The EU Has an AI Act, the UK Has Regulators and No Bill

Next Friday I start reading the AI Act one article at a time, and a single article is hard to follow without knowing where it sits, so this week is an overview of both regimes. The EU has one regulation of 113 articles that applies in every member state. The UK regulates AI through the laws and regulators it already had. Software sold in both has to satisfy both.

The EU's regulation is Regulation (EU) 2024/1689, amended in July by the Digital Omnibus, Regulation (EU) 2026/1744. What it asks of you depends on who you are, what your system does, and when.

Who you are

Almost every duty in the Act is addressed to a provider or a deployer, so the two definitions in Article 3 decide most of what follows. Here they are, verbatim, in the format every article gets from next week. Select any part of the text and its plain reading and notes open underneath.

{{< act-excerpt act="article-3" >}}

You can be a provider without training a model. If your product calls a model API and shows the result to people under your name, you developed an AI system and put it on the market. The company that trained the model is the provider of a general-purpose AI model, which is a separate role with separate duties.

There are four more roles. An authorised representative is a person or company in the EU with a written mandate to act for a provider outside it. An importer brings a non-EU company's system onto the EU market. A distributor is anyone else in the supply chain who makes a system available. A product manufacturer puts an AI system on the market inside its own product. The Act calls all six "operators" (Article 3(8)).

What the system does

The Act sorts AI systems by what they are used for, and the duties rise with the risk.

• Prohibited practices (Article 5). Banned outright since 2 February 2025: manipulative techniques that cause harm, social scoring, untargeted scraping of faces, emotion recognition at work and in schools, and several more. The Omnibus adds two more: systems that generate non-consensual intimate imagery, and systems that generate child sexual abuse material.
• High-risk systems (Article 6). There are two ways a system becomes high-risk. The first is being a safety component of a product already regulated under the laws in Annex I, such as medical devices, machinery and toys. The second is a use listed in Annex III, which has eight areas, among them biometrics, employment, education, law enforcement and access to essential services, which is where credit scoring sits. Most of the Act's length is about these systems: risk management, data governance, logging, human oversight, technical documentation and a conformity assessment before the system goes on the market.
• Transparency duties (Article 50). Chatbots have to say they are AI, generated content has to carry a machine-readable mark, and deep fakes have to be labelled. This applies whatever the risk tier.
• General-purpose AI models (Articles 51 to 55). Duties on the companies that train the models: technical documentation, a summary of the training content, a copyright policy, and more for models classified as carrying systemic risk.
• Everything else. No obligations beyond AI literacy (Article 4), with voluntary codes of conduct encouraged under Article 95.

The fines follow the same order (Article 99). A prohibited practice costs up to €35 million or 7% of worldwide annual turnover, whichever is higher. Most other breaches, Article 50 included, cost up to €15 million or 3%. Giving a regulator incorrect or misleading information costs up to €7.5 million or 1%. For SMEs, and since the Omnibus for small mid-caps too, it is whichever figure is lower.

When it applies

The Act arrives in stages, and the Omnibus moved the biggest one. The high-risk obligations for Annex III systems were due on 2 August 2026 and now apply from 2 December 2027.

The Commission fills in the detail with guidelines and codes of practice. For Article 50 there are guidelines published on 20 July 2026 and a Code of Practice finalised on 10 June. For general-purpose models there is a code of practice from July 2025. The guidelines on what counts as high-risk under Article 6 were published as a draft on 19 May 2026 and were still a draft when I checked on 12 November.

Who enforces it

Each member state names market surveillance authorities, and they enforce the Act for most systems. The AI Office, inside the Commission, has exclusive power over general-purpose AI models. The Omnibus gave it more: it is now also the only enforcer for AI systems built on a general-purpose model by the same provider, with exceptions that include products under Annex I and critical infrastructure, and for AI systems that are part of a very large online platform or search engine (Article 75(1)). A company that builds on its own model and sells across the EU is regulated by the AI Office rather than a national authority.

The UK has no AI act

The UK's approach comes from a white paper of March 2023, A pro-innovation approach to AI regulation. It gives existing regulators five principles to apply in their own sectors: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress. The principles are not law. The ICO applies them to personal data, the FCA to financial services, the CMA to competition, Ofcom to communications and the MHRA to medical devices, each using the powers it already had.

A bill has been discussed for two years and has not appeared. The King's Speech of 13 May 2026 contained no AI bill. Parliament's Joint Committee on Human Rights recommended one in September, and this month the AI minister said the government would look at regulation for the most advanced models if it turned out to be needed. I could find no bill, consultation or timetable.

Three things in the UK are more definite: the new rules on automated decisions, the AI Security Institute and copyright.

Automated decisions. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D, in force since 5 February 2026. They cover decisions "based solely on automated processing", meaning with "no meaningful human involvement", that have a legal or similarly significant effect on the person. Article 22B restricts such decisions when they use special category data. Article 22C sets the safeguards for the rest: tell the person, let them make representations, let them obtain human intervention, and let them contest the decision. The ICO's updated guidance went out for consultation on 31 March 2026 and has not been published in final form. For an engineer, 22C is the closest thing the UK has to an AI Act article.

The AI Security Institute. It tests frontier models before and after release and publishes research. It was renamed from the AI Safety Institute in February 2025 and is now part of the Cabinet Office. It is not set up in law and has no powers over anyone.

Copyright. UK law has no exception for commercial text and data mining, so training on copyrighted work for commercial use needs a licence. The Data (Use and Access) Act required the government to report on copyright and AI, and the report and impact assessment came out on 18 March 2026. They changed nothing in the law, and the government no longer has a preferred option.

Where the two meet

The AI Act applies to UK companies with EU customers. Article 2(1)(a) covers providers who place a system on the EU market "irrespective of whether those providers are established or located within the Union or in a third country", and Article 2(1)(c) covers providers and deployers in a third country "where the output produced by the AI system is used in the Union". A product built in the UK with customers in Germany is covered.

The part of the Act most of those products meet first is Article 50, which has applied since August. This is its first paragraph, annotated the same way as the definitions above. The whole article follows next Friday.

{{< act-excerpt act="article-50" paras="1" >}}

Earlier posts

I wrote about these two regimes in February, from the architecture side. Architecting for Two Europes with Compliance-as-Code builds one platform for both, with the jurisdiction split in middleware, and its logging and oversight patterns are the ones to build towards for the high-risk date. What It Actually Takes to Fine-Tune an LLM in Europe covers copyright and text and data mining on both sides, and when fine-tuning makes you the provider of a new general-purpose model. The March copyright report left UK law as it was, so that post's advice to license for the UK and treat that as the standard for both markets still holds. A Practical Guide to the European Sovereign Inference Stack routes requests between the EU GDPR and the UK GDPR, and Securing the Open Source AI Supply Chain maps the technical documentation in Article 11 and Annex IV to MLOps tooling.

Next Friday

Next Friday, 20 November, is Article 50 in full, with every clause selectable and the Commission's guidelines and the Code of Practice cited by paragraph. Article 6, which decides whether a system is high-risk, follows on 27 November.

This is an engineer's reading and no substitute for legal advice.