A firm that builds or uses AI in both the UK and the EU is working under two very different models: a binding, risk-tiered EU regulation with fixed dates and fines, and a UK approach of non-statutory principles applied by existing regulators, with data protection law as its main binding core. Most guidance explains one regime or the other. This guide puts them side by side for the decisions dual-market organisations actually face: whether the EU AI Act reaches a UK company, which UK obligations bind today, how obligations compare for the same product, what enforcement looks like on each side, and how to run one compliance programme that satisfies both. It is written for UK-based providers and deployers selling into the EU, EU groups with UK operations, and the security, privacy and risk leads who carry the evidence burden. For the UK picture on its own, see the UK AI Regulation Guide.
Status line (checked 14 November 2026): the EU AI Act text used here is the consolidated version as at 27 July 2026 on the European Commission's AI Act Service Desk, which includes the Digital Omnibus on AI amendments. In the UK, the UK Parliament bills list shows no Government Bill on artificial intelligence; the only active bill with the term in its title is a Private Members' Bill, the Artificial Intelligence (Consent and Misuse) Bill (session 2026-27). Both positions may change: check the official sources before relying on them.
Key takeaways
- Rules-based against principles-based. The EU AI Act sets legal obligations by role and risk tier with application dates and fines; the UK's five white paper principles are non-statutory and applied by sector regulators within their existing powers.
- The EU Act follows the product, not the headquarters. Article 2(1) covers providers placing AI on the EU market wherever they are established, and third-country providers and deployers where the system's output is used in the Union. A UK company can be fully in scope.
- The UK's binding core is UK GDPR. Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025 and fully in force since 5 February 2026, govern significant decisions made solely by automated processing, enforced by the ICO with UK GDPR penalties.
- The EU high-risk dates have moved. Under the consolidated Article 113, high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems; prohibitions already apply and new ones apply from 2 December 2026.
- Build to the EU, evidence to both. For a dual-market firm, the EU Act sets the higher documentary floor; map UK regulator expectations and UK GDPR safeguards onto the same inventory, risk classification and control evidence rather than running two programmes.
The short answer
| Item | United Kingdom | European Union |
|---|---|---|
| Core instrument | White paper "A pro-innovation approach to AI regulation" (CP 815, 29 March 2023) and government response (CP 1019, 6 February 2024): policy, not statute | Regulation (EU) 2024/1689, the AI Act, as amended by the Digital Omnibus on AI |
| Legal force | Principles issued on a non-statutory basis; binding law comes from existing regimes such as UK GDPR, consumer, equality and sector rules | Directly applicable regulation in every Member State |
| Who enforces | Existing regulators (ICO, FCA, CMA, Ofcom, MHRA and others) within their remits; no new AI regulator | National market surveillance authorities, with the Commission's role for general-purpose AI models |
| Structure | Five cross-sectoral principles applied in context | Prohibited practices, high-risk systems, transparency duties, general-purpose AI model duties |
| Definition of AI | Defined by two characteristics, adaptivity and autonomy, to avoid a rigid legal definition | A legal definition of "AI system" in Article 3(1) |
| Legislation pending | No Government AI Bill; one active Private Members' Bill | Regulation in force with staged application dates |
The practical consequence: in the EU you can read your obligations from the text once you know your role and risk class. In the UK you have to assemble them from what your regulator has said, what UK GDPR requires for automated decisions, and voluntary codes that customers and procurement teams increasingly ask for.
Side-by-side comparison
| Dimension | UK approach | EU AI Act |
|---|---|---|
| Risk classification | No statutory tiers; "high impact" is whatever your regulator and UK GDPR treat as such | Article 5 prohibitions, Article 6 high-risk classification (Annex I products, Annex III use cases), Article 50 transparency, Chapter V general-purpose AI models |
| Role model | Regulators look at the regulated firm; the AI Cyber Security Code uses Developers, System Operators and Data Custodians | Provider, deployer, importer, distributor, product manufacturer, authorised representative (Article 2(1)) |
| Automated decisions about people | UK GDPR Articles 22A to 22D: safeguards to receive information, make representations, obtain human intervention and contest | Human oversight design duties for high-risk systems sit in the AI Act; automated decision rules for personal data stay in EU GDPR Article 22 |
| Transparency to the public | Principle of appropriate transparency and explainability, applied by regulators | Article 50: tell people they are interacting with AI, machine-readable marking of synthetic content, deepfake disclosure |
| Security | Voluntary Code of Practice for the Cyber Security of AI (31 January 2025): 13 principles across five lifecycle phases | Accuracy, robustness and cybersecurity requirements for high-risk systems (Article 15) |
| Conformity and registration | None for AI as such; sector product rules still apply | Conformity assessment, declaration of conformity, technical documentation and registration for high-risk systems |
| Frontier and general-purpose models | Government set out a case for targeted binding requirements on developers of highly capable general-purpose AI, but has not legislated | Chapter V obligations for general-purpose AI model providers, applying from 2 August 2025 |
| Maximum penalties | No AI-specific fines; UK GDPR higher maximum of £17.5 million or 4% of worldwide turnover | Up to EUR 35 million or 7% for prohibited practices; EUR 15 million or 3% for most other obligations |
Scope and extraterritorial reach
Does the EU AI Act apply to UK companies?
