TRW & Co · Technology, data and AI
The EU AI Act: What UK Businesses Must Do
The EU AI Act UK businesses face applies whenever they place AI systems or models on the EU market, or their AI outputs are used in the EU, even without an EU entity. Prohibited practices, AI literacy and general-purpose AI duties already apply, most transparency duties began in August 2026, and the 2026 Digital Omnibus moved high-risk obligations to December 2027 and August 2028.
Key pointThe Act reaches UK providers and deployers through the use of AI outputs in the EU, so a UK company with no EU presence can still be directly regulated; the 2026 deferral changed the high-risk dates but not the obligations.
At a glance
Extraterritorial reach
The Act applies to providers placing AI on the EU market wherever they are based, and to non-EU providers and deployers whose AI output is used in the EU.
High-risk dates deferred
Following the Digital Omnibus, Annex III high-risk obligations apply from 2 December 2027 and Annex I product-embedded systems from 2 August 2028.
Transparency now live
Article 50 disclosure and content-marking duties apply from 2 August 2026, with a grace period to 2 December 2026 for marking by systems already on the market.
GPAI duties since 2025
General-purpose AI model providers have had documentation, copyright policy and training-summary obligations since 2 August 2025, with extra duties for systemic-risk models.
Fines up to 7%
Maximum fines reach €35 million or 7% of worldwide annual turnover for prohibited practices, with lower tiers for other breaches and lower caps for SMEs.
Swipe or scroll →
EU AI Act UK impact: the short answer
The EU AI Act UK companies need to understand is Regulation (EU) 2024/1689. Brexit does not take UK businesses out of its reach. It applies to providers that place AI systems or general-purpose AI models on the EU market wherever they are based, and to providers and deployers outside the EU where the output of an AI system is used in the EU. A UK software company with EU customers, or a UK group whose AI-generated outputs reach people in the EU, may well be in scope.
The timetable changed in 2026. The Digital Omnibus amendment, which entered into force on 27 July 2026, pushed back the main high-risk obligations to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI built into products regulated under Annex I. Prohibited practices, AI literacy and general-purpose AI obligations already apply, and most transparency duties have applied since 2 August 2026.
Does the EU AI Act apply to your UK business?
The AI Act attaches obligations to roles in the AI value chain rather than to where a company is incorporated. The scope provision captures:
- Providers that place AI systems on the EU market or put them into service in the EU, or place general-purpose AI models on the EU market, regardless of where they are established.
- Deployers of AI systems that are established or located in the EU.
- Providers and deployers in third countries, including the UK, where the output produced by the AI system is used in the EU.
- Importers and distributors of AI systems, and product manufacturers that place AI on the market with their own products.
The output limb is the one UK businesses most often overlook. A UK recruitment platform that scores candidates for an EU employer, or a UK lender whose AI model's output is used for decisions about EU residents, may be caught even without an EU entity. The EU AI Act UK analysis therefore starts with a map of where your systems, customers and outputs actually are.
Authorised representatives
Providers established outside the EU must, in many cases, appoint an authorised representative in the EU by written mandate before making a high-risk AI system or a general-purpose AI model available there. The representative must be able to provide documentation to authorities and cooperate with them, so it should be chosen with care and given access to the technical file.
The risk tiers explained
The Act regulates AI according to the risk it poses. Most AI systems fall into the minimal-risk tier and carry no specific obligations under the Act beyond AI literacy, though other EU laws such as the GDPR still apply.
