The EU AI Act and UK SMBs: What to check
The EU AI Act can apply to UK businesses.
If you sell products or services into the EU, or if AI-generated output is used in the EU, you may be in scope even if your business is UK-based.
The Act entered into force in August 2024. Most of it becomes fully applicable on 2 August 2026, although some parts already apply.
Risk Based Model
The Act uses a risk-based model:
- Unacceptable risk: banned
- High risk: heavier obligations
- Limited risk: transparency obligations
- Minimal risk: no specific obligations
For most SMBs, the main issues are likely to be:
- knowing which AI tools are in use
- understanding what data those tools process
- disclosing when users are interacting with AI
- keeping records of AI systems and their use
- checking whether any system could be classed as high-risk
High Risk Use Cases
If you run a chatbot, disclose that users are talking to AI.
If you generate content with AI, make sure your labelling and internal records are clear.
If you use AI for hiring, credit, education, or other decision-making about people, get a proper legal review.
AI Inventory & Risk Classification
Practical next steps.
1. Make an inventory of AI tools in use.
2. Classify each tool by use case and risk.
3. Add user disclosures where needed.
4. Keep logs and records.
5. Review any high-risk use with legal advice.
Bottom line:
Most SMBs do not need a huge compliance programme, but they do need to know where AI is being used and whether any use falls under the Act.
