Here is something most UK small businesses have not heard about: the EU AI Act obligations kick in on 2 August 2026. And no, Brexit does not save you.
If you sell products or services to customers in the EU — even one customer — parts of this law apply to you. And the fines for non-compliance are massive: up to €35 million or 7% of global turnover, whichever is higher.
Do not panic. Most SMBs will only need to make small changes. But you do need to know what applies.
Wait, Does the EU AI Act Apply to UK Businesses?
Yes, in some situations. The EU AI Act has extraterritorial reach — similar to GDPR. It applies to any business that:
- •Places AI systems on the EU market (sells products or services using AI to EU customers)
- •Has EU users of your AI system (even if you are based in the UK)
- •Uses outputs of an AI system inside the EU (rare for small businesses)
Translation: If you have any EU customers or your website/chatbot serves EU visitors, this affects you.
The 3 Categories of AI Risk
The law splits AI systems into risk tiers. Your obligations depend on which tier your tools fall into.
Tier 1: Prohibited AI Systems (BANNED outright)
These are now illegal to use in the EU:
- •Social scoring by governments or businesses (ranking citizens based on behaviour)
- •Emotion recognition in workplaces or schools
- •Predictive policing based purely on profiling
- •Real-time biometric surveillance in public spaces (with narrow exceptions)
- •Untargeted scraping of facial images from the internet or CCTV
Impact on most UK SMBs: Zero. You are not doing any of this. Move on.
Tier 2: High-Risk AI Systems (Heavy obligations)
AI used in these areas is "high-risk":
- •Recruitment and HR (CV screening tools)
- •Credit scoring and lending decisions
- •Education and vocational training
- •Access to essential services (insurance, healthcare)
- •Critical infrastructure
- •Law enforcement, migration, justice
Impact on UK SMBs: If you use AI for hiring (CV screening tools like HireVue, HiredScore, etc.), this applies. You need:
- •Risk assessments documented
- •Human oversight in the loop
- •Detailed logging of AI decisions
- •Transparency to affected individuals
If you do NOT use AI for hiring, credit decisions, or the other categories above, this tier does not apply to you.
Tier 3: Limited-Risk AI (Transparency required)
This is where most small businesses land. If you use:
- •AI chatbots on your website
- •AI-generated content in marketing
- •Deepfakes or synthetic media (rare for SMBs)
...you need to disclose that the content or interaction is AI-generated. Simple.
What Most UK SMBs Actually Need to Do
For 95% of UK small businesses, compliance boils down to three things:
1. Disclose Your Chatbot Is AI
If you have a Tidio, Intercom, Freshdesk, or any other AI chatbot on your website, users must be told they are talking to an AI, not a human. Most modern chatbots already do this automatically — check the greeting.
Action: Log into your chatbot admin panel and verify the greeting message includes something like "Hi, I am an AI assistant" or "You are chatting with our automated assistant."
2. Label AI-Generated Content
If you use AI to generate marketing content, product descriptions, or social media posts — and it could realistically be mistaken for human-created content — the EU AI Act suggests labelling it.
Reality check: This is a grey area for text content and mostly targets deepfakes and audio/video. For SMB blog posts and product descriptions, this is low-risk. But adding "AI-assisted content" to your blog footer is easy and future-proofs you.
3. Do Not Use Prohibited Systems
Easy — most SMBs are not doing any of this anyway. Just do not:
- •Use AI to secretly score your customers or employees
- •Deploy emotion-recognition cameras in your shop or office
- •Scrape faces from social media to build databases
The AI Literacy Requirement (Also August 2026)
Here is one that catches most businesses off guard. From 2 August 2026, businesses using AI systems must ensure their staff have "adequate AI literacy" — meaning they understand what AI does, its limitations, and its risks.
What this actually means:
- •Your team should know the basics of how the AI tools they use work
- •They should understand AI can make mistakes and needs oversight
- •They should know when to escalate to a human
Action: Spend 30 minutes at your next team meeting explaining the AI tools you use, what they can do, and what they cannot. Write it down. That is your AI literacy training. Done.
The Fines (Yes, They Are Real)
The EU AI Act allows fines up to:
- •€35 million or 7% of global turnover for prohibited AI use
- •€15 million or 3% of turnover for high-risk violations
- •€7.5 million or 1.5% of turnover for transparency failures (chatbot disclosure, etc.)
Are they going to fine a UK cafe €35 million? Obviously not. But enforcement is real, and even smaller fines can be devastating for an SMB. Reputational damage matters too.
A Simple Compliance Checklist
For most UK small businesses selling to EU customers, this is what you need to check:
- •[ ] Chatbot discloses it is AI — Check your chatbot greeting
- •[ ] No prohibited AI use — You are almost certainly fine
- •[ ] AI literacy for staff — 30-minute team briefing this month
- •[ ] AI in hiring? If yes, document your process, add human review, keep records
- •[ ] Privacy policy updated — Add a line about AI tools you use (Tidio, ChatGPT, etc.)
- •[ ] Bookmark 2 February 2027 — More obligations kick in then for general-purpose AI models
That is it. For most SMBs, an afternoon of work.
When to Get Professional Advice
Skip DIY compliance and consult a lawyer if you:
- •Use AI for hiring or credit decisions
- •Build your own AI systems (not just use ChatGPT/Canva)
- •Have EU customers who are especially sensitive (regulated industries)
- •Handle large amounts of EU personal data
- •Are unsure whether your AI use falls into high-risk categories
The Bottom Line
The EU AI Act is one of the biggest regulatory shifts in tech history. But for most UK small businesses, compliance is genuinely simple: disclose your chatbot is AI, do not do anything obviously creepy, and train your team on the basics.
The businesses that will get caught out are the ones who assume it does not apply to them because they are in the UK. It does apply — if you have EU customers. Take an afternoon, run through the checklist, and get compliant now while it is easy. Do not wait for the first enforcement actions to make headlines.
Next Steps
- •Bookmark this article and share it with your team
- •Update your chatbot greeting today (5 minutes)
- •Schedule a 30-minute AI literacy briefing this month
- •Explore our AI tools directory for compliant, transparent tools trusted by UK SMBs
Found this helpful?
Share it with other business owners
Ready to find the right AI tools?
Explore our curated directory of the best AI solutions for UK SMBs, complete with honest reviews and comparisons.