The EU AI Act: A Practical Guide for UK Businesses

The EU AI Act is designed to create a consistent, enforceable approach to the development and use of AI. Instead of treating AI as a single category, it focuses on the level of risk AI systems may pose to individuals, society, and people’s rights. 

The EU’s approach: classifying AI by risk 

A core concept in the EU AI Act is that some uses of AI are more sensitive than others. For example, a chatbot that answers basic customer questions is very different from AI used to help decide who gets a loan, who has access to education, or how a medical condition is assessed. 

To reflect this, the Act groups AI into four broad risk levels: 

Some obligations apply immediately, while others phase in on later dates.

The risk-based approach matters because it shapes the practical questions businesses ask, such as: 

• What category might our AI use fall into? 
• Are we a ‘provider’ or ‘deployer’ (or both)? 
• What evidence might we need to demonstrate appropriate oversight? 

Exactly where an AI system sits under the EU AI Act depends on what it does and how it is used, but a few examples help explain the overall approach. 

1. Unacceptable risk (prohibited AI uses

At the top end, the risk is unacceptable. This refers to AI uses that the regulation treats as incompatible with EU values or too harmful to permit. 

Discussions in this area often include certain types of manipulative AI or AI practices that could seriously undermine safety or people’s rights. The main point for businesses is that some use cases may not be something you can ‘fix’ simply by adding more controls or better paperwork – they may be restricted outright. 

While there are no finalised EU AI Act rulings at the time of writing, The Italian SA imposed a €20 million fine on Clearview AI Inc back in 2022 for their misuse of facial recognition. This is a high-profile real-world example of the type of practices which could be identified as an unacceptable risk. 

2. High risk (stricter requirements) 

High-risk AI refers to systems used in more sensitive settings where the outcome could materially affect someone’s life or fundamental rights. This can include AI used to support recruitment decisions, assess creditworthiness, operate in certain healthcare contexts, support critical infrastructure or safety-related functions, or influence access to education. 

This is the category where expectations are usually highest around governance, technical documentation, data quality, ongoing monitoring, and clear accountability. 

3. Limited risk (transparency obligations)

Limited risk AI is not necessarily harmful, but it may still require transparency. In other words, people may need to be told when they are interacting with an AI system, or when something has been created or altered using AI. 

Common examples include customer service chatbots, generative AI tools that produce text or images, and systems that create synthetic media, all of which require clear disclosure. Many uses of platforms such as CoPilot, Claude, and ChatGPT would be limited risk, so they are subject to transparency obligations. The aim is straightforward: to make sure users are not misled. 

4. Minimal or low risk (few or no specific obligations) 

At the other end of the scale is minimal or low-risk AI. This can cover everyday tools and features such as spam filtering, simple automation, and some basic recommendations (depending on how and where they’re used). 

In these cases, the EU AI Act may not add many direct requirements. However, businesses may still see expectations from customers, contracts, reputation, and internal governance, particularly in regulated sectors or when selling into larger organisations with formal procurement checks. 

Even though the UK is no longer part of the EU, the EU AI Act may still apply to some UK organisations, particularly when AI systems are: 

• Placed on the EU market. 
• Used in ways that affect people in the EU, including where system outputs are used within the EU. 

For UK organisations, this is a familiar pattern seen with other EU regulations: the rules can still have an impact beyond the EU’s borders. Many organisations start with a simple question: Are we in scope?  

A useful way to sense check is to ask: 

• Do we have EU customers, or do we plan to enter EU markets? 
• Is our AI embedded in a product that could be sold into the EU? 
• Are we a provider of AI functionality to another organisation that sells into the EU? 
• Do we rely on third-party AI systems whose outputs impact EU operations? 

If the answer to any of these is ‘yes’ or ‘possibly’, it may be worth treating EU AI Act awareness as part of wider planning for governance, regulatory readiness, and EU market access. 

Why cross-border impact matters 

In practice, UK businesses may encounter EU AI Act-related requirements if they sell AI-enabled products or SaaS services to EU customers, build AI features for EU users, or supply AI capability into an EU company’s wider compliance and risk programme.  

It may also be relevant where a UK business partners with EU distributors or integrators, or where an AI system developed in the UK produces outputs that influence decisions in the EU. 

