All services Every engagement has a fixed, published price. Book a strategy call
Brexit does not exempt you and the Omnibus moved only half the dates. The four routes into scope, the deadlines that stand, and what UK companies must do before 2 August 2026.
Two comfortable beliefs are quietly exposing UK boards. The first is that Brexit put British companies outside the EU AI Act. The second is that the Act was delayed, so nothing is urgent. Both are half true in the most expensive way. The Act follows the market rather than the company, so it reaches UK firms whose AI touches EU customers, and the June 2026 Digital Omnibus moved only half of the deadlines. The transparency duties that catch most ordinary businesses land on 2 August 2026. This guide sets out exactly when the Act applies to a UK company, which dates stand, and what to do in what order.
The short answer. The EU AI Act applies to a UK company when its AI touches the EU market: placing an AI system on the EU market, deploying AI in EU operations, or having AI output used in the EU all bring you into scope, and Brexit changes none of that. After the June 2026 Digital Omnibus, high risk obligations apply from 2 December 2027 for stand alone Annex III systems and 2 August 2028 for AI embedded in regulated products, but Article 50 transparency duties were never delayed and land on 2 August 2026, with AI content marking following on 2 December 2026. Prohibitions and AI literacy have applied since February 2025 and general purpose AI duties since August 2025.
The Act attaches to systems and markets rather than to where a company is registered, and there are four common routes into scope. You provide AI to the EU market. Selling, licensing or making an AI system available to EU users makes you a provider, wherever you are based. Your AI output is used in the EU. A system run from London whose output reaches people in the EU can be in scope without the system ever leaving the UK. You deploy AI in EU operations. A UK group using AI inside its EU subsidiaries, branches or establishments carries deployer duties there. You import or distribute. Bringing third country AI systems to the EU market carries its own obligations. A UK company whose AI genuinely never touches the EU market sits outside the Act itself, and should still expect its EU clients to push the Act down the supply chain in contracts, because that is already happening.
| Obligation | Date | Status |
|---|---|---|
| Prohibited AI practices and AI literacy (Article 4) | February 2025 | Already in force |
| General purpose AI obligations | August 2025 | Already in force |
| Transparency duties (Article 50) | 2 August 2026 | Never delayed |
| AI content marking | 2 December 2026 | Never delayed |
| High risk obligations, stand alone Annex III systems | 2 December 2027 | Moved by the June 2026 Omnibus |
| High risk obligations, AI embedded in regulated products | 2 August 2028 | Moved by the June 2026 Omnibus |
The June 2026 Digital Omnibus moved the two high risk dates and made targeted amendments elsewhere, including a new Article 5 prohibition covering AI generated non consensual intimate imagery and child sexual abuse material. It did not touch Article 50. Anyone who filed the whole Act under delayed is planning around the half of the map that moved and ignoring the half that did not.
Most UK organisations in scope are deployers with transparency tier exposure, and their 2026 obligations are concrete rather than philosophical. People must be told when they are interacting with an AI system, which catches customer facing chatbots. Synthetic content must be identifiable as such, and deepfakes must be disclosed, which catches AI generated marketing, media and communications from 2 December 2026 under the content marking duties. Staff working with AI need adequate AI literacy under Article 4, which has applied since February 2025 and which training answers directly, with board briefings from £4,500 + VAT. Companies with genuinely high risk systems, such as AI used in recruitment, credit, or safety components, have until 2 December 2027 for stand alone systems, which sounds distant and is one procurement cycle away for anything needing architecture change.
Four recur. Treating delayed as a synonym for postponed entirely, when the 2 August 2026 transparency duties never moved. Treating Brexit as exemption, when the Act follows the market and EU clients enforce it through contracts besides. Running policy and principles programmes while nobody inventories the actual systems, which produces culture change on workshop time while the dates run on legal time. And waiting for UK law to mirror the Act before acting, when the UK approach remains separate and the EU obligations bind UK companies through their EU exposure today. The antidote to all four is the same: start from an inventory of what you build, buy and embed, and map each system to the dates that stand.
The practical sequence is evidence first. An EU AI Act readiness assessment from £18,000 + VAT inventories every AI system you build, buy or embed, classifies each against the Act as amended, determines your role for each system, and maps each to its real deadline, with the 2 August 2026 duties flagged first. A short AI policy and staff training cover the immediate literacy and behaviour duties. Organisations wanting a certifiable structure build an ISO/IEC 42001 management system around the results. The wider practice is on our AI governance consulting page.
Yes, whenever their AI touches the EU market: providing AI systems to EU users, deploying AI in EU operations, having AI output used in the EU, or importing and distributing AI systems there. Brexit does not exempt UK companies, because the Act attaches to the market rather than to where a company is registered.
Prohibitions and AI literacy have applied since February 2025 and general purpose AI duties since August 2025. Article 50 transparency lands on 2 August 2026 and AI content marking on 2 December 2026. The June 2026 Digital Omnibus moved high risk obligations to 2 December 2027 for stand alone Annex III systems and 2 August 2028 for AI embedded in regulated products.
Article 50 transparency duties: people must be told when they interact with an AI system, synthetic content must be identifiable, and deepfakes must be disclosed. These duties were never delayed and catch customer facing chatbots and AI generated content touching the EU market.
If your AI genuinely never touches the EU market, the Act itself does not bind you. Expect it anyway through the side door: EU clients increasingly push the Act down their supply chains in contracts, and an inventory of your systems is the evidence you will need for those conversations.
It moved the two high risk deadlines to 2 December 2027 and 2 August 2028 and made targeted amendments, including a new Article 5 prohibition on AI generated non consensual intimate imagery and child sexual abuse material. It did not move prohibitions, AI literacy, general purpose AI duties, Article 50 transparency or content marking.
Inventory the AI you build, buy and embed, classify each system against the Act as amended, and map each to the dates that stand, with the 2 August 2026 transparency duties handled first. An independent readiness assessment from £18,000 + VAT does exactly this and ends in a roadmap sequenced backwards from each deadline.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
AI Governance
AI Governance