Does the EU AI Act apply to UK businesses?

The short answer

The EU AI Act (Regulation (EU) 2024/1689) is an EU regulation. It is not part of UK law, and the UK has not passed an equivalent AI Act. But, like the EU GDPR, it has extraterritorial reach. Article 2 brings into scope:

So the answer depends on what you do with AI, not where your head office is. A UK business that uses AI tools only for UK operations, with no EU presence and no AI output used in the EU, is unlikely to be in scope. One that sells AI-enabled products into the EU, has EU offices, or uses AI in ways that affect people in the EU should look more closely. The official text and the European Commission's AI Act page are the primary sources.

Provider or deployer?

The Act puts most obligations on providers: organisations that develop an AI system or general-purpose AI model, or have one developed, and place it on the market or put it into service under their own name or trademark. Lighter obligations fall on deployers: organisations using an AI system under their authority, other than for personal non-professional activity.

Most UK organisations whose staff use AI assistants, AI features in SaaS apps or coding assistants are, at most, deployers of those tools. The vendor is the provider. That can change if you build and sell your own AI product, or if you put your name or trademark on a high-risk AI system or substantially modify one.

What a deployer must do depends on the type of system:

• Prohibited practices are banned for everyone in scope.
• High-risk AI systems (for example certain uses in employment and recruitment, or creditworthiness assessment) carry deployer duties, including human oversight and monitoring.
• Transparency duties require, among other things, that people are told when they interact with AI in certain situations, and some fall on deployers, such as disclosing certain AI-generated or manipulated content.
• AI literacy: providers and deployers are expected to take measures on the AI literacy of their staff. This applied from 2 February 2025 and the article has since been amended, so check the current text.

Everyday use of general-purpose AI assistants for drafting and analysis is not, in itself, a high-risk use under the Act.

EU AI Act timeline

Dates from the European Commission's AI Act page, last updated 19 October 2026:

The timeline has already changed once through the AI Omnibus, so check the Commission's page for the current position before planning around a date.

The UK approach to AI regulation

The UK has not passed an AI Act. AI used in the UK is governed by existing law and regulators, with government codes and guidance alongside:

• UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, whenever AI processes personal data. See AI and UK GDPR and the regulator's AI guidance.
• The AI Cyber Security Code of Practice from the Department for Science, Innovation and Technology, published 31 January 2025 with an implementation guide. Read it on GOV.UK.
• The NCSC's Guidelines for secure AI system development, published 27 November 2023, aimed mainly at organisations building AI systems. Read them on the NCSC site.
• Sector regulators, who apply their own rules to AI used in their sectors.

For a UK business, the practical work overlaps heavily: an AI inventory, clear policy, risk assessment, human oversight of important decisions, and evidence. Doing that once serves UK GDPR, client due diligence and, where it applies, the EU AI Act. Our AI governance framework sets it out.

What UK businesses should do now

Whether or not the Act reaches you, these steps are worth taking:

1. Build an AI inventory. List the AI tools and agents in use, including shadow AI, and what they are used for.
2. Map your EU exposure. Note EU offices, EU customers and any AI output used in the EU.
3. Classify your role and the use. For each AI system, are you a provider or deployer, and could the use be high-risk or prohibited?
4. Address AI literacy. Make sure staff who use AI understand its risks and your rules, through policy and training.
5. Assess and record. Use an AI risk assessment and, where personal data is involved, a DPIA.
6. Keep evidence. Audit trails and reports that show how AI is used and controlled.

If you build or sell AI systems into the EU, take specialist legal advice on provider obligations; that is beyond the scope of this page.

How Workforce AI Security supports compliance work

For organisations that use AI rather than build it, the hardest EU AI Act and UK GDPR task is usually the first one: knowing what AI is in use. Check Point Workforce AI Security discovers sanctioned and shadow AI apps, tools and MCP servers, breaks use down by app, user and session, and classifies prompts into use-case categories, which gives you a factual inventory.

It then enforces your rules, with per-app policies, redaction of sensitive data, copy and paste and upload restrictions, interactive user guidance and blocking of unapproved apps, and records what happened. Check Point says its audit trails and customisable reports support compliance work for GDPR, HIPAA and the EU AI Act. The in-the-moment guidance also reinforces AI literacy, because people learn the rules when they meet them.

The Essentials tier covers web AI applications; the Enterprise tier adds desktop AI apps, coding assistants and agents. For AI applications and agents your organisation builds, Check Point has separate products: see Check Point AI Security.

How Forever Systems helps

We help UK organisations get the inventory, controls and evidence in place, starting with a discovery pilot of Workforce AI Security and moving to policy and staged rollout. We are a technology supplier, so we work alongside your legal adviser on questions of scope and obligations.

This page is general information, not legal advice. EU and UK rules on AI are still changing, so check the official sources and take advice for your circumstances. Contact us to talk about where to start.