Preparing for the EU AI Act: practical steps for UK organisations

Key points UK organisations should understand

• The EU AI Act is extra-territorial and can apply to UK organisations.
• Key compliance obligations are being introduced in phases with many already in place but the most onerous requirements starting in 2027.
• Obligations are not limited to just providers of AI but apply across the value chain so even those deploying AI may have obligations.
• Organisations should urgently determine whether EU AI Act applies to them and, if so, which AI systems and use cases fall within scope, what their role is for those systems and which risk category they sit in.
• Many of the foundations for compliance can be built by extending and adapting existing governance, risk and control frameworks, including those for cybersecurity, privacy and supplier risk management. 
• Organisations that strengthen AI governance now will be better placed to meet future compliance requirements.

Contents

• The EU AI Act has arrived: AI governance can no longer wait
• What UK organisations need to know about EU AI Act compliance
• Connect AI governance to the governance and controls you already have
• How we can help you prepare for the EU AI Act

The EU AI Act has arrived: AI governance can no longer wait

The run-up to the implementation of General Data Protection Regulations – GDPR – in 2018 was fraught with complexity, confusion and not a little friction. In the years since, data protection has remained a challenging and complex subject.

Now, with the rapid development of AI, companies will have to prepare themselves for something which is likely be an even more significant change than GDPR – the EU AI Act.

For years, the EU AI Act felt like something on the horizon. First signalled by European Commission president Ursula von der Leyen in 2019, this has finally now moved from policy debate to practical compliance requirements with a clear timeline. Organisations can no longer treat AI regulation as a future problem.

The journey has been complex. The technology has evolved rapidly, especially through the mainstream adoption of generative AI and the rapid proliferation of agentic AI and policymakers have had to balance innovation, competitiveness and public protection. But the upshot is designed to be balanced with a risk-based regime that gives organisations more clarity and raises the bar on accountability, evidence and control.

At its core, the Act is designed to protect people from the most serious potential harms of AI while enabling organisations to harness its potential responsibly. It bans a small number of unacceptable practices, imposes detailed obligations on high-risk systems and introduces transparency duties for certain uses, including chatbots and AI-generated content. In practice, the greater the potential impact of an AI system, the stronger the expected governance, oversight and evidence.

So, if AI governance has been sitting in the “important but not urgent” pile, that needs to change. Organisations covered by the regulation need to understand where AI is being used, the risks involved and the controls required.  They also need an understanding of where they are considered a provider rather than just a deployer of AI.

What UK organisations need to know about EU AI Act compliance 

EU AI Act at a glance

• Fines up to

  7% of global turnover or €35 million​

• Extraterritorial

  Extraterritorial and obligations across the value chain​

EU AI Act timeline

Risk categories

• The EU Artificial Intelligence Act officially entered into force on 1 August 2024 and is a ris-based regulation with a phased implementation timeline.
• The EU AI Act may apply to you even if you are not located in the EU. Like GDPR the EU AI Act has extraterritorial effect. Non-EU businesses may fall within scope if they place AI enabled products or services on the EU market or if the output of their AI systems is used in the EU.  UK based organisations therefore need to assess the Act across their products, services and operating arrangements.
• The Act also applies across the AI value chain. Providers, defined by the Act as organisations which develop or place AI systems on the market, have the most onerous obligations.  For high risk systems these obligations include having a risk management system, quality management system, documentation, data governance, security and robustness, transparency, human oversight over the systems they build. 
• The exposure is material and nearly double that of GDPR non-compliance. Penalties may reach €35 million or 7% of global annual turnover, depending on the infringement. For large organisations, that level of financial and regulatory risk puts the Act among the EU’s most significant digital regulations.
• The compliance timetable is phased, but the preparation window for high-risk systems is short. Some obligations, including the rules on prohibited AI practices and certain transparency requirements, are already in effect. However, many of the most significant obligations will apply later, including the main high-risk AI system obligations from December 2027 and requirements for certain embedded high-risk AI systems from December 2028.

How UK organisations can prepare for the EU AI Act

Organisations should use this period to identify in-scope systems, close governance gaps and build the evidence they will need before the deadlines arrive.

