UK) LLP Advisory firm Relevant if you want data protection and AI lawyers who publish how they use AI themselves
5/5 2/5 3/5
Handley Gill Advisory firm Relevant if you need data protection and AI governance support, including information-rights tribunal appeals
4/5 3/5 4/5
Hope & May Advisory firm Relevant if you run a charity and want a named DPO team from an NCVO trusted supplier
3/5 2/5 3/5
IT Governance (now GRC Solutions) Advisory firm Relevant if you want advice and ready-made compliance documents from one supplier, with published product prices
2/5 3/5 3/5
Kemp IT Law LLP Advisory firm Relevant if you need a regulated lawyer on the EU AI Act or UK data protection law
4/5 2/5 3/5
KPMG LLP (UK) Advisory firm Relevant if you already use Microsoft Purview and want AI-risk and data protection work from one firm
4/5 2/5 2/5
Osborne Clarke LLP Advisory firm Relevant if you need solicitors for an ICO crisis, a subject access dispute or an AI rollout
4/5 2/5 4/5
Pembroke Privacy Advisory firm Relevant if you need one adviser for EU and UK GDPR work and want named, qualified staff
4/5 3/5 3/5
PricewaterhouseCoopers LLP (PwC UK) Advisory firm Relevant if you want a Big Four firm that names its insurer and lists ISO 27701 certification
4/5 2/5 2/5
RPC (Reynolds Porter Chamberlain LLP) Advisory firm Relevant if you face a data breach or regulator's investigation and want a regulated law firm
3/5 2/5 3/5
Securys Advisory firm Relevant if you want a fixed-fee DPO with breach response and subject access requests included
4/5 3/5 3/5
SME Comply Advisory firm Relevant if you run a small business and want DPO support and legal advice from one place
3/5 2/5 2/5
The DPO Centre Advisory firm Relevant if you are appointing a first DPO and want named, qualified people and sector case studies
5/5 3/5 3/5
URM Consulting Advisory firm Relevant if you want DPO support and ISO 27001 or 22301 certification help from one firm
3/5 1/5 3/5
VeraSafe, LLC Advisory firm Relevant if you need an outsourced DPO or advice on California privacy law or the EU AI Act
4/5 2/5 2/5
Winston Taylor UK LLP (formerly Taylor Wessing) Advisory firm Relevant if you face a breach, regulator inquiry or EU AI Act question and want a law firm
4/5 2/5 3/5
Zaviant (WJS Cyber Consulting, LLC d/b/a Zaviant) Advisory firm Relevant if you are a US company building a privacy programme on OneTrust or a similar platform
3/5 2/5 3/5

Certification bodies (9)

Provider Qualifications Fee information Help when things go wrong
A-LIGN Compliance and Security, Inc. (dba A-LIGN) Certification body Relevant if you want one accredited body to certify security, privacy, continuity and AI management systems
5/5 1/5 3/5
Aprio, LLP Certification body Relevant if you want ISO/IEC 42001 or 27001 certification from a large, ANAB-accredited US firm
4/5 1/5 1/5
BSI (The British Standards Institution) Certification body Relevant if you want UKAS-accredited ISO/IEC 42001 certification and a certificate anyone can check online
5/5 2/5 5/5
Coalfire Certification, Inc. Certification body Relevant if you want ISO 42001 certification from a body that has already certified named technology firms
5/5 1/5 4/5
ISOQAR (formerly Alcumus ISOQAR) Certification body Relevant if you want a UKAS-accredited ISO 42001 certificate, audited alongside ISO 9001 or ISO 27001
5/5 3/5 4/5
LRQA Certification body Relevant if you want accredited ISO 42001 certification combined with ISO 27001, 9001 or 14001 audits
5/5 2/5 3/5
NQA Certification body Relevant if you want accredited ISO 42001 certification with the contract terms published before you sign
5/5 3/5 4/5
Perry Johnson Registrars, Inc. Certification body Relevant if you need certification to an established standard such as ISO 9001 or ISO 27001
3/5 1/5 1/5
TÜV UK Limited (TÜV NORD Group) Certification body Relevant if you want an ISO 42001 certificate from a UKAS-accredited body that says it does not consult
5/5 1/5 4/5

Software products (23)

Provider Qualifications Fee information Help when things go wrong
Advai Software product Relevant if you need test and monitoring evidence for a high-risk AI system in a regulated sector
2/5 1/5 4/5
Arthur AI Software product Relevant if you already run AI agents and want software to monitor them and log what they do
1/5 3/5 1/5
BigID Software product Relevant if you are in a regulated sector and want software, not advice, to find and classify data
4/5 1/5 2/5
Credo AI Software product Relevant if you need software to track your AI systems against the EU AI Act or ISO 42001
4/5 1/5 4/5
Drata Software product Relevant if you want software that links AI risks to controls, owners and evidence for ISO 42001
4/5 1/5 4/5
Enzai Software product Relevant if you want UK software to register, assess and monitor your AI systems
4/5 1/5 4/5
Fiddler AI Software product Relevant if you want AI governance software with a free tier and a published per-trace price
3/5 4/5 1/5
Hicomply Software product Relevant if you want compliance software with prices on the website before you speak to sales
1/5 5/5 2/5
Holistic AI Software product Relevant if you want one tool to list your AI systems and map them to several frameworks
2/5 1/5 4/5
IBM watsonx.governance Software product Relevant if you use IBM's watsonx and want audit records for AI models, with a published starting price
3/5 4/5 5/5
ISMS.online Software product Relevant if you already run ISO 27001 and want to add ISO 42001 on the same platform
3/5 1/5 3/5
LogicGate Software product Relevant if your team runs its own risk, compliance and AI oversight work and needs software for it
4/5 1/5 1/5
Metomic Software product Relevant if you need to see and stop sensitive data going into AI tools across your apps
4/5 1/5 3/5
Microsoft Purview Software product Relevant if you already use Microsoft 365 E3 or E5 and want controls on data sent to AI
4/5 5/5 5/5
Monitaur Software product Relevant if you are an insurer or financial firm wanting software to track AI model controls and evidence
3/5 1/5 4/5
OneTrust AI Governance Software product Relevant if you already use OneTrust for privacy and want AI governance in the same platform
5/5 1/5 4/5
Saidot Software product Relevant if you need software to classify AI systems by risk and document EU AI Act conformity
3/5 1/5 5/5
Secureframe Software product Relevant if you want ISO 42001 software on the same platform as SOC 2 and ISO 27001
5/5 1/5 4/5
Strike Graph Software product Relevant if you want to run SOC 2 or ISO 27001 compliance yourself and know the price upfront
2/5 5/5 1/5
SureCloud Software product Relevant if you already use SureCloud and want to add EU AI Act risk classification
3/5 1/5 4/5
Trilateral Research Software product Relevant if you buy through Crown Commercial Service and want data protection and AI governance together
3/5 1/5 4/5
Trustible Software product Relevant if you need a register of your AI uses, triaged by risk, for the EU AI Act
4/5 1/5 3/5
Vanta Software product Relevant if you want SOC 2 or ISO 42001 evidence collected automatically, with a published uptime commitment
5/5 1/5 4/5

This is an independent editorial guide, not legal advice.