Does the EU AI Act apply to your UK business?

Brexit did not take you outside it. The Act reaches you where your systems are used in the EU or where their outputs affect people located there — which is a far wider test than having an EU office.

Are you in scope?

Work through these in order.

1. Do you place an AI system on the EU market, or make one available there? If yes, you are in scope as a provider or distributor.

2. Is an AI system you use located or operated in the EU? If yes, in scope.

3. Do the outputs of your AI system affect people located in the EU? If yes, in scope — and this is the limb that catches UK businesses. A London recruiter screening candidates for a role in Dublin, a UK company using AI to score customers in France, a business monitoring EU-based staff: all within it.

If the answer to all three is no, the Act does not apply — but UK data protection and discrimination law still do, and they are not a lower standard in the areas that matter most.

Are you a provider or a deployer?

The obligations differ substantially.

Provider — you develop an AI system, or have one developed, and place it on the market or put it into service under your own name or trade mark. Heavier obligations: a risk management system, data governance, technical documentation, logging, conformity assessment and CE marking, and instructions for use.

Deployer — you use an AI system under your own authority. Lighter but real: human oversight with genuine authority to override, ensuring input data is relevant and representative, keeping logs, informing affected people, and monitoring operation.

The trap: a deployer can become a provider. Putting your own branding on a third party tool, modifying it substantially, or using it for a purpose the original provider did not intend can shift you into the heavier category. Businesses do this without realising.

The risk tiers

Prohibited. Banned since February 2025 — including emotion recognition in the workplace and in education, social scoring, and certain biometric categorisation. These are outright prohibitions, not compliance obligations.

High-risk. The regime deferred to 2 December 2027. Includes AI used in employment and worker management — recruitment, selection, promotion, termination, task allocation and monitoring — alongside other listed areas such as credit, education and essential services.

Limited risk. Transparency obligations, principally telling people they are interacting with AI or that content is AI-generated.

Minimal risk. No specific obligations.

There is also an AI literacy duty, in force since February 2025, requiring measures to ensure staff dealing with AI systems have an adequate level of understanding.

Penalties

Breach

Maximum

Prohibited practices

€35m or 7% of global annual turnover

High-risk obligations

€15m or 3%

Supplying false information

€7.5m or 1%

Whichever is higher, in each case.

What we do

Work through scope properly — which is the whole question for most UK businesses, and is answered in an hour rather than a project. Establish whether you are a provider or a deployer for each system. Map obligations to what you actually run. And deal with the UK layer at the same time, because it applies regardless.

What it costs

£400 per hour plus VAT. A scope and obligations assessment is a fixed fee. For most businesses it is a short piece of work with a clear answer, and it is worth having that answer in writing.

Questions

Questions businesses ask us

We are UK-based with no EU office. Are we really in scope?

Possibly. The test includes whether your system’s outputs affect people located in the EU. EU candidates, EU customers or EU-based staff can bring you within it without any EU presence.

When did the high-risk rules start?

2 August 2026. They are in force now, not forthcoming.

We bought the tool from a vendor. Are we still responsible?

Yes, as a deployer — and potentially as a provider if you have rebranded it, modified it substantially, or use it for a different purpose than intended.

Is recruitment AI high-risk?

Yes. Recruitment, selection, promotion, termination, task allocation and worker monitoring are all within the high-risk classification.

What if we are not in scope?

UK law still applies — data protection, the automated decision-making rules under the Data (Use and Access) Act 2025, and the Equality Act. Being outside the EU Act is not being unregulated.

The hub

AI law →

Also in this area

AI in recruitment and automated decisions →

Also in this area

AI vendor contracts and procurement →

Start with a conversation

A free 20-minute call. Tell us what has happened and we will tell you whether we can help, what it would involve and roughly what it would cost.

No charge

A free 20-minute call

Tell us what has happened and we will tell you whether we can help, what it would involve and roughly what it would cost. No advice is given on this call and there is no charge for it.

£350 plus VAT

A paid strategy session

One hour with a partner, followed by a written summary of your position and options. For people who want proper advice without instructing a firm yet. Credited in full against your fees if you go on to instruct us.

Or reach us directly

0207 112 8818

WhatsApp +44 7476 045967

[email protected]

We answer enquiries the same working day.