Why is your AI system potentially subject to EU law in 2026?
This is the question most mid-market UK business leaders haven’t asked yet. And the answer that the EU AI Act applies extraterritorially to any business whose AI touches EU consumers or EU-regulated decisions is one that carries real financial and operational consequences.
We’re not talking about Big Tech. We’re talking about the £150M FMCG brand selling into France through a platform that uses AI pricing. The £300M logistics business whose demand forecasting tool informs replenishment decisions for an EU retailer. The consumer goods manufacturer with an AI quality system on a production line serving European supermarkets.
If that sounds like your business, this guide is for you.
What Is the EU AI Act, and Does It Apply to UK Companies After Brexit?
The EU AI Act is the world’s first comprehensive legal framework governing artificial intelligence. Adopted in 2024 and phased into enforcement from February 2025, it requires businesses to classify their AI systems by risk level and meet corresponding compliance obligations or face fines of up to €35 million.
The Brexit question is the one most UK executives get wrong. The Act does not apply to the UK as domestic law. But it applies extraterritorially: if your AI system is deployed on the EU market or if its outputs are used in the EU, your compliance obligations exist regardless of where your company is registered.
The practical test is not “are we a UK company?” but “does our AI touch EU consumers or EU-regulated decisions?” For most mid-market UK businesses with any EU distribution, supply chain, or customer exposure, the answer is yes.
The Four-Risk Tiers: Where Does Your Business Actually Sit?
The Act classifies AI into four risk tiers, each carrying different obligations:
Unacceptable Risk (Prohibited): Social scoring systems, real-time biometric surveillance, and systems that exploit psychological vulnerabilities. Banned from February 2025.
High Risk: Requires pre-market conformity assessments, full technical documentation, human oversight protocols, and ongoing monitoring. Applies to AI in employment decisions, creditworthiness assessment, product safety systems, and critical infrastructure. This is where most mid-market risk sits.
Limited Risk: Transparency obligations only. Any AI that interacts with users (chatbots, recommendation engines, generative tools) must disclose that users are interacting with AI. This applies to most customer-facing AI deployments.
Minimal Risk: No specific obligations beyond existing law. Non-decision-making analytics and content-filtering tools fall here.
Most mid-market UK businesses sit in the Limited Risk tier for most of their AI, with specific deployments in FMCG, logistics, and HR that cross into High Risk without leadership realising it.
The High-Risk AI Uses Most Common in FMCG and Logistics
Based on our AI assessments across mid-market UK businesses, here are the five most common high-risk AI exposures:\
- AI-assisted hiring and candidate shortlisting. Any algorithm that filters, ranks, or scores job applicants is classified as high-risk under Annex III of the Act. If you are using a recruitment platform with AI screening and hiring for EU-facing roles, you are likely in scope.
- Dynamic pricing engines. AI systems that determine pricing in ways that affect access to services or create discriminatory outcomes for EU consumers carry high-risk obligations.
- Safety-critical logistics AI. Route optimisation, autonomous load planning, and vehicle management systems that operate in physical environments without continuous human oversight sit in the product safety category of high-risk AI.
- Automated quality and rejection systems. AI that makes autonomous accept/reject decisions about food safety, contamination, or product quality in manufacturing for EU distribution is classified as high-risk.
- Credit and financial health scoring. Any AI used to determine payment terms, credit limits, or financial access for EU business customers falls under the creditworthiness category.
What High-Risk AI Compliance Actually Requires
If any of your AI systems sit in the high-risk category, the compliance burden is substantial. The core obligations for providers (those who build or deploy AI on the market) and deployers (those who use third-party AI tools) include:
Risk management systems: Documented, tested, and continuously monitored frameworks that identify and mitigate foreseeable risks.
Technical documentation: Proof that the AI system was designed and tested to meet Act requirements before deployment.
Data governance protocols: Controls over training datasets, validation, and testing to prevent bias and ensure accuracy.
Audit trails and logging: Automatic records of system operations that can be reviewed by regulators.
Human oversight mechanisms: Real ability for humans to monitor, intervene in, or override AI decisions.
Transparency documentation: Clear information to users about what the system does and how to challenge its outputs.
If you are a deployer using a vendor’s AI tool rather than building your own, your obligations are lighter — but they are not zero. You are still required to maintain human oversight, report incidents, and ensure the system is used within its intended purpose.
