If you run a UK business and use AI (or you're thinking about it), you've probably heard of the EU AI Act. You may also have assumed that, since Brexit, it's not your problem.
For some businesses that's true. For others it isn't. The general application date of the Act was 2 August 2026, including its transparency rules for chatbots and certain AI-generated content, so now is a good time to work out where you stand.
This guide cuts through the legal jargon. No article numbers, no acronyms you need to look up. Just what the law says, whether it might affect you, and what to do about it.
What is the EU AI Act?
It's the EU's comprehensive law on artificial intelligence, and the first of its kind in a major economy. It entered into force in August 2024 and has been switching on in stages. The bans and AI-literacy duties applied from February 2025, the rules for general-purpose AI models from August 2025, and most of the rest from August 2026. The EU has since pushed back the dates for high-risk AI, covered below. You can see the overall picture on the European Commission's AI Act page.
The idea is simple: the more harm an AI system could do to people, the stricter the rules. An AI spam filter has no new rules. An AI that helps decide who gets a job or a mortgage has a lot.
"But we're in the UK. Why should I care?"
Since Brexit, UK businesses count as "outside the EU". But the Act was written to reach businesses outside the EU when their AI has a real connection to it. Being based in the UK does not, on its own, take you out of scope. You can be caught if, for example:
- you put an AI product or service on the EU market, or offer it to customers in the EU, or
- the output of your AI system is used in the EU, even if your servers and staff are all in the UK.
That second point surprises people. Say a UK firm uses an AI tool to shortlist job applicants and some of those applicants are in Ireland or the Netherlands. The Act may apply. Whether it does depends on the details: what the system does, your role, and how its output is used.
If your AI use is genuinely confined to the UK, with no connection to the EU market or to people there, the EU AI Act generally does not apply to you directly. The UK has taken a different approach, which we cover below.
The four risk levels, explained simply
The Act sorts AI into four risk levels. General-purpose AI models, the big models behind tools like ChatGPT, have a separate set of rules, covered after the four levels.
1. Banned: "You can't do this, full stop"
Some uses of AI are prohibited in the EU because they're too harmful. These include:
- social scoring, where AI rates people over time on their behaviour or characteristics and the score leads to unfair treatment, either in unrelated situations or in a way that is unjustified or disproportionate
- AI that manipulates people in harmful ways, or exploits vulnerabilities such as age or disability
- using AI to infer people's emotions from their biometric data (such as facial expressions or voice) in the workplace or in education, apart from narrow medical or safety uses
- building facial recognition databases by scraping images from the internet or CCTV
The emotion point is the one an ordinary business is most likely to stumble into, for example through software that claims to read staff mood from video meetings. It is narrower than it sounds. Ordinary call analytics or sentiment analysis of text does not automatically fall into this category. The question is whether a tool infers emotions from biometric signals about people at work. Check what your tools actually do. The Commission's guidelines on prohibited practices go into the detail.
2. High risk: "You can, but with serious safeguards"
This covers AI used for big decisions about people's lives in listed areas, and AI that acts as a safety component in certain regulated products. For example:
- sifting CVs or ranking job candidates
- assessing creditworthiness and making lending decisions
- risk assessment and pricing for health or life insurance
- deciding on school or university places, or assessing learning outcomes
- AI that acts as a safety component in products such as medical devices, machinery or vehicles
Being in one of these areas does not automatically make every AI feature high-risk. The detail of the use matters, and not every AI system inside a regulated product is classed this way.
If you build these systems, there's a lot of paperwork: risk management, detailed technical records, testing for bias, and a way for a human to oversee the system and step in.
If you use one (an AI recruitment platform, say), your job is lighter but still real. Use it as the supplier intends, keep a human in charge of the final decision, keep an eye on whether it's producing fair results, and keep the records you're responsible for.
The EU has pushed back the dates for most of this. Under Regulation (EU) 2026/1744, the high-risk rules for the listed areas such as hiring and lending now apply from 2 December 2027, and for AI in regulated products from 2 August 2028. Other parts of the Act, including the bans and the transparency rules, were not delayed. It's still worth starting conversations with your suppliers now.
3. Limited risk: "Be honest that it's AI"
The risk here is people being fooled. The rules are about transparency, and they have applied since 2 August 2026. They are more specific than "label everything":
- If a customer is chatting with an AI system, they need to be told it's AI, unless that is already obvious from the context. This duty sits mainly with the provider, who must design the system that way, so ask your chatbot supplier how it handles this.
- Providers of AI that generates images, audio, video or text must build in machine-readable marking so the output can be detected as AI-generated. If you simply use such a tool, that is mostly your supplier's job. Providers whose systems were already on the market before 2 August 2026 have until 2 December 2026 to meet this part.
- Businesses that use AI to create deepfakes, meaning realistic content that resembles real people, places or events and could pass as authentic, must clearly disclose that it's AI-generated or manipulated. Artistic, satirical or fictional works have lighter-touch disclosure rules.
- AI-generated text published to inform the public on matters of public interest must be labelled too, unless a person has reviewed it or exercised editorial control and someone holds editorial responsibility for it.
So this is not a rule that every AI-assisted email, caption or blog post needs a visible label. If you have a website chatbot that EU visitors use, or you publish realistic synthetic media for EU audiences, check these rules. The Commission's quick facts on AI transparency are a good starting point.
