Does the EU AI Act apply to UK companies?

Yes, if Europe is a market for you. The Act binds anyone who places an AI system on the EU market, and anyone outside the EU whose system produces output that is used inside it. Being established in London exempts you from nothing. What varies is which obligations land on you, and when.

What changed on 28 September 2026: the Digital Omnibus on AI took effect on 27 July and softened the AI literacy duty in Article 4, and enforcement began on 2 August.

The EU AI Act applies on the basis of where an AI system is used, not where the company using it is registered. That test sits in Article 2. It covers providers placing systems on the Union market irrespective of where they are established, and providers and deployers in a third country where the output the system produces is used in the Union. A Manchester company selling a hiring tool to a Dutch employer is inside the perimeter. So is a London agency running a support assistant on an Irish client's website. Which duties follow then depends on whether you are the provider or the deployer of that system, and most UK SMEs are deployers.

Who the Act reaches, and where the UK sits

The UK has no AI statute and no AI regulator. Five cross-sector principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress) are applied on a non-statutory basis by whichever regulator already covers your sector. Central government sets direction and enforces nothing, as set out in the CMS AI regulation scanner for the United Kingdom.

That direction no longer comes from DSIT: the machinery of government changes of 22 July 2026 moved responsibility for AI strategy to the Cabinet Office. Nothing in that arrangement carves a British company out of the EU regime. For most UK software firms the AI Act will be the only AI-specific statute they ever meet, and it will arrive through their customers.

Reach follows the market. For a small UK company that usually means selling a product with an AI feature to customers in the EU, or building software for a client who then sells it there. The one people forget is the quieter case. You run a tool yourself, from an office in London, and an EU entity uses what it produces. That is enough to bring the system into scope.

The awkward part is that the answer is per system, not per company. Every time we have classified the AI systems in a real product, a single product has turned out to hold more than one AI system, and the answers differed between them. There is usually a vendor assistant the company deploys and a feature built in-house on a hosted model. Somewhere further down sits a classifier that predates the whole conversation and that nobody in the room thinks of as AI. That last one is the one people miss, and it is often the one making the most consequential decision.

The compliance timeline, and what the Omnibus moved

Dates from the European Commission's AI Act page, which carries the current application timeline. The high-risk moves and the one-year sandbox delay come from the Digital Omnibus on AI, summarised by Gibson Dunn on 27 May 2026. The European Parliament endorsed the package on 16 June 2026, and the Council of the EU gave it the final green light on 29 June 2026. It was published in the Official Journal as Regulation (EU) 2026/1744, in force from 27 July 2026. The AI Office and national authorities gained their enforcement powers from 2 August 2026 (European Commission, 2026).

The Omnibus has been reported almost everywhere as a delay to the AI Act, and the shorthand is doing real damage. What moved is the high-risk tier. What did not move is 2 August 2026. The Article 50 transparency duties arrived on the original date and most of the transparency package was left untouched. The single reprieve went to providers whose generative systems were already on the EU market before that date, who have until 2 December 2026 to bring machine-readable marking into conformity. If you read one thing about the Omnibus and concluded you had until 2027, you read the wrong thing.

Are you a provider or a deployer?

The Act hands out duties by role, and the roles are defined in Article 3. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trade mark. A deployer uses an AI system under its own authority in the course of a professional activity. Licensing a tool and switching a feature on makes you a deployer. Putting your own name on something and selling it makes you a provider, even when the model underneath belongs to somebody else.

Most UK SMEs are deployers. Most published guidance is written for providers, which is why so much of it reads as frightening and irrelevant at the same time. Deployer duties are lighter, and they are still duties: the Article 50 obligations on emotion recognition, biometric categorisation and deepfake disclosure sit on deployers, not on the people who built the model.

The trap is that roles attach to systems and can shift under you. Fine-tune a model, ship the result under your own brand, and the question of which role you are in stops being obvious. Article 25 governs when responsibility moves along the value chain, and it is worth reading before anyone in your company describes a customisation as "just prompting". The specific tests, applied to the ordinary cases most SMEs are in, are set out in provider or deployer under the EU AI Act.

