# Does the EU AI Act apply to a UK firm? It can, even with no EU office, and what applies depends on your role and the date. **The short answer.** The EU AI Act can apply to a UK firm with no EU office. It does if the firm supplies AI in the EU, or if the AI's output is used there. Its first bans have applied since 2 February 2025, and its transparency rules since August 2026 ([AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2) and the [European Commission](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai), checked 29 September 2026). Under the EU AI Act, you are a provider if you build AI and offer it under your own name. You are a deployer if you use AI at work ([AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-3), checked 29 September 2026). The first question is whether you are covered, in which role, and for which systems. The dates matter too. The EU moved the high-risk deadlines in a change that came into force on 27 July 2026. Older guidance may carry the old dates (the [European Commission](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force), checked 29 September 2026). **When the EU AI Act applies** - 2 February 2025, EU: Bans on certain AI practices apply. - 27 July 2026, EU: A change to the Act comes into force and moves the high-risk dates. - August 2026, EU: Transparency rules apply, such as telling people they are talking to a chatbot. - 2 December 2027, EU: High-risk rules apply in listed areas, such as employment and education. - 2 August 2028, EU: High-risk rules apply to AI built into products, such as lifts or toys. The EU dates that matter for a UK firm whose AI is offered or used in the EU. Source: European Commission, AI Act, https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai (checked 29 September 2026); European Commission, AI Omnibus, https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force (checked 29 September 2026) > "AI use cases that can pose serious risks to health, safety or fundamental rights are classified as high-risk." > European Commission, https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai (checked 29 September 2026) ## What to do if the EU AI Act covers your UK firm 1. List the AI systems you build, sell or use at work. 2. For each one, note whether it is offered in the EU, or whether its output is used there. 3. Decide your role for each: provider if you offer it under your own name, deployer if you use it at work. 4. Check every date you are given against the [European Commission's timeline](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai). 5. If your AI uses personal data in the UK, check UK data protection law as well. 6. If you bring in help, ask whether the person holds an AI governance qualification, such as the [IAPP's AIGP](https://iapp.org/certify/aigp/). ## The 66 providers for this situation Grouped by type, alphabetical inside each type. ### Advisory firms (34) - [Ametros Group](https://theassurancedesk.com/advisers/ametros-group.md): Advisory firm - [Anekanta Consulting](https://theassurancedesk.com/advisers/anekanta-consulting.md): Advisory firm - [AvISO Consultancy](https://theassurancedesk.com/advisers/aviso-consultancy.md): Advisory firm - [BABL AI Inc.](https://theassurancedesk.com/advisers/babl-ai.md): Advisory firm - [BD Emerson LLC](https://theassurancedesk.com/advisers/bd-emerson.md): Advisory firm - [Bird & Bird LLP](https://theassurancedesk.com/advisers/bird-and-bird-llp-uk.md): Advisory firm - [Bratby Law](https://theassurancedesk.com/advisers/bratby-law.md): Advisory firm - [Bridewell](https://theassurancedesk.com/advisers/bridewell.md): Advisory firm - [DataGuard](https://theassurancedesk.com/advisers/dataguard.md): Advisory firm - [DCI Consulting Group, Inc.](https://theassurancedesk.com/advisers/dci-consulting-group.md): Advisory firm - [Deloitte LLP](https://theassurancedesk.com/advisers/deloitte-llp-uk.md): Advisory firm - [Elevate Consult](https://theassurancedesk.com/advisers/elevate-consult.md): Advisory firm - [Eticas.ai (Algorithmic Auditing Inc., US entity of Eticas Research and Consulting S.L.)](https://theassurancedesk.com/advisers/eticas-ai.md): Advisory firm - [Evalian](https://theassurancedesk.com/advisers/evalian.md): Advisory firm - [EY (UK), Ernst & Young LLP](https://theassurancedesk.com/advisers/ey-llp-uk.md): Advisory firm - [Fieldfisher LLP](https://theassurancedesk.com/advisers/fieldfisher-llp-uk.md): Advisory firm - [Forvis Mazars](https://theassurancedesk.com/advisers/forvis-mazars.md): Advisory firm - [Gowling WLG (UK) LLP](https://theassurancedesk.com/advisers/gowling-wlg-uk-llp.md): Advisory firm - [Handley Gill](https://theassurancedesk.com/advisers/handley-gill.md): Advisory firm - [Hope & May](https://theassurancedesk.com/advisers/hope-and-may.md): Advisory firm - [IT Governance (now GRC Solutions)](https://theassurancedesk.com/advisers/it-governance.md): Advisory firm - [Kemp IT Law LLP](https://theassurancedesk.com/advisers/kemp-it-law-llp.md): Advisory firm - [KPMG LLP (UK)](https://theassurancedesk.com/advisers/kpmg-llp-uk.md): Advisory firm - [Osborne Clarke LLP](https://theassurancedesk.com/advisers/osborne-clarke-llp.md): Advisory firm - [Pembroke Privacy](https://theassurancedesk.com/advisers/pembroke-privacy.md): Advisory firm - [PricewaterhouseCoopers LLP (PwC UK)](https://theassurancedesk.com/advisers/pricewaterhousecoopers-llp-uk.md): Advisory firm - [RPC (Reynolds Porter Chamberlain LLP)](https://theassurancedesk.com/advisers/rpc-reynolds-porter-chamberlain.md): Advisory firm - [Securys](https://theassurancedesk.com/advisers/securys.md): Advisory