Where are you operating from?
UK alone does not trigger EU AI Act duties.
EU AI Act, cross-checked & UK-aware
Built for engineering, product, and risk teams: verified Regulation (EU) 2024/1689 and Digital Omnibus Regulation (EU) 2026/1744 milestones, role-based obligation mapping, and UK Data (Use and Access) Act 2025 vs EU Article 2(1)(c) extraterritorial scope logic.
Reg. (EU) 2024/1689 + Omnibus 2026/1744Article 113 Timeline LogicUK DUAA 2025 & Art. 2(1)(c) GuardrailsArticles 99 & 101 Fine Engine
7 MilestonesAug 2024 to Aug 2028 (Omnibus)
UK != EUExtraterritorial scope check
4 RolesProvider, deployer, importer, distributor
Fine CalculatorArticles 99 & 101 + SME/SMC caps
Enforcement Roadmap (Article 113 & Digital Omnibus Reg. 2026/1744)
Current date context: 2026-11-04 · General application (Art. 50 & Art. 101): 2 August 2026 (In Force) · Standalone Annex III high-risk: 2 December 2027.
1. Interactive Scope Checker (UK-vs-EU first)
1. Jurisdiction2. EU trigger3. Role4. Risk5. Annex III6. Date
Placed on EU market, put into service, or output used in EU?
If Yes, obligations apply under Article 2(1)(a)–(c) extraterritoriality.
Role in value chain
Role changes obligations and penalty liabilities.
Primary risk band
When uncertain, start at limited and test scenarios.
Likely Annex III high-risk use case?
Yes triggers Articles 9–15 controls (standalone deadline 2 Dec 2027 per Reg. 2026/1744).
Assessment date (ISO)
Timeline-sensitive obligations are date-dependent.
EU AI Act likely not directly applicable (UK-only context)
Timeline stage: Phase 3 — Art. 50 transparency & Art. 101 GPAI fines in force (since 2 Aug 2026) · Annex III due 2 Dec 2027 (Omnibus) · EU applicability: Unlikely (UK Domestic Only)
- Document why your offering is UK-only — confirming it is neither placed on the EU market nor has output used in the EU (Art. 2(1)(c)).
- Run UK statutory controls: Data (Use and Access) Act 2025 (automated decision-making safeguards), UK GDPR / DPA 2018, and Equality Act 2010.
- Align with UK sector regulators (ICO / Information Commission, FCA, CMA, Ofcom, MHRA) and UK AI Security Institute (AISI) frontier safety benchmarks.
- Re-run this check before onboarding EU customers or allowing EU output consumption — Article 2 extraterritoriality triggers immediately.
Why this result
- Jurisdiction is UK and EU-market / EU-output trigger (Art. 2(1)(c)) is set to No.
- No current signal of placing AI system/model on the EU market or output being used in the EU.
Compliance intelligence only, not legal advice. Use this as a triage engine, then run legal sign-off for declarations and conformity evidence.
2. Fine & Liability Calculator (Articles 99 & 101)
Calculate your statutory maximum exposure by global annual turnover and operator size. Under Article 99(6) — extended to Small Mid-Caps (SMCs) by Regulation (EU) 2026/1744 — SMEs, startups, and SMCs benefit from the LOWER of the fixed Euro ceiling vs percentage rate on Article 99 fines (whereas Article 101(1) GPAI Commission fines specify whichever is higher, subject to proportionality).
Art. 99(4)
Estimated Maximum Fine Ceiling
€0.3M
Fixed Euro Cap: €15.0M
Turnover Rate (3%): €0.30M
Rule Applied: SME / Startup / Small Mid-Cap Rule (Art. 99(6) & Reg. 2026/1744): Capped at whichever is LOWER (€15.0M vs 3% of turnover).
3. Searchable Prohibited & High-Risk Rules Explorer
Search terms across the 8 banned practices and 8 Annex III high-risk domains.
