← Back to blog

What the EU AI Act Means for UK Businesses

You run a UK business with no EU office. Does the EU AI Act apply to you? The honest answer is: sometimes, and less than the headlines suggest. Here's the proportionate read.

“We’re a UK business with no EU office. Does this even apply to us?”

It’s the first question most UK firms ask about the EU AI Act, and it’s the right one. The Act is the EU’s flagship AI law, with penalties up to 35 million euros or 7% of global annual turnover. Headlines make it sound like a wall that everyone must climb.

The honest answer is narrower. The Act can reach a UK business that has no EU subsidiary, no EU office, and no EU staff. But for most UK SMEs, what it actually requires is modest, and the UK’s own framework is the more immediate concern. This post gives you the proportionate read: when the Act reaches you, how hard it bites, and what a sensible UK business does about it.

If you only skim one thing, start here:

  • The Act can apply to you without an EU entity, if you put AI on the EU market or your AI’s outputs are used in the EU.
  • For a UK-only firm with no EU foothold, direct enforcement is materially harder in practice than the penalty figures suggest.
  • Most commercial AI products are minimal or limited risk, where the obligations are light.
  • High-risk categories (recruitment, credit, education, and similar) are where real cost lives. Check whether you are in one.
  • Your UK obligations (UK GDPR, sector rules) usually come first. Treat the EU Act as an export question, not a domestic one.

First, the one-paragraph version

If you are new to the Act, here is the whole thing in brief. The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive AI law: a single binding regulation that sorts AI uses into risk tiers and scales obligations to match. Banned uses sit at the top, a defined set of high-risk uses (recruitment, credit, education, and similar) carry substantial duties, lighter transparency rules apply to things like chatbots, and the vast majority of everyday AI is minimal risk with no specific obligations. It came into force on 1 August 2024 and phases in over several years. We unpack all of that in what the EU AI Act is. The rest of this post is about one question: how it touches a UK business.

When the EU AI Act reaches a UK business

The Act does not care primarily about where your company is registered. It cares about where your AI lands. Under its scope provisions, it applies if any of these is true:

  • You place an AI system on the EU market, or put it into service in the EU.
  • You are outside the EU, but the output of your AI system is used in the EU.
  • You are an importer or distributor of AI systems in the EU.

That middle point is the one UK firms miss. If you run a SaaS product that any EU customer can sign up to, or an app on the EU app stores, or an API that EU developers call, you are plausibly in scope. The reach is deliberately broad, much like UK GDPR’s own territorial reach in reverse.

The flip side is just as important. If you have no EU users, no EU customers, and no outputs used in the EU, the Act is unlikely to apply to you on the facts. Plenty of UK SMEs are purely domestic, and for them the EU Act is simply not the right thing to spend time on yet.

Enforcement reality for a UK-only firm

Scope is not the same as enforcement, and this is where the proportionate read matters most.

The EU’s enforcement architecture leans heavily on having something to enforce against inside the EU: a local entity to fine, an authorised representative to hold responsible, a distributor or app store to pressure, or a market to close off. Against a UK business with an EU subsidiary or a large EU customer base, those levers are real. Against a UK-only, internet-native firm with no EU assets and no EU representative, direct enforcement is materially harder in practice.

The strongest practical lever is not a fine landing on your UK bank account. It is market access and commercial pressure: your EU enterprise customers have their own AI Act obligations, and they will increasingly ask you for compliance assurances before they buy or renew. In other words, the cost often arrives as a procurement question from a customer, not a letter from a regulator. That is a slower, more commercial risk, and it is the one worth planning for.

On the question founders sometimes raise: AI Act penalties are administrative, levied on the company, not criminal sanctions on individuals. A non-EU founder travelling to the EU faces very low practical risk under the Act itself. The risk profile here resembles GDPR, not sanctions law.

Which role are you?

The Act assigns obligations by role, and getting yours right is the single most useful step.

  • GPAI provider. You trained a general-purpose AI model, or significantly modified one. This means the likes of Anthropic, OpenAI, Google DeepMind, Mistral. If you are reading this as a UK SME, this is almost certainly not you. Commission guidance says ordinary fine-tuning does not automatically make you a GPAI provider; the indicative trigger is modification compute greater than a third of the original model’s training compute, which is far beyond a normal team’s budget.
  • AI system provider. You built a product or service that uses AI and put it on the market. Most UK firms building AI products sit here, including thin wrappers around an LLM API. Marketing a product built on someone else’s model still makes you the provider of that product.
  • Deployer. You use someone else’s AI tool in your business. Lighter obligations, mainly around human oversight and using the tool as intended.

A common and costly confusion: “we use OpenAI’s API, so OpenAI handles compliance.” OpenAI handles its GPAI obligations. You handle the obligations for the product you ship. They are separate.

How much of this actually bites?

The Act is tiered by risk, and most products land in the lower tiers.

  • Prohibited. A short list of banned uses (harmful social scoring, certain biometric surveillance, manipulation that causes harm). Most commercial products are nowhere near this. If yours might be, stop and take specialist advice before launching in the EU.
  • High-risk. This is where serious obligations live: risk management, data governance, technical documentation, logging, human oversight, conformity assessment, post-market monitoring. The categories are specific, not “anything sophisticated.” They include AI used in recruitment and HR, credit scoring, education assessment, essential services, and a handful of others. If your product makes or materially informs decisions about people in one of these areas, assume high-risk until you have checked properly. One recent piece of breathing room: the EU’s 2026 simplification package pushed the main high-risk deadlines back, to December 2027 for the standalone Annex III categories and August 2028 for AI embedded in regulated products.
  • Limited risk. Transparency obligations that apply from August 2026. Chatbots must tell users they are AI. Deepfakes and certain AI-generated or manipulated content must be disclosed or marked, subject to exceptions. These are real but light: disclosure, not a compliance programme.
  • Minimal risk. The vast majority of AI applications. No AI-specific obligations beyond the law you already follow, chiefly UK GDPR.

For a typical UK SME, a marketing-copy tool, an internal assistant, a workflow automation, the honest classification is minimal or limited risk. The practical ask is a clear AI disclosure, a page or two of documentation, basic AI-literacy materials for staff, and solid data protection. That is a sensible posture, not a project.

What this means for you

The UK has deliberately taken a different path: no single AI Act, but existing regulators applying cross-sectoral principles, backed by UK GDPR and the Data (Use and Access) Act. We have written about the UK’s AI stance and what it means for SMEs in detail. For most UK businesses, that domestic framework is the first call on your attention, and the EU AI Act is an export question you reach when you sell into the EU.

So the proportionate sequence is:

  1. Get your UK house in order first: data protection, sector rules, a basic AI policy.
  2. Map your EU exposure: do you have EU users, customers, or outputs used in the EU?
  3. If yes, classify your product honestly by role and risk tier. Most will be minimal or limited risk.
  4. If you touch a high-risk category, budget seriously or rethink EU timing.

Our Policy Wizard (free to try) drafts a starter AI policy, and the Policy Scanner gives you a free first scan of an existing one for gaps. Both are a practical starting point for steps one and three.

The bottom line

The EU AI Act is broad in scope but uneven in practice. It can reach a UK business with no EU office, yet for most UK SMEs the real obligations are modest and the direct enforcement risk is low. The cost, when it comes, tends to arrive through EU customers asking for assurances rather than regulators knocking. Treat it as a proportionate, risk-graded export question: know when you are in scope, classify honestly, and act in proportion to the tier you land in.

If you want help working out whether the EU AI Act applies to your business, or how much you actually need to do about it, get in touch. We help UK firms size this accurately, without over-engineering compliance they do not need.

References