The EU AI Act in outline

The EU AI Act is the first comprehensive AI law from a major jurisdiction, and even for UK firms it's the reference point everyone else responds to. This lesson is a practical orientation, not legal advice. If the Act may apply to your organisation, take proper advice.

The risk-based structure

The Act sorts AI systems into tiers by risk, with obligations scaled to match:

• Prohibited practices: uses judged unacceptable, such as social scoring of individuals by public authorities and certain manipulative or exploitative techniques. These are banned outright.
• High-risk systems: AI used in areas like recruitment and worker management, credit scoring, education, critical infrastructure, and access to essential services. These are permitted but carry substantial obligations around risk management, data quality, documentation, human oversight, and accuracy.
• Limited risk: transparency duties. For example, people should be told when they're interacting with an AI system rather than a human, and certain AI-generated or manipulated content must be disclosed.
• Minimal risk: the large majority of everyday AI uses, which face no new obligations under the Act.

The timeline

The Act entered into force in August 2024 and applies in stages: the prohibitions applied from February 2025, obligations for general-purpose AI models from August 2025, and most of the high-risk system obligations from August 2026, with some longer transition periods beyond that.

Why a UK firm should care

The Act has extraterritorial reach. If you place an AI system on the EU market, or the output of your AI system is used in the EU, you can be in scope even though you're UK-based. A UK firm serving EU clients, or embedding AI into a product sold into the EU, should establish early whether it's caught, and in which role, because obligations differ between providers of AI systems and organisations deploying them.