The EU AI Act and the UK
Brexit does not exclude you. Article 2 catches a UK provider that places an AI system on the EU market, and it separately catches a UK provider or deployer where the output produced by the system is used in the Union, even if the system never enters the EU market and you have no EU entity.
High-volatility page, verify before relying on it
National implementation is moving and public sources disagree about the status of several member states. Everything below is dated to our last review. Before relying on any statement about which authority supervises you, check the Commission’s published list of notified national competent authorities and the authority’s own website. We would rather tell you a fact is contested than present it cleanly and be wrong. Our standards →
Status as at our last review
| Hook 1 — market placement | A UK provider placing an AI system on the EU market or putting it into service in the EU is in scope, irrespective of where it is established. |
| Hook 2, output used in the EU | A UK provider or deployer is in scope where the output produced by the system is used in the Union. This is the hook most UK businesses miss. |
| Authorised representative | A non-EU provider of a high-risk AI system must appoint an authorised representative established in the Union (Article 22). |
| The UK’s own approach | The UK has not enacted an equivalent horizontal AI statute and has pursued a regulator-led approach through existing sectoral bodies. That is a separate regime and does not affect whether the EU AI Act applies to you. |
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Where the sources disagree
The UK is not in the EEA and does not apply the EU AI Act domestically. Any statement that the UK is within the Act’s territorial scope by virtue of alignment is wrong. What applies is the extra-territorial reach in Article 2, which is a different mechanism with different consequences.
How to get a definitive answer
- The European Commission’s published list of national competent authorities notified under Article 70 is the authoritative record of who has been designated.
- The authority’s own website, which will usually say whether it has AI Act competence.
- Your sector regulator, which in several member states retains competence for high-risk AI in its field regardless of who the lead authority is.
What to do in the UK specifically
- Test the output hook before concluding you are out. Not “do we sell in the EU” but “is the output our system produces used in the Union”. A UK analytics provider whose scores are used by an EU customer is inside Article 2 on the second hook.
- Appoint an authorised representative if you provide high-risk systems. Article 22 requires it of non-EU providers, and it is an appointment with a lead time.
- Do not conflate UK and EU regimes in one policy. The UK’s regulator-led approach and the EU AI Act impose different things; a single “AI compliance policy” covering both usually satisfies neither.
- UK GDPR runs alongside, and the AI Act’s Article 10(5) bias-testing permission is an EU instrument. Do not assume it travels.
What does not depend on designation
The AI Act is a regulation. It applies directly and in full without national transposition. Member states designate authorities and set national penalty procedures: they do not create the obligations.
So none of this is waiting on a designation:
Article 50 disclosure, Article 4 literacy, Article 49 registration, classification and the Article 6(4) assessment are all live or actionable and none waits on a designation. Full checklist →
Status labels on this page
Verified fact: The Regulation applies directly without transposition; the Article 70 designation duty applied from 2 August 2025; the obligations listed above are independent of national designation.
Expert analysis: The assessment of what matters practically in an early enforcement conversation.
Unsettled: The current designation status in this member state. Sources conflict; verify against the Commission's published list.
Work on what does not depend on a regulator
Inventory, classification, Article 50 and Article 4 are all actionable today and none of them waits on a national designation. That is the work with no excuse attached to it.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Frequently asked
Does the EU AI Act apply to UK companies?
It can. Article 2 applies to providers placing AI systems on the EU market or putting them into service in the Union irrespective of where they are established, and to providers and deployers established in a third country where the output produced by the AI system is used in the Union. Neither hook depends on having an EU entity or EU customers of record.
What penalties apply to UK companies?
The same Article 99 tiers: up to €35 million or 7 percent of total worldwide annual turnover for breaches of the Article 5 prohibitions, up to €15 million or 3 percent for other operator obligations including high-risk requirements and Article 50 transparency, and up to €7.5 million or 1 percent for supplying incorrect or misleading information to authorities.
Is the UK in the EEA for AI Act purposes?
No. The United Kingdom is not a member of the European Economic Area and the EU AI Act does not apply in the UK as domestic law. The EEA EFTA states are Iceland, Liechtenstein and Norway. UK exposure arises through the extra-territorial scope in Article 2, not through EEA membership or alignment.