# Who can help a UK firm with the EU AI Act?

Choose help for the work your firm needs, from checking the rules to testing the tool.

The Assurance Desk. Published 8 October 2026. Last checked 8 October 2026.

Part of the guide [What does the EU AI Act ask of a UK business?](https://theassurancedesk.com/guides/eu-ai-act-uk-business.md).

**The short answer.** For a UK firm, the right EU AI Act help depends on the job. Ask for help checking the rules, testing the AI or putting governance into practice. Government guidance describes a mix of technical tools, governance platforms and professional services ([GOV.UK, Introduction to AI assurance](https://www.gov.uk/government/publications/introduction-to-ai-assurance/introduction-to-ai-assurance), checked 8 October 2026).

## Can a UK firm with no EU office be covered?

Yes. A UK address does not settle the question. The EU AI Act can cover providers putting AI systems or general-purpose AI models on the EU market. It can also cover providers and users outside the EU where the system’s output is used in the EU ([EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727), checked 8 October 2026).

The Act calls an organisation using an AI system under its authority a deployer. Personal use outside work is excluded from that definition. Eduardo Ustaran recommends checking how the rules apply to each system and role ([EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727) and [Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ), checked 8 October 2026).

## What kind of help should you look for?

Start with the job you want done. AI assurance means gathering and checking evidence about a system. It can include tests of how it works, checks against rules and an assessment of its effects on people ([GOV.UK, Introduction to AI assurance](https://www.gov.uk/government/publications/introduction-to-ai-assurance/introduction-to-ai-assurance), checked 8 October 2026).

Use the table as a way to question a potential adviser. Ask who will do each part and what they will hand over. These discussion prompts draw on government guidance and Ustaran’s suggested planning steps. They are not a list of compulsory services ([GOV.UK, Introduction to AI assurance](https://www.gov.uk/government/publications/introduction-to-ai-assurance/introduction-to-ai-assurance) and [Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ), checked 8 October 2026).

**Match the work to the skills you need**

| Your question | Skills to ask about | Work to request |
| --- | --- | --- |
| Which rules apply to our AI? | Legal and compliance expertise | An explanation of the rules that apply to each system and role. |
| Does the tool work as expected? | Technical testing | Test results, the conditions tested and limits of the findings. |
| How could people be affected? | Impact assessment | A review of effects on people, including privacy and equality. |
| How do we put the plan into practice? | Governance and implementation | A prioritised plan, with the documents and measures needed. |

Source: GOV.UK, Introduction to AI assurance, https://www.gov.uk/government/publications/introduction-to-ai-assurance/introduction-to-ai-assurance (checked 8 October 2026); Eduardo Ustaran on LinkedIn, https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ (checked 8 October 2026)

## What should you take to the first meeting?

Bring a list of the AI your firm develops and uses. Eduardo Ustaran recommends this as the starting point for working out how the AI Act applies. His LinkedIn post is a practical view on preparation, rather than a statement of today’s legal duties ([Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ), checked 8 October 2026).

For the meeting, try a simple description of each tool and what you want help deciding. For example: “We use this tool to draft replies. We need to understand which rules apply to that use.” This is an example question, not a legal conclusion.

> "First of all, determine and document in a central AI inventory which AI systems and models are being developed and used."
> Eduardo Ustaran, LinkedIn post excerpt
> Eduardo Ustaran on LinkedIn, #ai #gdpr #ai #ai #ai #ai #privacy #ai, Eduardo Ustaran, 17 comments, https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ (checked 8 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ)

## What should a proposal explain?

Ask the provider to turn the findings into a clear plan. Ustaran’s suggested approach is to compare existing governance work with the requirements that apply, then set out the missing documents and measures in priority order ([Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ), checked 8 October 2026).

These prompts help make that proposed work concrete. Agree the answers before choosing a package.

