Does the EU AI Act apply to UK businesses?

The Act applies to any business placing AI systems on the EU market or affecting EU individuals, regardless of where the business is based. UK businesses serving EU customers must comply if their AI systems fall into any regulated category, including hiring tools, credit scoring, and access-to-services decisions.

Which AI uses are classified as high-risk under the EU AI Act?

The high-risk categories most relevant to UK SMEs are AI used in hiring and worker management, AI for credit or financial risk assessments, AI that controls access to essential services, and biometric identification systems. Any AI that assists decisions with a significant effect on a person's livelihood is likely to qualify.

What should I do if my AI supplier cannot show EU AI Act compliance?

Treat it as a risk you are carrying on their behalf. Either find a compliant alternative, add documented human oversight of the AI output to your process, or restrict use of that tool to non-EU decision contexts. Request written confirmation of your supplier's compliance position before the 2 August deadline.

EU AI Act: What UK SMEs Need to Know Before the 2 August 2026 Deadline

Q: What penalties apply for not complying with the EU AI Act?

For prohibited AI systems, fines reach up to 35 million euros or 7% of global annual turnover. For non-compliant high-risk AI systems, penalties of up to 15 million euros or 3% of turnover apply. EU customers and partners are also increasingly requiring demonstrated compliance as a condition of contracts.

When UK businesses think about the EU AI Act, the instinct is to assume it only applies to companies inside the EU. That assumption is wrong. Any UK business that places AI systems on the EU market, or uses AI to make decisions affecting EU individuals, is in scope from 2 August 2026 - when the Act's high-risk AI requirements come into force.

What the EU AI Act classifies as high-risk AI

The Act creates a tiered risk framework. The categories classified as high-risk that are most relevant to UK SMEs are:

Employment, worker management, and recruitment: AI used to screen CVs, score candidates, or make hiring recommendations.
Credit and financial services: AI that assesses creditworthiness or sets credit terms.
Access to essential services: AI that controls access to education, healthcare, or essential public services.
Biometric identification: Facial recognition or emotion inference in real-world settings.

If your business falls into any of these categories and serves EU customers, the rules apply regardless of where your company is registered.

What the rules require from 2 August 2026

For high-risk AI systems, the Act requires:

A conformity assessment - documenting that the AI system meets safety and transparency standards.
Technical documentation - a record of how the system works, what data it uses, and how errors are handled.
Human oversight provisions - a human must be able to review, override, or stop the AI's output.
Transparency to affected individuals - anyone subject to an AI-assisted decision must be informed.
Registration on the EU AI database for certain high-risk categories.

Which UK SMEs are most affected

Recruitment agencies and HR teams using AI to screen CVs, score candidates, or rank applicants for EU roles. The ICO has already flagged that some AI screening tools infer protected characteristics from candidate data. If you hire for EU-based positions using AI shortlisting, review your tooling before 2 August.

Professional services firms - accountants, lenders, and financial advisers - using AI to assist in credit assessments or risk scoring for EU clients.

Ecommerce businesses using automated fraud detection, credit offers, or age verification for EU customers.

Three questions to ask before 2 August

Do you use AI to assist decisions that have a meaningful effect on people - hiring, credit, service access?
Do any of those people live or work in the EU?
Can your AI supplier provide documentation of EU AI Act conformity?

If yes to the first two, contact your AI tool provider and request compliance documentation now. If they cannot provide it, you are carrying their compliance risk.

What non-compliance costs

For prohibited AI systems, fines reach 35 million euros or 7% of global annual turnover, whichever is higher. For non-compliant high-risk systems, penalties of up to 15 million euros or 3% of turnover apply. Beyond financial penalties, EU customers and partners increasingly require demonstrated AI compliance as a condition of doing business.

The UK position

The UK has not adopted the EU AI Act domestically. But for any UK business selling into Europe, the EU sets the standard your customers and partners operate under. Building compliant processes now - particularly documented human oversight of AI-assisted decisions - is both a regulatory requirement for EU-facing work and sound governance for any business using AI to make decisions that affect people.