You have started using AI tools, perhaps a chatbot on your website or an assistant built into your product, and someone has mentioned the EU AI Act. The natural questions are whether it applies to a UK business at all, and if so, what you actually have to do. The reality is more manageable than the headlines suggest. Most UK SMEs are not building the high-risk systems the Act polices most tightly, and the toughest deadlines have recently moved. But some obligations already bite, and a little preparation now saves a scramble later. This article explains what the Act does, when a UK SME is in scope, and the sensible steps to take. In practice, the Act can reach a UK business in two situations: you place an AI system on the EU market (for example, you sell AI-enabled software to EU customers), or the output of your AI system is used in the EU. If you only use AI internally and serve UK customers, this EU Act largely does not govern you — UK AI use falls to the UK’s own regulators, which currently take a principles-based approach with no equivalent standalone statute.
What the Act does
The EU AI Act is the EU’s rulebook for artificial intelligence. It takes a risk-based approach: the more potential an AI system has to cause harm, the more obligations attach to it. It entered into force on 1 August 2024 and applies in phases rather than all at once (European Commission).
The risk tiers
- Unacceptable risk: a short list of banned practices, such as social scoring and certain manipulative or exploitative systems. These are prohibited outright.
- High risk: systems used in sensitive areas such as recruitment, credit scoring, education or critical infrastructure. These carry the heaviest obligations around risk management, data quality, human oversight and documentation.
- Limited risk: systems such as chatbots and generated content, which mainly carry transparency duties, for example telling people they are dealing with AI or that content is AI-generated.
- Minimal risk: the vast majority of everyday AI tools, which are largely unregulated by the Act.
The phased timeline, including the recent delay
The dates matter, and some of them have just changed. The original schedule was: entry into force in August 2024; the ban on prohibited practices and AI literacy duties from 2 February 2025; obligations for general-purpose AI models from 2 August 2025; and the main high-risk obligations from 2 August 2026 (European Commission; artificialintelligenceact.eu).
In late 2025 the European Commission proposed a simplification package, the Digital Omnibus, and in mid-2026 the EU politically agreed and adopted the deferral of the heaviest deadlines, which takes effect on publication in the EU Official Journal. The high-risk obligations tied to the Act’s Annex III use cases were postponed from 2 August 2026 to 2 December 2027, and the product-related high-risk obligations moved to 2 August 2028 (Gibson Dunn). The prohibitions and the general-purpose AI rules that already applied were not rolled back. The practical takeaway: the bans are live now, but if you were worried about high-risk compliance, you have more time than the original calendar implied.
When a UK SME is in scope
Being outside the EU does not put you outside the Act. Like GDPR, it has extraterritorial reach. A UK SME is most likely to be caught in two situations. First, if you place an AI system on the EU market or put it into service there, for example by selling software with AI features to EU customers. Second, if the output of your AI system is used in the EU. If you only use AI internally and serve UK customers, your exposure is far lower, though the transparency norms are becoming good practice regardless.
Provider or deployer: your role changes your duties
The Act treats you differently depending on how you use AI. If you build or brand an AI system and put it on the market, you are a provider, and you carry the heavier obligations. If you simply use someone else’s AI tool in your business, you are a deployer, with a lighter set of duties focused mainly on using the tool as intended and, for higher-risk uses, keeping meaningful human oversight. Most UK SMEs are deployers of tools such as chat assistants and copilots, which is a comparatively comfortable place to be. The moment you embed AI into your own product and sell it, especially into the EU, you should assume the provider obligations may apply and plan accordingly.
A note on penalties
The Act is not toothless. Fines for the most serious breaches, such as using a prohibited system, can run to tens of millions of euros or a percentage of global turnover, in the same heavy tier as the strictest GDPR penalties (European Commission). That said, the enforcement most SMEs should focus on is not the headline number but the practical reality that customers, partners and regulators are increasingly asking about AI governance regardless of whether a fine is likely. Being able to answer those questions well is the near-term benefit.
No-regrets steps to take now
Whatever your precise exposure, a handful of steps are worth doing because they help you regardless of how the rules evolve:
- Build an AI inventory. List the AI tools your business uses and where AI appears in your own product. You cannot govern what you have not written down. Together with a short use policy, this is an afternoon of work at no cost.
- Set a short AI use policy. Make clear what data may and may not be put into public AI tools, and who signs off new tools. This is also the fastest-improving item in most maturity assessments, and costs nothing but a little time.
- Add transparency. Where customers interact with AI or see AI-generated content, tell them. It is cheap, it builds trust, and it aligns with the limited-risk duties.
- Keep a human in the loop for consequential decisions. If AI influences hiring, credit or anything that materially affects a person, make sure a person reviews the outcome.
- Check your tier honestly. If any of your uses look high-risk, such as screening job applicants, get advice early even though the deadline has moved.
How this maps to the TrustOps Maturity Model
AI governance sits inside the Govern function. Having a named owner, a written AI policy staff have seen, and rules on what data goes into AI tools is a Level 3 (Managed) capability, and one that customers and regulators are starting to ask about directly. Our AI governance readiness work builds the inventory, triages your risk, produces a lightweight policy and checks your EU AI Act applicability, mapped to the NIST AI Risk Management Framework.
If you are not sure where you stand today, the honest first move is to find out. Our free 15-minute assessment scores you out of 100 against the same six functions, shows your top five gaps, and gives you a maturity level you can act on, whether or not we ever speak again. Start with the free assessment at trustops.co.uk.
General information, current as of July 2026 — not legal or regulated compliance advice. Verify against current primary sources.
Sources
European Commission – AI Act (risk-based approach, entry into force, phased application, penalties): https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
EU Artificial Intelligence Act – Implementation Timeline (prohibitions Feb 2025, GPAI Aug 2025, high-risk dates): https://artificialintelligenceact.eu/implementation-timeline/
Gibson Dunn – EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes (deferral to Dec 2027 / Aug 2028): https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/
NIST – AI Risk Management Framework (AI RMF): https://www.nist.gov/itl/ai-risk-management-framework
