# Does the EU AI Act apply to UK firms? 2026 deadlines

> When the EU AI Act reaches a UK firm under Article 2(1), every application date after the 2026 Digital Omnibus, high-risk uses, AI literacy and fines.

Explainer · Safe AI in regulated firms · By Syed Husnain Khalid · Published 8 October 2026 · Last checked 8 October 2026
Drafted with AI. Each claim was checked against the primary sources listed below by AI on 8 October 2026; a person has not reviewed it yet.
Canonical: https://vexralabs.com/insights/eu-ai-act-deadlines-uk-firms

Short answer

Yes, in some cases. Under Article 2(1) the EU AI Act applies to a UK firm that **places an AI system on the EU market, puts one into service there, or whose AI output is used in the EU**. A UK firm whose systems stay in the UK is outside it. Annex III high-risk rules start 2 December 2027.

This guide is for UK accountants, financial advisers, immigration advisers and the software suppliers they buy from. The dates changed in July 2026: Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on 24 July 2026 and moved the high-risk deadlines. VexraLabs is a two-person team in Islamabad, so Article 2 treats us as it treats a UK supplier: as a provider in a third country. The sections below give Article 2(1) in full, every application date in Articles 113 and 111, the high-risk areas, the AI literacy duty, the transparency duties and the fines.

**Diagram: EU AI Act application dates in Article 113 after the Digital Omnibus.** 2 February 2025: Chapters I and II apply, covering AI literacy and the prohibited practices. 2 August 2025: the duties for general-purpose AI models, governance and penalties apply. 2 August 2026: the rest of the Regulation applies, including the Article 50 transparency duties. 2 December 2026: two new prohibitions apply and existing generative systems must meet Article 50(2). 2 December 2027: high-risk rules apply to Annex III systems. 2 August 2028: high-risk rules apply to Annex I systems.

*The Omnibus moved the two high-risk dates and added the December 2026 date. The 2025 dates and the 2 August 2026 start for Article 50 did not move.*

## What is the EU AI Act?

The EU AI Act is Regulation (EU) 2024/1689, the European Union’s law laying down harmonised rules on artificial intelligence. Its official short title is the Artificial Intelligence Act. It entered into force on 1 August 2024 and applies in stages.

The Act sorts duties by role. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). A deployer uses an AI system under its authority, other than for a personal non-professional activity (Article 3(4)).

The Digital Omnibus on AI is [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744)of 8 July 2026. It amended the Act’s dates, Article 4 and Article 5. The European Commission’s AI Act Service Desk publishes the consolidated text as at 27 July 2026 and marks each amended passage.

## Does the EU AI Act apply to UK firms?

The EU AI Act applies to a UK firm that falls within one of the seven points of [Article 2(1)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2). The points turn on where an AI system is sold, supplied or used, and where its output is used. Where the firm is established matters only for points (b) and (c).

| Article 2(1) | Who the Regulation applies to | A UK firm is in this point when |
| --- | --- | --- |
| (a) | Providers placing on the market or putting into service AI systems, or placing on the market general-purpose AI models, in the EU, whether they are established in the EU or in a third country | It supplies its own AI system to the EU market or to a deployer in the EU |
| (b) | Deployers of AI systems that have their place of establishment or are located within the EU | It uses an AI system from an establishment or location in the EU |
| (c) | Providers and deployers of AI systems established or located in a third country, where the output produced by the AI system is used in the EU | It stays in the UK, and the output of its AI system is used in the EU |
| (d) | Importers and distributors of AI systems | It makes another provider's AI system available on the EU market |
| (e) | Product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark | It sells a product in the EU with an AI system built in, under its own name |
| (f) | Authorised representatives of providers that are not established in the EU | It appoints one: the representative is located or established in the EU (Article 3(5)) |
| (g) | Affected persons that are located in the EU | Not a firm category: it covers the people the AI system affects |

The third column is our reading of each point, not the Regulation’s wording. Two definitions decide point (a). Placing on the market means the first making available of an AI system or general-purpose AI model on the EU market (Article 3(9)). Putting into service means supplying an AI system for first use directly to the deployer, or for own use in the EU, for its intended purpose (Article 3(11)).

