The EU AI Act for UK businesses: when it applies to you
· Written and maintained by Nonimo
The EU AI Act can apply to a UK business, and Brexit has nothing to do with whether it does. Article 2 of the Regulation reaches companies outside the Union in two common ways: when they place an AI system on the EU market, and when the output an AI system produces is used in the Union.
A London recruiter screening candidates for a client in Dublin is inside it. A plumber in Leeds using ChatGPT to draft quotes for customers in Leeds is not.
For everyone else, UK AI regulation means something narrower and more familiar. There is no UK AI Act. The government has chosen to leave AI to existing regulators working from five principles, and for most firms the regulator that matters is the ICO, applying UK GDPR to whatever personal data goes into the tools. That duty applies whether or not the EU Act ever reaches you.
This guide is the British half of the answer: where a UK firm meets the EU Act, what is different for it, and what UK law already asks in the meantime. The general analysis of the Regulation, with the full timeline, the prohibitions and the penalties, is in our guide to whether the EU AI Act applies outside the EU, and the supplier checks under UK GDPR are in what makes an AI tool GDPR compliant.
When the EU AI Act applies to a UK business
Two limbs of Article 2(1) do the work for a company with no office in the Union. Point (a) covers providers placing AI systems on the EU market, wherever they are established. Point (c) covers providers and deployers in a third country where the output produced by the AI system is used in the Union. The second is the one British firms tend to miss.
Output used in the Union, in British examples
Article 2(1)(c) does not require you to sell anything to a European. It requires the output of the AI system to be used in the Union. A Manchester agency that writes campaign copy with an AI tool for a client in Lyon produces output used there. So does a London consultancy that delivers an AI drafted report to a board in Milan, which then acts on it.
The cases that matter most are the high-risk ones. A UK recruitment firm running an AI shortlisting tool over applicants for a role in Amsterdam is the deployer of a high-risk system whose output is used in the Union. The same tool used only on roles in Bristol is outside the Act, although UK GDPR still covers every CV it reads.
What does not bring you in
Being registered in the UK, using an American model, or having a few EU visitors to your website does not, on its own, trigger anything. Nor does personal use: Article 2(10) excludes natural persons using AI in a purely personal, non-professional activity. The research and pre-market testing exclusions are set out in the general guide.
The practical test for a UK firm is one question per tool: does anything this system produces end up being used by, or about, someone in the EU? If the honest answer is “sometimes”, write down when, because that is the part of your business the Regulation covers. The AI use policy is the natural place to record it.
Provider or deployer: where a UK firm usually sits
The Act gives duties to roles, not to companies. If you bought your AI rather than built it, you are a deployer under Article 3(4), and the provider’s heavy obligations sit with whoever sold it to you. Using ChatGPT, Claude, Gemini or Copilot at work does not make your firm a model provider, and what those providers do with the text your staff type is a separate question, answered by their own terms. It differs between Claude and Gemini more than most buyers expect.
Two situations are specifically British, and they are where a UK firm can end up with more than a deployer’s list.
Selling an AI product into the EU, without an EU office
A UK software company that puts an AI system on the EU market under its own name is a provider under Article 2(1)(a), wherever its servers or its staff sit. For high-risk systems, Brexit adds a step that did not exist before 2021.
Article 22(1) requires providers established in third countries to appoint, by written mandate, an authorised representative established in the Union before making a high-risk system available there. Article 3(5) defines that representative as a person located or established in the Union, so a UK office cannot fill the role. The representative must hold the documentation and hand it to authorities on request. The provider duties, Article 22 included, apply to Annex III systems from 2 December 2027: build it into the launch plan, not the week before.
When a deployer becomes a provider
There is a trapdoor in Article 25. A deployer becomes a provider of a high-risk system, with all of a provider’s duties, if it puts its own name or trademark on one, makes a substantial modification to one, or changes the intended purpose of a system so that it becomes high risk.
Writing prompts does not do that, and nor does buying a business licence. Wrapping a bought model in your own branded screening product for EU clients might. If your solicitors are drafting the supply contract, the AI clause in your engagement letter is a good place to settle who is the provider before anyone else asks.
What the Digital Omnibus changed for UK firms
Regulation (EU) 2026/1744, the Digital Omnibus on AI, dated 8 July 2026 and in force since 27 July 2026, deferred the high-risk rules: Annex III systems to 2 December 2027, and AI inside regulated products to 2 August 2028. It did not narrow Annex III, and it left the prohibitions, the literacy duty and the Article 50 transparency rules where they were. The full date table is in the general guide.
If a supplier tells a British client the EU AI Act has been postponed, they have read one paragraph of it.