Often, yes. Article 2(1) of the consolidated text applies the Act to:
- Providers placing on the EU market: providers placing AI systems or general-purpose AI models on the Union market, or putting AI systems into service there, "irrespective of whether those providers are established or located within the Union or in a third country" (point (a)).
- Output used in the EU: providers and deployers established in a third country "where the output produced by the AI system is used in the Union" (point (c)). A UK firm that runs a scoring model in London whose results are used by an EU client can be caught.
- EU deployers: deployers established or located in the Union (point (b)), which includes the EU subsidiaries of UK groups.
- Supply chain roles: importers, distributors and product manufacturers (points (d) and (e)), and authorised representatives of non-EU providers (point (f)).
A UK provider of a high-risk system must also appoint an EU-established authorised representative by written mandate before placing the system on the EU market (Article 22). The representative verifies that the declaration of conformity, technical documentation and conformity assessment exist, keeps them available for 10 years, cooperates with authorities and must end the mandate and notify the authority if it believes the provider is infringing the Regulation.
Does UK AI regulation apply to EU companies?
Not as a single regime, because there is none. An EU firm serving UK users meets UK obligations through the existing laws that already reach it: UK GDPR for personal data of people in the UK, and the rules of whichever UK regulator supervises its activity. See UK GDPR vs EU GDPR for the data protection side.
Obligations compared for the same system
| System | EU AI Act position | UK position |
|---|---|---|
| CV screening tool used by employers | Employment use cases are listed in Annex III, so high-risk duties apply from 2 December 2027: risk management, data governance, documentation, logging, human oversight, accuracy and cybersecurity, conformity assessment | No AI-specific duties. If it makes significant decisions solely by automated processing, UK GDPR 22C safeguards apply; Equality Act and EHRC expectations apply; ICO guidance applies |
| Customer service chatbot | Article 50(1): design so people know they are interacting with an AI system unless obvious | Transparency principle applied by the relevant regulator, plus consumer protection law |
| Image generator in a marketing product | Article 50(2): machine-readable marking of synthetic output; Article 50(4): deployers disclose deepfakes | No marking duty in law; regulator and advertising rules apply |
| Internal coding assistant | Usually outside high-risk; the deployer still needs to check prohibited practices and the general-purpose model provider carries Chapter V duties | Security principle; the voluntary Code of Practice gives the baseline; UK GDPR if it processes personal data |
| AI agent approving refunds or credit limits | Creditworthiness assessment of natural persons is an Annex III use case; other agent use depends on classification | A significant decision with no meaningful human involvement triggers UK GDPR 22A to 22C; FCA expectations for regulated firms |
Two patterns follow. First, the EU Act imposes product-level duties (documentation, conformity, registration) that have no UK counterpart, so the EU sets the documentary floor. Second, the UK's binding duties concentrate at the point of decision about an individual, which overlaps with EU GDPR rather than with the AI Act. For the EU role split, see EU AI Act Provider vs Deployer Obligations Guide; for high-risk duties in detail, the EU AI Act High-Risk AI Systems Guide.
