The EU AI Act can apply to a UK organisation

Article 2 decides whether this EU law binds you. What counts is where your AI reaches, not just where you're based.

What is the EU AI Act?

The Act sorts AI uses by the risk they carry. It bans a short list of practices outright, sets obligations for general-purpose AI models and for the high-risk uses listed in its annexes, and attaches transparency duties to AI interactions and AI-generated content. Where a system does land in the high-risk category, the duty that follows is an EU AI Act conformity assessment before it goes on the market.

For a UK organisation, whether any of that applies turns on the scope rules in Article 2, and then on the role you hold and what each system is actually used for. Does the EU AI Act apply to the UK? works through that test case by case. The ISO 42001 readiness worksheet covers the management system underneath all of it.

The dates changed on 27 July 2026

Regulation (EU) 2026/1744 moved the Annex III stand-alone high-risk and Annex I product-embedded tracks to 2027 and 2028, and the duties on them still arrive.

Superseded arrangement

~~Annex III high-risk obligations~~Annex IIIsuperseded
~~Annex I product-embedded obligations~~Annex Isuperseded

Current arrangement

2 December 2027Annex III high-risk obligationsAnnex IIIdeferred
2 August 2028Annex I product-embedded obligationsAnnex Ideferred

Who the Act binds

Three routes bring an organisation inside the Act, and Article 2 sets all three. A UK organisation can be in scope without holding an office there.

01
You provide an AI system in the EU
The Act applies to providers that place AI systems on the EU market or put them into service in the EU, wherever the provider is established, so a UK company offering a system to EU customers under its own name does not fall outside it on location alone (Articles 2 and 3).
Article 2
02
Your EU operation deploys one
It also applies to deployers that are established or located in the EU, so a group with a UK parent and an EU arm should look at how that arm uses AI systems under its authority.
Article 2
03
The output is used in the EU
The Act applies where the output of an AI system is used in the EU, even if the organisation operating the system is elsewhere, so follow your outputs into the decisions and services they feed rather than stopping at the server or the supplier (Article 2).
Article 2

Your role: Provider

The Act applies to you

Your reach into the EU brings you within scope, and your answers point to the duties and classification questions set out below (Articles 2 and 4).

Your obligations timeline

In force nowAI literacyArticle 4in force
In force nowAI interaction noticeArticle 50in force
2 December 2027Employment and worker managementAnnex IIIdeferred

A result from the EU AI Act check

Your role decides which duties apply

The Act separately recognises providers, deployers, importers, distributors and product manufacturers, and one organisation can hold more than one role (Articles 2 and 3).

A provider develops an AI system or places it on the market under its own name, and a deployer uses an AI system under its authority (Article 3). Both the scope test and the duties work role by role, so settle which role you hold for each system first.

Parts of the Act are already in force

Which of them are yours depends on the systems you run and the role you hold for each one. The two deferred tracks are worth sorting out now, because the categories they cover haven't changed.

in force