Does the EU AI Act Apply to UK Businesses?

Short answer: yes, in defined circumstances — and Brexit makes no difference to the test. The EU AI Act reaches you if you place an AI system on the EU market, or if the output of an AI system you provide or deploy is used in the Union. A UK agency producing AI-assisted work for a German client, a UK recruiter screening candidates for an EU employer, and a UK software firm with AI features and Amsterdam users are all capable of being in scope. Where your company is registered is not the test. Two obligations are already live: the Article 4 AI literacy duty since February 2025, and the Article 50 transparency rules since 2 August 2026.

On this page:

• How the Act reaches a UK company
• What "output used in the Union" means
• Which obligations are live in 2026
• What Article 4 requires
• Whether you need an EU authorised representative
• Penalties, and whether Article 4 carries a fine
• How this sits alongside UK law
• What to do first
• What training costs
• Which course you need
• Frequently asked questions

How does the EU AI Act reach a company established in the UK?

Through three separate routes in Article 2(1), only one of which depends on being established in the EU. The Act was drafted to catch exactly the arrangement a post-Brexit service business represents: work performed outside the Union, delivered into it.

Since 1 January 2021 the United Kingdom is a third country for these purposes. Route (c) is the one most UK businesses overlook, because it catches deployers — ordinary users of AI tools — and not only the firms that build them.

What does "output used in the Union" mean in practice?

It means the result the AI system produced ends up being used by, or acted on, in the EU — even though the system itself never left the UK. Recital 22 to the Act sets out the scenario in almost exactly these terms: an operator established in the Union contracts work to an operator in a third country, the third-country system processes data that came from the Union, and the output is returned to the contracting operator inside the EU. The recital states plainly that this is captured to prevent circumvention.

Applied to real UK service work, that looks like:

• A London marketing agency drafting campaign copy with an AI assistant for a client in Milan, who publishes it.
• A Manchester recruitment firm using AI to sift or rank applicants for a role based in Dublin.
• A UK accountancy practice running AI-assisted analysis on the books of a French subsidiary and issuing the report there.
• A UK contact-centre or BPO using AI to triage, summarise or answer enquiries from customers in the Union.
• A UK insurer or lender using an AI model to assess EU-resident applicants.

The honest limit: the Act does not define "output used in the Union", and no Commission guidance yet fixes the boundary precisely. Nobody can tell you with certainty where the edge sits, and any provider claiming otherwise is guessing. What we see working commercially is a simple line: if the deliverable is consumed by an EU-established client, or the decision affects a person located in the Union, treat it as in scope and be able to say why you decided that. The decision itself, written down and dated, is worth more than a confident answer.

Which EU AI Act obligations are live for UK businesses in 2026?

Three are in force now; the high-risk requirements have moved to 2027 and 2028. The deferral is the single most misread development in this area — it applied to the high-risk chapters and to nothing else.

The Digital Omnibus on AI — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July — set those two high-risk dates as fixed deadlines. It did not touch Article 5, Article 50 or the timing of Article 4. Organisations that read the press coverage of "the AI Act delay" as a general reprieve are now eighteen months into a live obligation they believe they do not have.

What does Article 4 require a UK business to do?

It requires you to take measures that support the development of AI literacy among your staff and among anyone else operating AI systems on your behalf — and to be able to show what those measures were. It is an obligation of effort, not of result, and it applies at every risk tier, from a marketing chatbot to a high-risk system.

The wording changed on 27 July 2026. The original text, applying from 2 February 2025, required providers and deployers to take measures to ensure a sufficient level of AI literacy. The Digital Omnibus replaced Article 4 in full: the duty is now to take measures that support the development of AI literacy, with an express clarification that it does not require you to guarantee any specific level of AI literacy in any individual. That is a lower bar. It is still a bar, and the question put to you is unchanged: what measures did you take, and can you evidence them?

Two details catch UK businesses out repeatedly:

• It covers more than employees. The duty extends to any other person dealing with the operation and use of AI systems on your behalf — contractors, agency workers and freelancers included. Most training programmes cover payroll staff and stop, which leaves precisely the gap an auditor finds first.
• There is no exemption for small firms. Proportionality shapes what is adequate; it does not remove the obligation. A ten-person UK consultancy serving EU clients is in scope on the same terms as a multinational.

