What is the EU AI Act and does it apply to UK businesses?
+
The EU AI Act can apply to a UK provider placing AI systems on the EU market or putting them into service there, and to a UK provider or deployer where the system's output is used in the EU. Applicability depends on the role, system, intended use and Article 2 scope; using an AI tool or having EU customers does not by itself establish every obligation.
When do the EU AI Act obligations apply?
+
The AI Act applies in stages. Prohibited practices and AI literacy provisions already apply, and Article 50 transparency rules apply to the systems and content within their scope, subject to transitional provisions. Following the AI Omnibus, the main Annex III high-risk rules apply from 2 December 2027 and Annex I product-related high-risk rules from 2 August 2028. UK GDPR and existing workplace duties have their own requirements and timelines.
Are these documents actually legally valid?
+
Our packs are drafted to the structure required by the relevant UK and EU regulations and are tailored to your declared business circumstances. They are designed to evidence your compliance obligations, not to constitute legal advice. We recommend any business with complex circumstances has its pack reviewed by a solicitor.
How is this different from a free template?
+
Templates are generic. Our packs are generated from your declared sector, headcount, AI tools, and high-risk use cases, then assembled with the correct policy clauses, register entries, and signatures already populated. A regulator or auditor expects a document that reflects your actual operations, not a placeholder PDF.
What does the Annual Update Subscription cover?
+
The first 12 months of regulatory updates are included. When a change affects your pack, we send a link to review your original answers and regenerate the affected documentation. The first annual renewal is £74.50, then £149 a year, charged automatically unless you cancel. Bespoke partner projects have separate terms.
Can I get a refund?
+
If generation fails and we cannot deliver within 24 hours, or a technical error charges you twice, our Refund Policy provides for a full refund. It also covers materially incomplete or unreadable documents. A correctly generated and delivered pack is not refundable as standard; contact support about corrections.
What did the Digital Omnibus political agreement (May 2026) actually change?
+
The AI Omnibus entered into force on 27 July 2026. It extended the main Annex III high-risk timetable to 2 December 2027 and Annex I product-related high-risk rules to 2 August 2028, and simplified some requirements, including AI literacy. Article 4 still concerns measures supporting staff AI literacy; it does not require a particular certificate or a prescribed policy document. The duties and documents relevant to a business depend on its role and use case.
Has the high-risk AI deadline really moved to December 2027? What still applies now?
+
The AI Act applies in stages. Prohibited practices and AI literacy provisions already apply, and Article 50 transparency rules apply to the systems and content within their scope, subject to transitional provisions. Following the AI Omnibus, the main Annex III high-risk rules apply from 2 December 2027 and Annex I product-related high-risk rules from 2 August 2028. UK GDPR and existing workplace duties have their own requirements and timelines.
Does the Digital Omnibus mean we can wait until 2027 to act?
+
Check which provisions apply to your system and role now. Prohibited uses, relevant transparency rules, staff AI literacy measures and UK data protection duties may already require action. The Annex III high-risk transition does not suspend other applicable law, but it also does not make every future high-risk duty enforceable today. Policies and records should support the measures you actually implement.
What actually counts as a “high-risk” AI system under Annex III?
+
Annex III covers specified uses in areas such as recruitment, education, essential services, biometrics and law enforcement. Classification depends on the intended purpose and Article 6 criteria, including relevant exceptions. Healthcare systems may instead fall within Annex I product rules. Sector alone, or the mere use of AI, does not establish high-risk status.
Does the EU AI Act still apply to UK businesses post-Brexit?
+
The EU AI Act can apply to a UK provider placing AI systems on the EU market or putting them into service there, and to a UK provider or deployer where the system's output is used in the EU. Applicability depends on the role, system, intended use and Article 2 scope; using an AI tool or having EU customers does not by itself establish every obligation.
What happens if our business is not compliant?
+
The applicable duties, enforcement authority and penalties depend on the provision, operator role, jurisdiction and application date. The AI Act provides different maximum fines for different breaches and specific limits for SMEs. A documentation pack does not guarantee compliance or prevent enforcement. Obtain professional advice for a contested or high-stakes situation.
What does the Worker Protection Act 2023 actually require from employers?
+
It places a positive preventative duty on every UK employer to take reasonable steps to prevent sexual harassment of their workers, including harassment by third parties such as customers, contractors, and suppliers. In practice that means a documented risk assessment, an anti-harassment policy, a third-party harassment policy, a clear reporting route, and evidence that staff have been trained. The duty applies whether or not a complaint has ever been raised.
Does the Worker Protection Act apply to small employers with only a handful of staff?
+
Yes. There is no headcount threshold. A five-person business carries the same preventative duty as a five-hundred-person business, though what counts as reasonable steps is judged proportionately against your size, sector, and the risks your people actually face. Our Worker Protection Pack is generated against your declared working patterns and risk profile rather than a generic template.
What happens if we cannot evidence reasonable steps on harassment?
+
In a successful sexual harassment claim, an employment tribunal can uplift compensation by up to 25% where the employer has failed the preventative duty, and the EHRC has standalone enforcement powers it can use without any individual claim being brought. The practical test is documentary: a dated risk assessment, current policies, and training records.
When does UK GDPR require a DPIA, and do we need one?
+
A Data Protection Impact Assessment is required before processing that is likely to result in a high risk to individuals, which includes large-scale processing of special category data, systematic monitoring, profiling with significant effects, and in most cases feeding personal data into AI tools. If you are unsure, the ICO's position is that carrying out a DPIA is the safer course, and our UK GDPR and DPIA Pack produces one tailored to your declared processing.
What UK GDPR documentation should a small business already hold?
+
At minimum: a privacy notice that reflects what you actually do with personal data, a Record of Processing Activities covering your processing purposes, lawful bases, retention periods, and recipients, and a DPIA where your processing is high risk. Those are the first documents an ICO caseworker asks for, and the ones most small businesses either lack or have never updated.
Does putting client or customer data into an AI tool create UK GDPR obligations?
+
Yes. Personal data entered into an AI tool is still being processed, so you need a lawful basis, a privacy notice that reflects it, an entry in your Record of Processing Activities, and usually a DPIA. This is where UK GDPR and the EU AI Act overlap in practice, which is why our packs are designed to be held together rather than in isolation.