The 8 Core Prohibited Practices (Article 5 — In Force Since 2 Feb 2025 + Jul 2026 Omnibus Intimate Deepfake/CSAM Bans)
Harmful manipulation & deception
Psychological / BehavioralSubliminal techniques or deceptive tactics distorting behavior and impairing informed decisions to cause significant harm (Art. 5(1)(a)).
Exploitation of vulnerabilities
Social / VulnerabilityExploiting age, disability, or specific social/economic situation to distort behavior causing harm (Art. 5(1)(b)).
Social scoring
Social / ProfilingEvaluating or classifying natural persons over time based on social behavior or personal traits causing detrimental treatment (Art. 5(1)(c)).
Criminal-offence risk prediction
Justice / ProfilingPredicting an individual's risk of committing a crime based solely on profiling or personality traits (Art. 5(1)(d)).
Untargeted facial-image scraping
Biometrics / PrivacyCreating or expanding facial recognition databases via untargeted scraping of internet or CCTV footage (Art. 5(1)(e)).
Emotion recognition at work & school
Workplace / EducationInferring emotions of natural persons in workplace and educational institutions, except for medical or safety reasons (Art. 5(1)(f)).
Biometric categorisation of protected traits
Biometrics / DiscriminationCategorising natural persons based on biometric data to deduce race, political opinions, trade union membership, religious/philosophical beliefs, or sexual orientation (Art. 5(1)(g)).
Real-time remote biometric ID in public
Biometrics / Law EnforcementLive remote biometric identification in publicly accessible spaces for law enforcement, unless strictly necessary for narrow exceptions (Art. 5(1)(h)).
Annex III High-Risk Categories (Articles 6(2) & 9–15 — Deferred to 2 Dec 2027 by Omnibus Reg. 2026/1744)
Safety components in critical infrastructure
InfrastructureDigital or safety components in road traffic, water, gas, heating, electricity where failure endangers life and health.
Education & vocational training
EducationAI determining access, admission, assignment, or evaluating learning outcomes and exam scoring.
Employment & worker management
EmploymentCV-sorting, recruitment tooling, performance evaluation, task allocation, promotion, or termination decisions.
Access to essential private & public services
Essential ServicesCredit scoring, risk assessment for life/health insurance, dispatching emergency first responders.
Remote biometric identification & categorisation
BiometricsPost remote biometric identification systems and emotion recognition not banned under Art 5.
Law enforcement decision support
Law EnforcementAssessing criminal risk, polygraphs/lie detectors, evidence reliability scoring, profiling during detection.
Migration, asylum and border control
MigrationPolygraphs, risk assessment for border entry, visa application examination, asylum eligibility verification.
Administration of justice & democratic processes
JusticeAssisting judicial authorities in researching and interpreting facts and law, or influencing election outcomes.
4. Provider Obligations for High-Risk Systems (Articles 9-15)
Risk management system (Art. 9)
Continuous iterative risk assessment, testing, and mitigation across the entire lifecycle.
Data & data governance (Art. 10)
High-quality training, validation, and testing datasets with bias mitigation and representative sampling.
Technical documentation (Art. 11)
Detailed up-to-date documentation proving conformity before placement on the EU market.
Record-keeping & logging (Art. 12)
Automatic logging of events enabling traceability, auditability, and monitoring across operation.
Transparency & deployer info (Art. 13)
Clear instructions for use, capabilities, limitations, and operational specifications for deployers.
Human oversight (Art. 14)
Built-in interface controls allowing human operators to oversee, override, or interrupt output.
Accuracy, robustness & cybersecurity (Art. 15)
Resilience against adversarial prompt injection, cyber threats, data poisoning, and performance drift.
5. Article 50 Transparency & Disclosure Snippet Generator
In force since 2 August 2026 (narrow legacy pre-Aug 2026 generative marking transition ends 2 December 2026): Implement user-facing disclaimers and machine-readable synthetic content watermarks.
