Does the EU AI Act Apply to My UK Business?

The most common assumption we hear is that a UK company cannot be caught by an EU law. It is an understandable reading, and it is wrong. The more useful point is that the Act sets out exactly when it reaches beyond the EU, and those rules are narrower than simply having European customers.

The Act applies to a business outside the EU in two main situations. The first is where that business places an AI system on the EU market or puts an AI system into service in the EU. The second is where the output produced by an AI system, by a provider or a deployer sitting outside the EU, is used in the Union. In either case the Act can apply regardless of where you are registered or where your servers sit.

EU customers, employees or contractors are relevant facts, because they often point towards output being used in the EU or a system being made available there. They are not, on their own, an automatic trigger. The question is not who is on your books. It is where your systems and their output actually land.

Working out whether the Act reaches you comes down to three questions about your own use of AI.

One distinction matters throughout. Using a third party tool does not make you the provider of that tool. A business whose staff use ChatGPT, or any comparable assistant, is not the provider of ChatGPT and does not carry the obligations that come with providing it. What determines your own position is the role you play and where the output goes.

1. Are you providing an AI system, or putting one into service, in the EU? If you sell, license or otherwise make available a product containing AI to users in the EU, you are acting as a provider there, and the provider obligations can apply to you.
2. Do you have an EU establishment or operation that uses AI? If part of your business operates from inside the EU and uses AI in that operation, the Act applies to that use directly, much as it would for a business based in the EU.
3. If you operate only from the UK, is output from an AI system you provide or use actually used in the EU? Where the answer is yes, the Act can apply even though the system never runs on EU soil. Content, scores, rankings, recommendations and generated documents all count as output.

Many businesses read about the Act, picture large generative models, and conclude none of it applies to them. The definition is considerably wider than that, though it is not unlimited.

The Act covers software that infers from the input it receives how to generate outputs such as predictions, recommendations, content or decisions that can influence people or environments. That takes in a lot of ordinary business tooling. It does not mean every product with an AI feature attached carries the same obligations. What matters is what the system does and the role your business plays in providing or using it.

Examples already common across UK businesses include:

• CV screening, candidate ranking and shortlisting tools built into applicant tracking systems.
• Customer service chatbots and automated reply assistants on your website or inbox.
• Automated generation of marketing copy, product descriptions, images or video.
• Scoring and risk models used in credit checks, fraud detection or pricing.
• Meeting transcription and summarisation tools whose records people then rely on.

The Digital Omnibus package changed the sequencing, so it is worth being precise about the dates that actually apply.

The prohibited-practice rules began applying on 2 February 2025. The July 2026 AI Omnibus also changes the AI literacy approach: the Commission describes simplified requirements and a stronger public role in promoting literacy. Do not treat the former Article 4 company wording as an unchanged blanket duty. Helping staff understand the tools, risks and controls remains useful governance.

Article 50 transparency obligations have applied since 2 August 2026. These are specific duties rather than a blanket requirement to label everything AI produces. They cover telling people when they are interacting directly with an AI system such as a chatbot, disclosing deepfakes and certain AI generated or manipulated content, informing people where emotion recognition or biometric categorisation systems are used on them, and disclosing AI generated text published to inform the public on matters of public interest. That last duty carries an important exception: it does not apply where the content has undergone human review or editorial control, and a person is clearly identified as responsible for it.

Annex III high-risk obligations apply from 2 December 2027. These cover the heavier requirements for systems used in areas such as recruitment, credit, essential services and education, including risk management, human oversight and conformity work.

Annex I high-risk obligations, covering AI built into regulated products, apply from 2 August 2028.

Guessing your way through scope is the expensive option. Businesses tend to err in both directions: some assume they are exempt and do nothing, others assume the worst and buy documentation they will never need.

The sensible sequence is straightforward. Map the AI systems actually in use across your business, identify the role your business plays for each one, establish where the output ends up, and only then work out which obligations apply.

Clausely's free compliance checker walks through that first step. It takes about two minutes, asks about your sector, headcount, AI tools and EU exposure, and shows which obligations are likely to apply under the EU AI Act, the Worker Protection Act 2024 and UK GDPR. You can run it at /compliance-checker.

If it turns out you are in scope, the documentation you need is generated from your own declared operations rather than pulled off a shelf. If it turns out you are not, you will have a written record of why, which is worth having on file.