Rules & compliance
The EU AI Act and AI agents: what UK and EU businesses need to do now
The AI Act's rules for ordinary business use of AI are already in force. The heavier rules for high-risk systems were pushed back to December 2027. If your company uses AI agents for enquiries, records, reports or finance, a few duties apply today, and they apply to some UK companies too.
Facts checked on 1 November 2026. This article is general information, not legal advice. The sources at the end link to the official texts.
On this page
- Rules that apply now: AI literacy for staff, telling people when they're dealing with AI, labelling some AI-generated content, and a list of banned practices.
- Rules that moved: high-risk duties for areas like recruitment, staff management and credit scoring now start on 2 December 2027.
- UK companies are covered when they sell AI systems into the EU, or when the output of their AI is used in the EU.
- In the UK there is no AI Act. UK GDPR rules on automated decisions changed in February 2026.
The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. In July 2026 the EU adopted the Digital Omnibus on AI (Regulation (EU) 2026/1744), which moved the high-risk deadlines and made a few other changes.
| Date | What applies |
|---|---|
| 2 February 2025 | Banned practices (Article 5) and AI literacy (Article 4) |
| 2 August 2025 | Rules for general-purpose AI models, governance and penalties |
| 2 August 2026 | Most of the Act, including transparency duties (Article 50). National authorities can now enforce the bans, AI literacy and transparency |
| 2 December 2026 | Two new bans (non-consensual intimate deepfakes and child sexual abuse material). Generative AI systems already on the market must mark their output |
| 2 December 2027 | High-risk systems listed in Annex III, such as recruitment, managing staff and credit scoring (was 2 August 2026) |
| 2 August 2028 | High-risk AI built into regulated products under Annex I (was 2 August 2027) |
These dates are fixed in the amended Article 113. They no longer depend on when technical standards are ready.
Often, yes. Article 2 covers:
- companies that place AI systems on the EU market, wherever they are established;
- companies that use AI systems and are established or located in the EU;
- companies outside the EU, including in the UK, when the output of their AI system is used in the EU.
So a UK company selling an AI tool to EU customers is covered as a provider. Its EU customers and EU subsidiaries are covered as deployers. A UK company with no EU presence can still be covered if, for example, its customer-service agent answers people in the EU.
Most agents that handle enquiries, update records or prepare reports aren't high-risk. For them, four things matter now.
1. AI literacy (Article 4). Companies that build or use AI systems must take measures to support the AI literacy of their staff and of others who use the systems on their behalf. The Omnibus softened the wording: you don't have to guarantee a particular level, and you don't need a certificate. The Commission says an internal record of the training is enough.
2. Telling people they're talking to AI (Article 50(1)). If an agent talks directly with people, for example answering customer messages, it must be clear to them that it's AI, unless that's obvious to a reasonably observant person. The Commission reads that exception narrowly. Tell people at the latest at their first interaction.
3. Labelling AI-generated content (Article 50(2) and 50(4)). Providers of generative AI must mark synthetic text, images, audio and video in a machine-readable way. Companies that publish deepfakes must say so visibly. AI-generated text published to inform the public on matters of public interest must be labelled, unless a person has reviewed it and someone takes editorial responsibility. Internal reports and drafts a person checks don't need a label.
4. Practices you can't use (Article 5). Among them: manipulative or deceptive techniques that cause significant harm, exploiting people's vulnerabilities, social scoring, and emotion recognition in the workplace, except for medical or safety reasons. An agent that reads employees' mood from their messages or voice is banned.
Breaching the bans can cost up to €35 million or 7% of worldwide turnover. Breaching other duties, including transparency, up to €15 million or 3%. For SMEs, the lower of the two amounts applies.
An agent becomes high-risk when it's used in an area listed in Annex III. The ones that matter most for companies:
- recruitment: targeting job adverts, screening applications, evaluating candidates;
- managing staff: decisions on terms, promotion or termination, allocating tasks based on behaviour or personal traits, monitoring and evaluating performance;
- credit scoring of individuals (fraud detection is excluded);
- risk assessment and pricing in life and health insurance.
From 2 December 2027, a company using such a system must, among other things: use it as the instructions say; give human oversight to trained people with the authority to act; check that its input data is relevant; monitor the system and report serious incidents; keep logs for at least six months; and tell workers' representatives and affected staff before using it at work. Some deployers, including those scoring credit or pricing insurance, also need a fundamental rights impact assessment.
The deadline moved, but these systems take time to set up properly. If you plan an agent in HR or credit, design it with these duties from the start.
The UK has no equivalent of the AI Act, and the King's Speech in May 2026 did not include an AI bill. What applies to AI agents in the UK is mainly data protection law:
- Since 5 February 2026, UK GDPR has new rules on automated decision-making (Articles 22A to 22D, added by the Data (Use and Access) Act 2025). Significant decisions made solely by automated means are allowed, with safeguards.
- The regulator's draft guidance on automated decision-making and profiling went to consultation in spring 2026, and it opened a call for evidence on agentic AI in October 2026.
A UK company that also serves EU customers needs to meet both sets of rules.
- List the AI systems and agents you use or sell, and where their output is used.
- Check each one against the banned practices and the Annex III areas.
- Make sure customer-facing agents say they're AI at the first message.
- Record the AI training your staff have had.
- Decide which published content needs a label, and who reviews AI-written text.
- For any agent planned in HR, credit or insurance, plan human oversight, logs and staff information now.
We know the rules before we write the code. Every agent we build has its permissions agreed in writing, a person approving what matters, and every action logged. That helps with the transparency and oversight duties above and makes a later high-risk review much simpler. If you're planning an agent and want to check where it stands, ask for a free assessment.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 (AI Act)
- European Commission, AI Act Service Desk: implementation timeline
- European Commission: regulatory framework on AI
- European Commission: transparency obligations under Article 50, FAQ
- European Commission: AI literacy, questions and answers
- The Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026, SI 2026/82
- UK data protection regulator: call for evidence on agentic AI (October 2026)