The EU AI Act for a UK business: when it applies, what changed in 2026, and what to do.

The Act reaches beyond the EU by design. It applies to providers who place AI systems on the EU market or put them into service there, to deployers established in the EU, and to providers and deployers outside the EU where the output of the system is used in the EU. So a London firm selling an AI-enabled product to customers in Ireland or Germany is a provider in scope; a UK firm using an AI tool to screen applicants for a Dublin office is a deployer in scope; and a UK firm using ChatGPT and Claude internally for UK work, with UK clients, is not, whatever its suppliers say. The first task is to write down, for each AI system the firm sells or uses, whether it reaches the EU at all.

Two parts of the Act have applied for over a year and were not touched by the 2026 changes. The prohibited practices in Article 5, in force since February 2025, ban things such as manipulative or exploitative AI, social scoring by public bodies and certain biometric uses; a UK SME is unlikely to be near them, but a firm building customer-facing systems should read the list once. The obligations on providers of general-purpose AI models, in force since August 2025, fall on the model providers, Anthropic, OpenAI, Google and the like, covering transparency, documentation and, for the largest models, systemic-risk duties; a firm building on those models inherits documentation it can ask for, not obligations of its own under that chapter.

After negotiations that nearly broke down in April, EU lawmakers reached political agreement on 7 May 2026 on the Digital Omnibus on AI, which was published in the Official Journal on 24 July and entered into force on 27 July 2026. Its main effect is timing: the high-risk obligations that were due in August 2026 are deferred to 2 December 2027 for stand-alone high-risk systems in Annex III (which include recruitment and worker management, credit, education, and access to essential services) and to 2 August 2028 for AI embedded in products regulated under Annex I. The package also made targeted simplifications and added some prohibitions. The general-purpose model rules and the Article 5 prohibitions continue as before. The European Parliament’s legislative train and the Commission’s pages are the authoritative record; law-firm summaries differ on details and should be read as commentary.

Three cases. If the firm uses AI internally for UK work and UK customers, record that conclusion in the AI strategy and move on; UK GDPR, the ICO’s expectations and sector regulators are the rules that apply, and they are covered in our other guides. If the firm deploys AI on EU individuals, recruitment, credit, education, essential services, classify the use against Annex III now, because the deferral gives time to prepare, not permission to ignore it: the deployer duties include human oversight, informing affected people, keeping logs and using the system as the provider intends. If the firm sells AI-enabled software or services into the EU, classify the product, ask the model providers for their documentation, and plan for the provider obligations by the deferred dates, which for most SME products means risk management, documentation, logging and a conformity assessment.

The UK has no AI Act. It regulates AI through existing law, UK GDPR as amended by the Data (Use and Access) Act 2025, the Equality Act, consumer law, and sector regulators such as the ICO, FCA, SRA and CQC, each of which has published its expectations. For most UK SMEs that is the regime that matters, and it is the one our guides on GDPR, DPIAs, employment law and sector rules describe. The EU Act becomes relevant the day a product or a decision crosses the Channel, and the date to plan for is now December 2027.