EU AI Act for UK Business: Plain-English Timeline

Does the EU AI Act apply to your UK business? Probably not directly, but you are almost certainly already accountable for what your AI does under existing UK law. If you run a small or mid-sized UK company that uses AI tools, even just a chatbot or a writing assistant, this is the post that tells you where you actually stand. By the end you will know which rules touch you, which do not, and the five questions that turn AI governance from a worry into a quick, honest exercise. We are a Manchester technology business that advises and builds AI systems for UK small businesses, so this is the conversation we have with clients every week.

Read on, and you can skip the hundred-page policy.

How did AI go from principles to enforceable law?

AI regulation moved from voluntary principles to binding law in under three years, faster than almost any other part of the technology. For the first year after ChatGPT launched, it was a talking point. By 2025 it was a compliance deadline with real dates attached.

Here is the timeline in plain English.

From declarations to commitments

The Bletchley Declaration in November 2023 was the first time governments agreed, together, that frontier AI was worth coordinating on. It set no rules, but it started the international safety-summit cycle that continues today.

The Seoul commitments in May 2024 took the next step. The leading labs signed up to specific testing regimes, risk thresholds and published safety frameworks. Still voluntary, but a clear shift from vague principles to named obligations.

The American detour that reached us anyway

Between those two moments, the United States took a framework route rather than a statutory one. Safety-testing and reporting expectations were pushed onto the labs, and a shared risk-management vocabulary emerged for American organisations. It was guidance rather than statute, but it shaped procurement language everywhere, including here, because the documents vendors produce to satisfy one market tend to travel.

The one with actual teeth

Then the EU AI Act entered into force in August 2024. It is the big one: the first large-scale, binding legal framework for AI in a major market. Its obligations arrived in stages, with bans on prohibited practices from February 2025 and rules for general-purpose AI models from August 2025. For details straight from the source, the European Commission’s AI Act pages set out the structure and timeline.

”I’m a UK business: does any of this apply to me?”

Most UK small businesses have no direct EU AI Act obligations, but “it’s EU law” is not the same as “it’s not your problem”. The UK has so far chosen regulator-led guidance over copying the Act, yet three things still reach you.

The three routes it reaches you

First, if you sell into the EU, or your AI system’s outputs are used in the EU, the Act can apply to you directly. Like GDPR before it, it reaches beyond the EU’s borders.

Second, if you use AI suppliers, and almost every business now does, knowingly or not, their compliance posture becomes part of your supply chain. The Act’s obligations on model providers are a big reason every serious vendor now publishes usage policies and documentation.

Third, if you process personal data with AI, UK GDPR already applies. The ICO’s guidance on artificial intelligence is explicit that “the AI did it” is not a defence. You remain accountable for automated decisions about people.

What the UK is doing instead

The UK’s stated approach has been to let existing regulators apply existing law rather than pass a single AI statute, set out in the government’s pro-innovation approach to AI regulation. In practice that means your obligations arrive through the ICO, the FCA, the MHRA and others, depending on your sector, rather than through one document you can read on a Sunday.

So what does this mean for you? For most small and mid-sized UK businesses, the honest summary is this: you are unlikely to have direct AI Act obligations, but you are already accountable for what your AI does, under data protection, consumer protection and plain old contract law.

What does sensible AI governance actually look like for an SME?

Sensible AI governance for an SME is not a hundred-page policy. It is five questions answered honestly.

1. Inventory: what AI is actually in use in your business, including the tools employees adopted without asking?
2. Data flow: what information goes into each tool, and where does it physically go? This is where the open-weight versus closed model choice becomes a compliance lever, not just a technical one.
3. Human oversight: for decisions that affect customers or staff, where does a person check the output?
4. Disclosure: do customers know when they are talking to an AI? Our own chatbot says so in its first message; it costs nothing and builds trust.
5. Supplier diligence: for each AI vendor, where is data processed, is it used for training, and what do they document?

Start with the inventory, always

Of those five, the inventory is the one that changes the conversation, because almost every business we do this with finds a tool nobody had approved. That is not a discipline problem. It is what happens when useful software is one browser tab away.

The ICO’s advice hub for small organisations and the government’s data protection overview are both written for businesses without a legal department, and between them they cover most of what an SME needs.

Governance is a sales asset

A business that can answer those five questions has done more genuine AI governance than most. It has also positioned regulation as a trust asset rather than a threat. Done well, “we use AI responsibly and can show you how” wins deals, particularly with larger customers who have to ask.

How do the AI labs fit into this picture?

The labs now formalise their own safety practice, and buyers have started to check it. Published system cards, responsible-scaling policies and external red-teaming have become standard alongside the law.

What this changes about buying

Enterprise AI evaluations now routinely cover prompt-injection resistance, tool-call safety and data handling, not just whether the model is clever. When you assess a supplier, those are fair questions to ask, and good vendors expect them.

The security questions to ask alongside

Compliance and security overlap here. The NCSC’s briefing on AI and cyber security sets out the risks specific to AI systems, several of which are procurement questions rather than technical ones. If security certification is part of your sales process, our Cyber Essentials service covers the recognised route.

What should you actually do in the next 30 days?

You can get to a defensible position in about a month without hiring anyone. Here is the order we work through with clients.

Why one page beats a policy

A one-page document people read beats a fifty-page policy nobody opens. The purpose is not to satisfy an auditor. It is to make sure the person using an AI tool at 4pm on a Friday knows what they are and are not allowed to put into it.

If automation is also on your agenda, our guide to what AI automation can actually do pairs well with this one, and the rise of AI agents explains why oversight matters more as systems start to act, not just answer.

What do you say when a customer asks how you use AI?

This question is arriving in tenders and supplier forms far earlier than most small businesses expected, and a vague answer costs deals.

The answer that works

Name the tools, say what data they see, say where a human checks the output, and offer the one-page guidance you wrote in week four. That is it. Nobody is expecting a compliance department. They are checking that someone has thought about it.

The answer that loses deals

“We don’t really use AI” is the worst reply available, because it is almost never true and it is easy to disprove. If your team drafts emails with an assistant or your website has a chatbot, you use AI. Saying otherwise reads as either careless or evasive, and a buyer who spots it will assume the same of your other answers.

The honest bottom line

Most UK small businesses are not in scope for the EU AI Act directly, but every one of them is already accountable for what its AI does. The five-question checklist above is the practical floor, and for most firms it is enough to be both compliant and credible.

The mistake we see is treating this as a legal project. It is an operational one: know what you use, know where the data goes, decide who checks the output. Everything else follows from those three.

If you would like a second pair of eyes on it, this is bread-and-butter work for our AI consulting service, and if you want the wider picture of where AI genuinely fits in your business, that is what an AI Opportunity Assessment produces. Either way, you can just ask us for a straight answer on your exposure, with no hundred-page report.