The EU AI Act: What UK Businesses Need to Know, and When

By Jora Gill · 19 October 2026 · 7 min read

Brexit did not take UK businesses out of the EU AI Act. If your AI system is sold into the EU, or its output is used there, the Act can apply to you. The deadlines have moved, but the evidence you will need has not.

Who it applies to

The Act (Regulation (EU) 2024/1689) covers providers who place AI systems on the EU market and deployers who use them in the EU. It also reaches providers and deployers outside the EU when the output of their system is used inside it. A UK insurer scoring EU customers, or a UK software firm selling an AI feature to EU clients, is in scope.

The dates that matter

1 August 2024: the Act entered into force.
2 February 2025: prohibited practices, such as manipulative techniques and social scoring, were banned, and AI literacy duties began.
2 August 2025: obligations for general-purpose AI model providers began.
2 December 2027: obligations for stand-alone high-risk systems listed in Annex III, such as AI used in recruitment, credit scoring, education and access to essential services.
2 August 2028: obligations for high-risk AI built into products covered by EU product safety law.

The last two dates were set by the Digital Omnibus on AI, published in the Official Journal on 24 July 2026, which pushed the original high-risk deadlines back. The delay gives more time. It does not remove the obligations.

What high-risk providers must be able to show

A risk management process that runs across the system's life.
Data governance, including whether training and test data are relevant, representative and as free of errors as possible.
Technical documentation and record-keeping, so decisions can be traced.
Effective human oversight.
Appropriate accuracy, robustness and cybersecurity.

Every item on that list is a question of evidence. A policy saying the system is accurate is not proof that it is. Regulators, clients and auditors will ask to see the tests.

What to do now

Start with an inventory: which AI systems you run, who owns each one, and whether any could fall into Annex III. Then test the systems that could, against accuracy, security and fairness, and keep the results. Organisations that build that evidence now will find the 2027 deadline an administrative exercise. Those that wait will find it a project.

Penalties for the most serious breaches reach €35 million or 7% of worldwide annual turnover, whichever is higher.

Find out what your AI will get wrong, before anyone else does.

FireBreak independently tests AI for security, reliability, fairness and governance. We never assess systems we built, and we never sell fixes for what we find.