Since Brexit, British firms have grown used to treating new Brussels regulation as something that happens to other people. The AI Act is an awkward exception. Its reach is defined by where an AI system is sold and where its results are used, not by where the company behind it is registered.
Two routes bring UK businesses within scope. The obvious one is placing a system on the EU market: a Manchester software house that licenses a CV-screening product to a Dutch retailer is a provider under the Act, on the same footing as a competitor in Munich. The less obvious one concerns output. The regulation also covers providers and deployers based outside the EU where the output of their system is used inside it, so a British firm that scores loan applications on servers in Slough and sends the results to an Irish lender may be caught without selling any software in Europe. Once the high-risk rules take effect, overseas providers of such systems will also have to appoint an authorised representative within the Union. How widely the phrase about output will be interpreted is still unclear.
The obligations arrive in stages. Bans on a short list of practices and the rules for general-purpose models already apply, and since August so do transparency duties, including the requirement that people be told when they are dealing with a chatbot and not a person. The heaviest part, the regime for high-risk systems, was due to start this summer too but has been put back. The “Digital Omnibus” amendment adopted in July moves the date for stand-alone high-risk uses, such as recruitment and education, to December 2027, and for AI built into regulated products to August 2028. For a UK supplier the practical effect of the EU AI Act may be felt sooner than that, because European customers preparing for their own duties as deployers tend to pass questions about documentation, testing and human oversight down to whoever built the system.
At home the picture is different. The UK has no equivalent statute, and successive governments have preferred to let existing regulators apply existing law: the Information Commission on personal data and automated decisions, the Financial Conduct Authority in financial services, Ofcom on online safety, the Competition and Markets Authority on competition and consumer protection. The King’s Speech in May contained no cross-sector AI bill. It offered a Regulating for Growth Bill built around sandboxes in which new AI products can be trialled under supervision. Ministers have spoken of acting in specific areas if needed, and what that will amount to remains open.
Each approach has a cost. The British one is flexible and spares companies a formal conformity assessment, but it leaves them to piece together guidance from several regulators and decide for themselves what good practice looks like. The European one is prescriptive, with set requirements for risk management, technical documentation, logging and oversight, which is burdensome but at least tells a supplier what evidence it will be asked for. A firm serving both markets ends up running two tracks, and some will find it simpler to build to the documented EU standard and reuse that evidence at home, even though a UK sector regulator may still ask questions the Act never raises.
The postponement gives exporters more time on the hardest requirements. It does not postpone the earlier question of whether a system’s output reaches the EU in the first place. The answer lies less in the text of the regulation than in the sales ledger. It comes down to a plain list of which customers, in which countries, are acting on what the system produces.