Timeline and enforcement
| Date | Regime | What applies |
|---|---|---|
| 29 March 2023 | UK | White paper sets five non-statutory principles |
| 6 February 2024 | UK | Government response: regulators apply principles, £10 million for regulator capability, case for future targeted rules on highly capable general-purpose AI |
| 31 January 2025 | UK | Voluntary Code of Practice for the Cyber Security of AI published |
| 2 February 2025 | EU | Chapters I and II apply, including Article 5 prohibitions |
| 2 August 2025 | EU | Governance, general-purpose AI model obligations (Chapter V), penalties (Chapter XII) and notified body rules apply |
| 5 February 2026 | UK | UK GDPR Articles 22A to 22D fully in force |
| 2 August 2026 | EU | General application date of the Regulation for provisions not dated otherwise |
| 2 December 2026 | EU | Additional prohibitions added by the Digital Omnibus apply (Article 5(1) points (ba) and (bb), Article 5(1a) and (1b)) |
| 2 December 2027 | EU | High-risk obligations for Annex III systems |
| 2 August 2028 | EU | High-risk obligations for Annex I product systems |
EU penalties (Article 99): up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for other listed obligations, and up to EUR 7.5 million or 1% for supplying incorrect or misleading information, in each case whichever is higher. For SMEs and start-ups the cap is whichever is lower.
UK penalties: there are none specific to AI. Breaches of UK GDPR, including the automated decision safeguards, fall under the Data Protection Act 2018 section 157: a higher maximum of £17.5 million or 4% of worldwide turnover and a standard maximum of £8.7 million or 2%, whichever is greater. Sector regulators use their own powers. For the dated EU tracker, see the EU AI Act Implementation Timeline Tracker.
Compliance risk profile of each regime
Where firms get the EU AI Act wrong
- Assuming establishment decides scope: UK teams read "EU regulation" as "EU entities" and miss Article 2(1)(a) and (c).
- Misclassifying the system: a general assistant re-purposed for hiring or credit decisions moves into an Annex III use case, and the deployer who changes the intended purpose can take on provider duties.
- Planning to the old date: work paced to 2 August 2026 for high-risk systems is now early, but prohibitions and general-purpose model duties already apply and new prohibitions apply from 2 December 2026.
- No authorised representative: a non-EU high-risk provider without an Article 22 mandate cannot lawfully place the system on the market.
Where firms get the UK approach wrong
- Reading "no AI law" as "no obligations": UK GDPR 22A to 22D are binding, and regulators apply existing consumer, equality and conduct law to AI outcomes.
- Ignoring the regulator's own statement: the government asked key regulators to publish strategic approaches to AI by 30 April 2024; those documents are the most direct statement of how principles will be applied to a sector.
- Treating voluntary as optional in practice: the Code of Practice is voluntary, but procurement questionnaires and contracts can make it binding between parties.
- Waiting for a bill: the white paper anticipated a possible statutory duty on regulators to have due regard to the principles and the response said the government will legislate "when we are confident that it is the right thing to do"; neither creates obligations today.
Decision criteria for dual-market firms
- You place AI products on the EU market or your outputs are used there: the EU Act governs product design and documentation. Run the EU classification first, then layer UK duties.
- You only deploy AI internally in the UK: UK GDPR, your sector regulator and the Code of Practice govern; the EU Act is relevant only if outputs are used in the EU or EU staff are affected through an EU entity.
- Your UK use case would be Annex III in the EU: treat it as high-impact in the UK too. UK regulators and the ICO will expect comparable governance, and running one standard avoids divergent products.
- You are a small UK firm with one EU customer: confirm whether your system is high-risk before committing to a full EU programme; for most non-high-risk systems the EU duties centre on transparency and prohibited practice checks, which are cheaper to meet.
- You are a large group: run one AI register and one control library, with a jurisdiction column per system and a named owner for each regime.
A single compliance plan for both markets
- Build one inventory: record every AI system and model with purpose, role (provider or deployer per the EU definitions; Developer, System Operator or Data Custodian per the UK Code), where outputs are used, and whether it makes significant decisions about individuals. See the AI Register and AI Inventory Template.
- Classify twice: EU class (prohibited, high-risk Annex I or III, Article 50, minimal) and UK flags (UK GDPR 22A significant decision, special category data under 22B, regulated activity and supervising regulator).
- Close prohibited practice gaps first: they already apply in the EU and carry the highest fines; review the additional points that apply from 2 December 2026.
- Put UK automated decision safeguards in place now: for any significant decision with no meaningful human involvement, provide information, a route to make representations, human intervention and a way to contest, as Article 22C requires.
- Build the EU high-risk evidence pack to the 2027 and 2028 dates: technical documentation, logging, human oversight design and security testing. Reuse the same evidence for UK regulators' safety, transparency and accountability principles.
- Adopt the UK Code as the security baseline: its 13 principles give a lifecycle structure that supports EU Article 15 evidence as well; see the ETSI EN 304 223 and UK AI Cyber Security Code of Practice Guide.
