EU AI Act for UK Organisations | Deadlines

Two things about the EU AI Act are widely misunderstood in the UK. The first is that Brexit removed the obligation. It did not. The second is that the 2026 delay bought everyone time. It bought some people time on some obligations, and none at all on the ones with the largest fines.

Here is the position as at September 2026.

The short version

The Act reaches UK organisations that place AI on the EU market, put it into service there, or whose AI output is used in the EU.
The high-risk deadlines moved. Regulation (EU) 2026/1744, the AI Omnibus, entered into force on 27 July 2026. Annex III systems now have until 2 December 2027 and Annex I systems until 2 August 2028.
The prohibitions and transparency duties did not move. Article 5 is enforceable now, with fines up to €35 million or 7% of turnover. Article 50 applied from 2 August 2026.
Your exposure is mostly in what you bought, not what you built: emotion analysis in a contact-centre platform, candidate scoring in a recruitment tool.
Build one evidence base to the stricter standard and map it to the UK and EU regimes.

When it reaches you

The Act applies outside the EU. A UK-established organisation is in scope if it:

places an AI system on the EU market, directly or through a distributor or reseller;
puts an AI system into service in the EU; or
produces AI output that is used in the EU. This is the limb that catches people, because it does not require you to sell anything in the EU.

That last one deserves care. If your model scores applicants and some of them are in the EU, you are likely in scope. The same applies if your assistant serves EU-based customers of a UK product. It does not matter where your servers, your staff or your company registration sit.

What you have to do depends on your role: provider (you develop it and put it on the market), deployer (you use it), importer or distributor. Providers carry the heaviest load by a wide margin. Many UK organisations assume they are only deployers, then find that materially fine-tuning or rebranding a model makes them a provider.

The timeline after the delay

The AI Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It deferred the high-risk deadlines and left the rest in place:

Obligation	Status
Article 5 prohibited practices	In force and enforceable now
Two new Article 5 prohibitions: non-consensual intimate imagery and child sexual abuse material	2 December 2026
General-purpose AI model obligations	In application
Article 50 transparency: chatbot disclosure, marking and labelling synthetic content	Applied from 2 August 2026, with a grace period to 2 December 2026 for marking generative content already on the market
Annex III high-risk: recruitment, credit scoring, education, law enforcement, essential public and private services	2 December 2027
Annex I high-risk: AI as a safety component of regulated products	2 August 2028

The deferral applies to the high-risk regime only. It does not touch the prohibitions or the transparency duties.

The prohibitions are the urgent part

Article 5 bans a defined set of practices outright. Breach carries the Act’s heaviest penalty: up to €35 million or 7% of global annual turnover, whichever is greater. That is a larger maximum than GDPR.

The prohibited categories include:

social scoring
manipulative or exploitative techniques that materially distort behaviour
certain emotion inference in workplace and education settings
untargeted scraping of facial images to build recognition databases
biometric categorisation inferring sensitive attributes such as race, political opinion, religion or sexual orientation

Most organisations reading this are not deliberately doing any of that. The exposure is almost never in what you built. It is in what you bought. Emotion analysis bundled into a contact-centre platform. Candidate scoring in a recruitment tool that infers more than it should. Workforce analytics that categorise people in ways nobody reviewed.

The single highest-value hour of AI compliance work available to a UK organisation right now is to list every third-party tool with an AI feature and check it against Article 5.

Transparency duties already apply

Article 50 matters for anything customer-facing. If a chatbot or voice assistant serves people in the EU, they must be told they are dealing with AI unless that is obvious. Providers of generative systems must mark synthetic audio, image, video and text in a machine-readable way, and deployers must label deepfakes. Check the Commission’s guidelines against each system that talks to EU users.

What to do before December 2027

If you have systems that will fall into Annex III, the deadline sounds distant and is not. High-risk obligations require artefacts that have to be built alongside the system:

A risk management system running across the lifecycle.
Data governance covering training, validation and test data, including examination for bias and documented provenance.
Technical documentation sufficient for an authority to assess conformity.
Automatic logging with retention appropriate to the purpose.
Transparency and instructions for use so deployers can use the system correctly.
Human oversight designed in and capable of preventing or mitigating harm.
Accuracy, robustness and cybersecurity appropriate to the intended purpose, and stated.

Reconstructing training-data provenance for a model built eighteen months ago, by people who have since left, is the kind of task that turns into a rebuild. If a system is likely to be Annex III, the documentation obligation should shape the build now.

How it interacts with UK obligations

UK organisations in EU scope face two regimes: the UK’s principles-based, regulator-led framework at home, and the EU’s prescriptive regime for anything touching the EU market. Our guide to UK AI regulation in 2026 covers the first.

This is more manageable than it sounds, because the evidence overlaps heavily. A properly conducted DPIA, an accurate AI inventory, a real risk register, documented human oversight and an evaluation record satisfy most of what both regimes want to see. The difference is in formality and thresholds.

The practical mistake is running two separate compliance programmes. Build one evidence base, structured to the stricter requirement, and map it to each regime.

A proportionate sequence

1. Determine scope, in writing. For each AI system: are any outputs used in the EU? Are you provider or deployer? Record the reasoning as well as the conclusion. The reasoning is what you will need when someone asks in two years.

2. Screen everything against Article 5. Third-party tools first. This is the live liability.

3. Check transparency. Any chatbot, voice assistant or content generator used with EU audiences needs disclosure and labelling in place now.

4. Classify against Annex III. Recruitment, credit, education, essential services and law enforcement are the categories that catch commercial organisations. If a system is close to the line, treat it as in scope. The cost of over-preparing is documentation you would benefit from anyway.

5. Check your GPAI position. If you fine-tune or substantially modify a general-purpose model, you may inherit provider obligations you did not expect.

6. Build the evidence alongside the system. For anything heading for Annex III, the documentation is a property of how the thing is built, not a phase at the end.

In short

For most UK organisations the EU AI Act is not an immediate crisis, and the delay to December 2027 is real relief for high-risk systems.

It is not permission to stop, for two reasons. The prohibitions and transparency duties bind now, and the exposure is in procured tooling nobody has reviewed. And the high-risk documentation burden changes how a system must be built, which means the deadline that matters is the start of your next build.

Frequently asked questions

Does the EU AI Act apply to UK companies?

Yes, if you place an AI system on the EU market, put one into service there, or your AI’s output is used in the EU. Where you are established does not matter.

When do the high-risk rules apply after the Omnibus?

For Annex III systems such as recruitment and credit scoring, from 2 December 2027. For AI embedded in regulated products under Annex I, from 2 August 2028.

What are the fines under the EU AI Act?

Up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for most other breaches, including the high-risk and transparency duties. For SMEs the lower of the two figures applies.

Does a UK provider need an EU representative?

For high-risk systems, yes. A provider established outside the EU must appoint an authorised representative in the EU before placing the system on the EU market. Providers of general-purpose AI models have a similar duty, with exceptions.

Sources

General information as at September 2026, not legal advice. The position continues to move. For obligations specific to your systems, consult a qualified solicitor.

See also UK AI regulation in 2026. If you need the evidence base built, that is our AI governance and compliance service.

The EU AI Act for UK organisations: scope, timing and what to do