| Tier | Examples | Core obligations | Applies from |
|---|---|---|---|
| Prohibited practices | Manipulative techniques causing significant harm, social scoring, certain biometric uses, emotion recognition at work and in education | Banned outright | 2 February 2025 (new nudifier and CSAM bans after a transition to 2 December 2026) |
| High-risk: Annex III | Employment and recruitment, credit scoring, education, access to essential services, certain biometrics | Risk management, data governance, technical documentation, logging, human oversight, accuracy, conformity assessment, registration | 2 December 2027 |
| High-risk: Annex I | AI safety components in regulated products such as machinery and medical devices | As above, integrated into product conformity procedures | 2 August 2028 |
| Transparency (Article 50) | Chatbots, deepfakes, AI-generated content, emotion recognition | Disclosure and machine-readable marking of synthetic content | 2 August 2026 (marking grace to 2 December 2026 for systems already on the market) |
| General-purpose AI models | Foundation and large language models | Technical documentation, downstream information, copyright policy, training content summary; extra duties for systemic-risk models | 2 August 2025 (models already on the market by then have until 2 August 2027) |
| Minimal risk | Spam filters, most internal productivity tools | AI literacy measures only | 2 February 2025 |
High-risk systems in more detail
High-risk status is where the heaviest compliance burden sits. Providers must operate a risk management system, use training data that meets quality criteria, prepare technical documentation, enable automatic logging, design for human oversight and meet accuracy, robustness and cybersecurity requirements. They must also carry out a conformity assessment, affix CE marking and register the system in the EU database. Deployers have lighter but real duties, including following instructions for use, assigning human oversight to competent people, monitoring operation and, for some deployers, carrying out a fundamental rights impact assessment.
An Annex III system is not high-risk if it does not pose a significant risk of harm, for example because it performs only a narrow procedural task. Providers relying on that exception must document their assessment, and the exception does not apply where the system profiles individuals.
General-purpose AI model obligations
Obligations for providers of general-purpose AI (GPAI) models have applied since 2 August 2025. Providers must keep technical documentation, give information to downstream providers that integrate the model, put in place a policy to comply with EU copyright law, including rights reservations for text and data mining, and publish a sufficiently detailed summary of the content used for training.
Models presumed to carry systemic risk, broadly the most capable models trained with very large amounts of compute, carry further duties: model evaluation and adversarial testing, assessment and mitigation of systemic risks, serious incident reporting and cybersecurity protection. The Commission's AI Office supervises GPAI providers directly, and the 2026 amendments strengthened its role. A voluntary GPAI Code of Practice, published in July 2025, offers one way to demonstrate compliance.
UK developers of foundation models that are made available in the EU, including through APIs or open-weight releases, should treat these obligations as live today rather than as future risks.
What the 2026 Digital Omnibus changed
The amending regulation was signed in July 2026 and entered into force on 27 July 2026, just before the original 2 August 2026 date for high-risk obligations. Its main effects on the EU AI Act UK businesses must plan for are:
- High-risk deadlines deferred. Annex III systems from 2 December 2027; Annex I product-embedded systems from 2 August 2028.
- Transparency largely unchanged. Article 50 duties apply from 2 August 2026, with a grace period to 2 December 2026 for marking content from generative systems already on the market before that date.
- New prohibitions. Bans on AI used to generate child sexual abuse material and non-consensual intimate content of identifiable people, subject to a transition ending on 2 December 2026.
- AI literacy softened. The duty now requires measures that support a sufficient level of AI literacy among staff, rather than a duty to ensure it.
- SME and small mid-cap relief. Simplified documentation, proportionate quality management and mitigated penalties for smaller businesses.
- Bias detection. A wider legal basis to process special category data to detect and correct bias, subject to strict necessity.
The deferral buys time; it does not remove the obligations. Conformity assessment, data governance and technical documentation for a high-risk system can take many months to build. UK providers that pause their programmes until 2027 risk running out of time, and EU customers are already writing AI Act warranties into procurement contracts.
A compliance roadmap for UK businesses
The steps below reflect how we structure EU AI Act UK compliance work for providers and deployers.
- Map systems, roles and markets. List AI systems and models, identify whether you act as provider, deployer, importer or distributor for each, and record where customers, users and outputs are located.
- Screen for prohibited practices. Confirm that no system uses banned techniques, including the new prohibitions added in 2026, and document the review.
- Classify risk. Test each system against Annex I and Annex III and record the reasoning, especially if you rely on the narrow-task exception.
- Meet live obligations first. Put AI literacy measures in place, implement Article 50 disclosures and content marking, and, for GPAI providers, complete documentation, copyright policy and training content summaries.
