The EU AI Act came into force in August 2024 and has applied in stages since February 2025. Its transparency rules started in August 2026. The high-risk deadlines moved in July 2026, when the EU’s Digital Omnibus pushed them back to December 2027 and August 2028. Brexit doesn’t take you out of the EU AI Act. UK businesses whose AI reaches the EU market, or affects people there, need a plan now. Here’s where to start.

Contents

1. The Risk-Tiered Structure of the EU AI Act
2. Which UK Businesses Are In Scope?
3. High-Risk AI Systems: Is Yours on the List?
4. Key Deadlines in 2026
5. How the AI Act Relates to GDPR
6. What UK AI Policy Says
7. Practical First Steps

The Risk-Tiered Structure of the EU AI Act

If you want the EU AI Act explained in one sentence, here it is: the more harm an AI system could cause, the more rules it carries. The Act sorts AI into four tiers.

• Unacceptable risk (banned): These practices have been prohibited since 2 February 2025. They include social scoring, manipulative techniques that exploit people’s vulnerabilities, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and schools outside medical or safety uses. Two more bans start on 2 December 2026: AI that generates non-consensual intimate imagery, and AI that generates child sexual abuse material.
• High risk (regulated): Examples include credit scoring, CV screening and pricing for life and health insurance. These systems must meet strict requirements before they reach the market and while they’re in use.
• Limited risk (transparency obligations): Chatbots must tell people they’re talking to AI, and deepfakes and AI-generated content must be labelled or marked. These duties apply from 2 August 2026.
• Minimal risk (no specific obligations): Spam filters, stock forecasting tools and AI in video games fall here. The Act encourages voluntary codes of conduct for these systems.

General-purpose AI models, such as large language models, have their own set of rules. Those have applied to model providers since August 2025.

Which UK Businesses Are In Scope?

The Act follows where the AI has its effect, not where the company is based. EU AI Act obligations reach:

• Providers that place AI systems or general-purpose models on the EU market, or put them into service there, wherever they’re established
• Deployers established in the EU, and providers and deployers outside the EU whose AI output is used in the EU
• Importers and distributors that bring AI systems into the EU market

You don’t need an office, staff or servers in the EU to be caught. A London fintech whose credit model scores applicants in Ireland is in scope. So is a UK insurer pricing health cover for customers in Spain. Non-EU providers of high-risk systems must also appoint an authorised representative in the EU before they place those systems on the market.

High-Risk AI Systems: Is Yours on the List?

Annex III of the Act lists eight areas where AI use counts as high-risk:

1. Biometrics: remote biometric identification, biometric categorisation and emotion recognition, where the law permits them
2. Critical infrastructure: safety components in digital infrastructure, road traffic, and the supply of water, gas, heating and electricity
3. Education and vocational training: admissions, grading, and monitoring students during tests
4. Employment: recruitment, CV filtering, decisions on promotion and dismissal, task allocation and performance monitoring
5. Essential services: eligibility for public benefits, creditworthiness checks and credit scoring, risk assessment and pricing for life and health insurance, and emergency call triage
6. Law enforcement
7. Migration, asylum and border control
8. Administration of justice and democratic processes

AI built into products already covered by EU safety law, such as medical devices and machinery, can also be high-risk under Annex I.

For high-risk AI, UK firms in fintech, healthtech and insurance should look first at four scenarios:

• Credit scoring models used on EU applicants. Fraud detection is excluded.
• Underwriting or pricing tools for life or health cover sold to EU residents.
• AI diagnostic software sold as a medical device in the EU.
• Recruitment tools that screen candidates for EU roles.

An Annex III system can avoid the high-risk label if it only performs a narrow procedural task or doesn’t materially shape the outcome of a decision. That exemption never applies to systems that profile people, and you must document your reasoning either way.

If a system is high-risk, the AI Act requirements include:

• A risk management system
• Governance for training data
• Technical documentation
• Automatic logging
• Human oversight
• Standards for accuracy and cybersecurity
• Registration in the EU database

Key Deadlines in 2026

The Digital Omnibus on AI, Regulation (EU) 2026/1744, came into force on 27 July 2026 and moved the high-risk dates back. EU AI Act 2026 planning now means meeting transparency duties today and preparing high-risk systems for 2027.

Fines reach €35 million or 7% of worldwide annual turnover for banned practices, and €15 million or 3% for most other breaches. The Omnibus also softened the AI literacy duty. You now need to take measures that support staff AI literacy rather than guarantee a set level.

How the AI Act Relates to GDPR

The AI Act works alongside data protection law. It doesn’t replace it. Four overlaps matter most:

• DPIAs: A high-risk AI system that processes personal data will almost certainly need a data protection impact assessment under Article 35 of UK GDPR and its EU equivalent. AI Act deployers must use the provider’s instructions to complete theirs. Deployers of credit scoring and life or health insurance pricing tools must also carry out a fundamental rights impact assessment, which can now build on the DPIA.
• Transparency: Your privacy information has to explain how you use personal data in AI. The AI Act adds separate disclosure duties for chatbots and AI-generated content.
• Human oversight: High-risk systems must be designed so a trained person can monitor them, step in, and override the output.
• Automated decisions: In the EU, Article 22 of the GDPR still restricts solely automated decisions with legal or similarly serious effects. The UK replaced its version with Articles 22A to 22D on 5 February 2026. The UK rules allow more automated decisions, provided safeguards are in place, with stricter limits where special category data is involved. If you serve both markets, design to the EU standard.

What UK AI Policy Says

The AI regulation UK businesses face at home looks very different. The UK has no AI Act, and the government hasn’t introduced an AI bill. Existing regulators apply five cross-sector principles in their own areas. The January 2025 AI Opportunities Action Plan also pushes regulators to support AI growth.

The ICO leads on the data protection side:

• It published an AI and biometrics strategy in June 2025.
• Since May 2026, it has had a statutory duty to prepare a code of practice on AI and automated decision-making.
• It consulted on updated guidance on automated decision-making and profiling in spring 2026.

Sector regulators, including the FCA and Ofcom, set their own AI expectations on top.

The divergence creates risk. The UK widened the rules on automated decisions, while the EU added a full regime written specifically for AI. Meeting UK AI compliance standards alone won’t satisfy the EU, so firms active in both markets need to map their systems against both sets of rules.

Practical First Steps

You have time before the high-risk deadlines, but not much. These four steps put you in control:

1. Build an AI inventory: List every AI system you build, buy or embed, including AI features inside SaaS tools. Record who owns each one, what data it uses, and where its output goes.
2. Classify the risk: Place each system in a tier, and write down your reasoning, especially if you rely on an Annex III exemption.
3. Run a gap assessment: Compare high-risk and limited-risk systems against the requirements that apply to them. Check your vendor contracts as well, because providers must give deployers the information they need to comply.
4. Set up a governance framework: For AI governance, UK and EU expectations overlap: a named owner, a written AI policy, a human oversight process, staff training, an incident process and regular reviews.

The EU AI Act puts real duties on UK firms already. The transparency rules apply now, and the high-risk obligations follow in December 2027. Our team helps you inventory your AI, classify each system and close the gaps, drawing on regulator-facing experience from regulated finance. Our AI Act compliance service covers each step.

Where your models process personal data, our AI and LLM data protection support covers that side too.

Get your AI Act readiness assessment from KEWDATA.