Does the EU AI Act apply to UK businesses?

The EU AI Act applies to a UK business if it places an AI system on the EU market, puts one into service there, or if the output produced by its AI system is used in the EU. Selling to EU customers, screening EU-based job applicants, or running an AI feature for an EU client all fall inside that reach.

If your customers, staff and suppliers are all in the UK, the Act almost certainly does not apply to you — but UK GDPR and your sector regulator still do, and those are the rules that catch most British SMEs first.

• Do you sell, licence or embed an AI-powered product that EU-based customers use? If yes, you are likely a provider for that product.
• Do you use an AI tool whose results affect people in the EU — screening EU candidates, scoring EU customers, moderating EU users? If yes, you are likely a deployer.
• Do you rebrand or substantially modify someone else's AI system before passing it on? That can turn a deployer into a provider, with far heavier obligations.
• Is the use case on the prohibited list — social scoring, emotion inference at work or school, untargeted facial-image scraping? Those bans already apply and have no grace period.

• Prohibited — banned outright. Manipulative techniques, social scoring, emotion recognition in workplaces and schools, most real-time biometric identification in public.
• High risk — allowed with heavy conditions. Recruitment and worker management, credit scoring, access to essential services, education assessment, and safety components of regulated products.
• Limited risk — transparency duties. Chatbots must be identifiable as machines; synthetic images, audio and video must be labelled.
• Minimal risk — the vast majority of business tools. Spellcheckers, meeting summarisers, marketing copy assistants. No specific obligations beyond general law.

The tier that catches unsuspecting SMEs is high risk, and the usual culprit is hiring. An off-the-shelf CV screening or ranking tool used on EU applicants is a high-risk use, even though it feels like ordinary HR software.

• 2 February 2025 — prohibitions and AI literacy obligations applied.
• 2 August 2025 — general-purpose AI model rules and governance structures applied.
• 2 August 2026 — the bulk of the Act applies, including transparency duties and high-risk obligations for Annex III uses such as recruitment and credit.
• 2 August 2027 — remaining high-risk rules for AI embedded in regulated products.

• List every AI tool in use, including the ones staff adopted without asking. You cannot classify what you cannot see.
• For each tool, note whether its output touches anyone in the EU. That single column decides your exposure.
• Flag anything used in hiring, performance management, credit or access to services — these are the high-risk candidates.
• Check the vendor's documentation for a stated role and intended purpose; using a tool outside its intended purpose can shift liability onto you.
• Record human oversight: who reviews the output, and what authority they have to overturn it.
• Give staff basic AI literacy training and write it down. It is a live obligation, not a nice-to-have.