Is your AI system high-risk?

Probably not. The high-risk tier is the expensive one and most small British software companies are nowhere near it. The stand-alone high-risk uses live in Annex III, which the Commission's application timeline groups as biometrics, critical infrastructure, education, employment, migration, asylum and border control. Annex I is a different list: AI embedded in products already regulated for safety, such as machinery, lifts and toys.

Purpose is what puts a system in Annex III, so the same technology sits on both sides of the line. A ranking feature inside an HR product is employment. The same ranking code applied to restaurant reviews is not. A scheduling tool, an invoicing product, a document summariser and an internal search index are not high-risk because of what they are made of.

The Omnibus moved that tier to 2 December 2027 for Annex III, about sixteen months later than planned, and to 2 August 2028 for Annex I. That is a reprieve for anyone who is in it. It is not a reason to defer the classification. A system classified late is a system re-architected late, and the classification question turns up in customers' procurement checks and investors' technical due diligence long before a regulator asks it. Working through Annex III without a lawyer takes the categories one at a time, using ordinary business software as the worked example rather than the facial recognition scenarios that dominate the guidance.

What applies to nearly every company, right now

Two obligations reach almost everyone in scope and neither depends on the risk tier. One of them has been in force since before most companies started paying attention.

Article 4 applied from 2 February 2025, and the Omnibus rewrote it with effect from 27 July 2026. It now asks providers and deployers alike only for measures that support AI literacy among staff and others operating AI for them, with no level to guarantee (Regulation (EU) 2026/1744). Keeping a written record of what training happened, and when, is most of the practical compliance.

Article 50 is the one that landed on 2 August 2026, and it has four limbs. Providers of systems intended to interact directly with people must ensure those people are told they are dealing with an AI, unless it is obvious from the circumstances. Providers of generative systems must mark outputs in a machine-readable format so they are detectable as artificially generated. Deployers of emotion recognition or biometric categorisation must inform the people exposed to it. Deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest.

The carve-outs matter as much as the limbs, and the Article 50 guide published on artificialintelligenceact.eu in May 2026 sets both out together. Obviously fantastical content is exempt, as is AI limited to assistive editing. So is detection and investigation of criminal offences. The exemption most companies will reach for is the last one: text that a person has reviewed, with somebody taking editorial responsibility for it, does not need the disclosure.

The chatbot disclosure itself is a small piece of work: one line of copy above the input, and an hour of somebody's time including the review. What takes longer is the argument about wording, because the product team wants it to sound warm and the direct version sounds like a warning. Our position is that the plain sentence wins. A disclosure the user has to interpret is not a disclosure.

Penalties, and the cap that applies to small companies

Article 99 sets three penalty tiers. Prohibited practices under Article 5 carry up to €35m or 7% of worldwide annual turnover. Most operator obligations, transparency included, carry up to €15m or 3%. Supplying incorrect, incomplete or misleading information to authorities carries up to €7.5m or 1%.

For SMEs, start-ups included, each of those is capped at whichever of the fixed amount or the percentage is the lower figure. That is the reverse of the general rule, and it is the part of Article 99 that owner-managed companies almost never hear about. On €4m of turnover, 3% is €120,000, and the €15m ceiling never enters the arithmetic. The headlines quoted the ceiling.

There is a caveat worth stating plainly. The cap is on the size of the fine, not on the obligation, and an SME that ignores Article 50 is still in breach on 3 August.

The cap is not the only relief. Regulatory sandboxes have to give SMEs and start-ups priority access free of charge, under procedures the Act requires to be simple and clear, per the EU AI Act small business guide. Every member state must run at least one, and the Omnibus moved that deadline to 2 August 2027. Since 8 October 2025 the Commission has run an AI Act Service Desk and Single Information Platform. Its interactive Compliance Checker will tell you, at no cost, whether a described system is in scope and at which tier. Run it before you pay anybody for an assessment.

