The EU AI Act came into force in August 2024, with obligations rolling out in phases through to 2027. If you’re a UK small business, you might assume this doesn’t apply to you. That assumption could be expensive.
Does the EU AI Act apply to UK businesses?
In short: it can. The EU AI Act has extraterritorial reach, much like GDPR. If your AI system’s output is used within the EU, or if you provide AI-powered products or services to EU customers, the Act may apply to you. This catches more UK businesses than most realise, particularly those in professional services, e-commerce, recruitment, and financial services.
Even if you have no direct EU exposure today, your clients might. If you’re part of a supply chain that touches EU markets, you may face compliance requirements passed down through contractual obligations.
What does the Act actually require?
The EU AI Act takes a risk-based approach. It classifies AI systems into four categories: unacceptable risk (banned), high risk (heavily regulated), limited risk (transparency obligations), and minimal risk (largely unregulated).
Most SMEs will find their AI use falls into the limited or minimal risk categories, think chatbots, content generation tools, or analytics platforms. For these, the main obligation is transparency: making sure people know when they’re interacting with AI.
However, if you use AI in recruitment, credit scoring, employee monitoring, or safety-critical applications, you may be operating a high-risk system. High-risk classification brings significant obligations: risk management systems, data governance, technical documentation, human oversight, and conformity assessments.
The AI literacy requirement
One provision that catches almost every organisation is Article 4: the AI literacy obligation. This requires that all staff involved in the operation and use of AI systems have a sufficient level of AI literacy. This provision applied from February 2025 and has no exemption for business size.
For SMEs, this means you need to demonstrate that your people understand the AI tools they’re using, not just how to operate them, but the risks, limitations, and governance considerations. A quick team briefing won’t cut it; you need a documented approach to building AI capability.
What should UK SMEs do now?
Start with three practical steps. First, conduct an AI inventory, map every AI system your organisation uses, including tools your staff may have adopted independently. You cannot govern what you cannot see.
Second, classify your AI use against the Act’s risk categories. Most SMEs will find the exercise reassuring, the majority of common business AI tools fall into lower risk categories. But you need to know for certain, not assume.
Third, address AI literacy. Build a training programme that gives your team the knowledge they need to use AI responsibly. This doesn’t need to be complex, but it does need to be documented and ongoing.
The bottom line
The EU AI Act is not something UK businesses can afford to ignore. Even if direct compliance isn’t required today, the direction of travel is clear: AI governance expectations are rising globally. Organisations that get ahead of this curve will find themselves better positioned with clients, partners, and regulators.
Getting your AI governance foundations in place now is significantly cheaper and less disruptive than retrofitting compliance later.