FCA authorised · FRN 724952 0117 325 0027Quote & buy →
AI regulation
Yes, the EU AI Act can apply to a UK business that places AI systems on the EU market or whose AI output is used in the EU. It matters because fines reach €35 million or 7% of worldwide turnover, and EU customers already push AI Act duties down to UK suppliers by contract.
Part of: AI insurance UK
In short
The EU AI Act reaches UK firms that sell AI systems or general-purpose models into the EU, or whose AI output is used there. Duties depend on the risk tier: prohibited practices, high-risk systems, transparency for chatbots and generated content, and GPAI model duties. After the Digital Omnibus, Annex III high-risk duties apply from 2 December 2027 and Annex I from 2 August 2028. Fines reach €35 million or 7% of worldwide turnover. Fines are often uninsurable, but investigation costs and civil claims may be covered, subject to the policy terms.
The EU AI Act is Regulation (EU) 2024/1689. Article 2(1) applies it to providers placing AI systems or general-purpose AI models on the EU market, whether they are established in the EU or in a third country, to providers and deployers in a third country where the AI system's output is used in the EU, to importers and distributors, and to product manufacturers who put an AI system on the market under their own name. Being based in Bristol or London does not take you outside it.
| UK situation (illustrative) | Likely role under the Act | Why |
|---|---|---|
| A UK SaaS firm sells an AI screening tool to employers in Ireland and Germany | Provider | It places an AI system on the EU market under its own name |
| A UK consultancy runs an AI model in London and sends scored reports to a client in France | Provider or deployer in a third country | The system's output is used in the EU |
| A UK firm uses AI tools internally and serves UK clients alone | Usually outside scope | No EU market placement and no output used in the EU |
A UK provider of a high-risk AI system must appoint an authorised representative established in the EU, by written mandate, before making it available there (Article 22). EU customers often pass these duties down by contract; see AI contract clauses and indemnities.
The Act regulates by use, so the same model can be minimal risk in one product and high risk in another.
| Tier | Examples | Main duties |
|---|---|---|
| Prohibited (Article 5) | Harmful manipulation, social scoring, untargeted facial image scraping, emotion recognition at work; the Omnibus added intimate deepfakes and AI child sexual abuse material | Banned outright |
| High risk (Article 6, Annex III and Annex I) | Annex III: biometrics, critical infrastructure, education, employment (recruitment, screening, promotion), creditworthiness, life and health insurance pricing. Annex I: AI safety components in regulated products | Risk management, data governance, documentation, logging, human oversight, conformity assessment. Deployers keep logs for at least six months (Article 26) |
| Transparency (Article 50) | Chatbots, generated content, deepfakes | Tell people it is AI; mark synthetic output; disclose deepfakes |
| General-purpose AI models | Large models built into many systems | Documentation, information for downstream providers, copyright policy, training content summary (Article 53) |
| Everything else | Spam filters, AI features in productivity tools | AI literacy measures (Article 4) |
Recruitment tools land in Annex III (AI bias claims); customer chatbots fall under Article 50 (AI chatbot insurance).
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved several deadlines. The position below follows Article 113 and Article 111 as amended.
| Date | What applies |
|---|---|
| 2 February 2025 | General provisions, AI literacy and the original prohibitions |
| 2 August 2025 | General-purpose AI model duties, governance and the penalties chapter (except Article 101 fines on GPAI providers) |
| 2 August 2026 | General application date, including Article 50 transparency for new systems and the Commission's power to fine GPAI providers |
| 2 December 2026 | New prohibitions on intimate deepfakes and child sexual abuse material. Generative systems already available before 2 August 2026 must comply with the Article 50(2) marking duty |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 must comply |
| 2 December 2027 | High-risk duties for Annex III systems (previously 2 August 2026) |
| 2 August 2028 | High-risk duties for Annex I systems in regulated products |
The Omnibus also softened Article 4: providers and deployers must take measures to support AI literacy, without having to ensure any set level of it.
Member states set penalty rules within the maximums in Article 99: the higher of a fixed sum or a share of worldwide annual turnover.
| Breach | Maximum fine |
|---|---|
| Prohibited practices (Article 5) | €35 million or 7% of worldwide turnover |
| Provider, importer, distributor and deployer duties, and Article 50 transparency | €15 million or 3% |
| Misleading information to notified bodies or authorities | €7.5 million or 1% |
| GPAI model providers (fined by the Commission, Article 101) | €15 million or 3% |
For SMEs and start-ups the lower of the two figures applies; the Omnibus extends this to small mid-caps for the 3% and 1% bands.