The Penalties: What Non-Compliance Actually Costs
The fines under the EU AI Act are designed to be meaningful. For violations involving prohibited AI practices: up to €35 million or 7% of global annual turnover, whichever is higher. For violations of obligations for high-risk AI systems: up to €15 million or 3% of global annual turnover.
For context: a UK mid-market business with £200M annual revenue facing a 3% penalty faces a £6M fine. But the financial penalty is arguably the second-worst outcome. National market surveillance authorities also have power to require corrective action, mandate product recalls, and impose temporary or permanent bans on AI system deployment.
For a business whose supply chain planning, pricing, or operational decisions depend on AI, a forced suspension is a business continuity event, not just a compliance issue.
The UK’s Own AI Governance Requirements
The UK has taken a principles-based, sector-led approach to AI governance. The framework is built around five core principles: safety, security, and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.
These principles are currently non-binding at the horizontal level — but they are being enforced via existing sector regulators. The ICO, FCA, CMA, and MHRA are all applying existing powers to AI in their respective domains. For mid-market UK businesses, the most immediate domestic obligation is the ICO’s guidance on AI and data protection.
Under UK GDPR, if your AI system processes personal data — and virtually all commercially relevant AI does — you need a Data Protection Impact Assessment (DPIA) for any high-risk automated processing. This includes AI-driven profiling, automated decision-making, and systems that process sensitive data at scale. This obligation applies now. Not in 2026.
A Six-Step AI Governance Framework for Mid-Market UK Businesses
Rather than waiting for enforcement pressure, the businesses that emerge strongest from this compliance window will be those treating AI governance as a commercial asset. Here are six concrete steps.
Step 1 — Conduct an AI inventory audit. Map every AI system your organisation uses, deploys, or relies on — including third-party vendor tools. Categorise each by function, data inputs, decision outputs, and whether those outputs touch EU consumers or EU-regulated processes.
Step 2 — Classify your risk exposure. Apply the four-tier EU AI Act framework to each system. For anything in the high-risk category with EU market exposure, treat it as a compliance priority requiring immediate attention.
Step 3 — Complete DPIAs for all AI processing personal data. Under UK GDPR, this is already legally required for high-risk automated processing. If you have not completed a DPIA for your deployed AI systems, this is your most urgent action.
Step 4 — Build human oversight protocols. For any AI system that informs or makes decisions affecting people — customers, employees, suppliers — design and document a process for human review and override. This is required for high-risk AI under both the EU Act and UK GDPR’s Article 22.
Step 5 — Create an AI governance policy. Document who is accountable for AI decisions, how AI systems are selected and onboarded, and how incidents or failures are reported and remediated. Assign a designated responsible person for high-risk AI.
Step 6 — Engage your vendor contracts. Review contracts with AI tool providers. Providers of high-risk AI must furnish deployers with technical documentation, instructions for use, and incident reporting mechanisms. If your vendor cannot provide these, you are carrying compliance risk your contract does not address.
Why AI Governance Is a Commercial Advantage, Not Just a Compliance Cost
Most mid-market businesses will treat AI governance as a cost centre. The ones that gain competitive ground will treat it as a differentiator.
Retail buyers, institutional partners, and EU procurement teams are beginning to ask about AI governance in due diligence processes. An FMCG brand that can demonstrate its AI systems are compliant, auditable, and governed is in a stronger position than one that cannot. A logistics provider with documented AI governance is a lower-risk partner.\
The EU AI Act is a forcing function. It separates organisations building AI capability responsibly from those accumulating AI activity without accountability. Mid-market businesses that act now — before enforcement pressure builds — will build governance frameworks that serve them commercially for years beyond the compliance deadline.
Not Sure Where Your AI Systems Sit? Start Here.
AI Navi works with mid-market businesses in FMCG, logistics, and consumer products to build AI governance frameworks that are proportionate, commercially grounded, and operationally embedded. We start with an AI Check — a structured diagnostic that identifies your actual risk exposure across EU AI Act categories, UK regulatory obligations, and data protection requirements.
If your board has started asking questions about AI governance and you don’t have the answers yet, that’s exactly where we start. The first question is simple: do you know which of your AI systems would qualify as high-risk under the EU AI Act?
If the answer is “we’re not sure,” we should talk. Book Your AI Governance Check → ainavi.co.uk