AI Regulation

AI Regulation

AI's capabilities grew faster than the rules governing it — but that's changing. The EU and UK have taken different approaches to regulating AI, and both are directly relevant if you build with or deploy AI systems, even outside those regions, since many companies apply their strictest rules globally rather than maintain separate products.

The EU AI Act: Risk Tiers

The EU AI Act is the first comprehensive AI law of its kind, and it classifies AI systems by risk rather than by technology:

Unacceptable risk — banned outright: social scoring by governments, manipulative AI that exploits vulnerabilities, most real-time biometric identification in public spaces by law enforcement, and emotion-recognition in workplaces and schools.

High risk — heavily regulated, not banned: AI used in hiring, credit scoring, education access, law enforcement, and critical infrastructure. These systems need risk management, human oversight, documentation, and conformity assessments before deployment.

Limited risk — transparency obligations: chatbots, deepfakes, and emotion-recognition systems (outside the banned use cases) must disclose that users are interacting with AI or AI-generated content.

Minimal risk — largely unregulated: spam filters, recommendation engines for low-stakes content, and most everyday AI features fall here, with no specific obligations beyond general product law.

What's Already in Force

The Act is being phased in over several years, not all at once:

February 2025: the prohibitions on unacceptable-risk practices took effect, alongside Article 4 — an AI literacy duty requiring providers and deployers to ensure staff operating AI systems have a sufficient level of AI literacy, accounting for their technical knowledge, role, and context of use.

August 2025: obligations for providers of general-purpose AI (GPAI) models — the large foundation models behind chatbots and other downstream products — began applying, covering technical documentation, copyright compliance, and (for the most capable models) systemic-risk assessment.

August 2026: broader transparency obligations are due to apply, including the disclosure duties for limited-risk systems described above.

The Digital Omnibus: Deadlines Are Shifting

Implementation hasn't gone entirely to the original timetable. In late 2025, the European Commission proposed a "Digital Omnibus" package to simplify and partially delay the Act, after sustained pressure from industry over readiness and compliance burden. The headline change pushes back the high-risk system deadlines — originally due in 2026 — to December 2027 for most high-risk AI embedded in regulated products, and August 2028 for the remaining high-risk categories (notably those used in employment, essential services, and law enforcement).

As of October 2026: the prohibitions and AI literacy duty (February 2025) and the GPAI model obligations (August 2025) are already in force. The transparency obligations are due August 2026. The Digital Omnibus proposal, still moving through the EU legislative process, would delay most high-risk system deadlines to December 2027 and August 2028 — treat any "2026 high-risk deadline" you read as provisional until the Omnibus is finalised.

The UK's Different Bet

The UK deliberately didn't copy the EU's approach. Instead of a single cross-sector AI law, it relies on a principles-based, regulator-led model: existing regulators (covering finance, healthcare, competition, data protection, and so on) apply shared AI principles — safety, transparency, fairness, accountability, and contestability — within their own sectors, rather than a new AI-specific regulator policing everything centrally.

The UK also established the AI Security Institute (formerly the AI Safety Institute), a government body that evaluates frontier AI models for safety risks, conducts technical research, and advises government — a research and evaluation function rather than a conventional regulator with enforcement powers.

The practical upshot: if you're building or deploying AI that touches EU users, expect prescriptive, tiered legal obligations with real penalties. If you're UK-only, expect your existing sector regulator to interpret general principles rather than a dedicated AI rulebook — lighter-touch for now, but less predictable as it's worked out case by case.