The EU AI Act – Implications for UK Organisations Using or Providing AI Systems
The EU AI Act represents the world’s first comprehensive regulatory framework for artificial intelligence, imposing extensive obligations across all stages of the AI supply chain. Although this legislation is EU law, it has substantial extraterritorial effects, meaning UK businesses must navigate its complexities carefully.
Overview and Implementation Timeline
The scope of the Act is vast, encompassing not only developers and suppliers of AI systems but also businesses that utilize these systems. The Act came into force on August 1, 2024, with a phased implementation set to continue until August 2027, which may be extended under the EU’s proposed Digital Omnibus Regulation on AI unveiled in November 2025. This phased approach means many UK businesses that use or provide AI systems may already fall under the Act’s jurisdiction, exposing them to potential penalties for non-compliance that can reach up to €35 million or 7% of worldwide turnover.
Obligations Imposed by the Act
The Act adopts a risk-based approach to regulation, with obligations generally linked to the risk categorization of an AI system and the organization’s role in the supply chain:
General Obligations
Some obligations apply to all businesses regardless of risk level, including a requirement for staff to be sufficiently AI literate, effective from February 2, 2025.
Limited Risk Systems
Limited risk systems, such as chatbots or deepfake tools, are subject to transparency requirements starting August 2, 2026. Providers and deployers must disclose if content generated is artificially created or manipulated.
High-Risk Systems
Systems classified as high-risk involve stricter obligations. These include systems used in critical areas like education and safety. Providers and deployers must monitor performance, report incidents, conduct impact assessments, and implement technical measures. Compliance obligations for high-risk systems will primarily take effect from August 2, 2026.
Unacceptable Risk Systems
Systems deemed to pose an ‘unacceptable risk’ are prohibited outright. This includes systems that employ manipulative techniques or assess human emotions in sensitive settings. These prohibitions are applicable from February 2, 2025.
Extraterritorial Scope for UK Businesses
UK organisations are subject to the Act if they provide AI systems in the EU market or if they use AI systems whose outputs are utilized within the EU. For instance:
- UK Providers/Distributors: Entities that make AI systems available in the EU, such as an education tech firm incorporating an AI function in software sold in the EU, may fall under the high-risk classification.
- UK Deployers: Businesses using AI systems in the UK whose outputs are shared in the EU are also subject to the Act. For example, a professional services firm drafting advice for an EU client or a cultural organisation creating advertisements for EU distribution.
Challenges and Compliance Risks
One challenge for UK deployers is the unintended use of AI outputs that may end up in the EU, raising questions about whether they fall under the Act. For example, if an advice note drafted for a UK client is shared with an EU subsidiary, the UK firm could be inadvertently subject to the Act.
Penalties and Enforcement
Violations of the Act can result in severe penalties, particularly for unacceptable risk systems, with fines reaching 7% of global annual turnover or €35 million. Obligations for high-risk and limited-risk systems attract penalties of up to 3% of global turnover or €15 million.
Steps for UK Businesses
To mitigate exposure to the EU AI Act, UK businesses should:
- Conduct internal reviews to ascertain if their AI usage categorizes them as providers, deployers, or distributors.
- Update supplier and client contracts to ensure transparency regarding AI system usage and prohibit sharing AI outputs with EU entities.
- If falling under the Act, establish procedures to meet AI literacy requirements and review any high-risk uses necessitating compliance actions.
- Stay informed on EU guidance and regulatory developments.
This article aims to provide a comprehensive understanding of the EU AI Act’s implications for UK organisations, emphasizing the need for vigilance and proactive measures in compliance.
