What does the EU AI Act ask of a UK business?

Does the EU AI Act apply to a UK business?

The EU AI Act can apply to a UK business, even with no office in the EU. It covers firms that put AI systems or general-purpose AI models on the EU market, wherever they are based. It also covers firms outside the EU whose AI output is used in the EU, whether they build AI or only use it.

Firms based in the EU that use AI are covered as well.

The UK government makes the same point for general-purpose AI. A UK provider of a general-purpose AI system will need to comply with the EU AI Act to access the EU market.

Provider or deployer: which one is your firm?

Under the EU AI Act, your firm is a provider if it develops an AI system or a general-purpose AI model, or has one developed, and places it on the market. Your firm is a deployer if it uses an AI system under its own authority. Only personal use outside work is left out.

So if your staff use tools such as ChatGPT or Copilot at work, your firm is a deployer. The Act reaches you if you are based in the EU, or if the output is used in the EU.

One firm can be both. If you sell your own AI tool, you are its provider. If your staff use other AI tools at work, you are their deployer.

Some set-ups are harder to place. Eduardo Ustaran is global co-head of the privacy and cybersecurity practice at the law firm Hogan Lovells Cadwalader. In August 2026 he wrote that AI agents built on different kinds of underlying model, such as closed source, open weight and a firm's own models, create “a significant compliance complication”, because each kind of model “attracts its own regulatory consequences”.

Both roles share one duty. Providers and deployers must take steps to support the AI literacy of their staff, and of others who use AI for them. The law sets no fixed level for any one person.

Which risk level is your AI in?

The EU AI Act sorts AI by risk, and your AI's level depends on what it does. Banned practices sit at the top, then high-risk AI, such as hiring tools, then AI with transparency duties, such as chatbots. All other AI sits under the AI literacy duty. The Digital Omnibus on AI kept this risk-based approach.

The banned practices include AI that uses subliminal, manipulative or deceptive techniques to distort how people behave. They also include AI that makes realistic intimate or sexually explicit images or videos of an identifiable person without their consent.

AI systems listed in Annex III count as high-risk. That list includes AI used to recruit or select people, such as tools that filter job applications and evaluate candidates.

If you use a high-risk system, you must give human oversight to people with the right competence, training and authority.

The labelling section below explains the transparency duties.

Do you have to label AI-generated content?

Some AI-generated content must be marked or disclosed under the EU AI Act, and your role decides who does it. Providers of tools that make synthetic audio, images, video or text must mark the output so a machine can detect it as AI-made. Deployers who make a deep fake with AI must disclose that AI generated or changed it.

Providers of AI that talks to people, such as chatbots, must make sure people are told it is AI. This does not apply where that is obvious.

Content tools already on the market before 2 August 2026 have until 2 December 2026 to meet the marking duty.

What about the UK? The UK government says the UK does not currently regulate how AI-generated content is labelled.

UK company with no EU office: what do you need?

A UK company with no EU office needs an authorised representative in the EU if it provides a high-risk AI system or a general-purpose AI model to the EU market. The representative must be appointed by written mandate before the system is made available, or the model placed on the market, and must be established in the EU.

Both duties fall on providers. A firm that only uses AI tools is a deployer, and its duties are set out above.

EU AI Act timeline: the key dates

The EU AI Act applies in stages, and its main start date was 2 August 2026. AI literacy and the banned practices came first, on 2 February 2025, and the rules for general-purpose AI models followed on 2 August 2025. The high-risk rules come last, from 2 December 2027.

The law was amended this year. Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, entered into force on 27 July 2026. It kept the Act's structure and its risk-based approach.

Not every expert wanted the Act changed. In June 2026, before the changes were agreed, Sandra Wachter, Humboldt Professor of Technology and Regulation at the Hasso Plattner Institute in Germany, argued against weakening it.

The next date is 2 December 2026. Some new bans start then. Content tools already on the market before 2 August 2026 must meet the marking duty by the same day.

For AI listed in Annex III, such as hiring tools, the high-risk rules apply from 2 December 2027. For AI covered by the product laws in Annex I, they apply from 2 August 2028.

For each date, and what changed in July 2026, see the EU AI Act timeline.

What did AI engines cite on the EU AI Act?

AI engines cited one official source in 111 when we asked about the EU AI Act: the European Commission's AI Act Service Desk, cited once, by Perplexity. We asked six AI engines two questions a UK buyer might type, on 18 September 2026, from the UK, with web search on. The 12 answers cited 111 sources from 69 websites.

This was one run on one day, and AI answers change from day to day.

The full results are in our research note. For what the law asks of you, start with the Act and the Commission's AI Act Service Desk.

What to do

1. Work out your role for each AI tool: provider, deployer, or both.
2. Check whether your AI, or its output, is used in the EU.
3. Check each tool against the banned practices and the high-risk list in Annex III.
4. Support the AI literacy of the staff who use AI for you.
5. Providers of high-risk AI or general-purpose AI models from outside the EU need an authorised representative in the EU first.
6. Note the next dates: 2 December 2026, then 2 December 2027 for high-risk AI in Annex III.

Common questions

We only use ChatGPT or Copilot. Does the EU AI Act apply to us?

It can. Using an AI tool at work makes your firm a deployer. The Act covers deployers based in the EU, and deployers outside it when the output is used in the EU. If it covers you, the AI literacy duty applies, and so does the duty to disclose any deep fakes you make.

Are AI hiring tools high-risk under the EU AI Act?

Yes, when they are used to recruit or select people. Annex III lists AI that filters job applications and evaluates candidates, and AI in Annex III counts as high-risk. Those rules apply from 2 December 2027.

What are the fines under the EU AI Act?

The highest fines are for the banned practices: up to 35 million euros or 7% of total worldwide annual turnover, whichever is higher. Most other duties carry fines of up to 15 million euros or 3% of worldwide annual turnover. That includes the duties of deployers and the transparency duties.

Is there a UK AI Act?

No. The UK has no AI Act. AI is covered by the laws that already apply, through the regulators that already exist. The UK steps covered here are narrower than the EU AI Act. UK regulations made on 16 April 2026 require the UK's data protection regulator to prepare a code of practice. It will cover personal data in developing and using AI, and in automated decision-making. Those regulations came into force on 12 May 2026. The UK government also says the UK does not currently regulate how AI-generated content is labelled. See how the UK regulates AI.

Where next

• Exposed to the EU AI Act
• Does your UK business need an AI policy, and what goes in it?
• Who can help a UK firm with the EU AI Act?
• AI answers on the EU AI Act: 1 official source in 111

This is an independent editorial guide, not legal advice.