Part 4 of the Corporate Assist Data and AI Governance Series
On 2 August 2026, the EU Artificial Intelligence Act entered its principal application and enforcement phase.
The European Commission’s AI Office and national authorities began enforcing substantial parts of the Act. The transparency obligations under Article 50 also became applicable to specified AI interactions and AI-generated or manipulated content.
The EU AI Act can apply to UK organisations in specified circumstances, even though the United Kingdom is no longer part of the European Union.
The practical question is whether an organisation understands where its AI systems and outputs are provided or used, what role it performs and which requirements apply.
When the EU AI Act can affect a UK organisation
A UK organisation may need to consider the EU AI Act where it:
Provides an AI system or general-purpose AI model within the EU
Uses AI through an EU operation
Produces outputs that are used within the EU
Provides AI-enabled services to EU customers
Uses AI systems in a way that affects people located within the EU
The Act may also apply where the organisation uses suppliers subject to it or supports an EU-facing customer through contractual arrangements.
Even where the Act does not apply directly, customers and commercial partners may ask for information about the organisation’s AI systems, controls and assurance arrangements.
This can affect procurement, supplier questionnaires, contract negotiations and customer assurance, as well as direct regulatory compliance.
The organisation needs to assess its actual activities, customers, operations and system use rather than assume that the Act is irrelevant because it is based in the UK.
Provider and deployer responsibilities
The organisation’s role is an important starting point.
A provider generally develops an AI system or general-purpose AI model, has one developed and places it on the market or puts it into service under its own name or trademark.
A deployer uses an AI system under its authority as part of a professional activity.
Many organisations using commercially available AI tools are likely to be deployers. However, the position can change if an organisation substantially modifies a system, changes its intended purpose or presents it under its own name.
An organisation may also perform different roles in relation to different systems. It could be a deployer of one system and a provider of another.
The assessment should be based on what the organisation actually does rather than solely on the description used in a contract.
Legal or Compliance specialists should determine the formal position and obtain external advice where necessary. The wider project still needs an accurate record of the conclusion, supporting evidence, responsible owner and any resulting actions.
Article 50 transparency requirements
Article 50 applies from 2 August 2026 and creates transparency requirements for specified AI systems and content.
Depending on the system and the organisation’s role, these requirements can cover:
Direct interaction with certain AI systems
The detection and marking of AI-generated content
Emotion recognition systems
Biometric categorisation systems
Deepfakes
Certain AI-generated or manipulated text published to inform the public on matters of public interest
The practical questions include:
Which systems, interactions or content fall within scope?
Does the organisation act as a provider or deployer?
Who is responsible for providing information, markings or labels?
When and how should the information be provided?
Is the information sufficiently clear and accessible?
Is human review or editorial control involved?
Does an exception apply?
What evidence demonstrates compliance?
The European Commission has published guidance and a Code of Practice to support organisations applying the Article 50 transparency requirements.
AI literacy
The AI literacy obligations have applied since 2 February 2025. Supervision and enforcement began from August 2026.
Providers and deployers need to take measures to support the development of AI literacy among employees and other people involved in operating or using AI systems on their behalf.
This does not mean giving every employee the same training.
The appropriate approach depends on:
The individual’s role
Existing technical knowledge and experience
The AI system being used
The activity the system supports
The way its output influences work or decisions
The people or groups who may be affected
The relevant legal, regulatory and organisational requirements
A general awareness session may be appropriate for some employees. Other people may require system-specific guidance, instruction on human oversight, information about prohibited uses or training on the risks associated with particular activities.
The organisation should be able to explain how it determined what was proportionate, what guidance or learning was provided and how this was recorded.
AI literacy should support informed and responsible use. It should not become a training-completion exercise disconnected from the systems employees use in practice.
The EU AI Act timetable
The EU AI Act has been implemented in stages.
Prohibited AI practices and AI literacy obligations have applied since February 2025. Governance requirements and obligations for general-purpose AI models have applied since August 2025.
The principal provisions of the Act and the Article 50 transparency requirements became applicable on 2 August 2026.
Some requirements relating to high-risk AI systems have later application dates. The timetable also changed following amendments made through the EU’s AI simplification measures.
Organisations therefore need to distinguish between:
Requirements that currently apply
Requirements with confirmed future application dates
Requirements that do not apply to their activities
Questions requiring legal, technical or regulatory assessment
Changes that may affect an earlier implementation plan
An applicability record should show the position relied upon, the evidence supporting it, the person or function responsible for the assessment and the date on which it was last reviewed.
This is particularly important where an assessment was completed before the 2026 amendments or still refers to the original implementation timetable.
The connection with UK data protection
The EU AI Act and UK data protection legislation are separate frameworks, but both can apply to the same system.
Where AI processes personal information or supports automated decisions, organisations also need to consider the Data (Use and Access) Act 2025 and wider UK data protection requirements.
Depending on the system and activity, other requirements may also apply, including sector regulation, equality legislation, employment law, consumer protection, contractual obligations and internal policies.
Compliance with one framework does not establish compliance with another. The AI inventory should enable the relevant specialists to identify all applicable frameworks and record the resulting assessments.
Supplier assurance
Using an external AI supplier does not remove the need for internal oversight.
The organisation needs to understand:
The supplier’s role
Its own role
The agreed purpose of the system
Where the system and its outputs are used
What information is entered into the system
How responsibilities are addressed contractually
How system changes are communicated
What evidence the supplier provides
How incidents or regulatory enquiries are managed
Whether the organisation can obtain the information needed to meet its own obligations
A general statement that a product is “AI Act compliant” may not address the organisation’s actual use, configuration or contractual responsibilities.
Supplier information should be reviewed by the appropriate Legal, Compliance, Data Protection, Information Security, Procurement or technical specialists, depending on the system and its use.
The resulting conclusions, gaps and actions should be recorded and linked to the relevant system within the organisation’s AI inventory.
Supporting EU AI Act implementation
Your organisation may already have the necessary Legal, Compliance, Data Protection, Risk and technical expertise. The challenge is often finding sufficient capacity to identify the relevant systems, coordinate input across different functions, consolidate assessments and ensure that the resulting actions are completed.
Corporate Assist can support a defined EU AI Act implementation project by coordinating contributions, maintaining a clear record of applicability decisions, actions and evidence, organising supplier information and preparing progress reports.
Your Legal, Compliance, Data Protection, Risk and technical specialists retain responsibility for their assessments. However, Corporate Assist can ensure that the wider implementation project is properly coordinated, remains organised and continues to move forward.
Part 5 of this series, AI Governance for Boards: From AI Inventory to Board Assurance, considers how this work can support senior management and Board oversight.
If you need a trusted resource to support a defined governance or compliance project, please get in touch to discuss your requirements.
Share this post: