Does the EU AI Act apply to UK companies?

Often, yes. The EU AI Act is not limited to companies based in the EU. A UK company is in scope if it sells or supplies AI into the EU, operates through an EU entity, or runs AI whose output is used in the EU. A UK business using AI purely for UK customers, UK staff and UK decisions is generally outside it. Brexit did not take UK companies out of the Act; it just means the Act reaches them from across the border, the way GDPR always has.

Here is how the scope rules actually work, a quick way to test your own position, and what to do if the answer is yes.

This is a readiness explainer (October 2026), not legal advice.

Why a UK company can be caught by an EU law

The AI Act regulates the EU market and the people in it, not just EU companies. Article 2 sets out who it applies to, and several of its limbs are written specifically to reach businesses outside the EU. The logic is the same as GDPR: if your product or its effects land in the EU, the EU’s rules come with them.

So the question is not “where are we registered?” It is “where does our AI go, and where is its output used?”

The three ways UK companies come into scope

1. You place AI on the EU market

If you are a provider, you build an AI system or general-purpose AI model and supply it under your own name, and you make it available in the EU, you are in scope wherever you are established (Article 2(1)(a)). This is the most common route for UK companies:

• A UK SaaS company with an AI feature in a product sold to EU customers.
• A UK AI startup licensing a model or an API to EU businesses.
• A UK company whose AI product is resold in the EU by a distributor.

2. You operate through an EU entity

A deployer established or located in the EU is in scope (Article 2(1)(b)). If your group has an EU subsidiary or office that uses AI in its own operations, that entity is a deployer under the Act, even if the tooling was chosen and is run from London.

3. Your AI’s output is used in the EU

This is the limb that catches people out. Providers and deployers outside the EU are in scope where the output produced by the AI system is used in the EU (Article 2(1)(c)). Output means predictions, recommendations, content or decisions.

The system can run entirely on UK infrastructure, be operated by UK staff and be bought by a UK company, and still be in scope if what it produces is relied on in the EU. The recitals are explicit about why: to stop companies getting around the Act by keeping the AI just outside the border.

Examples:

• A UK recruitment firm using AI to screen candidates for roles in Germany.
• A UK lender using an AI credit model on applicants living in Ireland.
• A UK agency generating AI content that is published to an EU audience.

When a UK company is probably out of scope

You are generally outside the Act if all of these are true for a given system:

• You do not sell, license or supply it into the EU.
• No EU entity in your group uses it.
• Its output is used only in the UK (or elsewhere outside the EU).

A UK firm using ChatGPT to draft UK marketing, or an AI tool to triage UK support tickets, is typically not caught. Neither is purely personal, non-professional use, scientific research and development, or military and national security use, which the Act excludes entirely.

One caution: scope is decided per system, not per company. Most UK businesses with any EU exposure will find some systems are in scope and others are not. That is the same per-system logic as working out your role.

A quick test for each AI system

Question	If yes
Do we sell, license or supply this AI (or a product containing it) to anyone in the EU?	In scope as a provider
Is it used by an entity in our group that is established in the EU?	In scope as a deployer (that entity)
Is its output (scores, decisions, content, recommendations) used by people or organisations in the EU?	Likely in scope via Article 2(1)(c)
None of the above?	Generally out of scope for that system

Run this against your AI system register. If you do not have one yet, that is the first job, because you cannot answer the scope question for systems you have not listed.

What applies if you are in scope

Being in scope does not mean the whole Act lands on you. What you owe depends on your role and the system’s risk level, exactly as for an EU company:

• Prohibited practices (Article 5) are banned outright, and have been since February 2025.
• AI literacy (Article 4) applies now: the people operating your in-scope AI need to understand it well enough to use it responsibly. See the Article 4 duty in practice.
• Transparency (Article 50) has applied since 2 August 2026: tell people when they are dealing with an AI, and mark AI-generated content. See the Article 50 rules.
• High-risk obligations for standalone Annex III systems, AI in hiring, credit, education and essential services, apply from 2 December 2027, after the Digital Omnibus deferral. AI built into regulated products (Annex I) follows on 2 August 2028.

For most UK companies, that means literacy and transparency now, and high-risk duties only if a system genuinely falls into Annex III. Classify each system before assuming the heaviest obligations apply.

The UK-specific extra: an EU authorised representative

There is one obligation that falls on non-EU companies and not EU ones. If you are a UK provider of a high-risk AI system or a general-purpose AI model placed on the EU market, you must appoint an authorised representative in the EU, by written mandate, before you make it available there (Articles 22 and 54). They act as your point of contact for EU authorities and must hold your documentation. Deployers do not need one.

What about UK AI regulation?

The UK has taken a different route. As of October 2026 there is no UK AI Act and no AI bill before Parliament. AI is governed through existing law, UK GDPR and the Data (Use and Access) Act 2025 for automated decision-making, plus equality and consumer law, applied by sector regulators such as the ICO, FCA and CMA.

The practical upshot for a UK company with EU exposure: the EU Act is the specific, binding AI law you have to plan around, and the UK regime sits alongside it. Governance built to the EU Act, or to ISO 42001, will cover most of what UK regulators expect anyway. Building one system that satisfies both is far cheaper than running two.

Even if you are out of scope, your customers may not be

There is a commercial route in, too. If you sell to EU businesses, they are deployers under the Act, and they are already pushing obligations down their supply chain: questionnaires on how your AI works, contract clauses on transparency and oversight, requests for evidence of governance. UK enterprise buyers increasingly ask the same questions, using the EU Act as their reference point.

So a UK company that is technically outside the Act can still find it shaping deals. Being able to answer those questions with evidence, rather than reassurance, is a sales advantage well before it is a legal requirement.

The short version

The EU AI Act reaches UK companies that supply AI into the EU, operate through an EU entity, or produce AI output that is used in the EU. If none of those is true for a system, it is generally out of scope. Work it out system by system, not for the company as a whole. If you are in scope, the duties are the same as for an EU company: literacy and prohibitions now, transparency since August 2026, high-risk from December 2027. The one extra for UK providers of high-risk or general-purpose AI is an EU authorised representative. And with no UK AI Act on the horizon, the EU Act is the benchmark your customers will hold you to either way.

Not sure which of your systems are in scope? The free EU AI Act check maps your AI to the obligations that actually attach, in about ten minutes, no email required. When you want a defensible answer, our EU AI Act Baseline gives you one table of systems, scope, roles, risk categories and actions. For the full picture, see the EU AI Act guide, or talk to us.