EU and UK rules create separate compliance duties for AI developers

The EU regulates AI through a dedicated law, while the UK relies on existing legislation and sector regulators. Companies selling systems to EU customers fall within the AI Act regardless of where they are based. Developers that build products around another company’s model API and market them under their own name are system providers, with responsibilities separate from those of the model developer.

EU obligations depend on the system’s use and risk classification. High-risk applications face requirements covering risk management, logging, human oversight, technical documentation and conformity assessment. Article 50 requires chatbot disclosures, machine-readable marking of generated content and labels for deep fakes. Existing generative systems covered by the marking grace period have until 2 December 2026 to comply. High-risk obligations for Annex III systems, including specified employment, education and essential-service applications, begin on 2 December 2027.

The UK has no dedicated AI act, and its cross-sector regulatory principles are not law. Existing authorities oversee areas including personal data, financial services, competition and medical devices. Rules for significant decisions made without meaningful human involvement require notification and opportunities for representations, human intervention and challenge, with additional restrictions for special category data. Commercial training on copyrighted work requires a licence under UK law.