Our plain-English guide to Article 4 on our sister website, sets out the detail without the sales pitch.

Do UK companies need an EU authorised representative?

Only providers do, and only in two situations. If you are a UK provider making a high-risk AI system available on the Union market, Article 22 requires you to appoint, by written mandate, an authorised representative established in the Union before you do so. If you place a general-purpose AI model on the Union market, Article 54 imposes the equivalent requirement.

An ordinary UK deployer — a firm that uses AI tools in its own work, even where the output reaches the Union — does not need an authorised representative. It does need to meet the deployer obligations that apply to it, Article 4 among them. Confusing the two is a common and expensive misdiagnosis, usually sold alongside a service you do not need.

What are the penalties, and does Article 4 carry a fine?

Article 4 does not carry a fine of its own. Article 99 sets three tiers, and the enumerated list in Article 99(4) — the €15 million or 3% of global annual turnover tier — does not include Article 4. A number of vendors state that it does. They are wrong, and it is worth knowing that when you read their sales pages.

Two points that most summaries miss. First, under Article 99(6) the cap for SMEs inverts: it is the lower of the two figures, not the higher — which matters a great deal to a UK company of thirty people reading a headline about €35 million. Second, Article 26 is in the 99(4) list, and Article 26(2) obliges deployers to assign human oversight of high-risk systems to people with the necessary competence, training and authority. So an untrained overseer of a high-risk system is a fineable failure — under a different article, but with the same fix.

For most UK businesses the realistic exposure is not a fine at all. It is evidential: a documented literacy gap counts against you the moment anything else is examined, and in practice the first request tends to arrive from an EU client's procurement team, not from a regulator. A supplier questionnaire asking whether staff who handle AI systems have received documented training is answered with a record or it is not answered at all.

How does this sit alongside UK law?

The UK has no equivalent statute, so a UK business with EU exposure effectively runs to the EU standard. As of August 2026 there is no UK AI Act and no government AI bill before Parliament; the approach set out in the 2023 white paper — existing regulators applying existing law within their remits — has held under both governments. The Regulating for Growth Bill announced in the May 2026 King's Speech puts regulatory sandboxes on a statutory footing rather than creating an AI rulebook.

What does apply domestically: the UK GDPR as amended by the Data (Use and Access) Act 2025, enforced by the ICO, which reformed the rules on automated decision-making; the FCA through the Consumer Duty for financial services; and Ofcom under the Online Safety Act 2023 and the Telecommunications (Security) Act 2021. None of these carries an AI literacy duty in the Article 4 sense. If you serve EU clients, the EU obligation is the higher standard and the one that sets your baseline.

What should a UK business do first?

Establish whether you are in scope, then create the record. In that order — most of the cost in this area is spent by firms that bought a solution before they knew which problem they had.

1. Inventory the AI systems in use. Include the tools staff adopted without asking. Shadow AI is where undisclosed EU-facing output usually turns up.
2. Decide your role for each one — provider or deployer. The obligations differ sharply, and you can be both for different systems.
3. Test each system against Article 2(1). Does output reach the Union? Write down the answer and the reasoning, with a date. This document is the foundation of everything else.
4. Put a literacy measure in place for staff and for contractors, agency workers and freelancers who operate AI on your behalf.
5. Keep dated, per-person records. Who completed what, and when. The training is half the obligation; the record is the other half.
6. Check the Article 50 items now that they apply — chatbot disclosure and labelling of synthetic content on anything customer-facing that reaches the Union.

What does AI literacy training cost a UK business?

Published per-person prices ranged from roughly €49 to €1,395 when we surveyed the market in August 2026. That spread is not a quality ladder. It is a length ladder, and the bottom of it is far shorter than most buyers assume.

At around €49 you are buying a course that runs 30 to 40 minutes. That is the tick-box tier: one short video, a certificate, a dashboard entry, often sold as an annual per-employee subscription. It produces a filing, which is worth something. It does not produce a colleague who works differently on Monday morning. German commentary already argues that a generic half-hour e-learning will not be treated as sufficient under current market surveillance practice — worth knowing before you buy the cheapest option and assume the question is closed.