firm - [SME Comply](https://theassurancedesk.com/advisers/sme-comply.md): Advisory firm - [The DPO Centre](https://theassurancedesk.com/advisers/dpo-centre.md): Advisory firm - [URM Consulting](https://theassurancedesk.com/advisers/urm-consulting.md): Advisory firm - [VeraSafe, LLC](https://theassurancedesk.com/advisers/verasafe.md): Advisory firm - [Winston Taylor UK LLP (formerly Taylor Wessing)](https://theassurancedesk.com/advisers/winston-taylor-uk.md): Advisory firm - [Zaviant (WJS Cyber Consulting, LLC d/b/a Zaviant)](https://theassurancedesk.com/advisers/zaviant.md): Advisory firm ### Certification bodies (9) - [A-LIGN Compliance and Security, Inc. (dba A-LIGN)](https://theassurancedesk.com/advisers/a-lign.md): Certification body - [Aprio, LLP](https://theassurancedesk.com/advisers/aprio-llp.md): Certification body - [BSI (The British Standards Institution)](https://theassurancedesk.com/advisers/bsi.md): Certification body - [Coalfire Certification, Inc.](https://theassurancedesk.com/advisers/coalfire-certification.md): Certification body - [ISOQAR (formerly Alcumus ISOQAR)](https://theassurancedesk.com/advisers/isoqar.md): Certification body - [LRQA](https://theassurancedesk.com/advisers/lrqa.md): Certification body - [NQA](https://theassurancedesk.com/advisers/nqa.md): Certification body - [Perry Johnson Registrars, Inc.](https://theassurancedesk.com/advisers/perry-johnson-registrars.md): Certification body - [TÜV UK Limited (TÜV NORD Group)](https://theassurancedesk.com/advisers/tuv-uk.md): Certification body ### Software products (23) - [Advai](https://theassurancedesk.com/advisers/advai.md): Software product - [Arthur AI](https://theassurancedesk.com/advisers/arthur-ai.md): Software product - [BigID](https://theassurancedesk.com/advisers/bigid.md): Software product - [Credo AI](https://theassurancedesk.com/advisers/credo-ai.md): Software product - [Drata](https://theassurancedesk.com/advisers/drata.md): Software product - [Enzai](https://theassurancedesk.com/advisers/enzai.md): Software product - [Fiddler AI](https://theassurancedesk.com/advisers/fiddler-ai.md): Software product - [Hicomply](https://theassurancedesk.com/advisers/hicomply.md): Software product - [Holistic AI](https://theassurancedesk.com/advisers/holistic-ai.md): Software product - [IBM watsonx.governance](https://theassurancedesk.com/advisers/ibm-watsonx-governance.md): Software product - [ISMS.online](https://theassurancedesk.com/advisers/isms-online.md): Software product - [LogicGate](https://theassurancedesk.com/advisers/logicgate.md): Software product - [Metomic](https://theassurancedesk.com/advisers/metomic.md): Software product - [Microsoft Purview](https://theassurancedesk.com/advisers/microsoft-purview.md): Software product - [Monitaur](https://theassurancedesk.com/advisers/monitaur.md): Software product - [OneTrust AI Governance](https://theassurancedesk.com/advisers/onetrust-ai-governance.md): Software product - [Saidot](https://theassurancedesk.com/advisers/saidot.md): Software product - [Secureframe](https://theassurancedesk.com/advisers/secureframe.md): Software product - [Strike Graph](https://theassurancedesk.com/advisers/strike-graph.md): Software product - [SureCloud](https://theassurancedesk.com/advisers/surecloud.md): Software product - [Trilateral Research](https://theassurancedesk.com/advisers/trilateral-research.md): Software product - [Trustible](https://theassurancedesk.com/advisers/trustible.md): Software product - [Vanta](https://theassurancedesk.com/advisers/vanta.md): Software product ## The EU AI Act and UK firms: common questions ### What applies to us right now? If the EU AI Act covers you, its bans and transparency rules apply now. Certain AI practices have been banned in the EU since 2 February 2025. Since August 2026, people who use an AI chatbot must be told it is a machine. The first high-risk rules start on 2 December 2027 (the [European Commission](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai), checked 29 September 2026). ### Do we need ISO 42001 for the EU AI Act? The EU AI Act does not ask for ISO 42001 by name. Under Article 40 of the EU AI Act, a high-risk system that meets EU-approved standards counts as meeting the rules they cover. Article 40 does not name ISO 42001 ([AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-40), checked 29 September 2026). ISO 42001 can still give your AI governance a structure. ### What applies to our AI in the UK itself? In the UK, data protection law applies to your AI where it uses personal data. The UK's Data (Use and Access) Act 2025 changed the rules on automated decisions. Its data protection parts were in force by 19 June 2026. UK regulations also require the UK data protection regulator to write a code of practice on AI and automated decisions (the [ICO](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/) and [legislation.gov.uk](https://www.legislation.gov.uk/uksi/2026/425/made), checked 29 September 2026). ## Where next - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking.md) - [What does the EU AI Act ask of a UK business?](https://theassurancedesk.com/guides/eu-ai-act-uk-business.md) - [EU AI Act timeline: the key dates after the July 2026 changes](https://theassurancedesk.com/guides/eu-ai-act-timeline.md) - [How does the UK regulate AI?](https://theassurancedesk.com/guides/uk-ai-regulation.md) - [AI answers on the EU AI Act: 1 official source in 111](https://theassurancedesk.com/news/ai-answers-eu-ai-act-official-sources.md) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.