<!-- Article 50(1) Interactive AI User Disclaimer -->
<div class="ai-disclosure-banner" role="status" aria-live="polite">
<span class="ai-icon">🤖</span>
<p><strong>Notice:</strong> You are interacting with an automated AI assistant powered by synthetic intelligence.</p>
</div>UK vs EU AI Regulation Matrix (Verified October 2026)
Side-by-side comparison of the EU AI Act (as amended by Digital Omnibus Regulation (EU) 2026/1744) and the UK framework (Data (Use and Access) Act 2025, sector regulators & UK AI Security Institute).
| Dimension | European Union (EU AI Act + Omnibus 2026/1744) | United Kingdom (DUAA 2025 + Sector Model) |
|---|---|---|
| Regulatory Architecture | Single horizontal risk-based statute: Regulation (EU) 2024/1689 as amended by Digital Omnibus Regulation (EU) 2026/1744 (in force 27 Jul 2026). | Context-specific, pro-innovation sector-regulator model (ICO / Information Commission, FCA, CMA, Ofcom, MHRA) — no horizontal omnibus AI Act. |
| 2025–2026 Statutory Anchor | Art. 5 bans & Art. 4 literacy live (Feb 2025); Chapter V GPAI live (Aug 2025); Art. 50 transparency & Art. 101 GPAI fines live (2 Aug 2026). | Data (Use and Access) Act 2025 (2025 c. 18, Royal Assent 19 Jun 2025) + UK GDPR, Data Protection Act 2018 & Equality Act 2010. |
| Frontier AI Oversight Body | European AI Office (European Commission): enforces Chapter V GPAI duties, July 2025 GPAI Code of Practice & >10^25 FLOPs systemic-risk rules (Art. 51). | UK AI Security Institute (AISI, DSIT): renamed from AI Safety Institute on 14 Feb 2025; conducts frontier cyber, bio/CBRN & misuse evaluations. |
| High-Risk & Automated Decisions | Mandatory ex-ante conformity, QMS & FRIA (Arts. 9–15, 27): standalone Annex III systems due 2 Dec 2027; Annex I product safety due 2 Aug 2028. | DUAA 2025 broadens lawful bases (including recognised legitimate interests) for automated decision-making (ADM), subject to notice, contestation & human intervention. |
| Extraterritorial Reach | Article 2(1)(a)–(c): captures UK/non-EU providers & deployers placing AI on the EU market OR where AI system output is used in the EU. | Applies to UK-established organisations and non-UK controllers/processors offering goods/services to or monitoring individuals in the UK. |
| Maximum Penalty Exposure | Up to €35M or 7% global turnover (Art. 99(3)); €15M or 3% (Art. 99(4) & Art. 101 GPAI); lower cap for SMEs, startups & Small Mid-Caps on Art. 99 fines. | Up to £17.5M or 4% of global annual turnover under UK GDPR / DUAA 2025 data enforcement, plus sector-regulator statutory sanctions (FCA, CMA, Ofcom). |
6. Frequently Asked Questions
Does the EU AI Act apply to UK companies?
Not automatically — the UK is outside the EU. However, the Act has explicit extraterritorial reach under Article 2(1)(a)–(c): it applies to any UK provider or deployer that places AI systems or GPAI models on the EU market, puts them into service in the EU, or where the AI system's output is used in the EU. Purely domestic UK operations instead follow the UK pro-innovation sector-regulator model, the Data (Use and Access) Act 2025 (Royal Assent 19 June 2025), UK GDPR, Equality Act 2010, and frontier security evaluations led by the UK AI Security Institute (renamed from the AI Safety Institute in February 2025).
What took effect on 2 August 2026?
Under Article 113 — as amended on 27 July 2026 by Regulation (EU) 2026/1744 (the Digital Omnibus on AI) — the 2 August 2026 general application date activated Article 50 transparency and deepfake obligations (with a narrow grace window until 2 December 2026 for machine-readable marking on legacy pre-August 2026 generative systems), Article 101 European Commission fining powers for GPAI providers, national market surveillance enforcement, and Article 57 AI regulatory sandboxes. Standalone Annex III high-risk duties were deferred to 2 December 2027, and Article 6(1) Annex I regulated product-safety duties to 2 August 2028.
How did the July 2026 Digital Omnibus on AI change high-risk deadlines?
