The EU AI Act and UK approach in brief: what businesses need to know

The EU and the UK have taken different routes on AI regulation. The EU passed a single, wide-ranging law, the AI Act, and amended its timetable in 2026. The UK has so far relied on existing regulators and existing laws, with no AI-specific statute. If you are a UK business that sells into the EU, or uses AI tools in your work, both matter.

This brief sets out the position as at October 2026. It is general information, not legal advice. Dates have already moved once, so check the official sources before you plan around them.

Does the EU AI Act apply to you

Article 2 of the AI Act sets its reach. It covers providers who place AI systems on the EU market “irrespective of whether those providers are established or located within the Union or in a third country”, deployers based in the EU, and providers and deployers outside the EU where “the output produced by the AI system is used in the Union.”

In plain terms: a provider builds or sells an AI system under its own name, and a deployer uses one in its business. A UK company that only uses AI internally for UK customers is unlikely to be caught. A UK company whose AI chatbot talks to customers in France, or whose AI tool scores candidates for a role in Germany, may well be. Purely personal, non-professional use by individuals is excluded.

The four risk levels

The European Commission’s AI Act page describes four tiers:

1. Unacceptable risk: banned practices, such as social scoring and harmful manipulation. The Commission lists nine prohibited practices.
2. High risk: allowed, with strict duties covering risk management, data quality, logging, documentation and human oversight. Examples include AI used in employment, education and access to essential services.
3. Transparency risk: disclosure duties, such as telling people they are talking to a machine and labelling deepfakes.
4. Minimal or no risk: no specific rules. The Commission gives spam filters and AI in video games as examples.

Most everyday business uses, such as drafting emails or summarising documents, fall into the last tier. Customer-facing chatbots and generated media bring in the transparency duties. Hiring tools are the most common route into high risk for small firms.

Key dates as at October 2026

The dates come from the Commission’s page and the Future of Privacy Forum’s AI Act timeline.

What the 2026 AI omnibus changed

An amending regulation, known as the AI omnibus, was published in the EU’s Official Journal on 24 July 2026 and entered into force on 27 July 2026, according to the FPF timeline. The main changes for businesses, as summarised by Addleshaw Goddard and the Commission:

• High-risk duties were deferred from August 2026 to 2 December 2027 for Annex III systems and to 2 August 2028 for systems built into products.
• The AI literacy duty was reframed. Providers and deployers must take measures to support their staff’s AI literacy, without having to guarantee any particular level for each person.
• Some simplifications for small and medium-sized enterprises were extended to small mid-cap companies.
• A new prohibition was added for systems that generate non-consensual intimate imagery or child sexual abuse material.

The deferral moves the high-risk deadlines back. It does not remove the obligations.

The UK approach

The UK set out its approach in its February 2024 response to the AI regulation white paper. Instead of a new AI law, existing regulators such as the ICO, the CMA, Ofcom and the FCA apply five cross-sector principles in their own areas: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress. The response said “a non-statutory approach currently offers critical adaptability” and that the government would legislate when confident it was right to do so.

As of September 2026, Lewis Silkin reported that no dedicated AI bill had been introduced, and suggested one might appear in the next King’s Speech, which it did not expect before late 2027.

That does not mean AI is unregulated in the UK. Existing laws apply to AI use: UK GDPR, including the automated decision-making changes made by the Data (Use and Access) Act 2025, consumer protection law, equality law and advertising codes.

A worked example

An example (illustration only): a UK online homeware brand with 15 staff sells across the UK and EU. It uses three AI tools.

1. A website chatbot answering EU and UK customers: transparency risk under the AI Act. It labels the bot clearly as AI for all customers.
2. AI-generated lifestyle images: mostly minimal risk, but any realistic AI image of a person shown on its EU site gets a disclosure, and the brand follows UK advertising rules on misleading content.
3. An AI tool that ranks applicants for roles in its Dutch warehouse: employment is an Annex III high-risk area. As a deployer it plans for human oversight, logging and staff training ahead of December 2027, checks that the vendor is preparing to meet provider duties, and runs a UK GDPR assessment for UK roles in the meantime.

It also gives staff short AI training and keeps a one-page register of the tools it uses.

What to do now, and mistakes to avoid

• List your AI tools and note which touch EU customers, candidates or staff.
• Sort each by risk level and check none fall into a prohibited practice.
• Label chatbots and disclose deepfakes where EU rules apply.
• Give staff practical AI training and keep a record of it.
• For any high-risk use, start planning now. December 2027 is not far away for procurement and process changes.

The common mistakes are assuming a UK base puts you outside the EU Act, reading the deferral as a cancellation, and assuming no UK AI law means no UK rules.