EU AI Act: What UK Boards Must Act On Before August 2026

UK companies that deploy or sell AI-powered products and services in European Union markets are subject to the EU Artificial Intelligence Act — regardless of Brexit. With Article 50 transparency obligations already enforceable since 2 April 2026, and AI literacy requirements under Article 4 already enforceable since February 2025, boards that have not mapped their exposure face tangible regulatory and reputational risk. This article sets out what senior executives need to understand and act on now.

Does the EU AI Act Apply to UK Businesses After Brexit?

Yes — and this is the most common misunderstanding among UK boards. The EU AI Act operates on an extraterritorial basis. If your organisation places an AI system on the EU market, deploys an AI system in the EU, or if the outputs of your AI systems are used within the EU, you are in scope. Headquarters location is irrelevant.

The Act distinguishes between providers (organisations that develop or place AI systems on the market), deployers (organisations using AI systems in a professional context), importers, and distributors. Each role carries different compliance obligations. A UK bank using an AI-based credit scoring tool for EU customers is a deployer. A UK software house selling an AI recruitment product to EU employers is a provider. Many UK organisations will hold both roles simultaneously across their product portfolio.

Providers established outside the EU must designate an EU representative — a named legal entity or individual within the EU who can be held accountable by supervisory authorities. Failure to appoint one is itself a compliance breach.

Executive Action:

• Audit every AI product, tool, or system your organisation deploys or sells that touches EU customers, employees, or markets — including third-party AI embedded in your platforms.
• Classify your legal role for each system: provider, deployer, importer, or distributor. Your obligations differ materially by role.
• If you have no EU entity, identify and appoint a qualified EU representative before August 2026.

What Must UK Boards Act On Before 2 August 2026?

Article 50 of the EU AI Act — the transparency obligations — became enforceable on 2 April 2026. These are not aspirational guidelines; they carry financial penalties and are being actively monitored by EU member state supervisory authorities.

The core requirements are: AI systems interacting directly with humans (chatbots, virtual assistants, customer service agents) must clearly disclose that the user is interacting with an AI — not a human. Providers of generative AI systems must ensure AI-generated content is technically marked as machine-produced. Deep fake images, audio, and video must be explicitly labelled. AI-generated text published to inform the public on matters of public interest — including news summaries, regulatory communications, and investor updates — must carry visible disclosure.

Separately, Article 4 AI literacy obligations have been in force since February 2025. Organisations must ensure staff who work with AI systems possess sufficient understanding of those systems to discharge their professional duties competently. Research from PwC suggests fewer than one in three UK organisations has a documented AI literacy programme that meets this standard as of early 2026.

Executive Action:

• Commission an urgent audit of every customer-facing and internally deployed AI interface — map where Article 50 disclosures are absent and set a remediation deadline of no later than 15 July 2026.
• Require your Chief People Officer and General Counsel to jointly confirm that Article 4 AI literacy requirements are documented, evidenced, and board-reportable.
• Ensure your communications and investor relations teams understand that AI-generated public content requires labelling — this includes earnings summaries, board statements, and regulatory filings produced with generative AI assistance.

How Has the EU AI Act Omnibus Changed Your Compliance Timeline?

On 7 May 2026, European co-legislators reached provisional political agreement on the EU AI Act Omnibus — a significant package of amendments that has extended several key deadlines and simplified obligations for smaller providers. Boards following earlier compliance guidance may be operating on incorrect assumptions.

The most material change: high-risk AI systems listed in Annex III — covering recruitment and HR tools, credit scoring, educational assessment, law enforcement, and border control — now have a compliance deadline of 2 December 2027, extended from the original August 2026 date. AI systems embedded in regulated products under Annex I (medical devices, machinery, aviation equipment) have been pushed further still, to 2 August 2028.

Critically, these extensions do not apply to Article 50 transparency obligations, which became enforceable on 2 April 2026. Nor do they alter Article 4 literacy requirements, which are already enforceable. Organisations that have deprioritised AI Act compliance on the basis that “deadlines have been pushed back” need to revisit that position immediately.

Executive Action:

• Rebuild your EU AI Act compliance roadmap around three distinct tracks: August 2026 (transparency), December 2027 (standalone high-risk Annex III), and August 2028 (product-embedded AI).
• Brief your board on the Omnibus amendments directly — avoid the risk of leadership concluding that all AI Act pressure has eased.
• Use the extended high-risk deadline to invest properly in risk classification, conformity assessment processes, and technical documentation — not to defer the work.

What Board Governance Structures Does the AI Act Demand?

The EU AI Act elevates AI governance to a board-level accountability function. Compliance cannot sit solely with an IT team or a junior data privacy officer. The Act requires a named oversight function with sufficient authority, competence, and organisational access to oversee AI risk across the enterprise.

For high-risk AI systems specifically, providers must implement a quality management system covering risk management processes, data governance, technical documentation, transparency measures, human oversight mechanisms, and post-market monitoring. According to analysis by Latham & Watkins, the compliance infrastructure expected by EU supervisory authorities closely mirrors the standards already applied under ISO 27001 and NIST frameworks — boards with strong existing cybersecurity governance have a structural advantage.

General-purpose AI models (GPAIs) — including large language models used internally or integrated into products — carry separate obligations around transparency, technical documentation, and copyright compliance. If your organisation has deployed any GPAI capability, either built in-house or licensed from a third party, those obligations apply to you as a deployer from the point of integration.

You can use INFORMD’s AI governance assessment tools to benchmark your current governance posture against EU AI Act expectations, and our technology strategy review template to structure board-level oversight frameworks.

Executive Action:

• Name a board-accountable AI governance lead — this can be the General Counsel, Chief Risk Officer, or a designated Non-Executive Director — and ensure the role is formally minuted and resourced.
• Establish a cross-functional AI risk register that maps each AI deployment to its regulatory classification, legal role, and associated obligations under the EU AI Act.
• Conduct a GPAI audit: identify every large language model or generative AI tool in use across the organisation and confirm that deployer-level obligations are understood and assigned.

What Are the Penalties for Non-Compliance — and Is Enforcement Real?

The EU AI Act carries fines of up to €35 million or 7% of global annual turnover for the most serious violations — deploying prohibited AI systems. Breaches of obligations applying to high-risk systems or general-purpose AI models carry fines of up to €15 million or 3% of global turnover. Providing incorrect or misleading information to supervisory authorities attracts fines of up to €7.5 million or 1.5% of turnover.

For UK businesses with significant EU revenue, these are material financial exposures that belong on the board risk register alongside GDPR and FCA enforcement risk. Research from legal analysis firms suggests EU member state supervisory authorities are expected to begin active enforcement programmes for Article 50 violations from Q4 2026, with initial focus on consumer-facing AI products in financial services, healthcare, and media.

UK boards should not underestimate the reputational risk dimension. The EU AI Act creates a public accountability mechanism: supervisory authorities may publish enforcement decisions, and serious violations will be centrally logged on the EU AI Act database. A UK FTSE-listed company appearing in an EU enforcement register would face investor relations, ESG scoring, and media consequences well beyond the financial penalty itself.

For a structured approach to AI project review and governance, see INFORMD’s executive briefings library and project review tools.

Executive Action:

• Add