A UK practice that uses AI only in the UK, with no output used in the EU, falls outside points (a) to (f). Article 2 also excludes some uses, including AI used by a person for a purely personal non-professional activity (Article 2(10)), AI developed and put into service solely for scientific research (Article 2(6)) and testing before a system is placed on the market (Article 2(8)). Article 2 holds the full list.

## What are the EU AI Act deadlines after the Digital Omnibus?

The EU AI Act applies from 2 August 2026, with earlier and later dates for named parts. [Article 113](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113) sets the application dates. [Article 111](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111) sets the dates for systems and models already on the market.

| Date | What applies | Provision |
| --- | --- | --- |
| 1 August 2024 | The Regulation entered into force | Article 113 |
| 2 February 2025 | Chapters I and II: the general provisions, including Article 4 AI literacy, and the Article 5 prohibited practices | 113(a) |
| 2 August 2025 | Chapter V (general-purpose AI models), Chapter III Section 4 (notifying authorities and notified bodies), Chapter VII (governance), Chapter XII (penalties) except Article 101, and Article 78 (confidentiality) | 113(b) |
| 27 July 2026 | Articles 102 to 110, which amend other EU legislation | 113(d), new |
| 2 August 2026 | The rest of the Regulation, including the Article 50 transparency duties and Article 101 fines for providers of general-purpose AI models | 113, second paragraph |
| 2 December 2026 | The two prohibitions the Omnibus added: Article 5(1)(ba) and (bb), with Article 5(1a) and (1b) | 113(a), amended |
| 2 December 2026 | Article 50(2) marking for systems generating synthetic audio, image, video or text that were placed on the market before 2 August 2026 | 111(4), new |
| 2 August 2027 | Providers of general-purpose AI models placed on the market before 2 August 2025 comply by this date | 111(3) |
| 2 December 2027 | Chapter III Sections 1 to 3 for AI systems that are high-risk under Article 6(2) and Annex III | 113(c)(i), amended |
| 2 August 2028 | Chapter III Sections 1 to 3 for AI systems that are high-risk under Article 6(1) and Annex I | 113(c)(ii), amended |
| 2 August 2030 | Providers and deployers of high-risk AI systems intended to be used by public authorities comply by this date | 111(2) |
| 31 December 2030 | AI systems that are components of the large-scale IT systems in Annex X, placed on the market or put into service before 2 August 2027, comply by this date | 111(1) |

The Commission’s [implementation timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act) adds that enforcement of the prohibitions, the transparency rules, AI literacy and the general-purpose AI model rules starts on 2 August 2026.

## Which deadlines did the Digital Omnibus extend?

The Digital Omnibus extended the two high-risk deadlines. Annex III systems moved from 2 August 2026 to **2 December 2027**. Annex I systems moved from 2 August 2027 to **2 August 2028**. The [original Article 113](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) shows the earlier dates.

Annex III lists the eight areas whose AI systems are high-risk under Article 6(2). Annex I lists the EU product-safety laws whose AI safety components are high-risk under Article 6(1).

The Omnibus also added dates. Two new prohibitions apply from 2 December 2026. The first covers AI systems that generate or manipulate realistic intimate or sexually explicit material of an identifiable person without that person’s explicit consent (Article 5(1)(ba)). The second covers AI systems that generate or manipulate child sexual abuse material (Article 5(1)(bb)).

A high-risk AI system already on the market before its application date is covered only if its design changes significantly from that date (Article 111(2)). Systems intended to be used by public authorities are the exception: their providers and deployers comply by 2 August 2030.

## Which AI uses are high-risk for regulated firms?

[Annex III](https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3)names eight high-risk areas: biometrics; critical infrastructure; education and vocational training; employment and workers’ management; access to essential private and public services; law enforcement; migration, asylum and border control; and administration of justice and democratic processes.

