EU AI Act UK: What's Enforceable Now, What Moved to 2027, and What to Do Next
By AI Advisers — an AI consultancy in Milton Keynes helping UK SMEs adopt AI safely and stay on the right side of the EU AI Act.
Quick answer: The EU AI Act is being enforced from 2 August 2026. Transparency duties (Article 50), AI literacy (Article 4), prohibited practices and fines up to €35m are live now. High-risk system obligations moved to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). UK businesses are in scope if their AI systems or outputs are used in the EU.
The EU AI Act is now in force and being enforced, but its hardest deadline moved. The Digital Omnibus on AI (Regulation (EU) 2026/1744) pushed high-risk obligations to 2 December 2027 and 2 August 2028. Transparency, AI literacy, prohibited practices and penalties all apply today, from 2 August 2026.
EU AI Act UK: key facts at a glance
- The delay is real but narrow. Only high-risk system obligations moved: standalone Annex III systems to 2 December 2027, product-embedded Annex I systems to 2 August 2028.
- Enforcement started on 2 August 2026. National market surveillance authorities and the EU AI Office now have live powers, with fines up to €35m or 7% of global turnover.
- Article 50 transparency is live now — if you run a branded chatbot or publish AI-generated content, you have disclosure duties today.
- AI literacy (Article 4) was softened, not scrapped. It is now a duty to support staff literacy, and it became supervisable on 2 August 2026.
- UK businesses are in scope if their AI systems, or the outputs of those systems, are placed on or used in the EU market.
What is the current status of the EU AI Act?
The AI Act entered into force on 1 August 2024 with a staggered rollout. Through 2025 and early 2026, industry pressure over readiness led the Commission to propose a simplification package. Parliament and Council reached political agreement on 7 May 2026, Parliament approved it in plenary on 16 June 2026 by 423 votes to 57, and the Digital Omnibus on AI was published in the Official Journal on 24 July 2026, entering into force on 27 July 2026 — six days before the original high-risk deadline.
That timing matters. Many businesses read "delay" and assumed the whole regime slipped. It did not.
The current EU AI Act timeline
| Date | What applies | |---|---| | 1 August 2024 | AI Act enters into force | | 2 February 2025 | Prohibited practices; AI literacy duty (Article 4) | | 2 August 2025 | Governance rules; general-purpose AI (GPAI) model obligations | | 2 August 2026 | General applicability; Article 50 transparency; enforcement and penalties live | | 2 December 2026 | Grace period ends for marking content from systems already on the market | | 2 December 2027 | High-risk standalone systems (Annex III) | | 2 August 2028 | High-risk AI embedded in regulated products (Annex I) |
EU AI Act obligations that apply to UK businesses right now
Transparency duties (Article 50)
This is the obligation most UK SMEs are quietly breaching. Under Article 50, providers must ensure people know "they are interacting with an AI system, unless this is obvious", and must mark synthetic audio, image, video or text "in a machine-readable format and detectable as artificially generated or manipulated". Deployers must disclose deepfakes and inform people exposed to emotion recognition or biometric categorisation. Disclosure must be clear "at the latest at the time of the first interaction or exposure".
Norton Rose Fulbright's Data Protection Report puts the practical scope bluntly: "The transparency obligations for providers are relevant to any organisations applying their name and trade mark to an AI system that creates content. This includes any organisations who have developed a chatbot with their own branding" (Data Protection Report, July 2026).
If you white-label a chatbot, generate marketing copy or imagery with AI, or run an AI voice agent, this is you. If you deploy an AI Operating System or agentic AI teammate under your own brand, the disclosure duty applies to that system too.
Systems already on the market before 2 August 2026 get until 2 December 2026 for the machine-readable marking requirement — that is roughly four months from now.
AI literacy (Article 4) — softened, not deleted
The Omnibus rewrote Article 4. The original duty was to "ensure, to their best extent, a sufficient level of AI literacy". The new text requires providers and deployers to "take measures to support the development of AI literacy" among staff, and clarifies it "does not require providers or deployers to guarantee any specific level of AI literacy of any individual" (Law & Technology Europe, 2026).
In practice: an obligation of effort rather than result. But the duty stands, it applies to every organisation deploying AI, and from 2 August 2026 national market surveillance authorities have formal supervisory powers over it. "We softened it" is not "we removed it" — and as we set out in why the need for AI literacy training is accelerating, the commercial case for trained staff long outran the legal one anyway.
