EU AI Act vs UK AI regulation: a guide for startups in both
Hephaestus Technology7 min read
The EU AI Act is a single, binding law that classifies AI by risk and sets fixed obligations, deadlines and fines, while the UK has no equivalent statute and instead asks existing regulators to apply five non-statutory principles within their sectors. A startup selling in both markets is caught by the EU AI Act whenever its AI is placed on the EU market or its output is used in the EU. The practical answer is to build to the EU AI Act as your baseline and add UK data protection and sector rules on top.
Key takeaways
- The EU regulates AI through one binding law, the AI Act, with risk tiers, fixed deadlines and fines; the UK relies on existing regulators applying five non-statutory principles within their own sectors.
- A UK startup is covered by the EU AI Act when it places AI on the EU market or its AI output is used in the EU, regardless of where it is based.
- In the UK, the binding rules for most AI products come from existing law, notably UK GDPR as amended by the Data (Use and Access) Act 2025, which now permits more solely automated decisions with safeguards.
- For a startup selling in both, the practical approach is to build to the EU AI Act as the baseline and layer UK data protection and sector rules on top.
- Both sides offer supervised testing: AI Act regulatory sandboxes in every Member State by August 2027, and proposed AI Growth Labs in the UK.
How do the EU and UK approaches differ?
The EU legislated; the UK delegated to regulators. The AI Act entered into force in August 2024 and applies in stages, as amended by the Digital Omnibus on AI. The UK set out its approach in a 2023 white paper and confirmed it in the government response of 6 February 2024, which said "a non-statutory approach currently offers critical adaptability".
| EU AI Act | UK approach | |
|---|---|---|
| Legal form | Directly applicable EU regulation | Non-statutory principles applied by existing regulators |
| Scope | Horizontal: all sectors | Sector by sector, through each regulator's remit |
| Structure | Prohibited, high-risk, transparency and minimal risk tiers | Five principles: safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress |
| Key dates | Transparency since 2 August 2026; Annex III high-risk from 2 December 2027; Annex I from 2 August 2028 | No AI-specific compliance deadlines |
| Fines | Up to €35m or 7% of turnover; SMEs pay the lower figure | Only under existing laws, such as UK GDPR |
| General-purpose AI models | Binding obligations since August 2025 | Voluntary for now; targeted binding rules possible later |
| Supervised testing | National AI regulatory sandboxes by 2 August 2027 | Proposed AI Growth Labs; sector sandboxes |
| Who enforces | National market surveillance authorities; AI Office for GPAI | Existing sector regulators, supported by £10 million for AI capability announced in 2024 |
Does the EU AI Act apply to a UK company?
Yes, in two situations. Article 2 of the AI Act covers providers placing AI systems on the EU market or putting them into service in the EU, wherever they are established, and providers and deployers in third countries "where the output produced by the AI system is used in the Union". A London SaaS company selling an AI feature to Irish or German customers is a provider under the EU AI Act for that feature.
So the familiar questions apply: what is your role, and what is the risk tier? Our guide to whether the EU AI Act applies to your business works through them.
What actually binds an AI product in the UK?
Existing law, applied by existing regulators. The five principles are guidance for regulators, not obligations on companies. What binds you is the law each regulator enforces: data protection, consumer protection, competition, equality, financial services and product safety rules.
Data protection is the one almost every AI product meets. The Data (Use and Access) Act 2025 changed UK GDPR's rules on automated decision-making. According to the government factsheet, the reform "creates a more permissive framework for making decisions based solely on automated processing", allowing such decisions in wider circumstances provided safeguards are in place: telling people about significant decisions, letting them make representations and contest them, and "enabling them to obtain human intervention in the taking of the decision". Stricter rules remain for special category data.
That moves UK rules away from the EU GDPR, which this UK reform does not change, and from the EU, where AI used in areas such as recruitment or credit scoring will also be high-risk under the AI Act from December 2027. Our guide to GDPR and LLMs covers the EU data protection side.
What about general-purpose AI and frontier models?
The EU already regulates them: providers of general-purpose AI models have had obligations on documentation, copyright policy and training-data summaries since 2 August 2025, with additional duties for models with systemic risk. The UK's 2024 response anticipated that "all jurisdictions will, in time, want to place targeted mandatory interventions" on the most capable systems, but preferred voluntary measures until then. For a startup building on third-party models rather than training them, this difference matters less than the product-level rules.
How do supervised testing options compare?
Both jurisdictions want to let innovators test with regulators, by different routes. In the EU, Article 57 requires every Member State to have an AI regulatory sandbox operational by 2 August 2027, free for SMEs, with no AI Act fines for participants acting in good faith. In the UK, the government announced a blueprint for AI regulation on 21 October 2025 built around AI Growth Labs, where specific regulations could be temporarily adjusted under supervision, with consumer protection, safety, fundamental rights, workers' protections and intellectual property excluded. The call for evidence closed on 7 January 2026, with no outcome published on that page at the time of writing. Our guide to AI regulatory sandboxes covers the EU route in detail.
What should a startup selling in both markets do?
- Map where your AI is used. Any EU customers or EU users of your output put you in AI Act scope.
- Classify under the EU AI Act. It is the more prescriptive regime, so use it as the baseline for every product.
- Apply Article 50 everywhere. Chatbot disclosure and AI content labelling cost little and match UK transparency expectations.
- Run UK GDPR separately. Check automated decision-making safeguards under the amended UK rules, and Article 22 GDPR for the EU.
- Check sector regulators. Financial services, health and employment uses carry extra rules in both markets.
- Keep one evidence file. Classification, testing, human oversight and literacy records serve both an EU authority and a UK regulator.
- Watch for change. The UK position on AI legislation has shifted before; check gov.uk for any new bill.
Is one regime clearly better for startups?
Neither is free. The EU gives legal certainty at the cost of more formal obligations, softened for SMEs by lower fine caps, simplified documentation and free sandboxes. The UK gives flexibility, but compliance means reading several regulators' guidance and existing laws rather than one text. For most startups targeting both, the EU sets the floor and the UK adds data protection and sector detail.
Frequently asked questions
Does the UK have an AI Act?
No. The UK government's February 2024 response to its AI white paper chose a non-statutory approach in which existing regulators apply five cross-sector principles. It said it would consider targeted binding rules for the most capable general-purpose AI only if voluntary measures proved inadequate.
My startup is in London. Does the EU AI Act apply to me?
Yes, if you place an AI system on the EU market or the output of your AI system is used in the EU. Article 2 of the AI Act covers providers wherever they are established in those cases, and deployers in third countries whose AI output is used in the EU.
Which UK law matters most for AI products?
For most products, UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The amendments allow solely automated decisions with significant effects in wider circumstances, provided safeguards such as information, the ability to contest and human intervention are in place. Sector rules, for example in financial services or medical devices, apply on top.
Is complying with the EU AI Act enough for the UK?
Not automatically. EU AI Act compliance covers much of what UK regulators expect under their principles, but UK GDPR has its own requirements and the two regimes differ in detail. Map UK data protection and sector obligations separately.
Can I test my AI product with UK regulators?
The UK government consulted on AI Growth Labs, supervised pilots where specific rules are temporarily adjusted, from October 2025 to January 2026. It had not published an outcome on the consultation page at the time of writing. Some sector regulators run their own sandboxes.
If you are planning an AI product for both the EU and UK markets, book a free 30-minute call to talk through the sequencing.
Cover photo by Miguel González on Pexels.