For the United Kingdom, after Brexit, it is tempting to imagine that regulation will no longer come from Brussels. Yet one of the world’s most important pieces of digital legislation – the EU’s Artificial Intelligence Act – is now coming into force and its effects will affect UK businesses, regulators and citizens.
AI is already present in everyday life: in how loans are set, how job applications are reviewed, how fraud is detected, how medical services are triaged, and how online content is distributed.
THE European AI lawwhich comes into force in stages, aims to make these invisible processes safer, more responsible and closer to European values. This reflects a deliberate choice to manage the social and economic consequences of automated decision-making.
The law aims to harness the innovative power of AI while protecting EU citizens from its harms. The UK has chosen a lighter regulatory path, but it will not be immune to the consequences of this law. Through the AI Office and national law enforcement authorities, the EU will be able to sanction British companies that operate in the bloc, regardless of where they are headquartered.
The law allows authorities to impose fines or require systems to be changed. This shows that the EU is now treating AI governance as a matter of compliance rather than a matter of voluntary ethics. My research highlights the power of implementing provisions, in particular their influence on how AI systems will be designed, deployed or even withdrawn from the market.
Many of the systems most relevant to daily life, such as those used in employment, health care or credit scoring, are now considered “high risk” under the law. AI applications in these scenarios must meet demanding standards for data, transparency, documentation, human monitoring and incident reporting. Certain practices, such as systems that use biometric data to exploit or distort people’s behavior by targeting vulnerabilities such as age, disability or emotional state, are simply prohibited.
The regime also extends to general-purpose AI – the models that underpin everything from chatbots to content generators. These are not automatically classified as high risk, but are subject to transparency and governance obligations as well as stricter safeguards in situations where AI could have systemic or large-scale effects.
This approach effectively exports expectations from Europe to the world. The so-called “Brussels effect” works according to simple logic. Large companies prefer to adhere to a single global standard rather than maintaining separate regional versions of their systems. Companies wishing to access 450 million European consumers will therefore only have to adapt. Over time, this becomes the global standard.
Learn more:
UK government’s AI plan provides insight into how it plans to regulate the technology
The United Kingdom has opted for a much less prescriptive model. Although his comprehensive legislation on AI appears to have doubts, regulators – including the Information Commissioner’s Office, the Financial Conduct Authority and the Competition and Markets Authority – are examining the broad principles of security, transparency and accountability within their own remit.
This presents the merit of agility: regulators can adjust their directions as needed without waiting for legislation. But it also places a greater burden on businesses, which must anticipate regulatory expectations from multiple authorities. This is a deliberate choice to rely on regulatory experimentation and sector-specific expertise rather than a single, centralized regulation.
Agility has tradeoffs. For small and medium-sized businesses trying to understand their obligations, EU clarity may seem more manageable.
There is also a risk of regulatory misalignment. If the European model becomes the global benchmark, British companies could find themselves working to both national and European standards demanded by their customers. Maintaining this infrastructure will be expensive and is rarely sustainable.
Why UK businesses will be affected
Perhaps the most important – but least widely understood – aspect of EU AI law is that extraterritorial reach I mentioned earlier. The law applies not only to EU-based companies, but also to any supplier whose systems are either placed on the EU market or whose products are used within the bloc.
This encompasses a wide range of activities in the UK. A London fintech offering AI-based fraud detection to a Dutch bank, a UK insurer using AI tools that inform policyholder decisions in Spain, or a UK manufacturer exporting devices to France – all of these fall squarely within the scope of EU regulations.
My research also covers the obligations of banks and insurers – they may naturally need robust documentation, human monitoring procedures, incident reporting mechanisms and quality management systems.
Even developers of general-purpose AI models could find themselves under fire, particularly when regulators identify systemic risks or transparency gaps that warrant further review or remedial action.
For many UK businesses, the most pragmatic choice will be to design their systems to European standards from the outset rather than producing separate versions for different markets.
Andrei_Popov/Shutterstock
Although this debate often seems abstract, its effects are anything but. The tools that determine your access to credit, employment, healthcare or essential public services increasingly rely on AI. The standards imposed by the EU – particularly requirements to minimize discrimination, ensure transparency and maintain human oversight – are likely to spill over into UK practices simply because large suppliers will adapt globally to meet European expectations.
Europe has made its choice: a comprehensive, legally binding regime designed to shape AI according to the principles of safety, fairness and accountability. The United Kingdom has chosen a more permissive path, focused on innovation. Geography, economics and shared digital infrastructure ensure that Europe’s regulatory influence will reach the UK, whether through markets, supply chains or public expectations.
The AI Act is a model for the type of digital society Europe wants – and, by extension, a framework within which UK businesses will increasingly need to adapt. In an age where algorithms determine opportunity, risk and access, the rules that govern them matter to us all.