Prohibited practices
The Article 5 bans have applied since February 2025 — social scoring, manipulative techniques exploiting vulnerabilities, untargeted facial-image scraping, workplace emotion recognition. The Omnibus added a new prohibition on AI generating non-consensual intimate imagery and child sexual abuse material, with a transitional period to 2 December 2026.
EU AI Act penalties: what UK businesses face
| Breach | Maximum fine | |---|---| | Prohibited practices (Article 5) | €35m or 7% of worldwide annual turnover | | Provider/deployer obligations, incl. Article 50 transparency | €15m or 3% of worldwide annual turnover | | Supplying incorrect or misleading information to authorities | €7.5m or 1% of worldwide annual turnover |
Source: Article 99, EU AI Act. For SMEs and start-ups, the fine is capped at the lower of the fixed sum or the percentage — meaningful relief, but a €15m ceiling is not comfort for a 40-person firm.
EU AI Act high-risk deadlines: what was delayed and until when
Only the high-risk regime. The Omnibus replaced the Commission's earlier conditional trigger with fixed dates:
- Standalone high-risk systems (Annex III) — biometrics, critical infrastructure, education, employment and worker management, essential public and private services, law enforcement, migration, justice — now 2 December 2027.
- High-risk AI embedded in regulated products (Annex I) — medical devices, machinery, vehicles — now 2 August 2028.
Alongside this, simplified documentation was extended to medium-sized companies, registration duties for non-high-risk systems were reinstated on a proportionate basis, and machinery products were moved to a sectoral approach.
If you use AI in recruitment screening, credit decisions, worker monitoring or access to essential services, you have gained about 16 months. You have not gained an exemption.
Does the EU AI Act apply to UK businesses?
Yes, in many cases. The Act reaches beyond EU borders: a UK company is in scope where it places an AI system or model on the EU market, or where the output produced by its system is used in the EU. EU customers, EU staff, or an EU-facing product all pull you in.
The UK, by contrast, still has no cross-sector AI statute. DSIT continues with a principles-based approach delivered through existing regulators — the ICO, FCA, Ofcom and CMA — supplemented by the AI Growth Lab regulatory sandbox launched in June 2026. For most UK firms with any European exposure, that means the EU AI Act is the strictest standard they must meet, and therefore the sensible one to build to. We work with businesses across Milton Keynes, Northampton, Bedford and Luton on exactly this. We cover the SME picture in more depth in what the EU AI Act means for UK small businesses in 2026.
Why the delay is a trap for unprepared businesses
Governance is improving, but slowly. Stanford HAI's 2026 AI Index found that "the share of businesses with no responsible AI policies in place fell sharply from 24% to 11%", and that AI-specific governance roles grew 17% in 2025 (Stanford HAI, 2026 AI Index). Only 36% of organisations had adopted ISO/IEC 42001 and 33% the NIST AI Risk Management Framework. The barriers cited were knowledge gaps (59%), budget (48%) and regulatory uncertainty (41%).
That last figure is the trap. Firms delay because the rules feel unsettled — and each delay makes the eventual compliance sprint more expensive. High-risk conformity work is not a retrofit: technical documentation, risk management systems, data governance and human oversight have to be designed into the product. Sixteen months of runway is roughly one product cycle, not a reprieve.
What should you do in the next 90 days?
- Inventory every AI system you build, buy or embed — including tools staff adopted without approval. An AI readiness audit is the fastest way to get a complete picture.
- Classify each one against the four-tier risk framework: prohibited, high-risk, limited-risk (transparency), minimal.
- Fix Article 50 now. Our EU AI Act compliance service can run the inventory and classification for you if you're unsure where to start. Add AI-interaction disclosure to chatbots and voice agents; mark AI-generated content. The marking grace period ends 2 December 2026.
- Evidence your AI literacy measures — training records, role-appropriate content, a dated policy. "We take measures to support" needs proof.
- Assign an owner. A named person accountable for AI governance is the single cheapest control you can put in place.
- Build a 2027 plan for anything that looks high-risk, working backwards from 2 December 2027.
Educational information, not legal advice. Consult a qualified adviser on your specific obligations.
EU AI Act compliance support for UK businesses
We work with UK SMEs who use AI daily and have no compliance function to lean on.
Our EU AI Act compliance service runs a five-step process: AI system inventory, risk classification, gap analysis against the Act's requirements, a prioritised remediation plan, and the policies and documentation you need on file. Plain English throughout — no legal jargon, no 90-page report you will never read.
