Plain-English guide
Does the EU AI Act
apply to your UK business?
Short version: it might, and being in Cornwall is not the defence people assume it is. The transparency rules went live on 2 August 2026. Here is who gets caught, what is actually being asked, and why for most small firms this is an afternoon's work rather than a compliance project.
The EU AI Act can apply to a UK business if you offer an AI system into the EU or your AI system's output is used there. Its transparency rules under Article 50 have applied since 2 August 2026 and require you to tell people when they are dealing with AI — a chatbot, a deepfake, or AI-generated content. For most small UK firms, compliance means labelling your chatbot and disclosing AI-generated media.
Published
Does it apply to you? Three questions
The thing most people get wrong is assuming that a European law stops at the Channel. It does not. The AI Act was written with deliberate reach, in the same way the GDPR was. It applies to businesses outside the EU when their AI touches the EU market. So the question is not where you are based. It is where your AI ends up.
Work through these three:
- 01
Do you sell or offer an AI system into the EU?If you build tools and any of your customers are in an EU country, that is the clearest possible yes.
- 02
Is the output of your AI used in the EU?This is the one that surprises people. You can be entirely UK-based and still be caught if what your system produces is being used by someone inside the EU.
- 03
Do you serve EU customers through an AI system?A chatbot on your website that answers enquiries from EU visitors, a booking system, a holiday let taking bookings from Germany and France. Tourism-facing Cornish businesses should read that line twice.
If all three are a firm no — you trade UK-only, your customers are UK-only, nothing you produce goes abroad — then the AI Act does not bite on you today. Read the section on the UK position below, because UK data protection law still applies to you either way, and skip the rest until you expand.
If any of them is a yes or a maybe, carry on.
The date that matters
What changed on 2 August 2026
On that date, the transparency obligations in Article 50 of the AI Act started to apply, and the European Commission confirmed it would begin enforcing them. The Commission published guidelines on 20 July 2026 explaining what the obligations cover and how to meet them, alongside a voluntary Code of Practice on the transparency of AI-generated content.
There is an important detail here that gets lost in the noise. Much of the AI Act has been delayed. The heavier obligations for high-risk systems were pushed back into December 2027 as part of the EU's Digital Omnibus package. Article 50 was left out of that delay. It arrived on schedule, and national market surveillance authorities can enforce it from that date.
So if you read something last year saying the AI Act was years away and nothing to worry about, that advice has aged. The part most likely to touch an ordinary small business is the part that is already live.
The penalty ceiling for breaching the transparency obligations is up to 15 million euros or 3% of worldwide annual turnover, whichever is higher. That is calibrated for large platforms rather than a six-person firm in Truro, but the duty itself applies to everyone equally.
The four situations Article 50 covers
Article 50 is not about whether your AI is dangerous. It is about whether people can tell they are dealing with AI at all. It splits duties between providers, meaning whoever built and put the system on the market, and deployers, meaning whoever is actually using it in their business. Most Cornish firms are deployers. If you build your own tools, you are both.
1. Systems that talk to people
Chatbots, voice assistants, AI agents that deal with the public. People have to be told they are interacting with AI rather than a person, unless it would already be obvious to a reasonably alert person. This is the one that catches the most small businesses, and it is the cheapest to fix.
2. Systems that generate content
Where a system produces synthetic audio, images, video or text, the provider has to mark that output in a machine-readable way so it can be detected as artificially generated. This is a technical provenance duty and it sits mainly with the big model providers, not with you for using their tools.
3. Emotion recognition and biometric sorting
If you use a system that reads emotions or categorises people by biometric data, you have to tell the people it is being used on. Rare in small business, but worth knowing exists before someone sells you a clever camera for your premises.
4. Deepfakes and AI-written public information
If you generate or manipulate image, audio or video that plausibly passes for real, you have to disclose it. The same applies to publishing AI-generated text that informs the public on matters of public interest, unless a human has reviewed it and someone holds editorial responsibility for it. Marketing that uses an AI-generated face or voice sits squarely here.
What this means for a small UK business
Strip out the parts aimed at model developers and platforms, and what is left for an ordinary firm with EU exposure is small. Genuinely small. Three things:
Label your chatbot. A single line does the job: you are chatting with our AI assistant, a person can pick this up at any time. It needs to be visible before someone starts typing, not buried in a privacy policy. If you are having an assistant built for you, this should be in it as standard rather than something you have to ask for. That is how I build them.
Disclose AI-generated media. If you have used AI to create a face, a voice, a video or a photorealistic image in your marketing, say so. Not in tiny print. A caption is fine. The test is whether someone could reasonably believe it was real.
Know what you are running. You cannot label what you have not noticed. Most firms genuinely do not know how many AI features are already switched on inside their booking system, their CRM or their accounting software. A short written list of where AI touches your business turns any future compliance question from a project into a two-minute answer.
What it does not mean: you do not need a compliance officer, a policy manual, or a consultant on retainer. Anyone telling a six-person Cornish business that the AI Act requires a governance framework is selling something.
Coming up
The 2 December 2026 deadline
One obligation got a runway. Generative AI systems that were already on the market before 2 August 2026 have until 2 December 2026 to comply with the machine-readable marking requirement for the content they produce. Everything else in Article 50 applied immediately.
