AI Act UK Equivalence: The Complete Board Implementation Guide 2026

The EU AI Act is now in force. UK firms with EU operations, EU customers, or AI systems deployed in EU markets are directly in scope. This briefing provides the complete board implementation framework — what the Act requires, how it maps to existing UK AI governance guidance, and the specific actions each board role must take before enforcement begins.

Why UK boards are in scope despite Brexit

The EU AI Act has extraterritorial reach comparable to GDPR. A UK firm is in scope if it places an AI system on the EU market, puts an AI system into service in the EU, or deploys AI systems that affect persons in the EU — regardless of where the provider is established. This captures the overwhelming majority of FTSE 350 firms with European operations.

Additionally, the UK government’s AI governance framework — published by DSIT and the ICO — tracks the EU Act closely. Boards that implement EU AI Act compliance frameworks will simultaneously satisfy UK domestic AI governance expectations, making dual compliance the most efficient approach.

The AI Act’s four-tier risk classification

Every AI system your organisation deploys, procures, or develops must be classified against the Act’s four-tier risk hierarchy. This classification determines the compliance burden.

The GPAI tier — general-purpose AI models

A significant addition to the Act is the General-Purpose AI (GPAI) model tier, which captures large language models and foundation models. If your firm develops or fine-tunes GPAI models with more than 10^25 FLOPs of compute, additional obligations apply including systemic risk assessments and adversarial testing. Most firms are GPAI users rather than developers, but procurement teams need to ensure GPAI providers can demonstrate compliance.

High-risk AI: the full compliance requirements

If your organisation deploys any high-risk AI system, the following obligations apply from August 2026 (for new systems) or August 2027 (for existing deployed systems):

1. Risk management system — a documented, iterative process identifying and mitigating risks throughout the AI lifecycle
2. Data governance — training, validation, and testing datasets must meet quality criteria; bias monitoring is mandatory
3. Technical documentation — detailed documentation of system design, capabilities, limitations, and performance
4. Transparency and user information — users must receive information enabling them to interpret outputs
5. Human oversight — systems must be designed to allow human intervention; operators must assign oversight responsibility to named individuals
6. Accuracy, robustness, and cybersecurity — tested performance standards with ongoing monitoring
7. EU database registration — high-risk AI systems must be registered in the EU’s public AI database before deployment
8. Conformity assessment — either self-assessment or third-party audit, depending on the application area

What the board must own directly

The AI Act places obligations on “providers” (those who develop or place AI on the market) and “deployers” (those who use AI under their own authority). Most UK corporates are deployers. Deployer obligations include:

• Assigning human oversight of high-risk AI to competent, empowered individuals
• Ensuring staff using AI have sufficient AI literacy (a board-level training obligation from February 2025)
• Monitoring for drift, degradation, and unexpected outcomes in deployed high-risk AI
• Maintaining logs of high-risk AI system operation for at least six months
• Notifying the provider and competent authority of serious incidents or malfunctions

Mapping AI Act obligations to existing UK frameworks

UK boards operating across multiple frameworks can rationalise compliance by mapping AI Act obligations to existing requirements:

• GDPR / UK GDPR — AI Act data governance and bias requirements largely overlap with GDPR data quality and automated decision-making obligations under Article 22. A joint compliance programme is more efficient.
• FCA Consumer Duty — AI systems used in customer-facing financial services must already meet Consumer Duty fairness standards. AI Act transparency and human oversight obligations reinforce this.
• UK Corporate Governance Code 2024 — Provision 29’s internal controls declaration should now include AI governance controls where material AI systems are deployed.
• SMCR (financial services firms only) — Boards at FCA/PRA-regulated firms should designate a Senior Manager as accountable for AI governance, reflected in their Statement of Responsibilities. Non-financial services boards should adopt equivalent accountability mechanisms suited to their governance structure.

Enforcement timeline