The new Article 4a, and why it does not help with UK candidates
The Omnibus also inserted Article 4a, which lets providers and deployers process special categories of personal data where strictly necessary to detect and correct bias, under six conditions including pseudonymisation, strict access controls and deletion once the bias is corrected. It creates no duty to go looking for bias.
It is an EU provision, and it gives a UK firm nothing under UK law. Testing a screening tool on UK candidates still needs an Article 9 condition under UK GDPR, which is set out in our guide to special category data in AI.
What already binds a UK firm the Act reaches
For a UK deployer inside Article 2, three duties are live today. None of them waits for December 2027, and two of them have applied since February 2025.
Article 5 and the British contact centre
Most of the prohibited list is exotic. One item is not: Article 5(1)(f) bans AI systems that infer the emotions of a person in the workplace or in education, with a narrow exception for medical or safety reasons. Call centre software that scores agent tone, interview tools that rate a candidate’s enthusiasm and wellbeing dashboards built on voice analysis all sit inside it.
For a UK contact centre handling calls for an EU client, that is a live question, and it sits in the top band of fines rather than the middle one. The two further prohibitions the Omnibus adds from 2 December 2026 are covered in the general guide.
Article 4 literacy, and the British numbers behind it
Article 4, as rewritten in July 2026, asks providers and deployers for measures to support AI literacy, and says expressly that no one has to guarantee any individual’s level. A dated session, the version of the policy people saw and the list of tools it covered is better evidence than a slide deck emailed to everyone.
UK firms have a reason to do this whether or not the Act reaches them. The ONS reported on 20 July 2026 that 55% of working adults in Great Britain use AI for work or education. Business adoption is measured by a different survey, and the ONS warns the two are not directly comparable, but the point for an employer stands: some of your staff are using AI whether or not the firm has chosen a tool, which is the gap a written AI policy exists to close.
Article 50 for a UK chatbot with EU users
Article 50 has applied since 2 August 2026. If a UK firm built its own chatbot and EU customers use it, that firm is the provider for Article 50(1) purposes, and the system must tell people they are dealing with an AI unless that is obvious to a reasonably well informed, observant and circumspect person. Article 50(5) says the information must reach them at the latest at their first interaction.
A firm that only deploys someone else’s widget still has to check what the supplier switched on, and what that supplier keeps from each conversation. The fix is usually a line of copy, which makes it the rare AI Act duty you can close this afternoon.
High risk under the EU AI Act: recruitment, credit and insurance
High-risk status comes from a list, not from how dangerous a use feels. Annex III names eight areas, and three of them reach ordinary businesses, including British ones serving EU clients.
| Annex III area | the version that reaches a UK business |
|---|---|
| Point 4, employment | CV screening, ranking candidates, task allocation, promotion or termination |
| Point 5(b) and (c), credit and insurance | creditworthiness scoring, risk pricing for life and health cover |
| Point 3, education | admissions, assessment scoring, monitoring during exams |
Source: Annex III of Regulation (EU) 2024/1689.
What a deployer owes from 2 December 2027
Article 26 sets the deployer duties. Use the system in line with the provider’s instructions. Give human oversight to someone competent, trained and with authority to override it. Make sure the input data you control is relevant and sufficiently representative. Keep the logs. Tell workers and their representatives before putting a system into service at work.
For an insurance broker pricing EU risks with an AI model, or a recruiter screening for an EU employer, those duties attach in December 2027. The classification attaches today, so a contract signed this year should already require the provider to hand over instructions, documentation and logs.
The UK rule that already covers part of this
UK law reaches the same recruiter by another road. A decision based solely on automated processing, meaning with no meaningful human involvement, that has a legal or similarly significant effect on someone is a significant decision under Article 22A of UK GDPR, and Article 22C requires safeguards, including a way for the person to contest it and to obtain human intervention.
So a UK firm screening UK candidates with AI has no Annex III duty, but it may well have a 22C duty, and it has had one since 5 February 2026, when section 80 of the Data (Use and Access) Act 2025 came fully into force. That is the subject of the next two sections.
UK AI regulation: no AI Act, five principles and existing regulators
The UK chose the opposite model to the EU. The white paper A pro-innovation approach to AI regulation, published on 29 March 2023, proposed principles for existing regulators to apply in their own areas rather than a single AI law. The government’s response of 6 February 2024 confirmed it.
| principle | what a regulator applying it looks for |
|---|---|
| Safety, security and robustness | systems that work as intended and resist misuse |
| Appropriate transparency and explainability | people can find out when and how AI is used |
| Fairness | no unlawful discrimination or unfair outcomes |
| Accountability and governance | someone is answerable for the system |
| Contestability and redress | a route to challenge a harmful outcome |
Source: DSIT, A pro-innovation approach to AI regulation: government response, 6 February 2024.
