Brexit did not put the EU AI Act out of reach. If you have users, customers or operations in the EU, or you supply AI that ends up used there, parts of the Act reach you. For most UK SMEs the obligations are lighter than the headlines suggest, but you still need to know which tier you sit in and act accordingly.
Here is what applies, and what to do about it.
Does it apply to you?
The EU AI Act applies based on where the AI is used and who it affects, not where your company is registered. So a UK business can be in scope if it offers an AI system to users in the EU, or its output is used in the EU. If you have no EU footprint at all, it may not reach you, but check rather than assume, because “we sell online” often means EU users are involved.
The risk tiers, in plain English
The Act sorts AI by risk, and the obligations scale with it.
Unacceptable risk. A small set of banned uses, such as social scoring. Most businesses are nowhere near these.
High risk. AI used in sensitive areas such as employment decisions, credit, or safety. These carry real obligations around risk management, data quality, transparency and human oversight.
Limited risk. Things like chatbots and generative tools, where the main duty is transparency, making clear that people are dealing with AI or seeing AI-generated content.
Minimal risk. Everyday tools, where there is little specific obligation.
Most SMEs using everyday AI sit in the limited or minimal tiers. The trap is assuming that without checking, when a use quietly sits higher than you thought.
What to do
Work out your footprint. Confirm whether you have EU users or output, which decides whether the Act reaches you at all.
Classify your uses. For each way you use AI, work out its risk tier. This is the step people skip, and it is the one that matters.
Meet the transparency basics. Where you use chatbots or generative AI with customers, be clear that it is AI. That covers a lot of limited-risk obligations cheaply.
Get specialist input for high-risk uses. If any use touches hiring, credit, or other sensitive decisions, treat it seriously and get proper advice on classification and obligations.
Build on the controls you already need. The register, policy, owner and records that make up good AI governance are the same foundations the Act expects, so doing that work is not wasted whatever happens with UK regulation.
The UK angle
The UK has no equivalent single AI statute yet, and regulators apply existing law, with the ICO treating AI as a data protection matter. So a UK business often has to satisfy both existing UK law and, where it has EU reach, the EU AI Act. The good news is that a solid governance baseline serves both.
Where ScaleAround fits
Our AI governance advisory helps UK businesses work out what applies and build a defensible baseline, and our free AI Governance Starter Kit is a practical starting point. For high-risk classification questions we bring in the right specialist input.
Our founder, Oliver Smith, established and ran an AI and machine learning function in regulated financial services and facilitates sessions at the CDO Financial Services Exchange. He is a Fellow of the British Computer Society. Our engagements are led by senior practitioners with at least 15 years of relevant experience.
Frequently asked questions
Does the EU AI Act apply to UK businesses? It can. It applies based on where the AI is used and who it affects, so a UK business with EU users or whose AI output is used in the EU may be in scope.
What are the risk tiers? Unacceptable (banned), high (sensitive uses with real obligations), limited (transparency duties, such as chatbots), and minimal (everyday tools). Most SMEs sit in limited or minimal.
What is the first thing to do? Confirm your EU footprint, then classify each of your AI uses by risk tier. Classification is the step most businesses skip.
Does UK law still apply too? Yes. There is no single UK AI law, but existing law, data protection in particular, applies, and the ICO expects you to manage AI use.
Does a governance baseline help with the Act? Yes. The register, policy, owner and records of good governance are the same foundations the Act expects.
Unsure what the EU AI Act means for you? Our AI governance advisory works out what applies, and the free AI Governance Starter Kit gets you started. Book a 30-minute scoping call to talk it through.