EU AI Act brings familiar product safety duties to broader risks

The EU AI Act introduces dedicated, risk-based regulation, while the UK continues to rely largely on existing laws and sector-led oversight. Despite that divergence, many operational requirements resemble established product regulation: ongoing risk assessment, post-market monitoring, incident investigation, regulatory notification and corrective action. Businesses with mature product compliance processes may therefore have a foundation for meeting their AI obligations.

Providers of high-risk AI systems must monitor performance after deployment and respond to emerging risks or non-compliance. Corrective measures can include bringing systems into conformity, withdrawing them, disabling them or recalling them. Serious incidents generally require reporting immediately after a causal link is established or reasonably suspected, and no later than 15 days after awareness. Accelerated deadlines include no later than 2 days for widespread infringements or serious, irreversible disruption to critical infrastructure, and no later than 10 days for incidents involving death.

The key difference from traditional product safety regulation is the scope of harm. Alongside health and safety, the EU framework covers fundamental rights, including discrimination, privacy and freedom of expression, even without physical injury. In the UK, AI risks remain subject to data protection, product safety, consumer protection and sector-specific requirements. For businesses spanning both jurisdictions, adapting existing governance to these broader risks may be more practical than creating entirely new compliance structures.