For most readers this is someone else's deadline. It lands on the providers of the tools you use, and the large ones are working through the Commission's Code of Practice to demonstrate they have met it. Signing that Code is voluntary. The underlying legal duty is not.
It matters to you in one situation: if you have built and released your own tool that generates content for other people to use. If that is you, that date is yours, and it is close.
What isn't in force yet
Worth saying plainly, because the coverage of this law runs hot and it is easy to come away thinking everything landed at once. It did not.
The obligations on high-risk AI systems — the Annex III list, covering things like AI used in recruitment, credit scoring, education and access to essential services — were deferred to December 2027 under the Digital Omnibus package. Those are the heavy ones: risk management systems, technical documentation, conformity assessment, registration. If your business uses AI to sift job applicants, that is the timeline you should be tracking, and you have time to prepare properly.
The transparency duties in Article 50 are a different and much lighter animal. They are live now, and they ask you to be honest about what is AI. That is the whole shape of it.
And the UK position, for comparison
There is no UK AI Act. A House of Commons Library briefing in June 2026 confirmed there is no AI bill before Parliament. That is a deliberate policy choice rather than a gap waiting to be filled: the UK regulates AI through the regulators it already has, applying the law it already has.
In practice that means UK GDPR and the Data Protection Act, ICO guidance and enforcement, and existing law such as the Equality Act, all applied to how you use AI. Sector regulators layer their own expectations on top. The ICO has been given a statutory duty to produce a code of practice on AI and automated decision-making, with the code itself expected in 2027. When it lands it will carry real legal weight, because courts and the ICO will have to take it into account.
So a UK-only business is not unregulated. It is regulated somewhere else, under a different name. That gets its own guide — the AI rules UK businesses actually have to follow covers what applies to you at home.
What to do this week
- 01
Answer the three questions at the top honestly. Most Cornish trades will get three noes. Tourism, hospitality and anyone selling online often will not.
- 02
Look at your website chatbot if you have one. Does a visitor know it is AI before they type? If not, that is a one-line fix and it is the highest-value thing on this list.
- 03
Check your marketing for AI-generated faces, voices or photorealistic images. Caption them.
- 04
Write the list. Every place AI touches your business, on one page. Include the features that came switched on inside software you already pay for.
- 05
Diary December. Only if you have built and released a tool that generates content for others. Otherwise, it is not your deadline.
That is the lot. An hour, maybe two. The firms that get into trouble with this are not the ones who did it imperfectly, they are the ones who never looked.
Where this comes from
- European Commission — Guidelines on transparency obligations for providers and deployers of certain AI systems ↗
- European Commission — Code of Practice on Transparency of AI-generated Content ↗
- Article 50, Regulation (EU) 2024/1689 — full text ↗
This is plain-English guidance for small businesses, not formal legal advice. Where something genuinely needs a solicitor or a data-protection specialist, I'll tell you straight.
Straight answers
- Does the EU AI Act apply to a business based in the UK?
- It can, yes. The Act reaches beyond the EU. If you put an AI system onto the EU market, or the output of your AI system is used inside the EU, you are in scope regardless of the fact that you are sitting in Cornwall. Brexit did not put UK firms outside it.
- Is the EU AI Act actually in force, or still coming?
- The transparency rules in Article 50 have applied since 2 August 2026 and the European Commission began enforcing them from that date. Other parts of the Act arrive later. The high-risk obligations were pushed back to December 2027, but Article 50 was deliberately left out of that delay.
- I only have a handful of EU customers. Am I really caught?
- There is no small-business exemption in Article 50, but the practical test is whether you are genuinely offering your AI system into the EU market or your output is being used there. An occasional EU visitor to your website is a grey area. The honest answer is that labelling a chatbot costs you one sentence, so the argument is not worth having.
- What are the fines?
- For breaches of the transparency obligations, up to 15 million euros or 3% of worldwide annual turnover, whichever is higher. That ceiling is aimed at large providers, not one-man bands, but the obligation itself applies the same way to everyone.
- Do I have to relabel content I published before August?
- No. Content generated and published before 2 August 2026 does not have to be retroactively labelled. The obligations bite on what you do from that date onwards.
- What is the 2 December 2026 deadline about?
- It is a transitional period for one specific obligation: the machine-readable marking of AI-generated audio, image, video and text by systems that were already on the market before 2 August 2026. The disclosure duties for chatbots and deepfakes applied immediately and had no such runway.
- Is there a UK equivalent I need to worry about?
- Not as a single statute. There is no UK AI Act and no AI bill before Parliament. The UK regulates AI through existing regulators applying existing law, chiefly UK GDPR and the ICO. What binds you at home is data protection law, not an AI act.
- What should I actually do about this?
- For most small firms it is three things: label any chatbot as AI, disclose AI-generated images or video where a person could be fooled, and write down where AI touches your business. That is an afternoon of work, not a compliance project.
Want to know if this catches you?
Tell me how AI touches your business and I'll tell you straight whether the EU rules reach you, and what needs doing if they do. Fixed price, plain English, no open-ended bills.
Ask about a readiness check