EU AI Act sets risk-based duties with reach into the UK

The EU AI Act imposes binding obligations on providers, deployers, importers and distributors according to the risks their systems pose. It covers businesses outside the EU when they place AI systems on its market or their systems’ outputs are used in the Union. UK providers must appoint an EU-based authorised representative before making high-risk systems available on the EU market.

The framework distinguishes unacceptable, high, transparency and minimal risk. Banned practices include social scoring and workplace emotion recognition. High-risk systems face requirements covering risk management, data quality, documentation, human oversight, accuracy and cybersecurity. Transparency rules require chatbot disclosures and identifiable AI-generated content such as deep fakes from 2 August 2026. Minimal-risk systems have no specific requirements, although providers and deployers remain subject to AI literacy duties. General-purpose model providers must meet transparency and copyright obligations, publish training-content summaries and address systemic risks where applicable.

The AI Omnibus moved high-risk Annex III requirements to 2 December 2027 and Annex I product requirements to 2 August 2028. Additional bans covering systems that create non-consensual intimate images or child sexual abuse material apply from 2 December 2026. Breaches of prohibited-practice rules can attract fines of up to EUR 35 million or 7% of worldwide annual turnover, with the higher figure applying to larger firms and the lower figure capping penalties for SMEs. Compliance starts with an inventory of systems and their assigned risk levels.