What non-statutory means for a firm
The response says a non-statutory approach “currently offers critical adaptability”, and that the government would keep it under review. In practice the principles guide regulators in how they apply their own powers, not businesses directly. Your duties come from the law each regulator already enforces: for a law firm that includes the SRA, whose position is covered in our guide to AI in court documents, and for a council the public sector rules in AI in local government.
The emphasis since has been growth. The AI Opportunities Action Plan, published by DSIT on 13 January 2025, is about adoption and infrastructure rather than new duties. As of October 2026 there is no horizontal AI statute on the books, so for most UK firms the AI regulator in practice is the one that regulates personal data.
UK GDPR and the ICO: what UK law asks of your AI use today
Every UK firm that puts personal data into an AI tool is already regulated, whatever happens in Brussels. The ICO applies UK GDPR and the Data Protection Act 2018 to that processing, and the questions it asks are the ones a supplier contract has to answer: who is the controller, on what lawful basis, under which processor terms, and with which transfer route.
Those supplier checks are set out in full in our guide to GDPR compliant AI tools, and what each assistant keeps is covered for ChatGPT and Copilot. This section covers what is moving in UK law, because that is where the AI specific change is.
The Data (Use and Access) Act 2025, fully in force
The ICO updated its guidance on 19 June 2026 to say that all data protection provisions of the Data (Use and Access) Act 2025 are now in force. Two of them touch AI use directly.
Section 80, in force since 5 February 2026, replaced Article 22 of UK GDPR with Articles 22A to 22D. The ICO reads them as opening the full range of lawful bases for significant automated decisions, with appropriate safeguards, while keeping a tighter rule where special category data is involved. The safeguards are information about the decision, a chance to make representations, human intervention and a way to contest it.
The Act also obliges you to help people complain, to acknowledge a complaint within 30 days and to respond without undue delay.
The ICO’s AI guidance, and the code that is coming
The ICO’s Guidance on AI and data protection was last updated on 15 March 2023, and it now carries a banner saying it is under review because of the Data (Use and Access) Act. It is still the regulator’s fullest statement, and its risk toolkit is worth an afternoon.
What is new is statutory. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, made on 16 April 2026 and in force since 12 May 2026, require the Information Commissioner, whose functions passed to the Information Commission (still known as the ICO) on 30 September 2026, to prepare a code of practice on processing personal data when developing and using AI and automated decision making, including children’s data.
A statutory code is not an AI Act. It runs on data protection powers and reaches AI only through personal data. The difference is standing. The ICO’s own page on codes describes them as guidance the government has directed it to produce and Parliament has approved, which ordinary guidance is not.
What else the ICO says is on its way
The ICO’s plan for new guidance, read on 13 October 2026, lists updated guidance on automated decision making and profiling for winter 2026, after a consultation that has closed. Guidance on agentic AI is listed for autumn 2026, with its consultation still shown as due to launch in September 2026, and work on foundation models is due in autumn 2026.
Plan around the duties, not the publication dates. None of the forthcoming guidance changes the fact that a lawful basis, a processor contract, a DPIA where the triggers are met and a written rule about what staff may type are already required. Public bodies have more to work with, and a council is the case where the two regimes meet most often.
The EU AI Act and UK GDPR, side by side
These are the two most confused laws in UK AI compliance. They come from different legislatures, ask different questions and are triggered by different facts. A use can be fine under one and a problem under the other.
| EU AI Act | UK GDPR and the DPA 2018 | |
|---|---|---|
| the question | what kind of system is this, and what is it for | whose personal data is processed, and on what basis |
| when it reaches a UK firm | EU market, or output used in the Union | processing by a UK establishment, wherever it happens |
| who enforces | authorities in the member states, and the AI Office for model providers | the ICO |
| highest ceiling | €35 million or 7% of worldwide turnover | £17.5 million or 4% of worldwide turnover |
Sources: Articles 2 and 99 of Regulation (EU) 2024/1689; section 157(5) of the Data Protection Act 2018.
A third law that may also apply
There is a third regime that UK firms serving the EU sometimes forget. The EU GDPR itself, under its Article 3(2), applies to a controller outside the Union that offers goods or services to people in the Union or monitors their behaviour there. Article 2(7) of the AI Act says the AI Act does not affect it.
So a UK firm screening EU candidates with AI can be inside three laws at once, with three different regulators. The common ground is the data: what the tool saw. That is where the next section starts, and it is the part a pseudonymisation step can change.
