EU AI Act Compliance Checklist for UK Small Businesses

The EU AI Act applies in phases. Article 4 AI literacy has applied since 2 February 2025, Article 50 transparency rules apply from 2 August 2026, and key Annex III high-risk rules are scheduled from 2 December 2027. Whether the Act applies to a UK business depends on its role, where AI systems are placed on the market or put into service, and whether outputs produced by the system are used in the EU. A simple EU customer or audience connection is not, by itself, a complete scope test.

This checklist covers the core documentation and governance steps that most UK small businesses need to take. Work through each item and note what you have in place and what is still outstanding.

If both boxes apply, you should carry out a proper scope assessment rather than assuming the Act automatically applies. A UK business can fall within scope in several ways, including where it provides or deploys covered AI in the EU or where an AI system's output is used in the EU.

If only the first box applies and you have no EU connection whatsoever, you are likely outside the Act’s current scope, but should still consider best-practice AI governance given UK legislation may follow.

• [ ] Your business uses at least one AI tool (ChatGPT, Claude, Microsoft Copilot, Midjourney, GitHub Copilot, or any other AI powered software) in a professional capacity.
• [ ] Your business has at least one of the following: EU based customers, EU based employees or contractors, EU based users of your product or service, or content or outputs that reach EU audiences.

• [ ] Review the AI tools you use and the purposes for which you use them.
• [ ] Determine whether any of your AI use falls into a high-risk category under Annex III of the EU AI Act. High-risk categories relevant to UK SMEs include: recruitment and CV screening, candidate ranking or shortlisting, credit or financial risk assessment, access to essential services, and educational assessment or evaluation.
• [ ] If you have high-risk AI use, note the specific use case and the categories of people affected.

Article 4 requires providers and deployers in scope to take measures to support AI literacy among relevant staff and other people using AI systems on their behalf. The Act does not prescribe a specific document called an 'AI Literacy Policy' or 'AI Acceptable Use Policy', but documented policies and records can help a business organise its controls and evidence the measures it has taken.

• [ ] AI Acceptable Use Policy. A written policy can govern which AI tools are approved, what they can be used for, what is prohibited, and who is accountable. If you adopt one, make sure the people expected to follow it can access and understand it.
• [ ] AI Literacy Policy (Article 4 support). A documented framework can help show how your organisation supports AI literacy for relevant staff, taking account of their knowledge, experience, training and the context in which AI is used. Article 4 requires measures to support AI literacy, but does not prescribe this specific policy format or state that every business must keep a particular form of training record.

Depending on the AI systems you provide or deploy and how they are used, additional controls may be relevant. Article 50 does not impose every transparency measure below on every EU facing business:

• [ ] Article 50 Transparency Disclosures. Specific duties apply to certain AI interactions and content. Examples include informing people when they are directly interacting with an AI system in the circumstances covered by Article 50, and disclosure duties for deployers using deepfakes or certain AI generated public-interest text. The exact duty depends on the use case; Article 50 does not create a general requirement to label every AI assisted email or recommendation.
• [ ] Human Oversight SOP. A documented standard operating procedure setting out how human oversight is exercised over AI outputs before they are acted upon, shared externally, or used in decisions affecting individuals.
• [ ] AI Incident Response Procedure. A documented procedure for detecting, responding to, and reporting incidents involving AI systems: including data leaks, harmful outputs, bias events, and system failures.
• [ ] Vendor AI Risk Register. A register of all AI tools and vendors used, including their risk classification, data processing agreement status, certifications, and residual risk ratings.

If your business deploys a system that is high-risk under the Act, additional controls may apply. The exact deployer obligations depend on the system, your role and the relevant Annex III category:

• [ ] Fundamental Rights Impact Assessment (Article 27), only if it applies to you. This is a specific legal requirement for public bodies, private organisations delivering public services, and businesses using AI for credit or insurance risk scoring. If none of those describe you, a FRIA isn't a legal requirement, though a lighter internal review of discrimination and fairness risk is still good practice.
• [ ] AI Risk Register. A documented record of the risks arising from your high-risk AI use and how you manage them. This is evidence for your own Article 26 deployer obligations, not the Article 9 risk management system, which is a requirement on the businesses that build AI systems rather than the ones that use them.
• [ ] Conformity Self-Assessment Checklist. An article-by-article self-assessment of your compliance with the EU AI Act’s requirements for high-risk AI deployers.

• [ ] Designate an accountable person responsible for AI governance in your organisation: someone with the authority and competence to oversee AI use, approve new tools, and respond to incidents.
• [ ] Ensure your privacy notice and candidate or customer-facing information discloses your use of AI tools where required.
• [ ] Implement a process for reviewing and updating your AI governance documentation whenever you adopt new tools, change use cases, or when relevant legislation or guidance is updated.
• [ ] Set a calendar reminder to review all documentation annually, and again ahead of each phased obligation date.

If your answer is very few, you are not alone. Most UK small businesses have not yet started their EU AI Act compliance work, but the deadline is approaching fast.

Clausely generates the documents in this checklist from the business, AI-tool and use-case information you provide. The pack is supplied in editable Word format so it can be reviewed, completed and adopted through your own governance process.