The EU AI Act and the UK position: what UK and Irish businesses using AI need to do, and by when

The EU AI Act timetable changed in 2026, with high-risk rules moved to December 2027. The UK still has no AI Act, but UK GDPR and new automated decision rules apply. What a UK or Irish business using AI needs to know, the dates that matter and the steps to take now.

Most businesses we work with aren't building AI models. They're using them: Copilot in Microsoft 365, an agent over their sales data, a tool that screens CVs or scores customers. The question we're asked is the same in Leeds and in Dublin. Does the EU AI Act apply to us, and what do we actually have to do?

The short answer: if you operate in Ireland or anywhere in the EU, or your AI's output is used there, the Act is relevant to you now. If you're purely UK-based, there's no AI Act, but existing law already covers most of what matters. And in both cases, the practical steps are almost the same.

This is a plain summary for business leaders, not legal advice.

What changed in 2026?

The EU AI Act came into force in August 2024 with obligations phased in over several years. In 2026 the EU passed the Digital Omnibus on AI, Regulation (EU) 2026/1744, which came into force on 27 July 2026. It moved the high-risk deadlines back and softened some duties, but it didn't remove the Act's structure, its transparency rules or its penalties of up to €35 million or 7% of global turnover for the most serious breaches.

The dates that matter

• 2 February 2025: banned practices, such as social scoring and manipulative techniques, apply. So does the duty on providers and deployers to take measures to support AI literacy among their staff.
• 2 August 2025: obligations on providers of general-purpose AI models, the companies that build the large models, apply.
• 2 August 2026: transparency duties apply. People must be told when they're dealing with an AI system rather than a person, and AI-generated content must be identifiable.
• 2 December 2026: the grace period ends for labelling content from generative AI systems already on the market before August 2026, and new bans on AI that generates non-consensual intimate images apply.
• 2 December 2027: rules for high-risk AI systems listed in Annex III apply. That covers uses such as recruitment and managing staff, credit scoring, access to education and essential services.
• 2 August 2028: high-risk rules for AI built into products already covered by EU safety law, such as machinery and medical devices.

Does the EU AI Act apply to UK businesses?

It can. The Act applies to providers that place AI systems on the EU market and to providers and deployers outside the EU where the AI's output is used in the EU. A UK business with Irish or EU customers, staff or operations should assume it is in scope for those activities. An Irish business is in scope as a matter of course.

Most of our clients are what the Act calls deployers: organisations using an AI system under their own authority, not building one. Deployers have fewer duties than providers, but they aren't zero, and they grow sharply if a use counts as high-risk.

What is the UK position?

The UK has no AI Act, and the government has said it prefers regulating AI where it is used, through existing regulators, rather than a single new law. A private member's AI bill has sat at first reading in the House of Lords since March 2025. That doesn't mean AI is unregulated in the UK.

• UK GDPR and the Data (Use and Access) Act 2025. New rules on automated decision-making took effect on 5 February 2026. Significant decisions made solely by automated means are now allowed in more situations, but only with safeguards: telling the person, letting them make representations, offering human intervention and a way to contest the decision. Stricter limits remain where special category data is involved.
• The ICO. The Information Commissioner's Office is updating its guidance on AI and automated decisions and has a duty to prepare a statutory code on AI.
• Sector regulators. The FCA has said it doesn't plan extra rules for AI and expects firms to apply the Consumer Duty and existing principles. Other regulators have published their own expectations.
• The AI Security Institute tests advanced models but isn't a regulator of businesses using AI.

What should a UK or Irish business do now?

The steps are much the same whichever side of the Irish Sea you're on.

• List the AI you use. Copilot, agents, AI features inside your CRM or HR system, tools staff use on their own. You can't manage what you haven't listed.
• Work out your role and the risk for each. Are you a provider or a deployer? Does any use touch hiring, staff management, credit, education or access to services? Those are the ones that may be high-risk from December 2027.
• Train people. The AI literacy duty already applies to EU operations. It's sensible everywhere: people should know what the tools are good at, where they go wrong and what not to put into them.
• Be open about AI. Tell customers and staff when they're dealing with AI, and label AI-generated content where people could be misled.
• Keep a person in the loop for significant decisions. For anything that affects someone's job, money or access to a service, make sure a person can review, explain and overturn the outcome. That satisfies the UK automated decision rules and is the core of the EU high-risk approach. Our post on governing analytics that AI helped build covers how.
• Ask your suppliers. For any AI tool, ask what it does with your data, where it's processed and what documentation it provides. Microsoft's own changes to where Claude models are processed in Copilot are a good example; see Claude Fable 5.2 is in Copilot.
• Get the data right. Most AI risk in practice comes from poor, ungoverned or overshared data, not from the model. Our guide to AI, your data and UK data protection and Copilot oversharing cover the essentials.

Talk to us

We help UK and Irish businesses use AI on governed data: an inventory of where AI touches your numbers, data foundations that keep answers consistent, and the controls that let you show a regulator, an auditor or your board how a figure was produced. If you're working out what the AI Act means for your business, or want a second opinion before December, get in touch. We're happy to have an informal conversation first, and we'll tell you plainly if you need a lawyer rather than us.

Sources: Regulation (EU) 2024/1689 as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744; the Data (Use and Access) Act 2025; FCA and ICO publications, 2026. This post is a summary for business leaders, not legal advice.

Related reading

• AI, your data and UK data protection: what a leader needs to get right
• In the loop or on the loop: governing analytics that AI helped build
• Can a CFO sign off a number that AI produced?
• Copilot readiness: fix oversharing in SharePoint before you roll out Microsoft 365 Copilot