Four entries are closest to the work of accountancy, advice and immigration firms:

- **Employment (point 4(a)):** AI intended to recruit or select people, in particular to place targeted job advertisements, analyse and filter applications and evaluate candidates.
- **Credit (point 5(b)):** AI intended to evaluate the creditworthiness of individuals or establish their credit score, except AI used to detect financial fraud.
- **Insurance (point 5(c)):** AI intended for risk assessment and pricing of life and health insurance for individuals.
- **Migration (point 7):**AI intended to be used by or on behalf of competent public authorities, or by EU institutions and bodies, for migration, asylum and border control. A private adviser’s own tools are not in this point.

[Article 6(3)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6) takes an Annex III system out of the high-risk class where it does not pose a significant risk of harm to health, safety or fundamental rights. That applies where the system meets any of four conditions:

- It performs a narrow procedural task.
- It improves the result of a previously completed human activity.
- It detects decision-making patterns or deviations from them, and does not replace or influence the earlier human assessment without proper human review.
- It performs a preparatory task to an assessment relevant to an Annex III use case.

An Annex III system that profiles individuals is always high-risk. A provider relying on Article 6(3) documents its assessment before placing the system on the market (Article 6(4)).

Deployers of high-risk systems have their own duties under Article 26. They assign human oversight to people with the competence, training and authority to do it (Article 26(2)), which sits beside the UK rule explained in [human in the loop AI under UK GDPR Article 22A](https://vexralabs.com/insights/human-in-the-loop-ai-uk-gdpr). They keep the system’s automatically generated logs for at least six months (Article 26(6)); those logs are one part of the [AI audit trail](https://vexralabs.com/insights/ai-audit-trail) a regulated firm keeps.

## What does the Article 4 AI literacy duty require?

[Article 4](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4)applies to providers and deployers of AI systems. They “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”. The duty has applied since 2 February 2025.

The measures take into account those people’s technical knowledge, experience, education and training, the context the AI systems are used in, and the persons or groups the systems are used on. Article 4(1) now adds: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”

The Digital Omnibus replaced the earlier wording. The original Article 4, in the [Official Journal text of 12 July 2024](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng), required providers and deployers to “take measures to ensure, to their best extent, a sufficient level of AI literacy” of the same people. The duty changed from ensuring a level to supporting development.

AI literacy means the skills, knowledge and understanding to make an informed deployment of AI systems and to be aware of AI’s opportunities, risks and possible harm (Article 3(56)).

## What does Article 50 require from 2 August 2026?

[Article 50](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50) sets transparency duties for providers and deployers of certain AI systems. Three of them, each with exceptions in Article 50, are:

- **Chatbots (Article 50(1)):** providers ensure that an AI system intended to interact directly with people tells them they are interacting with AI, unless that is obvious.
- **Synthetic content (Article 50(2)):** providers of systems generating synthetic audio, image, video or text ensure the outputs are marked in a machine-readable format and detectable as artificially generated.
- **Deep fakes and public-interest text (Article 50(4)):** deployers disclose that the content was artificially generated or manipulated. The text duty does not apply where a person has reviewed the content and a natural or legal person holds editorial responsibility for publishing it.

## What are the fines under the EU AI Act?

[Article 99](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99) sets three maximum fines for operators, each the higher of a fixed amount and a share of total worldwide annual turnover for the preceding financial year. Operators are providers, product manufacturers, deployers, authorised representatives, importers and distributors (Article 3(8)).

| Breach | Maximum fine | Article |
| --- | --- | --- |
| Prohibited practices in Article 5 | €35 million or, for an undertaking, 7% of worldwide annual turnover, whichever is higher | 99(3) |
| The operator duties listed in Article 99(4), including deployer duties under Article 26 and transparency duties under Article 50 | €15 million or, for an undertaking, 3% of worldwide annual turnover, whichever is higher | 99(4) |
| Incorrect, incomplete or misleading information supplied to notified bodies or national authorities in reply to a request | €7.5 million or, for an undertaking, 1% of worldwide annual turnover, whichever is higher | 99(5) |

For small and medium-sized enterprises (SMEs), including start-ups, each fine is capped at whichever of the amount or the percentage is lower (Article 99(6)). The Omnibus added Article 99(6a), which applies the same lower cap to small mid-cap enterprises for the fines in Article 99(4) and (5).

