The EU AI Act: what UK businesses actually need to know

The EU AI Act sets rules for artificial intelligence used in the EU. It entered into force in August 2024. It started applying from February 2025. Think of it as GDPR for AI — but focused on how AI gets used, not just data.

It covers four risk levels: minimal, limited, high, and unacceptable. Different obligations apply depending on how risky your AI use is. Most SMEs on off-the-shelf tools like ChatGPT sit in minimal or limited risk.

Yes — if you serve EU customers or have EU-based staff. Post-Brexit, the UK isn't directly subject to EU law. But if your business operates in or sells to EU markets, the Act applies to those activities.

Even UK-only today? Clients may still ask about AI compliance in procurement. The UK is developing its own AI regulation too. Read the UK-specific guide →

• Unacceptable risk— banned (social scoring, manipulative AI). You're unlikely to touch this.
• High risk — hiring AI, credit scoring, healthcare decisions. Strict documentation requirements. Deadline: December 2027
• Limited risk — chatbots, AI-generated content. Transparency disclosures required. Article 50 guide →
• Minimal risk — internal Copilot use, grammar checkers. No specific obligations for most deployers.

Two dates matter most. August 2, 2026 — Article 50 transparency obligations become fully enforceable (chatbot disclosures, etc.). December 2, 2027 — high-risk AI system obligations under Annex III.

Article 4 (AI literacy) has been in force since February 2025. Full deadline breakdown →

For most teams on standard AI tools, the practical list is short:

• Add transparency disclosures to customer-facing AI (chatbots, AI assistants)
• Document that staff have had AI literacy training
• Keep a log of AI tools in use and how they're used
• Review high-risk use cases if you make decisions about people

That's it for the majority. No 144-page compliance manual required.

Deploy AI that interacts directly with people — chatbots, automated customer service, AI assistants on your website — and you must tell them they're interacting with AI. Before or at the start of the interaction.

It can be as simple as “This service uses AI” at the top of your chat window. The deadline is August 2, 2026. Article 50 guide →

If your staff use AI tools, they need to understand its limitations, the relevant rules, and when not to rely on it.

Proof means documented records: who was trained, when, and on what. A short internal session plus a training log is enough for most SMEs. NudgeCompliant generates these records automatically.

High-risk AI covers systems used in employment decisions, education, credit scoring, healthcare, law enforcement, and critical infrastructure. If your ChatGPT use is drafting emails internally, you're not high risk.

Use AI to screen CVs, score loan applications, or make healthcare recommendations? You likely are — and you have until December 2027 to get the heavier documentation sorted.

Fines can reach €35M or 7% of global turnover. Sounds scary. For SMEs, enforcement is expected to be proportionate. Regulators aren't going to chase a 20-person agency for a missing chatbot notice on day one.

The bigger practical risk is procurement. Enterprise clients asking for AI compliance docs before signing contracts. Fines and enforcement guide →

1. Run a free audit to classify your AI tools (about 4 minutes)
2. Generate transparency notices and literacy records from templates
3. Log your tools and set deadline reminders
4. Review and approve — you stay in control, the heavy lifting is done for you

Total time for most teams: a few hours, not 3 months. Starter plan is £29/month with a 7-day free trial.

NudgeCompliant is built for teams that use AI — not companies building AI products. It classifies your tools, generates documents, tracks deadlines, and nudges you before they hit.

Free audit for up to 3 tools. No account needed. See pricing → or compare to hiring a consultant →