• Build and maintain a live AI inventory. You cannot govern what you cannot see. Start by identifying AI systems, models, agents and embedded AI capabilities across the organisation, including pilots and third-party tools. Capture the basics: purpose, owner, lifecycle stage, data used, supplier dependencies, users, geography and regulatory impact. The inventory should not be a one-off spreadsheet; it should become the front door for AI governance, linked to procurement, change, privacy, cyber security and operational risk processes.
• Determine your role and the requirements that apply. For each system, establish whether the organisation is acting as a provider, deployer, importer, distributor or product manufacturer, as this determines its obligations under the EU AI Act.
• Classify AI risk so governance is right-sized. Not all AI needs the same level of control. Assess each use case against clear criteria such as intended purpose, autonomy, impact on individuals, use of personal or sensitive data, reliance on third parties, business criticality and which EU AI Act risk category applies. While the most rigorous requirements apply to providers of high-risk AI systems, other uses of AI, such as chatbots, deepfakes and certain AI-generated content, are also subject to transparency obligations.  These include disclosure requirements and content labelling,
• Apply proportionate controls across the AI lifecycle. Once systems are visible and risk-classified, organisations should define controls that are appropriate to the level of risk. For high-risk AI, key considerations include risk management, human oversight, data governance, technical documentation, logging and record-keeping, monitoring, incident management and cybersecurity. Supporting practices such as supplier due diligence and change control can help organisations maintain compliance as systems evolve. The aim is not to slow innovation, but to establish a defensible control baseline that scales with risk and provides evidence of compliance when challenged by regulators, boards, customers or insurers.

Connect AI governance to the governance and controls you already have

For providers and deployers of high-risk AI systems, compliance should not mean creating an entirely separate governance framework. In many cases, organisations can build on the controls they already have in place by extending existing cybersecurity, data governance, privacy, risk management, supplier oversight, incident management and change management processes to address AI-specific risks and regulatory obligations. For example, existing data governance processes can be expanded to cover the quality, provenance and suitability of training and operational data, while existing privacy and security controls can be adapted to address issues such as AI misuse, model manipulation and unauthorised access.

This approach is often more practical, efficient and sustainable than developing AI governance in isolation. It helps organisations align AI oversight with wider technology and regulatory requirements, reduces duplication and provides clearer accountability for managing risk. It also makes it easier to demonstrate compliance by embedding AI controls within established governance and assurance processes.

That said, AI does introduce some new considerations. Organisations may need to introduce new controls in areas such as human oversight, transparency, ongoing monitoring, record keeping and AI literacy. The goal is not to create governance for governance's sake, but to establish a proportionate control framework that reflects the risks of the technology, supports innovation and provides evidence that AI is being used responsibly

How we can help you prepare for the EU AI Act

We help organisations build practical, proportionate AI governance that supports innovation while managing regulatory, operational and reputational risk. We have a multi-disciplinary approach that combines cyber security, AI ethics, data governance, business and technology risk specialists to design and embed the foundations needed for the EU AI Act.

We can support you by:

• Assessing your organisation’s EU AI Act readiness through reviews of existing governance, controls and processes, identifying gaps and prioritising actions.
• Creating visibility and ownership through AI inventories, clear accountabilities and AI governance processes.
• Designing risk classification and control frameworks through practical risk tiering approaches and proportionate control baselines across the AI lifecycle, covering development, procurement, deployment, monitoring, incident management, human oversight and third-party AI risk.
• Aligning AI governance with existing frameworks by aligning AI governance with privacy, cyber security, operational resilience, data governance, supplier management, change and internal control processes so organisations avoid duplication and create clearer evidence of accountability.
• Providing independent assurance and board-level insight through readiness reviews, maturity assessments and practical recommendations.

Our approach is deliberately pragmatic. We focus on helping you build right-sized governance to scale AI safely and confidently without creating unnecessary friction for lower risk AI.

Whether you are assessing AI use cases for the first time or strengthening existing controls, our AI specialists can help you understand your obligations and prepare for EU AI Act compliance with confidence.

Contact us today