Under Article 53, GPAI model providers must keep technical documentation, give downstream providers enough information to understand the model's capabilities and limits, maintain a policy for complying with EU copyright law, and publish a summary of training content. The Commission received the final General-Purpose AI Code of Practice, a voluntary way to show compliance, on 10 July 2025.
A UK business building on someone else's model is usually not the GPAI model provider, but may be the provider of the AI system it builds. Copyright exposure from training and output is covered in AI IP infringement insurance.
In an explanatory memorandum dated 3 August 2026, the UK government told the Northern Ireland Assembly that the AI Act is not in Annex 2 of the Windsor Framework and does not apply in Northern Ireland under it. The EU has told the UK it thinks the Act should apply there, and the UK has not yet decided. Amendments to the Machinery Regulation, which is in Annex 2, do apply in Northern Ireland, so AI requirements for machinery can reach firms there by that route. See our Northern Ireland PI overview.
Great Britain has no equivalent statute. As at September 2026 a dedicated UK AI bill had yet to materialise (Lewis Silkin, 14 September 2026).
Insurance does not make a business compliant. Whether an AI Act fine can be insured depends on the law that applies; for data protection fines, for example, the dominant view in Germany is that cover would be void and Italy treats fines as generally uninsurable (K&L Gates, February 2026). We explain the English position in are AI regulatory fines insurable?
| AI Act-related exposure | Can insurance help? (subject to the policy terms) |
|---|---|
| Fine from an EU authority or the Commission | Often not, or uncertain |
| Costs of responding to a regulator's investigation | Sometimes, if the policy includes investigation costs (how that cover works) |
| Client claims that your AI system failed or caused financial loss | Commonly, under PI, if the AI work is insured activity |
| Injury or property damage from an AI product sold into the EU | Commonly, under product liability. The new EU Product Liability Directive covers software, including AI, placed on the market from 9 December 2026; see AI product liability |
| A customer suing under an AI Act warranty or indemnity in your contract | Uncertain; assumed contractual liability is commonly excluded |
The proposed EU AI Liability Directive was withdrawn in October 2025, so civil AI claims in the EU run through national law and the new Product Liability Directive. Check also that your policy's territorial and jurisdiction limits extend to EU claims (territorial and jurisdiction limits).
Apex has an AI insurance scheme with an insurer in which the policy names your specific AI work as insured activity, rather than relying on a generic business description. You choose from professional indemnity, cyber, product or public liability and IP infringement cover, so several AI exposures can sit in one policy; US cover is available subject to underwriting. To quote we need what your business does (describe the AI work precisely, including where its output is used), your address, your turnover including any USA and Canada share, and the limit of indemnity you need. You can start an AI insurance quote online in a few minutes, or read more on AI insurance in the UK.
Under section 3 of the Insurance Act 2015 you must make a fair presentation of the risk. For EU-facing AI work, say where in the EU your AI or its output is used, whether any system could be high risk, what role you play, and whether customer contracts warrant AI Act compliance. Look too for new AI exclusions at renewal. See also US cover for UK AI firms and AI insurance for fintech.
Yes, in some cases. It applies to UK providers placing AI systems or general-purpose AI models on the EU market, and to UK providers and deployers whose AI output is used in the EU. A UK firm using AI purely for UK clients is usually outside it.
After the Digital Omnibus, high-risk duties for Annex III systems, such as recruitment and credit scoring tools, apply from 2 December 2027, and for AI in regulated products under Annex I from 2 August 2028. Prohibitions and GPAI duties already apply.
Article 99 sets maximums of €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for most other duties, and €7.5 million or 1% for misleading information to authorities, whichever is higher. For SMEs and start-ups the lower figure applies.
Usually not with confidence. Insurability depends on the applicable law, and several European countries treat administrative fines as uninsurable. Policies more often help with investigation costs and customer claims, subject to the policy terms.
Not at present, according to a UK government memorandum of 3 August 2026, because the Act is not in Annex 2 of the Windsor Framework. The EU thinks it should apply; the UK has not decided. Machinery Regulation amendments do apply in Northern Ireland.
No. As at September 2026 the UK had no general AI statute and no government AI bill. Existing law, such as data protection, consumer and equality law, applies to AI. UK firms selling into the EU still need to consider the EU Act.
Tell us what your AI work is, where you are based, your turnover and the limit you need. It takes a few minutes online, and a broker will come back to you with options. Or call 0117 325 0027.
Start an AI insurance quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