- Build the high-risk file. For high-risk systems, design the risk management system, data governance, logging, human oversight and quality management system, and plan the conformity assessment route.
- Appoint an authorised representative. Where required, choose an EU representative and agree a written mandate and information flows.
- Update contracts. Align customer, vendor and distribution agreements with the allocation of AI Act duties, including cooperation, audit and incident reporting. Our article on AI contracts covers drafting points.
- Monitor and report. Set up post-market monitoring and serious incident reporting, and track guidance and harmonised standards as they are published.
Enforcement and penalties
National market surveillance authorities in each Member State enforce most of the Act, while the AI Office supervises GPAI models. Maximum fines are tiered: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other breaches, and up to €7.5 million or 1% for supplying incorrect or misleading information, in each case whichever is higher. Lower caps apply to SMEs. GPAI providers face separate Commission fines.
Regulatory fines are only part of the exposure. Non-compliant products can be withdrawn from the EU market, and customers increasingly treat AI Act compliance as a condition of contract, so a gap can cost revenue before any regulator acts.
Illustrative scenario: a UK HR tech provider
This scenario is illustrative only and does not describe any real client or matter.
A London-based software company sells a candidate-ranking tool to employers in the UK, Ireland and Germany. It has no EU subsidiary. It also offers a chatbot that answers applicants' questions.
As a provider placing an AI system on the EU market for recruitment, the company is likely to fall within Annex III, so high-risk obligations will apply from 2 December 2027. It will need a risk management system, data governance for its training data, technical documentation, logging, human oversight design, a conformity assessment, registration and an EU authorised representative. Its EU customers, as deployers, will need instructions for use and support with their own oversight duties.
The applicant chatbot raises a separate transparency duty that already applies: people must be told they are interacting with AI. The company's UK customers are not covered by the EU regime for UK-only use, but UK equality and data protection law still apply, as our guide to AI regulation in the UK explains. Running one programme to the EU standard is usually simpler than maintaining two.
EU AI Act UK risks and common mistakes
Assuming Brexit means the Act does not apply
The Act's scope turns on placing AI on the EU market and on where outputs are used, not on where the provider is incorporated. UK companies with EU customers, EU users or EU-facing outputs can be directly subject to it. Treating the EU AI Act UK question as irrelevant because there is no EU subsidiary is one of the most common and costly errors, because it often surfaces only when an EU customer's procurement team asks for evidence of compliance.
Treating the deferral as a cancellation
The 2026 amendments moved the high-risk dates but kept the obligations. Building a compliant quality management system, technical documentation and data governance takes time, and conformity assessment capacity may be stretched as the deadlines approach. Use the extra time to build the programme properly rather than restarting it in late 2027. Prohibited practices, AI literacy, transparency and GPAI duties are not deferred and apply now.
Misclassifying the role in the value chain
Obligations differ sharply between providers, deployers, importers and distributors. A business that substantially modifies a third-party system, changes its intended purpose to a high-risk use, or puts its own name or trademark on it can become the provider and inherit the full provider obligations. Record your role for each system and revisit it whenever the product or its use changes.
Overlooking transparency duties for generative features
Many UK businesses add chatbots or content generation to existing products without considering Article 50. People must be informed when they interact with an AI system, and synthetic audio, image, video and text content must in many cases be marked in a machine-readable format. Deepfakes must be disclosed. These duties apply from 2 August 2026, with only a short grace period for marking content from systems already on the market.
Cross-border angle: running UK and EU compliance together
For UK groups, the practical challenge is running two different regimes side by side: the EU's prescriptive, product-safety style rules and the UK's principles-based, regulator-led approach set out in the 2023 AI white paper, as modified by the Data (Use and Access) Act 2025. Most clients choose a single governance framework built to the EU standard for systems that touch the EU, with a lighter UK overlay for domestic-only uses, and a common inventory across both.
