EU AI Act in the UK: Post-Brexit Reach and Why British AI Companies Are Still Caught

A London fintech that sells an AI credit-decisioning tool to a lender in Dublin is bound by the EU AI Act today. Brexit did not change that. The trap is to read "we left the EU, so EU law does not apply to us" as a clean exemption — true for the United Kingdom as a domestic legal system, wrong for any British company that places an AI system on the EU market or whose AI output is used in the Union. For a UK company, the EU AI Act is never domestic law, and there is no UK application date to wait for. Its reach is extraterritorial, through Article 2, and that reach is the entire and permanent basis on which the Act can ever bind you.

---

The UK is a third country: the Act never becomes British law

The United Kingdom left the EU on 31 January 2020 and the single market and customs union at the end of the transition period on 31 December 2020. It is not an EU Member State and — unlike Norway, Iceland, and Liechtenstein — it is not in the European Economic Area (EEA). So there is no EEA-incorporation mechanism that could ever pull the EU AI Act into UK law. Regulation (EU) 2024/1689 applies in the United Kingdom only to the extent its extraterritorial scope reaches a UK actor.

No UK application date — and that is the point

For an EU Member State, the Act applies by force of EU law on fixed calendar dates. For the UK, those dates are not a domestic switch-on; they are simply the dates on which UK companies that are already in scope through Article 2 must comply. Waiting for a "UK date" is waiting for something that will never arrive. If you touch the EU market, the EU dates are your dates.

What Brexit changed, and what it did not

Brexit removed the UK from the EU's institutional and enforcement architecture: no UK seat on the European Artificial Intelligence Board, no UK national competent authority designated under the Act, no UK market-surveillance authority enforcing it. What Brexit did not change is the commercial reality that the EU is a major export market — and the Act follows the product and the output into that market regardless of where the company sits.

---

The UK's own approach: pro-innovation, principles-based, no statute

The UK has deliberately not legislated an "AI Act." Its policy, set out in the 2023 A pro-innovation approach to AI regulation White Paper and continued by the current government, relies on existing law and existing regulators rather than a single horizontal statute.

Five principles, applied by existing regulators

Instead of one cross-sector law, the UK frames AI governance around five cross-cutting principles — safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress — which sectoral regulators apply within their remits. In practice that means the Information Commissioner's Office (ICO) under UK data-protection law (the UK GDPR as amended by the Data (Use and Access) Act 2025), Ofcom under the Online Safety Act 2023, and the Financial Conduct Authority (FCA) under the FSMA framework, among others. There is no single UK AI regulator.

No AI Act before Parliament; a sandbox-led blueprint

As of mid-2026 there is no government AI Act in force and no government AI Bill before Parliament. A private member's Artificial Intelligence (Regulation) Bill has been introduced in the House of Lords but is not government legislation and has not become law. In October 2025 DSIT published its AI Growth Lab call for evidence — proposing sectoral sandboxes in which specific rules can be relaxed for testing. Treat all of this as a moving picture for legal review, not a settled framework.

The practical upshot: the UK regime is lighter and more discretionary than the EU's. But a UK company selling into the EU does not get to pick the lighter regime — the EU AI Act attaches on the EU limb, in addition to whatever the UK requires at home.

---

Article 2: why UK companies are caught when they touch the EU market

This is the decisive provision for British AI companies. Article 2 sets the Regulation's scope, and it reaches well beyond EU borders.

Placing AI on the EU market (Article 2(1)(a))

Under Article 2(1)(a), any provider that places an AI system on the EU market or puts it into service in the Union is in scope, regardless of where that provider is established. A UK company selling an AI product to customers in Germany, France, or Ireland is caught — establishment in London does not move you outside the Regulation; selling into the Union moves you inside it.

Output used in the Union (Article 2(1)(c))

Under Article 2(1)(c), a provider or deployer established in a third country is in scope where the output of the AI system is used in the Union. This mirrors the extraterritorial logic UK companies already know from the EU GDPR: the question is where the effect lands, not where the server or the company sits. A UK company whose AI output reaches people in the EU is caught on this limb even if it never signs an EU customer directly.

The authorised representative obligation (Article 22)

A UK provider of a high-risk system must, before placing it on the EU market, appoint an authorised representative established in the Union under Article 22. This is the post-Brexit equivalent of the EU-representative requirement British firms met under the GDPR (GDPR Article 27) — a different statute, a different appointee, but the same structural need for an in-Union point of contact.

---

Timeline: the EU dates apply to in-scope UK companies

There is no separate UK date. A UK company in scope through Article 2 plans against the EU statutory calendar.

The Digital Omnibus high-risk deferral

Under the Digital Omnibus, the stand-alone Annex III high-risk obligations are deferred from 2 August 2026 to 2 December 2027, and the product-embedded Annex I high-risk obligations from 2 August 2027 to 2 August 2028. The European Parliament adopted the package in its plenary vote of 16 June 2026 and the Council on 29 June 2026; it was published in the Official Journal as Regulation (EU) 2026/1744 on 24 July 2026 and has been in force since 27 July 2026. Both deferral dates are now law.