Over time, this can create new expectations around how AI is governed and evidenced. That may include clearer documentation of how an AI system works and is controlled, stronger accountability across the AI lifecycle, defined oversight processes (such as policies, approvals, and monitoring), and transparent communication so users or affected individuals understand how AI is involved. 

The EU AI Act recognises that different organisations play different roles in the AI supply chain. One of the key roles is the AI provider. This is usually the organisation that develops an AI system or puts it on the market under its own name. 

For UK businesses, a provider could be: 

• An AI product company or SaaS vendor 
• A business building bespoke AI for clients 
• A manufacturer embedding AI into products sold in the EU 
• A firm that fine-tunes or makes significant changes to an AI system before it is placed on the EU market 

Provider obligations 

What a provider may need to do can depend on the AI system’s risk level, especially if it is classed as high risk. In general, responsibilities may include implementing structured controls and evidencing them. 

Risk management  

This may involve showing a clear approach to identifying and managing risks, including:  

• How the system is intended to be used (and how it might be misused) 
• Its safety and reliability 
• Security and robustness 
• What could go wrong in practice 
• How issues are escalated and handled 

Data governance  

Requirements for data governance may become more important because AI outcomes often depend on the data used to train, test, or run the system. This can include demonstrating that the data is relevant and suitable for the intended use, keeping records of data sources and processing, and implementing controls. 

Technical documentation 

Often a central theme for higher-risk systems, this can cover:  

• What the system is for – its intended use and limits 
• How it has been tested 
• What risk controls are in place 
• How human oversight is designed 
• How monitoring and incidents are managed 

Transparency  

Requirements vary by system type. Providers may be expected to provide clear information to customers and users on how to use the system properly, its limitations, and the conditions under which it is designed to operate. In some cases, providers may also need to support downstream transparency, such as helping deployers inform end users that they are interacting with AI. 

Post-market monitoring  

Focusing on events that occur after the system is released, this may include:  

• Tracking performance over time 
• Spotting new risks 
• Collecting feedback or incident reports 
• Managing updates through controlled change processes 

Conformity assessment (for certain high-risk AI) 

For some high-risk AI systems, the Act may require formal conformity assessment procedures before the system is placed on the EU market (depending on classification and context). 

From an operational standpoint, this can influence: 

• Product development lifecycles 
• Release management 
• Supplier assurance activities 
• Audit-readiness and evidence collection 

A second critical role is the AI deployer (formerly referred to as “user” in earlier drafts), an organisation that uses an AI system as part of its operations, even if it did not build the system. 

In the UK, deployers can include: 

• Businesses using AI tools for HR, finance, customer service, or operations. 
• Public sector or regulated organisations adopting AI for service delivery. 
• Companies integrating third-party AI into workflows. 
• Teams using generative AI tools for content or decision support. 

Deployers may still have responsibilities even where the AI system is purchased ‘off the shelf’. 

Deployer responsibilities 

Depending on the AI system type and risk level, deployers may need to consider: 

Oversight of AI system use 

Depending on the system and how it is used, deployers may be expected to ensure AI is used as it was designed. That usually means following the provider’s instructions, staying within the intended purpose and known limitations, and aligning use with the organisation’s own policies and governance requirements. This becomes especially important where AI outputs could influence decisions about individuals. 

Human oversight 

This is a recurring theme in AI governance. In plain terms, this means having meaningful human supervision in place to reduce the chance of harmful outcomes, particularly in higher-impact situations. Organisations may need to be clear about:  

• When a person must review or approve an AI output.  
• What training or competence the reviewer needs. 
• How exceptions and edge cases are handled. 
• How oversight is recorded in a way that can be checked later. 

Monitoring outcomes 

Even when an AI system is bought in from a third party, deployers may still need to monitor how it performs once it is used in their real-world environment. Outputs may be more reliable in one context than another, and changes in local data or operating conditions can shift the risk profile over time. Ongoing monitoring can therefore be an important part of responsible deployment. 

Transparency toward users or affected individuals 

Where transparency obligations apply (for example, interacting with a chatbot), deployers may be the party closest to the end user and best positioned to deliver the disclosure. 

While many UK organisations are assessing what the EU AI Act may mean for their operations, (particularly where AI systems are developed, deployed, or supplied into EU markets), there are a few early governance areas that are often worth looking at. 