4. Minimal risk: "Carry on"
Most everyday business AI sits here: spam filters, product recommendations, stock management, smart search, AI that helps you draft emails or proposals. The Act adds no specific new requirements for these. Good practice is encouraged, but it's voluntary. If the Act applies to your business, it does ask providers and deployers of any AI system to take measures to support staff AI literacy, which we come back to in the steps below.
Separate rules for general-purpose AI
The big AI models that power tools like ChatGPT, Gemini and Claude have their own rulebook, covering documentation, copyright and safety testing. It is a separate framework, not another risk level. These duties fall mainly on the companies that build the models, not on the businesses that use them. If you're a typical UK business using these tools, it mostly matters because your supplier should be able to tell you how their model was built and tested.
Maker or user? It makes a big difference
The Act treats the people who make AI very differently from the people who use it.
- Makers ("providers") develop an AI system and put it on the market under their own name. They carry most of the burden.
- Users ("deployers") use AI tools in their business. That describes most UK SMEs.
Your role depends on what you actually do, and it can change. If you build your own tool, or put your own name on someone else's system, you may count as a provider. If you're using off-the-shelf AI tools, most of the heavy lifting sits with your suppliers. Your job is to use the tools sensibly, be open with customers, and keep people in control of important decisions.
What about businesses that only trade in the UK?
The UK has chosen not to copy the EU. There is no single, comprehensive AI Act and no single cross-sector AI regulator. That does not mean AI is unregulated. Existing laws and sector regulators still apply, and the government has asked those regulators to apply five common-sense principles within their own areas:
- Safety: AI should work reliably and securely.
- Transparency: people should know when AI is being used and roughly how it reaches decisions.
- Fairness: AI mustn't discriminate. The Equality Act still applies.
- Accountability: someone in the business is clearly responsible for it.
- The right to challenge: people should be able to question an AI-driven decision and get it put right.
These principles are policy guidance, not a new set of binding duties. The binding rules are the ones you already follow, and they still apply when AI is involved: UK GDPR, the Equality Act, consumer protection law, and the requirements of your sector regulator, whether that's the ICO, FCA, CMA or another body.
One update worth knowing about: the UK's rules on significant decisions made without meaningful human involvement changed in February 2026. Safeguards still apply, including the ability for people to challenge a decision and ask for human intervention. The ICO has also been asked to prepare a statutory code of practice on AI and automated decision-making, so expect more guidance from it.
Even if you're UK-only, the EU's standards are quietly becoming a reference point. Big software suppliers build to them, and larger clients are starting to ask their suppliers whether they use AI responsibly. Getting your house in order now is good business as well as good compliance.
Six practical steps for UK businesses
You don't need a compliance department to get started:
1. Make a list of every AI tool you use. Include the AI hidden inside other software: your CRM, recruitment platform, marketing tools, phone system. Most businesses are surprised how long the list is.
2. Ask where it reaches. Does any of it touch customers, clients, candidates or staff in the EU, or produce output used there? If not, focus on UK rules. If so, keep going.
3. Check nothing is on the banned list. Pay particular attention to anything that claims to read staff or customer emotions from faces or voices, or to score people on their behaviour.
4. Put each tool into a risk level. For most businesses this will be mostly "minimal", with a chatbot or two in "limited". Look carefully at anything to do with hiring, lending or insurance.
5. Be upfront. Make sure your chatbots make clear they're AI, and ask your suppliers how they meet the marking rules. If you publish realistic synthetic images, audio or video, disclose it. For EU audiences some of this is a legal requirement, and everywhere else it is simple good manners.
6. Make sure your team understands the AI they use. What it's good at, where it gets things wrong, and when a human needs to check its work. If the Act applies to you, it asks providers and deployers to take measures to support AI literacy, and a simple written record of what you've done is sensible.
If you build and sell AI products into the EU, especially anything high-risk, the list is longer. A provider based outside the EU that makes a high-risk system available there generally needs to appoint an authorised representative in the EU, and also needs detailed technical documentation and ongoing monitoring. It's also worth looking at ISO/IEC 42001, the international standard for managing AI responsibly. It can support good governance, but certification is not a guarantee that you comply with the AI Act or with UK law.
What happens if you get it wrong?
The headline figures are large. Under Article 99 of the Act, the maximum fine for using banned AI is €35 million or 7% of worldwide annual turnover. For most other breaches, including the transparency rules, the maximum is €15 million or 3%. Giving authorities incorrect or misleading information carries a lower ceiling again (€7.5 million or 1%). For SMEs, including start-ups, the cap is the lower of the two figures rather than the higher. Those are maximums, not automatic fines, and regulators must consider the circumstances.
For most UK SMEs the bigger, more immediate risk is commercial: losing an EU contract because you can't answer your client's questions about how you use AI.
The bottom line
For most UK founder-led businesses, the EU AI Act is not a reason to stop using AI. It's a reason to use it deliberately: know what tools you're running, be honest with the people they affect, and keep a human in charge of the decisions that really matter.
That's exactly how we think AI should be used anyway. At Amplifyy we help UK founder-led service firms put AI to work so the business can grow without the founder becoming the bottleneck, with clear oversight built in from the start.
Want to know where your business stands? Book a conversation with us and we'll help you make sense of the AI you already use, and the AI you could be using.
This article is general information, not legal advice. Whether and how the rules apply depends on your exact role and use of AI, and the law and official guidance continue to develop. This article reflects the position as at 6 October 2026. If you build or sell high-risk AI into the EU, take specialist legal advice.
Amplifyy is a trading name of Predictive Profits LLP.