Not everything moved

The "stop the clock" proposal to pause the timeline was rejected. Article 5 prohibitions and Article 4 literacy have applied since 2 February 2025; GPAI obligations under Articles 51–55 since 2 August 2025; Article 50 transparency since 2 August 2026. These are live now for any UK company on the EU market.

---

What in-scope UK companies actually have to do

The obligations are the EU obligations

Because the Act binds through Article 2 rather than through any UK transposition, an in-scope UK provider or deployer faces the same role-based duties as an EU company. There is no UK-lite version and no UK-specific carve-out. The roles map identically: provider, deployer, importer, distributor — with importer duties at Article 23 and distributor duties at Article 24.

The Article 25 role-shift catches resellers and fine-tuners

A deployer, distributor, or importer becomes a provider under Article 25 the moment it puts its own name or trademark on a high-risk system, substantially modifies it, or changes its intended purpose. A UK company that rebrands a high-risk EU tool, or fine-tunes a model into a new high-risk purpose, can cross that line and inherit the full provider stack without realising it.

High-risk and penalties

For a stand-alone Annex III high-risk system, the provider stack applies in full: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness (Articles 9–15), conformity assessment, the Article 49 registration, and provider obligations under Article 16. Penalties are the Article 99 tiers — identical figures, calculated on worldwide turnover, not UK or EU revenue: up to €35 million or 7% for Article 5 breaches (Article 99(3)); up to €15 million or 3% for most other obligations including high-risk provider duties (Article 99(4)); up to €7.5 million or 1% for supplying incorrect or misleading information (Article 99(5)). For SMEs, Article 99(6) caps the fine at the lower of the fixed amount or the percentage.

---

Worked example: a London fintech selling AI credit-scoring into the EU

LedgerLoop Ltd is a roughly 90-employee London fintech with around £14 million in annual turnover. It sells an AI credit-decisioning tool to lenders in Ireland and the Netherlands.

Why LedgerLoop is in scope now

As a provider placing the system on the EU market, LedgerLoop is in scope under Article 2(1)(a) today — Brexit and the London headquarters change nothing about that. Its tool is high-risk under Annex III point 5(b) (AI used to evaluate creditworthiness or establish credit scores of natural persons, excluding fraud detection), which triggers the full provider stack under Articles 9–15.

LedgerLoop's pre-market checklist

• Appoint an Article 22 authorised representative established in the Union before placing the system on the EU market.
• Build the Article 11 / Annex IV technical documentation and the Article 47 / Annex V EU declaration of conformity.
• Run the conformity assessment and register the system under Article 49.
• Because this is a creditworthiness use case, its lender customers must run an Article 27 Fundamental Rights Impact Assessment, which applies to deployers of Annex III point 5(b) credit-scoring systems — so supply the information they need for it.
• Note the exposure: a high-risk provider breach sits in the Article 99(4) tier. As an SME, LedgerLoop benefits from the Article 99(6) cap at the lower of the fixed amount or the percentage, so 3% of roughly £14 million turnover is the operative ceiling, not the €15 million figure.

A British company can be fully UK-compliant under the ICO's and FCA's regimes and still owe every one of these EU duties. The two regimes stack; they do not substitute.

---

What UK companies should do now

Map your EU exposure first

Do not start from "are we UK-compliant?" Start from "do we touch the EU market?" If you place AI on the EU market or your output is used in the Union, the EU timeline binds you through Article 2 — independent of anything the UK does or does not legislate.

A five-step starting checklist

1. Map your AI systems against Article 2 to confirm where you place systems on the EU market or your output reaches the Union.
2. Classify each system: clear the Article 5 prohibited-practice gate first, then assess Article 6 / Annex III for high-risk status.
3. Assign roles — provider, deployer, importer, distributor — and run the Article 25 conversion check on anything you rebrand, modify, or repurpose.
4. For high-risk systems where you are a non-EU-established provider, appoint an Article 22 authorised representative before market placement.
5. Build the compliance file: risk management, Annex IV documentation, conformity assessment, and the Annex V declaration of conformity — and keep your UK obligations (ICO, FCA, Ofcom) running in parallel.

Two developments to monitor

Track two moving pieces for legal review: the Commission guidance and harmonised standards still being finalised for the high-risk regime (the Digital Omnibus dates themselves are now law), and the UK's own framework — the DSIT AI Growth Lab proposals and any future government AI Bill — which may add UK obligations but will not displace the EU AI Act's extraterritorial reach.

---

How Confir helps UK companies

Confir derives your provider, deployer, importer, or distributor role and classifies your systems under Articles 5 and 6 with Annex III logic from plain-language intake. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same audit-defensible finding with a human-readable explanation of which rule fired.

Confir generates the Article 11 / Annex IV technical documentation pack and the Article 47 / Annex V declaration of conformity, and supports the Article 27 Fundamental Rights Impact Assessment where it applies. The aim is to position a UK company to be ready against the EU calendar regardless of how UK domestic policy evolves. The GPAI workflow (Articles 51–55) is partial and on the roadmap, not presented as complete. Confir is EU-hosted, at confir.eu.

---

Related guides

• EU AI Act extraterritorial reach for non-EU companies
• EU AI Act in Switzerland: extraterritorial reach
• EU AI Act scope explained (Article 2)
• EU AI Act deadlines and application dates
• Provider vs deployer: which are you?