## What should a UK firm do now?

A UK firm first tests each AI system it builds, sells or uses against Article 2(1). Four steps follow from the provisions above:

1. List each AI system and record whether it is supplied to the EU, used from an EU location, or produces output used in the EU.
2. Check each system that is in scope against Annex III and Article 6(3) before 2 December 2027.
3. Record the measures that support AI literacy for staff and others who operate the systems on your behalf.
4. Check customer-facing chatbots and generated content against Article 50.

A firm outside Article 2(1) is still regulated at home. UK GDPR and the firm’s own regulator govern its AI use, and our pillar guide [AI in regulated industries: UK rules and human review](https://vexralabs.com/insights/ai-in-regulated-firms) maps those rules. UK GDPR requires a data protection impact assessment whether or not the EU AI Act applies; [DPIA for AI tools](https://vexralabs.com/insights/dpia-for-ai-tools) explains when. In either case, AI drafts and a person signs off.

Not legal advice

This summary reflects Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, as shown on the European Commission’s AI Act Service Desk on the date checked. The third column of the scope table is our reading. Take legal advice on whether a specific system is in scope.

## Frequently asked questions

### Does the EU AI Act apply to a UK company?

Yes, where the company falls within Article 2(1): for example, it places an AI system on the EU market or puts one into service there, it deploys AI from a location in the EU, or the output of its AI system is used in the EU. Article 2(1) also covers importers, distributors, product manufacturers and authorised representatives.

### When do the EU AI Act high-risk rules apply?

From 2 December 2027 for systems that are high-risk under Article 6(2) and Annex III, and from 2 August 2028 for systems that are high-risk under Article 6(1) and Annex I (Article 113(c)).

### Was the EU AI Act deadline extended?

Yes, for high-risk systems. Regulation (EU) 2026/1744 moved Annex III systems from 2 August 2026 to 2 December 2027 and Annex I systems from 2 August 2027 to 2 August 2028. The Article 50 transparency duties still apply from 2 August 2026.

### Is AI used in recruitment high-risk?

Annex III point 4(a) lists AI intended to recruit or select people, including analysing and filtering applications and evaluating candidates. Article 6(3) exempts a system that poses no significant risk and meets one of four conditions, but never one that profiles individuals.

### Does the AI literacy duty already apply?

Yes. Article 4 has applied since 2 February 2025. Since the Digital Omnibus it requires providers and deployers to take measures to support the development of AI literacy, and it does not require them to guarantee a specific level for any individual.

## Sources

1. [EU AI Act Article 2 (scope), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2)
2. [EU AI Act Article 113 (entry into force and application), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113)
3. [EU AI Act Article 111 (systems and models already on the market), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111)
4. [EU AI Act Article 3 (definitions), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-3)
5. [EU AI Act Article 4 (AI literacy), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4)
6. [EU AI Act Article 5 (prohibited AI practices), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5)
7. [EU AI Act Article 6 (classification rules for high-risk AI systems), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6)
8. [EU AI Act Article 26 (obligations of deployers of high-risk AI systems), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26)
9. [EU AI Act Article 50 (transparency obligations), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50)
10. [EU AI Act Article 99 (penalties), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99)
11. [EU AI Act Annex III (high-risk areas), European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3)
12. [Timeline for the implementation of the EU AI Act, European Commission AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act)
13. [Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal, 12 July 2024](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)
14. [Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal, 24 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744)