Question 1

What is the EU AI Act?

Accepted Answer

The EU AI Act is the European Union's first comprehensive law regulating artificial intelligence. It sets rules for how AI systems can be developed, deployed, and used, with stricter obligations for higher-risk uses such as recruitment, credit scoring, education, and essential services. Its obligations apply on a phased timetable that is already under way.

Question 2

Does the EU AI Act apply to UK businesses?

Accepted Answer

The Act can apply to businesses outside the EU in circumstances set out in Article 2, including where providers place AI systems or general-purpose AI models on the EU market and where the output produced by an AI system is used in the EU. Having EU customers or staff can be relevant to the analysis, but is not by itself a complete scope test.

Question 3

What happens if we are not compliant?

Accepted Answer

Non-compliance can lead to fines of up to €15 million or 3% of global annual turnover (whichever is higher) for breaches of deployer (a business using an AI system, even one you did not build) and transparency obligations, with the most serious prohibited-use breaches attracting penalties of up to €35 million or 7% of global turnover.

Question 4

How long does the compliance assessment take?

Accepted Answer

Approximately 2 minutes. The assessment asks a short set of plain-English questions about your business, your AI use, the personal information you handle and your workforce. Sections that cannot apply to you are skipped, and no documents or payment are required.

Question 5

What do I get after completing the assessment?

Accepted Answer

You see your full Compliance Snapshot on screen and can download a Word report without signing in. An optional emailed copy is available to your verified account address. Your snapshot covers the compliance areas that may apply to your business, why each one came up based on your answers, and the Clausely packs that cover them. The assessment is indicative guidance, not legal advice.

Question 6

Can’t I just use ChatGPT or Claude to write my own compliance documents for free?

Accepted Answer

You can, the same way you could represent yourself in court. But here’s what that approach misses. AI tools like ChatGPT and Claude don’t know your specific business, your AI use cases, your data flows, or which risk category the EU AI Act places you in. They’ll produce something that looks like a compliance document. Whether it actually covers you legally is another question entirely.

Clausely starts with a structured risk assessment that determines your actual obligations first. Your documents are then generated against that specific profile, not a generic template. They reference the correct articles of the EU AI Act, reflect your business’s risk level, and are structured the way regulators expect to see them. If you’re ever investigated, “I asked ChatGPT” is not a defence. A tailored, dated, signed document that demonstrates genuine compliance awareness is.

Question 7

What did the Digital Omnibus political agreement (May 2026) actually change?

Accepted Answer

The Digital Omnibus political agreement narrowed and clarified scope in several places, eased some technical compliance burdens for general-purpose AI providers, and pushed the substantive obligations for most Annex III high-risk AI systems to December 2027. What it did not change: the Article 4 AI literacy obligations, the Article 50 transparency obligations, the prohibited-use rules, and the governance and documentation expectations placed on deployers. For UK businesses deploying AI tools, the baseline policy framework you need is essentially unchanged, and only the timetable for high-risk system technical conformity has moved.

Question 8

Has the high-risk AI deadline really moved to December 2027? What still applies now?

Accepted Answer

Yes. The agreement pushes the substantive technical and conformity obligations for most Annex III high-risk AI systems to December 2027, giving providers more time to complete conformity assessments and CE marking. Transparency obligations (Article 50), AI literacy obligations (Article 4), prohibited-use rules, governance structures, and the documentation expected of deployers sit outside that extension and already apply. In practice the policy framework, Acceptable Use, AI Literacy, Article 50 disclosures, oversight SOPs and vendor registers, needs to be in place now, even if you are also a high-risk system provider working to a 2027 conformity deadline.

Question 9

Does the Digital Omnibus mean we can wait until 2027 to act?

Accepted Answer

No. The Omnibus extended one specific timetable, substantive conformity for most Annex III high-risk systems, to December 2027. It did not defer the transparency, literacy, governance, or deployer documentation obligations. If your business uses AI tools (ChatGPT, Copilot, an internal copilot, an AI chatbot, AI-assisted recruitment or marketing), those obligations already apply to you rather than waiting until 2027. Waiting risks both regulatory exposure and PI questionnaire failure at renewal.

Question 10

What actually counts as a “high-risk” AI system under Annex III?

Accepted Answer

Annex III lists categories of AI systems treated as high-risk because of where they are used, not because of the underlying technology. These include AI used in: biometric identification and categorisation; critical infrastructure (water, gas, electricity, transport); education and vocational training (admissions, grading, proctoring); employment (recruitment, CV screening, performance evaluation, task allocation, termination); access to essential private and public services (credit scoring, insurance pricing, benefits eligibility, emergency dispatch); law enforcement, migration and border control; and administration of justice and democratic processes. If your AI sits in any of these workflows, even if it only assists a human decision, you are likely a high-risk deployer.

Question 11

Does the EU AI Act still apply to UK businesses post-Brexit?

Accepted Answer

The Act has extraterritorial provisions. A UK business may be in scope, for example, where it places an AI system or general-purpose AI model on the EU market or where output produced by its AI system is used in the EU. Whether a particular UK business is covered depends on its role and activities, so EU customers, staff or users should not be treated as a standalone scope test.

Question 12

What happens if our business is not compliant?

Accepted Answer

Enforcement of the EU AI Act is phased and already under way, and there is no grace period once an obligation applies to you. National regulators (in the UK, the ICO and sector regulators acting in cooperation with EU authorities) can investigate, request your documentation, and refer matters for fines. Penalties reach €15 million or 3% of global annual turnover (whichever is higher) for breaches of deployer and transparency obligations, and €35 million or 7% of global turnover for the most serious prohibited-use breaches. PI insurers are already asking for documented AI policies at renewal, so undocumented AI use can affect cover as well as expose you to enforcement.

EU AI Act Compliance Checker for UK Businesses

Does your business use any AI tools?

Compliance assessment: your questions answered