At the top of the range sit lawyer-led seminars and one-day workshops, running three hours to two days, priced per head or per group.

What moves the price in between: length and depth of content, live delivery versus on-demand, per-seat versus organisation-wide licensing, how long access lasts, and whether per-person completion records and certificates are included or sold separately.

Our own Article 4 course is €149 per person for 20 video lessons, approximately 4.3 hours, with 12 months of access. Measured per hour of teaching, that is roughly €35. A €49 course running 40 minutes works out at roughly €74 an hour. The cheap option is more than twice the price of ours once you count what actually arrives.

A worked example: a 40-person UK firm putting everyone through the Article 4 course pays €5,960 at list price, before any volume rate. Prices are charged in euro, so the sterling cost depends on your card rate on the day. Volume rates are available for larger groups — tell us how many seats you need.

Which course does a UK business need?

Most need the baseline literacy course for everyone who touches AI, and one person who goes deeper. The two are not cumulative. The Deployer and Governance course contains all 20 lessons of the Article 4 course plus 12 more, so nobody should buy both. Both are sold on our EU site, bhcourses.eu, as on-demand video in English.

In practice: the team takes the Article 4 course, and the one person who will write the AI policy, keep the register and answer the client questionnaire takes the Deployer and Governance course instead of it, not as well as it. The extra 12 lessons cover policy, documentation, security, access control, shadow AI, the risk register and governance cadence.

Neither course makes your organisation compliant on its own, and we will not tell you otherwise. Article 4 compliance is your measures plus your records; a course is one measure. There is also no official EU certificate for AI literacy — no authority issues one and none is planned — so what carries weight is the dated, per-person record you keep.

The full curriculum for both courses, including every lesson title, is on the Article 4 course page.

Frequently asked questions

Does Brexit exempt a UK company from the EU AI Act?

No. The Act applies by market and by output, not by establishment. A UK company is caught where it places an AI system on the EU market, or where the output of an AI system it provides or deploys is used in the Union. Where you are registered is not the test.

Does the EU AI Act apply if we only use ChatGPT internally in the UK?

Usually not, if the work stays in the UK. The moment that output is delivered to an EU client, or used to make a decision about someone located in the Union, Article 2(1)(c) can pull the same everyday use into scope. The tool matters far less than where its output lands.

Does the EU AI Act cover our contractors and freelancers?

Yes. Article 4 reaches your staff and any other person dealing with the operation and use of AI systems on your behalf, which includes contractors, agency workers and freelancers. Most training programmes cover employees and stop there, leaving the gap a reviewer is most likely to find first.

Is there an official EU certificate for AI literacy?

No. No EU authority issues one and none is planned, so any vendor selling "EU AI Act certification" is selling something that does not exist. What carries weight with a regulator or an enterprise buyer is a dated, per-person record of proportionate, role-appropriate training.

Does the December 2027 delay mean we can wait?

No. The Digital Omnibus deferred the high-risk obligations to 2 December 2027 and 2 August 2028. It did not defer Article 4, Article 5 or Article 50. Reading the coverage of "the AI Act delay" as a general reprieve is the most common and most costly mistake in this market.

We are a UK company with no EU customers at all — does any of this apply?

Not directly. The Act reaches you through the EU market or through output used in the Union, and with neither you are outside its scope. UK law still applies: UK GDPR as amended by the Data (Use and Access) Act 2025, and your sector regulator's expectations, both govern how you use AI in Britain.

Get your team's Article 4 measure in place

If output from your AI use reaches the Union, the literacy obligation has applied to you since February 2025. Enrol your team on the Article 4 course and start the record today. Buying for a larger group? Get in touch and tell us how many seats you need.

Sources: Regulation (EU) 2024/1689 (EUR-Lex); Article 2 — Scope and Recital 22, European Commission AI Act Service Desk; Article 22 — Authorised representatives; Regulation (EU) 2026/1744, the Digital Omnibus on AI, OJ 24 July 2026 (EUR-Lex); European Commission AI Literacy Q&A, May 2025. Market prices from our own survey of published provider pricing, August 2026.

This page is general information about a regulation, not legal advice on your circumstances. Written by BH Courses.

Last updated: 19 August 2026