Adopted on 8 July 2026 and in force since 27 July 2026, Regulation (EU) 2026/1744 (Digital Omnibus on AI) decoupled high-risk enforcement from August 2026 due to CEN/CENELEC harmonised standards delays. Standalone Annex III high-risk AI obligations now apply from 2 December 2027, and Annex I product-safety AI obligations apply from 2 August 2028. It also refined Article 4 AI literacy to 'supporting' literacy development and extended Article 99 SME fine-capping relief to Small Mid-Caps (SMCs).
How does the SME, Startup & Small Mid-Cap penalty rule work?
Under Article 99(6), for SMEs and startups (EU Recommendation 2003/361/EC) — and extended to Small Mid-Cap enterprises (<750 staff, Recommendation (EU) 2025/1099) by Regulation (EU) 2026/1744 — Article 99(3)–(5) fine ceilings are capped at whichever of the two figures (the fixed Euro ceiling vs percentage of worldwide annual turnover) is LOWER rather than higher. Note that Article 101(1) Commission fines for GPAI model providers specify 'whichever is higher' (€15M or 3%), subject to proportionality and economic viability.
Which AI practices are already banned?
Eight core Article 5 AI practices have been prohibited since 2 February 2025 — including harmful manipulation, exploitation of vulnerabilities, social scoring, individual criminal-offence profiling, untargeted facial scraping, workplace/school emotion recognition, sensitive biometric categorisation, and real-time remote biometric identification for law enforcement (narrow judicial exceptions) — plus explicit Digital Omnibus (Regulation (EU) 2026/1744) bans on non-consensual intimate deepfake imagery and CSAM.
Do GPAI model rules already apply?
Yes. Chapter V obligations for general-purpose AI model providers have applied since 2 August 2025 (supported by the European AI Office's July 2025 GPAI Code of Practice) — covering technical documentation, downstream transparency, EU copyright compliance, training data summaries, and systemic-risk duties (>10^25 FLOPs under Article 51). Commission fining powers under Article 101 went live on 2 August 2026, while legacy GPAI models placed on the market before 2 August 2025 have until 2 August 2027 to comply under Article 111(3).
Is this page formal legal advice?
No. It is compliance intelligence for engineering, product, and legal triage. For binding conformity declarations, filings, and legal sign-off, consult qualified EU/UK legal counsel and verify against Regulation (EU) 2024/1689 and amending Regulation (EU) 2026/1744.
7. Cross-Fact-Check Sources
Digital Omnibus on AI — Regulation (EU) 2026/1744 (EUR-Lex)
Entered into force 27 July 2026: deferred Annex III high-risk rules to 2 Dec 2027, Annex I to 2 Aug 2028, and extended SME fine-cap relief to Small Mid-Caps.
European AI Office — GPAI Code of Practice (Published July 2025)
Official operational guidance and presumption-of-conformity benchmarks for Chapter V GPAI models (Art. 101 Commission fines active since 2 Aug 2026).
Official EU policy page (European Commission)
Risk tiers, the 8 prohibited practices, high-risk categories, transparency timing, GPAI policy context.
Regulation (EU) 2024/1689 — full official text (EUR-Lex)
The binding foundational legal text in all 24 EU languages — read alongside amending Regulation (EU) 2026/1744.
AI Act Article 113 explorer (text mapped to OJ version)
Entry into force and staged application dates, including the Article 113(b) carve-out for Article 101.
EU AI Act Service Desk (Commission)
Official single information platform for AI Act questions.
UK Data (Use and Access) Act 2025 — 2025 c. 18 (legislation.gov.uk)
Royal Assent 19 June 2025: reformed UK automated decision-making rules, scientific research AI training provisions, and Information Commission governance.
UK AI Security Institute (AISI — GOV.UK)
Renamed from AI Safety Institute in Feb 2025 by DSIT; leads UK technical evaluations of frontier AI cyber, CBRN, and national security risks.
UK Government white paper (DSIT)
UK principles-based sector-regulator approach; no single horizontal EU-style AI Act in domestic UK law.
ICO AI guidance index
UK data protection, automated decision-making, and DPIA compliance resources for AI systems.