How EU AI Act works in practice
The Act regulates AI by use-case risk rather than underlying maths, sorting systems into four tiers: unacceptable risk (prohibited), high risk, transparency risk, and minimal risk, alongside dedicated rules for General-Purpose AI (GPAI) model providers. Prohibited practices (such as untargeted facial scraping, social scoring, and manipulative subliminal techniques) and mandatory staff AI literacy duties under Article 4 took legal effect on 2 February 2025.
Obligations for GPAI models (transparency documentation, copyright policies, and systemic-risk evaluations for frontier compute thresholds) entered into application on 2 August 2025, together with national governance structures and penalty regimes reaching up to €35 million or 7 per cent of global annual turnover. Under the EU's Digital Omnibus agreement reached on 7 May 2026, enforcement of high-risk AI obligations was aligned with technical standards delivery: standalone Annex III high-risk systems (covering recruitment, creditworthiness, education, and biometric categorisation) apply from 2 December 2027, while Annex I product-embedded high-risk AI systems (such as medical devices and machinery) apply from 2 August 2028.
For example, a London HR-tech vendor selling automated CV-screening software to employers in Dublin and Frankfurt is classified as a high-risk AI provider under Annex III, requiring a risk management system, dataset bias audits, human oversight hooks, technical documentation, and EU database registration.
Why it matters and trade-offs
Any UK business serving EU customers or allowing EU employees to use its AI outputs falls within the Act's extraterritorial reach under Article 2. Crucially, an enterprise that substantially modifies a third-party model or deploys an LLM into a high-risk HR or credit workflow can legally step into the shoes of a high-risk 'provider', inheriting the full compliance burden.
Waiting until late 2027 to inventory systems is a costly mistake: prohibited-practice bans, Article 4 AI literacy rules, and GPAI obligations are already enforceable today, and procurement teams across Europe now require AI Act conformity roadmaps before signing SaaS contracts.