- Appoint the EU authorised representative before placing any high-risk system on the EU market, and contract for the Article 22 tasks.
- Watch both horizons and review quarterly: the AI Act Service Desk consolidated text and Commission guidance on one side; the UK Parliament bills list, regulator statements and ICO guidance on the other.
Worked scenario: a UK lending platform with EU partners
A UK fintech runs a model that scores consumer loan applications for its own UK lending and, under contract, for a bank in Ireland. In the UK, the model's output is accepted automatically below a threshold, so declines are significant decisions with no meaningful human involvement: UK GDPR Article 22C safeguards apply now, and the FCA's expectations as supervisor apply. In the EU, the fintech is a provider whose output is used in the Union (Article 2(1)(c)), and creditworthiness assessment of natural persons is an Annex III use case, so high-risk obligations apply from 2 December 2027, including an EU authorised representative under Article 22. The fintech builds one evidence pack: model documentation, data governance records, decision logs, a human review route that also serves as the UK contest mechanism, and security testing mapped to the UK Code. It holds a single register entry with both classifications and two named owners.
Detection and measurement
Track:
- Percentage of AI systems in the register with both an EU classification and UK flags recorded.
- Number of systems making significant automated decisions about UK individuals without a documented Article 22C safeguard route (target zero).
- Percentage of EU high-risk systems with a complete technical documentation pack, measured against the 2 December 2027 and 2 August 2028 dates.
- Median days to answer contest and human review requests from individuals.
- Number of obligations in the control library with a "date checked" older than 90 days.
Framework and control mapping
| Need | EU AI Act anchor | UK anchor | Supporting framework |
|---|---|---|---|
| Scope and role | Article 2(1), Article 22 | Regulator remit; UK GDPR territorial scope | AI register |
| Decisions about individuals | High-risk human oversight duties; EU GDPR Article 22 | UK GDPR Articles 22A to 22D | See EU AI Act vs GDPR |
| Transparency | Article 50 | Transparency and explainability principle | Model and system cards |
| Security | Article 15 for high-risk | Code of Practice, 13 principles | ISO/IEC 42001, NIST AI RMF; see NIST AI RMF vs EU AI Act |
| Accountability | Provider and deployer duties, penalties under Article 99 | Accountability and governance principle; DPA 2018 s157 penalties | Named owners, board reporting |
Common failure patterns
- Two programmes, two inventories: separate registers drift apart and nobody can show which systems sit in both regimes.
- Using UK silence as the EU answer: a UK product team designs to the lighter UK model and then finds that EU customers need conformity evidence it never produced.
- Human review in name only: a reviewer who approves every model output is unlikely to be "meaningful human involvement" under Article 22A, so the UK safeguards still apply.
- Quoting superseded dates: contracts and board papers still cite the original 2 August 2026 high-risk date or describe the UK as about to legislate.
- Forgetting the output test: EU reach through outputs used in the Union is missed when systems are hosted in the UK and sold through partners.
Practitioner checklist
- Record the date checked and the source for every obligation in both regimes.
- Test every product against EU Article 2(1)(a) and (c), not just entity location.
- Hold one AI register with EU classification and UK flags per system.
- Remove or redesign anything near an Article 5 prohibition, including the points applying from 2 December 2026.
- Implement UK GDPR Article 22C safeguards for every significant solely automated decision.
- Plan EU high-risk evidence to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- Appoint an EU authorised representative before placing a high-risk system on the market.
- Read your UK regulator's published AI approach and map its expectations to your controls.
- Adopt the UK AI Cyber Security Code of Practice as the shared security baseline.
- Review the UK bills list and EU consolidated text quarterly and update board reporting.
Standards and references
- European Commission AI Act Service Desk: Article 2, Scope
- European Commission AI Act Service Desk: Article 113, Entry into force and application
- European Commission AI Act Service Desk: Article 99, Penalties
- UK Government: A pro-innovation approach to AI regulation (white paper)
- UK Government: A pro-innovation approach to AI regulation, government response
- legislation.gov.uk: Data (Use and Access) Act 2025, section 80
- UK Government: Code of Practice for the Cyber Security of AI
- UK Parliament: Bills search, artificial intelligence
Related NHI Mgmt Group resources: UK AI Regulation Guide · EU AI Act Compliance Guide · Global AI Regulation Map · UK Data Act 2025 Guide. This guide summarises the UK approach to AI regulation and the EU AI Act as at 14 November 2026 and is not legal advice.