Service · EU AI Act
EU AI Act compliance for UK organisations
Find out which of your AI systems the Act reaches, what it asks of each, and have the evidence ready before the dates that matter to you.
Last reviewed: .
Comonad helps UK organisations work out whether and how the EU AI Act applies to them and puts in place the controls and evidence it requires; it does not give legal advice.
- Risk and compliance leads
- General counsel and legal teams
- CTOs and product leads
Does the Act reach you?
It does if your AI reaches the EU. The Act applies to providers that place AI systems or general-purpose AI models on the EU market or put them into service there, wherever they are established, and to providers and deployers outside the EU whose AI output is used in the EU (Article 2(1) of Regulation (EU) 2024/1689 (opens in new tab)). A UK company selling an AI feature to EU customers, supplying an AI tool to an EU subsidiary, or sending AI-generated scores to an EU client can all be in scope. Our guide Does the EU AI Act apply to UK companies? sets out the tests.
Provider, deployer or both?
Your duties depend on your role for each system. A provider develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name (Article 3(3)). A deployer uses an AI system under its own authority (Article 3(4)). Most high-risk duties fall on providers; deployers carry their own, including human oversight and keeping logs. One organisation is often both.
The dates you plan against
The Digital Omnibus on AI (Regulation (EU) 2026/1744 (opens in new tab)) has been in force since 27 July 2026. It set the high-risk dates below. Article 4 now asks providers and deployers to take measures to support the development of AI literacy, and does not require them to guarantee any particular level. Several measures that had applied to SMEs now also apply to small mid-cap companies. The high-risk obligations do not start on 2 August 2026. Every date, with what to do before each: EU AI Act timeline for UK firms.
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices; Chapter I, including AI literacy (Article 4) |
| 2 August 2025 | General-purpose AI model obligations; governance and penalties |
| 27 July 2026 | Digital Omnibus (Regulation (EU) 2026/1744) in force |
| 2 August 2026 | General application, including most Article 50 transparency duties |
| 2 December 2026 | Article 50(2) marking for generative systems placed on the market before 2 August 2026; the new prohibition on AI that generates non-consensual intimate imagery or child sexual abuse material |
| 2 December 2027 | High-risk obligations for Annex III systems |
| 2 August 2028 | High-risk obligations for AI in Annex I products |
What you keep
AI inventory
Every AI system you build, buy or use, including AI inside third-party products.
Scope and role record
For each system: in scope or not, provider or deployer, and the reasoning.
Risk classification
Each system checked against the prohibitions, Annex I, Annex III and Article 6(3).
Current duties plan
AI literacy measures, Article 50 transparency and any general-purpose AI model duties.
High-risk readiness plan
Risk management, logging, human oversight, evaluation and documentation, dated.
Control set and evidence
Controls with an owner, a test and a record, mapped to the Articles they serve.
How an engagement runs
Diagnose
Inventory, market and output mapping, and roles.
Design
Classification, the current duties plan and the control set.
Embed
Review the running systems against the control set, with your teams.
Hand over
Your risk and engineering teams own the inventory, controls and review cycle.
What we do not do
- We do not give legal advice. Legal sign-off stays with your counsel.
- We do not act as your EU authorised representative under Article 22, and we do not carry out conformity assessments.
Who it is for
- Risk and compliance leads who need an inventory, a classification and evidence.
- General counsel and legal teams who decide how the law applies, and want that turned into controls.
- CTOs and product leads whose systems are sold into the EU or produce output used there.
Our founder spent almost seven years as co-founder and CTO of Cloud KB, building software for the UK energy market. Read his profile.
Alex Vakhitov
Founder, Comonad · AI and software architect, London
Alex Vakhitov founded Comonad in 2024. An AI and software architect, he was co-founder and CTO of Cloud KB, UK energy-market software, from August 2015 to March 2022.
Questions about EU AI Act compliance
Do we need an EU AI Act consultant or a lawyer?
Usually both, for different jobs. Your counsel decides how the law applies to you. We do the work that turns that into an inventory, classifications, controls and records your engineers can run and your risk team can evidence.
We only use AI internally in the UK. Are we in scope?
Often not, where the system is not placed on the EU market or put into service there and its output is not used in the EU. An EU subsidiary using the system, or output reaching EU customers or staff, can bring it in. Check each system; do not assume a blanket exemption.
What applies to us right now?
For most organisations, the duties already in force are the prohibitions, AI literacy measures and, where they apply, the Article 50 transparency duties. Providers of general-purpose AI models also have Chapter V duties. Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to mark their output.
Does ISO/IEC 42001 certification make us compliant?
No, not on its own. ISO/IEC 42001 is a voluntary management-system standard and is not a harmonised standard under Article 40 of the Act, so certification to it does not by itself show that a system meets the Act's obligations. One control set can serve both; see our ISO/IEC 42001 readiness service.
What are the penalties?
Up to €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices; up to €15 million or 3% for most other breaches, including the transparency duties; up to €7.5 million or 1% for misleading information to authorities (Article 99 of Regulation (EU) 2024/1689 (opens in new tab)). For SMEs, including start-ups, each of those caps is whichever amount is lower. For small mid-cap enterprises, the lower amount applies to the two lower tiers, Article 99(4) and (5), as amended by Regulation (EU) 2026/1744 (opens in new tab).
Sources
Related
Discuss the EU AI Act
Tell us which systems might reach the EU, and which dates you are planning against.
Discuss the EU AI Act