Data protection adds a further layer. GDPR and UK GDPR obligations continue alongside the AI Act, and the ICO's guidance on AI and data protection remains the UK reference point, and international data transfer rules apply when training data or outputs move between the UK, the EU and other countries, including Bangladesh, the Gulf and Singapore. Our data protection solicitors and digital regulation team coordinate this work with EU counsel where local advice is required.
What to do next: a checklist
- Map every AI system and model, your role for each and where outputs are used.
- Confirm no prohibited practices, including the 2026 additions.
- Classify high-risk systems and document any reliance on exceptions.
- Implement AI literacy measures and Article 50 disclosures and marking now.
- For GPAI models, complete documentation, copyright policy and training content summaries.
- Plan conformity assessment and quality management for the 2027 and 2028 deadlines.
- Appoint an EU authorised representative where required.
- Update customer and vendor contracts to reflect AI Act roles and cooperation.
We help UK providers and deployers scope and meet their EU AI Act UK obligations alongside domestic law, working with our artificial intelligence lawyers and technology team. Contact our London office at Holborn Gate, 330 High Holborn, London WC1V 7QH, by email at info@trw.co or on +880 1779 127165.
Frequently asked questions
01Does the EU AI Act apply to UK companies after Brexit?
Yes, in many cases. The Act applies to providers that place AI systems or general-purpose AI models on the EU market or put them into service in the EU, regardless of where they are established. It also applies to providers and deployers in third countries, including the UK, where the output of the AI system is used in the EU. A UK company with EU customers or EU-facing outputs should assess its position, even if it has no EU subsidiary.
02When do the EU AI Act high-risk rules apply?
After the Digital Omnibus amendment, which entered into force on 27 July 2026, high-risk obligations for stand-alone systems listed in Annex III, such as recruitment and credit scoring, apply from 2 December 2027. High-risk AI that forms a safety component of products regulated under Annex I, such as machinery or medical devices, follows from 2 August 2028. Other parts of the Act, including prohibitions, AI literacy, GPAI and transparency duties, are not deferred.
03What counts as a high-risk AI system?
There are two routes. AI systems that are safety components of, or are themselves, products covered by the EU product safety laws listed in Annex I and need third-party conformity assessment are high-risk. So are systems used in the areas listed in Annex III, including biometrics, critical infrastructure, education, employment, access to essential private and public services such as credit and insurance, law enforcement, migration and the administration of justice. A narrow exception applies to Annex III systems that do not pose a significant risk of harm, but not where they profile individuals.
04Do UK companies need an EU authorised representative?
Providers established outside the EU generally must appoint an authorised representative in the EU, by written mandate, before making a high-risk AI system available on the EU market. Providers of general-purpose AI models established outside the EU have a similar requirement, with an exception for certain free and open-source models that do not present systemic risk. The representative must hold documentation and cooperate with authorities, so the mandate should be drafted carefully.
05What are the EU AI Act transparency obligations?
Under Article 50, providers must design AI systems that interact with people so users are informed they are dealing with AI, unless that is obvious. Providers of generative AI must mark synthetic audio, image, video and text in a machine-readable format so it can be detected as AI-generated. Deployers must disclose deepfakes and, in some cases, AI-generated text published to inform the public. These duties apply from 2 August 2026, with a grace period to 2 December 2026 for marking by generative systems already on the market.
06How does the EU AI Act differ from UK AI regulation?
The EU AI Act is a binding, risk-tiered regulation with prescriptive requirements, conformity assessment and dedicated enforcement. The UK has no equivalent statute; it relies on existing laws such as the UK GDPR, the Equality Act 2010 and sector rules, applied by regulators using five principles. Many UK groups operating in both markets adopt EU-standard governance for systems that reach the EU and a lighter overlay for UK-only uses.
Sources and official materials
- Regulation (EU) 2024/1689 (Artificial Intelligence Act) — Official text of the EU AI Act
- A pro-innovation approach to AI regulation — The UK's contrasting principles-based approach
- ICO guidance on AI and data protection — UK data protection rules that run alongside the EU regime
- Data (Use and Access) Act 2025 — UK reforms to automated decision-making
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.