Our AI governance and literacy training covers the Article 4 side: AI fundamentals, risk and governance frameworks, ethical practice, and compliance. Delivered as half- or full-day workshops for teams of up to ten, two-hour executive briefings for boards, or bespoke multi-session programmes. If your priority is workforce-wide understanding rather than board strategy, start with AI literacy training.
Key takeaways
- Enforcement is live from 2 August 2026 — transparency, literacy and prohibited-practice rules apply now, not in 2027.
- Article 50 is the most immediate risk for UK SMEs — any branded chatbot, AI-generated content or voice agent triggers disclosure duties today.
- The high-risk delay is not a reprieve — conformity work for Annex III systems must be designed in, not bolted on in the final quarter before December 2027.
- UK businesses are in scope if their AI outputs are used in the EU — being registered outside the EU does not remove you from scope.
- AI literacy is an obligation of effort — evidence your measures (training records, policy, dated content) before a market surveillance authority asks.
- Fines are live — up to €35m or 7% of global turnover for prohibited practices; €15m or 3% for transparency breaches.
AI Advisers is an AI compliance and implementation consultancy based in Milton Keynes, working with UK SMEs on EU AI Act readiness, AI literacy training and workflow automation. This article was written by the AI Advisers editorial team, drawing on direct compliance work with clients across the East Midlands and UK.
Frequently asked questions about the EU AI Act
Has the EU AI Act been delayed?
Partly. The Digital Omnibus, in force from 27 July 2026, moved high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Prohibitions, AI literacy, transparency, GPAI rules and penalties all apply from 2 August 2026 as originally planned.
When does the EU AI Act apply to high-risk AI systems?
Standalone high-risk systems listed in Annex III must comply by 2 December 2027. High-risk AI embedded in products already covered by EU product-safety law (Annex I) has until 2 August 2028.
Does the EU AI Act apply to UK companies?
Yes, where you place an AI system or model on the EU market, or where your system's output is used in the EU. Being registered outside the EU does not remove you from scope.
What are the fines for breaching the EU AI Act?
Up to €35m or 7% of worldwide annual turnover for prohibited practices; €15m or 3% for provider and deployer obligations including transparency; €7.5m or 1% for supplying misleading information. SMEs pay the lower of the two figures.
Is AI literacy training still mandatory under the EU AI Act?
Yes. Article 4 now requires providers and deployers to take measures supporting staff AI literacy, rather than guarantee a set level. Market surveillance authorities gained supervisory powers over it on 2 August 2026.
Do I have to tell people they are talking to a chatbot?
Yes. Article 50 requires clear disclosure at or before first interaction that a person is dealing with an AI system, unless it is obvious. It applies from 2 August 2026 regardless of risk tier.
What is the deadline for labelling AI-generated content?
2 August 2026 for new systems. Systems already on the market before that date have until 2 December 2026 to meet the machine-readable marking requirement under Article 50(2).
What does Article 50 of the EU AI Act require?
Article 50 requires providers to ensure users know they are interacting with an AI system (unless obvious), and to mark synthetic audio, image, video or text in a machine-readable format as artificially generated. Deployers must disclose deepfakes and inform people exposed to emotion recognition or biometric categorisation. Disclosure must happen at or before first interaction.
What is the difference between a provider and a deployer under the EU AI Act?
A provider develops an AI system or places it on the market under its own name or trade mark. A deployer uses an AI system under its own authority — most UK SMEs using off-the-shelf AI tools are deployers, not providers. Both have obligations under the Act.
Glossary
- Digital Omnibus on AI — Regulation (EU) 2026/1744, the simplification package amending the AI Act, in force 27 July 2026.
- Annex III — the list of standalone high-risk use cases: biometrics, employment, credit, education, essential services, law enforcement, migration, justice.
- Annex I — AI embedded in products already regulated by EU product-safety law.
- Deployer — an organisation using an AI system under its own authority. Most UK SMEs are deployers, not providers.
- Provider — the party developing an AI system or placing it on the market under its own name or trade mark.
- GPAI — general-purpose AI models, such as large language models, subject to their own transparency and copyright rules since August 2025.
- Market surveillance authority — the national regulator enforcing the Act in each member state.
The bottom line
The deadline moved; the obligation did not. Transparency, literacy and prohibited-practice rules are enforceable today, penalties are live, and the high-risk work you have deferred to December 2027 is design work, not paperwork you can bolt on in the final quarter.
Book a free EU AI Act readiness call. We will map your AI systems, tell you which tier each falls into, and give you a prioritised plan — in plain English. Start with an EU AI Act compliance review, or book team training if your first gap is staff literacy.