The client file typed into a chatbot, under UK law
Nothing in the EU AI Act stops an employee in Birmingham opening an everyday chatbot and typing a client’s name, address and account details into it. It is not a prohibited practice and not a high-risk system. Under UK GDPR it is a disclosure of personal data to a third party, and depending on the account and what happened next it can be a personal data breach.
The control has three places it can live: the vendor contract, the account settings, and what leaves the machine in the first place. Knowing which details to take out is the start of the third.
A written rule, and what it cannot reach
A written rule is necessary, and it is the first thing the ICO would ask to see. It is not sufficient, because it relies on every person remembering it at the moment they are in a hurry, with a document open and a deadline close, and some of that use happens on personal accounts your policy cannot see.
A control that works on the text itself, before it leaves, does not depend on knowing which account someone opened. For a clinic, the stakes are clearer still, as the NHS guide shows.
Where Nonimo fits
This is where we have an interest, so here it is plainly. Nonimo is a Mac and Windows app that sits between the person and the chat window. Select the text and press its key: names, addresses, emails, phone numbers, dates of birth, and UK identifiers such as National Insurance and NHS numbers become labels like [PERSON_1] before anything leaves the computer. The reply comes back with the real details put in again, from a map kept encrypted on that machine.
It pseudonymises rather than anonymises, so under UK GDPR the text is still personal data in your hands and every duty in this guide still applies. What it changes is what the provider receives. What it keeps on your disk is on our security page, and team deployment is on the organisations page.
What a UK firm should do this quarter
- Map each tool against Article 2. For every AI system in use, note whether its output reaches anyone in the EU. Most will not, and that is worth knowing in writing.
- Settle your role. Ask each supplier to confirm in writing that it is the provider and you are the deployer, and whether anything you use falls under Annex III.
- Close Article 50 if it applies. A chatbot that EU customers reach needs a clear AI disclosure before the first exchange.
- Write the rule and train to it. One policy, naming approved tools and what must never be typed into them, with a dated session for the people who use them. It serves Article 4 and the ICO at the same time.
- Check automated decisions against Article 22C. Anywhere AI makes or shapes a significant decision about a person in the UK, make sure they can contest it and reach a human.
If a client or an insurer is already asking about your AI use, the questions and answers are in our guide to the AI questions on a cyber questionnaire, and firms in regulated professions will find the sector detail for solicitors and accountants.
Sources
Checked 13 October 2026. The AI Act’s own text is the primary source throughout; where the Digital Omnibus changed it, the consolidated text on the Commission’s AI Act Service Desk is cited.
- Regulation (EU) 2024/1689 (the AI Act), 13 June 2024, EUR-Lex. Article 2(1)(a) and (c), 2(7) and 2(10) on scope; Article 3(4) and 3(5) on deployers and authorised representatives; Article 4 on literacy; Article 5(1)(f) on emotion inference; Article 22 on authorised representatives of third country providers; Article 25 on deployers becoming providers; Article 26 on deployer duties; Article 50 on transparency; Article 99 on penalties; Annex III on high-risk areas.
- Regulation (EU) 2026/1744, the Digital Omnibus on AI, 8 July 2026, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. The deferral to 2 December 2027 and 2 August 2028, the amended Article 4 and the new Article 4a.
- European Commission, AI Act Service Desk, implementation timeline, read 13 October 2026. The Commission’s own timetable reflecting the Omnibus, and the two prohibitions applying from 2 December 2026.
- AI Act Service Desk, Article 4a and Article 113, consolidated text, read 13 October 2026. The six conditions for processing special category data to correct bias, and the amended application dates.
- European Commission, European AI Office. The Commission body supervising general purpose AI models.
- Regulation (EU) 2016/679, Article 3 (the EU GDPR), EUR-Lex. Territorial scope for controllers outside the Union offering goods or services to, or monitoring, people in the Union.
- DSIT, A pro-innovation approach to AI regulation, white paper published 29 March 2023, and the government response of 6 February 2024. The five principles, their non-statutory basis, and the decision to work through existing regulators.
- DSIT, AI Opportunities Action Plan, 13 January 2025. The government’s adoption and growth plan.
- The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, SI 2026/425, made 16 April 2026, laid 21 April 2026, in force 12 May 2026. Regulation 2, requiring the Commissioner to prepare the code, including on children’s data.
- The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026, SI 2026/386, legislation.gov.uk, in force on 30 September 2026 (SI 2026/1015). From that date the UK regulator is the Information Commission, which still uses the ICO name.
- Data (Use and Access) Act 2025, section 80, legislation.gov.uk, in force for all purposes from 5 February 2026. Articles 22A to 22D of UK GDPR: significant decisions, the special category restriction, and the safeguards.