The points below are best read as areas to consider, rather than a checklist of actions. 

1. Identifying where AI is used 

A sensible starting point is simply understanding where AI already exists in the organisation. That can include: 

• In-house-developed AI  
• Third-party tools used by teams (including ‘shadow AI’ adopted informally) 
• AI features built into products 
• AI used in customer-facing services or internal decision-making  

Having a clearer picture helps organisations see which systems are business-critical, which are experimental, and where AI adoption may be growing faster than expected. 

2. Understanding risk and use contexts

Because the EU AI Act is based on risk, it can help to look at AI systems in context, not just by name or vendor. This usually means being clear about what the system is for, who it affects, what decisions it supports, and whether the outputs could materially impact individuals.  

It may also be relevant to consider whether the AI falls within a regulated activity (for example, financial services or healthcare), what could go wrong (such as errors, bias, misuse, or unexpected behaviour), and its real-world consequences. 

3. Making accountability and evidence clearer

Compliance often becomes more tangible at the documentation stage, as organisations may need to demonstrate how AI systems are governed, monitored, and controlled, particularly where regulatory obligations apply. Some businesses find it helpful to record why a system is used, what data it relies on, who is responsible for it day to day (from a business, technical, and risk perspective), how changes are approved, and what monitoring is in place.  

The goal is not paperwork for its own sake, but clearer ownership and a trail of evidence that supports oversight. 

4. Putting governance around AI use

Governance can sound abstract, but in practice, it often comes down to roles, rules, and review. For some organisations, that means agreeing on who can approve new AI use cases, what ‘acceptable use’ looks like, and how higher-impact use cases are assessed before they go live. It also includes practical operational readiness, such as how issues are escalated, how incidents are handled, and how third-party suppliers are assessed, where AI is bought in rather than built. 

5. Checking whether data governance is fit for AI

Many AI risks are closely linked to data risks, including poor data quality, unclear provenance, privacy concerns, or bias introduced through datasets. With that in mind, organisations may want to consider whether their data governance supports transparency, whether controls are applied consistently across teams and vendors, and whether decisions and approvals can be evidenced. In higher-impact use cases, those ‘behind the scenes’ data controls can become a key part of demonstrating responsible oversight. 

As AI regulation grows, many organisations seek ways to establish governance that is repeatable, auditable, and scalable – rather than a collection of one-off controls. 

What is ISO/IEC 42001? 

ISO/IEC 42001 is the internationally recognised standard for Artificial Intelligence Management Systems (AIMS). It provides a structured way for organisations to manage how AI systems are designed, developed, deployed, and monitored, supporting clearer oversight across the AI lifecycle.  

As such, ISO 42001 is a practical, evidence-based way to bring clarity and accountability to how AI is used – helping manage risk without slowing innovation. 

How ISO 42001 may support structured AI oversight 

Management System Standards are designed to help organisations build consistent processes for governance and continual improvement. 

In an AI context, an AIMS approach may support: 

• Clarity on AI ownership and accountability 
• Consistent risk management across AI use cases 
• Structured documentation and control 
• Performance evaluation and monitoring mechanisms 
• Improvement cycles based on feedback, incidents, and change 

Amtivo has discussed the growing importance of AI governance in a recent webinar, which you can watch now.  

Management System Standards and integration 

Many ISO Management System Standards follow the same common structure. This can make them easier to fit alongside systems you already use, such as: 

• ISO 9001 (quality) 
• ISO 27001 (information security) 
• ISO 27701 (privacy) 

For many businesses, this can be helpful because AI governance does not exist in isolation. It overlaps with information security, privacy, quality, and operational risk. 

Learn more about Annex Sl and why it is important for ISO standards. 

Even for organisations that are not immediately in scope, the EU AI Act is still likely to shape what ‘good’ looks like in the market, especially for UK suppliers selling into EU value chains. Over time, it may influence customer expectations, procurement questions, and the level of assurance buyers require before adopting AI-enabled products or services. 

Stronger governance expectations 

One of the biggest shifts is likely to be around governance. Businesses may face greater pressure to demonstrate that AI is not used on an ad hoc basis but is managed with clear accountability. That includes explaining who is responsible for the system, what ‘responsible AI’ is in practice, and what happens if something goes wrong. 

