EU AI Act for UK Boards: What Applies Now and the New 2027–2028 Deadlines

Last updated: 19 October 2026 — rewritten for the Digital Omnibus on AI (Regulation (EU) 2026/1744), which moved the main high-risk deadlines to December 2027 and August 2028.

UK companies that sell or deploy AI-powered products and services into the European Union can be caught by the EU Artificial Intelligence Act, Brexit notwithstanding. Parts of the Act already apply — the bans on prohibited practices and the AI literacy duty since February 2025, general-purpose AI rules since August 2025 and most transparency duties since August 2026 — while the heaviest high-risk obligations have now been pushed back to 2027 and 2028. This briefing sets out what UK boards need to act on now and what the new timetable means.

Does the EU AI Act Apply to UK Businesses?

It can. The Act has extraterritorial reach: it applies to organisations that place AI systems on the EU market or put them into service in the EU, and to providers and deployers outside the EU where the output of their AI system is used in the EU. Where your headquarters sits does not decide the question.

The Act distinguishes between providers (who develop an AI system or place it on the market under their own name), deployers (who use an AI system in a professional context), importers and distributors, and each role carries different obligations. A UK software company selling an AI recruitment product to EU employers is a provider; a UK lender using a third-party AI credit-scoring tool for EU customers is a deployer. Many groups will hold several roles across their portfolio. Providers of high-risk AI systems established outside the EU must appoint an authorised representative in the EU before placing those systems on the EU market.

Executive Action

• Inventory every AI product, tool or system you sell or use that touches EU customers, employees or markets — including AI embedded in third-party platforms.
• Record your legal role for each system: provider, deployer, importer or distributor.
• If you provide high-risk AI into the EU without an EU establishment, plan the appointment of an authorised representative well ahead of the high-risk dates below.

What Already Applies Today?

Prohibited practices (since 2 February 2025). Certain uses of AI — such as manipulative techniques that cause significant harm, social scoring and some uses of emotion recognition in the workplace — are banned outright. The Omnibus adds further prohibitions that apply from 2 December 2026.

AI literacy (since 2 February 2025). Article 4 requires providers and deployers to take measures to ensure a sufficient level of AI literacy among staff who operate or use AI systems on their behalf. For a board, the practical test is whether the organisation can show what training and guidance it has given, and to whom.

General-purpose AI models (since 2 August 2025). Providers of general-purpose AI models — the companies that build large language models — have duties on technical documentation, information for downstream providers and copyright policy. Most UK businesses are users of these models rather than providers, so the obligations sit mainly with the model vendor; your exposure comes through how you build them into your own products.

Transparency (Article 50, from 2 August 2026). People must be told when they are interacting with an AI system such as a chatbot unless it is obvious; deep fakes must be disclosed; and AI-generated text published to inform the public on matters of public interest must be labelled unless it has been through human editorial review. The requirement for providers to mark generative AI output in a machine-readable way applies to systems placed on the market before 2 August 2026 from 2 December 2026.

Executive Action

• Audit customer-facing AI interfaces for Article 50 disclosures and fix any gaps now — this obligation is already live.
• Ask the Chief People Officer and General Counsel to confirm the AI literacy programme is documented and reportable to the board.
• Confirm with your generative AI vendors how they will meet the machine-readable marking requirement by 2 December 2026.

How Has the Digital Omnibus Changed the Timetable?

The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since 27 July 2026 — deferred the high-risk regime because harmonised standards and national authorities were not ready. The key changes for boards:

• Stand-alone high-risk systems (Annex III) — including AI used in recruitment and HR, creditworthiness, education and access to essential services — now apply from 2 December 2027 instead of 2 August 2026.
• High-risk AI embedded in regulated products (Annex I) — such as medical devices and machinery — now apply from 2 August 2028.
• High-risk systems used by public authorities have until 2 August 2030.

This is a deferral, not a repeal. Transparency and literacy duties are unaffected, and building a high-risk compliance programme — risk management, data governance, technical documentation, human oversight, conformity assessment — takes longer than most boards expect. The extra time is best used to do that work properly.

Executive Action

• Rebuild your AI Act roadmap around three tracks: obligations already in force, December 2027 (Annex III high-risk) and August 2028 (product-embedded AI).
• Brief the board on the Omnibus directly, so leadership does not conclude that all AI Act pressure has gone away.
• Classify each AI system against Annex III now, so the 2027 workload is known and budgeted.

What Governance Does the Board Need?

AI Act compliance cannot sit only with an IT team or a junior privacy officer. For high-risk systems, providers need a quality management system covering risk management, data governance, technical documentation, transparency, human oversight and post-market monitoring; deployers need to use systems in line with instructions, assign competent human oversight, monitor operation and keep logs. Organisations with mature information security and risk frameworks will find much of this familiar, but the AI-specific elements — data quality, bias testing, human oversight design — usually need new capability.

INFORMD’s AI governance assessment tools can help benchmark your current posture, and the AI governance for boards briefing sets out a wider board framework.

Executive Action

• Name a board-accountable AI governance lead — for example the General Counsel, Chief Risk Officer or a designated non-executive — and minute the appointment.
• Maintain an AI risk register mapping each system to its classification, your legal role and the applicable obligations and dates.
• Build AI Act clauses into procurement: documentation, transparency support, incident notification and audit access.

What Are the Penalties?

Fines run up to €35 million or 7% of worldwide annual turnover (whichever is higher) for prohibited practices; up to €15 million or 3% for breaches of most other obligations, including those on high-risk systems and transparency; and up to €7.5 million or 1% for supplying incorrect or misleading information to authorities. Lower caps apply to SMEs. For UK groups with material EU revenue these belong on the board risk register alongside GDPR exposure — and the reputational impact of a published enforcement decision may outweigh the fine itself.

Frequently Asked Questions

When do the EU AI Act high-risk rules apply?

Following the Digital Omnibus on AI, obligations for stand-alone high-risk systems listed in Annex III apply from 2 December 2027, and for high-risk AI embedded in regulated products from 2 August 2028.

Did the Omnibus delay the transparency rules?

Largely no. Article 50 transparency duties apply from 2 August 2026. The main exception is the machine-readable marking duty for generative AI systems already on the market before that date, which applies from 2 December 2026.

Do UK businesses using ChatGPT or similar tools have general-purpose AI obligations?

Generally not as GPAI providers — those duties fall on the companies that build the models. But how you use those tools can still trigger obligations, for example Article 50 transparency for customer-facing chatbots, or high-risk obligations if you use them in an Annex III context such as recruitment.

Sources: Digital Omnibus on AI, Regulation (EU) 2026/1744; Regulation (EU) 2024/1689 (the AI Act), Articles 2, 4, 5, 50, 99 and 113.