EU AI Act

The EU AI Act is the European Union's law on artificial intelligence. It sorts AI systems into four tiers by how much harm they could do, and attaches different obligations to each: some uses are banned outright, some are heavily regulated, some need only a disclosure, and most need nothing at all.

The UK has not adopted it. There is no UK AI Act, and Britain regulates AI through existing regulators instead. That does not put a UK business automatically out of reach, because the Act follows the market rather than the registered office.

The four tiers

Unacceptable risk. Banned since February 2025. Social scoring by public authorities, exploiting the vulnerabilities of particular groups, untargeted scraping of facial images, and emotion recognition in workplaces and schools outside narrow exceptions.

High risk. Heavily regulated. Two lists: standalone systems used in recruitment, worker management, education access, credit scoring, essential services, law enforcement and justice; and AI embedded in products already covered by EU safety law, such as medical devices and machinery.

Limited risk. Disclosure only. Chatbots, deepfakes, AI-generated content. This is where most ordinary business use lands when it lands anywhere.

Minimal risk. Nothing at all. Spam filters, recommendation engines, most productivity tooling.

The dates that matter

Prohibited practices have applied since 2 February 2025. AI literacy duties under Article 4 applied from the same date, with supervision beginning 2 August 2026. Transparency duties under Article 50 applied from 2 August 2026.

The high-risk obligations moved. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred standalone high-risk systems to 2 December 2027 and product-embedded ones to 2 August 2028.

The distinction worth holding on to is that the duties most likely to catch an ordinary business, transparency and literacy, are precisely the ones that did not move.

How a UK business ends up in scope

Three routes, and only three. You place an AI system on the EU market. The output of your AI system is used in the EU. Or you have an EU establishment.

If none of the three apply, the Act does not apply to you. That is the position for most UK SMEs trading domestically, and it is worth establishing definitively rather than assuming in either direction.

The route people miss is the second one. A UK recruitment firm using AI to sift candidates for a Dublin employer is in scope, with no EU entity and no EU sales, and lands in the high-risk category because recruitment is on the Annex III list.

Penalties

Prohibited practices attract up to EUR 35 million or 7 per cent of global annual turnover, whichever is higher. Most other breaches, including high-risk and transparency duties, attract up to EUR 7.5 million or 1.5 per cent. Enforcement is by member state authorities, so a UK business is reached through its EU activity.

What we would actually do

For a business under a few hundred people this is a morning and a page, not a compliance programme. Establish scope, list the AI systems in use, classify each one, fix the chatbot disclosure if you have a chatbot, and do something real about staff understanding.

What we would not do is buy a governance platform or commission an audit. Those are answers to a problem most SMEs do not have, sold by people who benefit from you believing you do.