The Omnibus also extends the simplified compliance framework beyond SMEs to small mid-cap companies, and the published text settles who counts. A small mid-cap is a company that is not an SME, employs fewer than 750 people, and has turnover of no more than €150m or a balance sheet of no more than €129m. The regulation borrows that definition from Commission Recommendation (EU) 2025/1099. Its fine cap is narrower than the SME one: the lower-of rule covers operator and information breaches, not prohibited practices (EUR-Lex, 2026).

What to do this quarter

With 2 August 2026 now behind us, the work worth doing is still small and mostly clerical.

Start with an inventory. List every AI system the company uses or ships, including the ones that arrived as a feature of something you bought for another reason. Against each, write down what it does, who supplies it, whether you are provider or deployer, and whether any of its output reaches the EU. Everything else is built on that list, and the first pass takes an afternoon.

After that, run the Commission's Compliance Checker against each entry. It gives you a self-assessment, and we would not treat its output as a defence, but it is free and it asks the Commission's own questions in the Commission's own order.

That leaves the two obligations that are already live. If anything you run talks to people, put the disclosure into the interface now, because the duty has applied since 2 August. If your staff use AI at all, start the AI literacy record: a short note of who was trained on what, and when, is enough to evidence that measures were taken.

The rest is documentation, and compliance is the weakest reason to write it. The same pack answers a buyer's security questionnaire and most of an investor's diligence list, and writing it under deadline is how it ends up wrong. We keep the AI documentation pack beside the architecture notes in the repository, because a document nobody opens goes stale, and a stale model inventory is worse than no model inventory.

If you have no internal rules at all, the fastest useful move is an AI use policy sized for a small company. It covers scope, approved tools, what data may go into them, when disclosure is required, and how often the whole thing gets reviewed. It doubles as the cheapest evidence you have that Article 4 measures exist.

Common questions

What does the EU AI Act mean for UK companies?

It means the Act applies to you whenever your AI system is placed on the EU market or its output is used in the EU. Being registered in the UK exempts you from nothing. What you owe depends on whether you are provider or deployer of each system, its risk tier, and the dates the Digital Omnibus moved.

Does it apply if we only use ChatGPT?

Partly. Internal staff use of a general chatbot does not place a system on the EU market, so most of the Act stays out of reach. Article 4 does not. The literacy duty binds every deployer, though since 27 July 2026 it asks for measures supporting staff literacy, not a guaranteed level. A written training record is the practical response.

What happens on 2 August 2026?

General application, and with it the Article 50 transparency duties, which EU and member state regulators can enforce from that day. Systems that interact with people must say they are AI. Generative outputs must be machine-readable as artificial. Deployers must disclose deepfakes and AI-written public-interest text. The high-risk tier does not arrive on that date, whatever older guidance says.

Are there SME exemptions?

Reliefs rather than exemptions. Article 99 fines for SMEs and start-ups are capped at the lower of the fixed amount and the turnover percentage. Regulatory sandbox access is free and prioritised. The Commission's Compliance Checker costs nothing. The underlying obligations still apply in full.

Did the Digital Omnibus delay the AI Act?

Part of it. Stand-alone Annex III high-risk obligations moved from 2 August 2026 to 2 December 2027, and Annex I embedded high-risk sits at 2 August 2028. The change has been law since 27 July 2026. Transparency and general application kept their original date of 2 August 2026, and AI literacy was softened but stays in force.

We are a UK company with no EU customers. Are we in scope?

Not on those facts. The position changes the day an EU customer signs, or an EU entity starts using output your system produced. UK obligations still apply through your existing sector regulator and through data protection law, neither of which the AI Act displaces.

Who decides whether we are a provider or a deployer?

You do, and you need to be able to show the reasoning. Using a vendor's tool at work usually makes you a deployer, and selling something under your own name makes you a provider. Write the answer down for each system separately, because the roles attach to systems.