The EU AI Act for UK Businesses: When It Applies, What Changed in 2026, and What to Do Now

A common assumption in UK boardrooms is that the EU Artificial Intelligence Act is somebody else's problem. It is not. Regulation (EU) 2024/1689 has deliberate extraterritorial reach, much like the GDPR before it. If your organisation places AI systems on the EU market, or if the output of your AI system is used in the EU, the Act can apply to you regardless of where you are established.

The timetable also moved in 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and pushed back the high-risk obligations. This article explains who is in scope, what the revised dates are, and what UK organisations should be doing in the meantime.

Does the EU AI Act apply to my UK business?

Article 2 of the Act sets its scope. In summary, it applies to:

• Providers that place AI systems or general-purpose AI models on the EU market or put them into service in the EU, wherever the provider is based.
• Deployers of AI systems that are established or located in the EU.
• Providers and deployers in third countries, including the UK, where the output produced by the AI system is used in the EU.
• Importers, distributors and authorised representatives in the AI supply chain.

In practice, UK organisations are most likely to be caught when they sell an AI-enabled product or SaaS service to EU customers, when they have EU subsidiaries or offices that use AI, or when an AI system's decisions affect people in the EU (for example, screening job applicants for an EU role). A UK company using AI purely internally for UK operations is unlikely to be in scope, though its EU customers may still ask contractual questions.

The risk-based structure in one page

• Prohibited practices: a short list of uses banned outright, such as certain manipulative techniques, social scoring and some biometric uses. These have applied since 2 February 2025, and the Omnibus added a prohibition on AI systems that generate non-consensual intimate imagery and child sexual abuse material.
• High-risk systems: AI used in areas listed in Annex III (including employment, education, access to essential services such as credit, and certain law enforcement and migration uses) and AI that is a safety component of products covered by EU product legislation in Annex I. These carry the heaviest obligations: risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity.
• Transparency obligations: under Article 50, people must be told when they are interacting with an AI system, and certain AI-generated or manipulated content must be marked or disclosed.
• General-purpose AI models: providers of foundation models have documentation and copyright-related duties, with extra obligations for models with systemic risk. These have applied since 2 August 2025.
• Everything else: most AI systems fall outside these categories and face no specific obligations under the Act, although other law such as the GDPR still applies.

What the 2026 Omnibus changed

The original Act would have applied the high-risk rules from 2 August 2026. Standards and national authorities were not ready, so the EU legislated a fixed delay. Alongside the new dates, the Omnibus extended some simplified obligations previously reserved for SMEs to small mid-cap companies, softened the AI literacy requirement on companies by giving the Commission and Member States a stronger role, simplified registration of exempted systems in the EU database, and expanded access to regulatory sandboxes.

A delay is not a reprieve. Organisations that will be providers of high-risk systems have roughly a year to put in place risk management, documentation and quality processes that typically take that long to build and evidence.

What UK organisations should do now

1. Build an AI inventory and classify each system

You cannot assess scope without knowing what AI you have. Include third-party tools and AI features inside existing software. Our article on finding shadow AI covers discovery. For each system, record your role (provider or deployer), whether output is used in the EU, and which risk category it falls into.

2. Check for prohibited uses immediately

These already apply. A short legal review of any AI used for emotion recognition at work, biometric categorisation or behavioural manipulation is worth doing now.

3. Fix transparency at the interface

Customer-facing chatbots and AI-generated content are the most common UK exposure. Make sure users are told they are dealing with AI, and that synthetic content is labelled where the Act requires it.

4. If you may be a high-risk provider, start the management system now

The high-risk requirements map closely to a management system approach. ISO/IEC 42001 does not equal compliance, but it builds the risk management, documentation, life cycle control and monitoring the Act expects. Our ISO 42001 readiness guide sets out a staged plan.

5. Do not forget cybersecurity

Article 15 requires high-risk systems to be resilient against attempts to alter their use or performance by exploiting vulnerabilities, naming threats such as data poisoning, model evasion and confidentiality attacks. That is a testing obligation in practice. Adversarial testing, as described in our article on LLM and agent red teaming, produces the evidence.

6. Prepare for contractual questions

Even where the Act does not apply to you directly, EU customers will push obligations down the supply chain. Having an inventory, a policy and evidence of testing ready makes those questionnaires far easier.

What about UK regulation?

The UK has so far taken a principles-based approach, asking existing regulators such as the ICO, FCA and CMA to apply AI principles within their remits, rather than passing a single AI statute. UK GDPR already covers much AI processing of personal data, including rules on solely automated decisions. For cyber security specifically, the government's AI Cyber Security Code of Practice sets baseline expectations for developers and operators. Aligning with the EU Act, ISO 42001 and the UK Code together is achievable because they overlap heavily.

How Pyralink helps

Pyralink builds products that support the evidence side of cloud and AI governance: PyraLink™ Prove keeps read-only evidence of the cloud configuration your AI systems depend on. Pyralink does not provide legal advice; where a legal opinion on scope is needed, take it from your legal advisers.

Frequently asked questions

Does the EU AI Act apply to UK companies after Brexit?

It can. The Act applies to providers placing AI systems on the EU market wherever they are based, and to providers and deployers outside the EU where the output of the AI system is used in the EU.

When do the EU AI Act high-risk rules apply?

Following Regulation (EU) 2026/1744, high-risk obligations apply from 2 December 2027 for standalone systems listed in Annex III, and from 2 August 2028 for AI embedded in products covered by Annex I.

What are the penalties under the EU AI Act?

Fines can reach up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for most other infringements, with proportionate treatment for smaller companies.

Is ISO 42001 certification enough to comply with the EU AI Act?

No. ISO 42001 is a voluntary management system standard. It supports compliance by building governance and risk management processes, but the Act has its own specific legal requirements.

Does the UK have its own AI Act?

The UK has not passed a single AI statute. It relies on existing regulators applying AI principles, UK GDPR for personal data, and guidance such as the AI Cyber Security Code of Practice.

Sources: EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act); EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI); European Commission: AI Omnibus enters into force; DSIT: AI Cyber Security Code of Practice; ICO: Guidance on AI and data protection.