**Questions to put beside a proposal**

| Ask this | Look for a clear answer |
| --- | --- |
| Which systems and business uses are included? | A defined scope, with any exclusions stated. |
| Who checks the legal position and who tests the tool? | Named responsibilities for the different parts of the work. |
| What will you deliver? | The assessments, test evidence, documents or implementation plan. |
| What work stays with our team? | The information and decisions the provider needs from you. |
| What happens after the review? | Who helps put the agreed measures into practice. |

Source: GOV.UK, Introduction to AI assurance, https://www.gov.uk/government/publications/introduction-to-ai-assurance/introduction-to-ai-assurance (checked 8 October 2026); Eduardo Ustaran on LinkedIn, https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ (checked 8 October 2026)

## How much can an AI search tell you?

When The Assurance Desk asked 6 AI engines on 18 September 2026 who could help a UK firm with no EU office, their answers cited 44 links. Just 1 answer cited an official source. Each engine was asked once, from the UK, with web search on ([The Assurance Desk: AI answers on the EU AI Act, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-eu-ai-act-2026-09-18.json), checked 8 October 2026).

This was a small snapshot, not a test of adviser quality. Repeated links were counted. The full study asked another question too; the chart below shows only the question about finding help. Later answers may use different sources ([The Assurance Desk: AI answers on the EU AI Act, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-eu-ai-act-2026-09-18.json), checked 8 October 2026).

Treat the names in an AI answer as leads. Ask a provider to explain the rules and evidence behind its proposed work.

**The same snapshot in numbers**

| Measure | Count |
| --- | --- |
| AI answers | 6 |
| Answers citing an official source | 1 |
| Cited links, including repeats | 44 |

Source: The Assurance Desk: AI answers on the EU AI Act, measured 18 September 2026 (data file), https://theassurancedesk.com/data/ai-answers-eu-ai-act-2026-09-18.json (checked 8 October 2026)

**Only one answer linked to an official source**

Unit: answers

- Answers citing an official source: 1 of 6

The help-finding question, asked once of each engine from the UK on 18 September 2026. The bar shows the share of answers with an official source, not adviser quality.

Source: The Assurance Desk: AI answers on the EU AI Act, measured 18 September 2026 (data file), https://theassurancedesk.com/data/ai-answers-eu-ai-act-2026-09-18.json (checked 8 October 2026)

## What to do

1. Start with Ustaran’s suggested list of the AI systems your firm develops and uses ([Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ), checked 8 October 2026).
2. Use Ustaran’s next question: which rules apply to each system and role ([Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ), checked 8 October 2026).
3. Separate testing and checking the rules from implementation. Ustaran recommends a plan that puts the missing work in priority order ([GOV.UK, Introduction to AI assurance](https://www.gov.uk/government/publications/introduction-to-ai-assurance/introduction-to-ai-assurance) and [Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ), checked 8 October 2026).
4. Request a written scope and clear responsibilities.

## Common questions

### Does buying an AI tool mean the supplier handles everything?

Start by checking your own role. The EU AI Act defines a deployer as the person or organisation using an AI system under its authority, apart from personal use outside work. Ustaran recommends assessing how the rules apply to each system and role ([EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727) and [Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ), checked 8 October 2026).

### Should we start by buying governance software?

Start by defining the work. Government guidance describes governance platforms alongside technical tools and professional services. Ask what each option would do for your firm, then compare it with the work you need ([GOV.UK, Introduction to AI assurance](https://www.gov.uk/government/publications/introduction-to-ai-assurance/introduction-to-ai-assurance), checked 8 October 2026).

## Where next

- [Exposed to the EU AI Act](https://theassurancedesk.com/best/eu-ai-act-exposed.md)
- [What does the EU AI Act ask of a UK business?](https://theassurancedesk.com/guides/eu-ai-act-uk-business.md)
- [EU AI Act timeline: the key dates after the July 2026 changes](https://theassurancedesk.com/guides/eu-ai-act-timeline.md)
- [Do you need AI governance software, or is an adviser enough?](https://theassurancedesk.com/guides/ai-governance-software-or-adviser.md)
- [Is there a qualification or certification for AI governance?](https://theassurancedesk.com/guides/ai-governance-qualifications-and-certification.md)

## Sources

- GOV.UK, Introduction to AI assurance: https://www.gov.uk/government/publications/introduction-to-ai-assurance/introduction-to-ai-assurance (checked 8 October 2026)
- EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727 (checked 8 October 2026)
- Eduardo Ustaran on LinkedIn: https://www.linkedin.com/posts/eduardoustaran_ai-gdpr-ai-activity-7175964659894628352-JPTZ (checked 8 October 2026)
- The Assurance Desk: AI answers on the EU AI Act, measured 18 September 2026 (data file): https://theassurancedesk.com/data/ai-answers-eu-ai-act-2026-09-18.json (checked 8 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.