- Data Protection Act 2018, section 157, legislation.gov.uk. The higher maximum of £17.5 million or 4% of worldwide turnover.
- ICO, The Data (Use and Access) Act 2025: what does it mean for organisations, updated 19 June 2026. All data protection provisions in force, the wider lawful bases for automated decisions, and the 30 day complaints acknowledgement.
- ICO, Guidance on AI and data protection, updated 15 March 2023 and marked as under review because of the Data (Use and Access) Act.
- ICO, Our plans for new and updated guidance: technology, read 13 October 2026. The stages and dates for the agentic AI, automated decision making and foundation model guidance.
- ICO, Our plans for new and updated codes of practice, read 13 October 2026. Codes as guidance the government directs and Parliament approves.
- ONS, Artificial intelligence in UK businesses: 2023 to 2026, released 20 July 2026. Around 35% of businesses with ten or more employees using at least one AI technology and 49% of those with 250 or more (BICS, June 2026), and 55% of working adults in Great Britain using AI for work or education (Opinions and Lifestyle Survey, May to June 2026).
This page is for information and is not legal advice. For your own organisation, ask your regulator or a qualified adviser.
Nonimo is the software that does this on your own computer: it redacts client names and IDs before your text reaches ChatGPT. No account needed, and the app does it without your files leaving your machine.
Common questions
Does the EU AI Act apply to UK businesses?
Only through Article 2, but more often than people expect. It reaches a UK firm that places an AI system on the EU market, and a UK provider or deployer whose AI output is used in the Union. Brexit does not change that, because the test is where the system is sold or its output used, not where the company is registered. A firm with only UK customers is outside it.
Is there a UK equivalent of the EU AI Act?
No. The UK has no horizontal AI statute. The government's 2024 response to its AI white paper kept five principles on a non-statutory basis, for existing regulators to apply within their remits. For most firms that means UK GDPR and the ICO, which regulates AI wherever personal data is involved, and a statutory ICO code on AI and automated decision making is now being prepared.
Can a UK company act as the EU authorised representative for an AI system?
No. Article 3(5) of the EU AI Act defines an authorised representative as a person located or established in the Union, and Article 22(1) requires a non-EU provider of a high-risk system to appoint one established there before making the system available. A UK software house selling a high-risk system into the EU needs an EU entity or an EU firm to take the mandate. A UK office does not qualify.
When do the high-risk rules apply to a UK recruiter with EU clients?
From 2 December 2027, for systems listed in Annex III such as CV screening, after Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved the date. AI inside regulated products follows on 2 August 2028. The Omnibus did not change which systems count as high risk, so a screening tool used on candidates for EU roles is already one, and the contract signed today should reflect that.
How do EU AI Act fines compare with UK GDPR fines?
Article 99 of the EU AI Act sets three ceilings: up to €35 million or 7% of worldwide annual turnover for a prohibited practice, €15 million or 3% for most other duties including Article 50 transparency, and €7.5 million or 1% for misleading a regulator. For SMEs the lower figure applies. Under UK GDPR, section 157 of the Data Protection Act 2018 sets the higher maximum at £17.5 million or 4%.
Does the EU AI Act replace UK GDPR for a UK company?
No. They are separate laws from separate legislatures, and they can apply to the same tool at once. The EU AI Act asks what the system is for and where its output goes. UK GDPR asks whose personal data went into it and on what basis. Article 2(7) of the AI Act says it does not affect the EU GDPR either, which may also reach you if you serve people in the EU.
What does the ICO say about using AI at work?
Its main guidance on AI and data protection dates from 15 March 2023 and is marked as under review because of the Data (Use and Access) Act 2025. The duties underneath have not moved: a lawful basis, a processor contract, a DPIA where the risk calls for one, and safeguards for significant automated decisions under Articles 22A to 22D of UK GDPR, fully in force since 5 February 2026.
Do I need to tell EU customers that my chatbot is AI?
If your chatbot reaches people in the EU, yes, since 2 August 2026. Article 50(1) puts the duty on the provider to design the system so people are told they are dealing with an AI, unless that is obvious to a reasonably well informed, observant and circumspect person. If you built the chatbot yourself, you are the provider. A clear line of copy before the first message usually closes it.
Is AI literacy training a legal requirement for UK firms?
Under the EU AI Act, only for firms the Act reaches. Article 4, as rewritten in July 2026, requires providers and deployers to take measures to support AI literacy among the staff who use AI on their behalf, without guaranteeing any individual's level. UK law has no equivalent duty, though training staff against a written AI rule is the simplest way to make that rule hold under UK GDPR.