For organisations working across a supply chain, there may also be a greater focus on role clarity, including whether you are acting as the provider, the deployer, or the distributor, and what responsibilities sit with each party. 

Increased focus on documentation 

Documentation may also become more important, not just for compliance but for commercial reasons. 

Buyers and partners may increasingly ask for practical evidence such as what the system does (and what it does not do), what risks have been assessed, how performance is monitored, and how users are informed when AI is involved. 

In many cases, the ability to provide clear, consistent information quickly can reduce friction during due diligence. 

New compliance considerations when entering EU markets 

For UK businesses selling into the EU, AI regulatory readiness may become part of the go-to-market conversation. It can affect how products are planned and positioned, what gets prioritised on the roadmap, and what needs to be agreed upon during contract negotiations. 

Partners and distributors may also introduce their own requirements, particularly if they need to manage risk across multiple suppliers. 

Operational changes may be needed behind the scenes 

Finally, stronger expectations around oversight can lead to operational changes in how AI is managed day to day. Organisations may need clearer processes for releasing and updating AI systems, managing changes in a controlled way, handling incidents, and reviewing performance after deployment. 

Supplier and model management may also come under more scrutiny, especially where third-party models, data, or tools play a material role in how the AI behaves. 

The EU AI Act is a business compliance requirement, but it is also designed to shape how AI affects people. It aims to provide the following: 

Improved transparency 

A key consumer benefit is helping individuals understand: 

• When they are interacting with AI. 
• When AI-generated content is involved. 
• The expectations they should have about system limitations. 

Protecting individuals from harmful AI uses 

By restricting prohibited uses and setting requirements for higher-risk systems, the regulation aims to reduce AI outcomes that could: 

• Discriminate unfairly 
• Manipulate behaviour 
• Create unsafe conditions 
• Undermine fundamental rights 

Increased accountability in AI systems 

The Act encourages clearer accountability across the AI lifecycle, supporting the principle that organisations should be able to explain and evidence how AI systems are governed. 

Strengthening trust in AI-enabled products and services 

Ultimately, a core societal goal is to increase confidence that AI can be adopted responsibly, supporting innovation while reducing harm. 

The EU AI Act is widely seen as an early signal of where AI regulation is heading, not just in Europe. 

Increasing global AI regulation 

Many countries are now working out how to regulate AI in ways that fit their own legal systems and priorities. In some places, this is happening through sector-specific rules, for example, in finance or healthcare. In others, it is taking the form of broader AI principles, or new requirements around safety and transparency, particularly for generative AI. Even where the details differ, the overall direction is toward more formal oversight. 

In the UK, there is currently no AI-specific regulation or legislation. Instead, its use is regulated through existing legal frameworks, but there are growing calls on the government to introduce binding regulations specifically on AI.  

The rise of AI governance frameworks 

As regulation develops, many organisations are looking for practical ways to turn high-level expectations into day-to-day controls. That is where governance frameworks and standards come in. They can help make AI oversight more consistent, easier to evidence, and more scalable, especially when AI is being used across multiple teams, products, and regions. 

Higher expectations for responsible AI 

The push for responsible AI is not coming solely from regulators. Expectations are rising from customers and procurement teams, boards and risk committees, insurers and investors, and from employees and the public. For many organisations, responsible AI is becoming part of how trust is built and maintained, not just a compliance issue. 

Likely evolution of international approaches 

The EU AI Act may also influence how other regulators shape their own approaches. In particular, it may affect thinking around risk-based classification, transparency and disclosure, accountability across AI supply chains, and ‘good’ documentation for higher-impact AI systems. 

The EU AI Act is a major milestone in AI regulation, and its influence may extend well beyond EU borders. For UK businesses that develop, use, distribute, or integrate AI systems connected to EU markets, the regulation may create new expectations around risk classification, transparency, documentation, and oversight.  

Standards such as ISO/IEC 42001 may provide a structured way to organise oversight across policy, risk management, day-to-day controls, monitoring, and continual improvement. 

If your organisation is exploring how to structure AI governance, you may find it useful to learn more about AI management system approaches and how they can support robust oversight as the regulatory landscape evolves. 

For more information on AI Governance or to request a quote for ISO 42001, contact our team today.