People

Careers

Corporate

Commercial

Employment

News & Insights

Blog

News

Videos

Who we are

Environment & Sustainability

Diversity, Equity & Inclusion

WONDER Foundation

Home

Resources

<p>Registered in England &amp; Wales at 73 Shelton Street, Covent Garden, London, WC2H 9JQ</p>
<p><a href="tel:+442081596000">Tel: +44 (0)20 8159 6000</a></p>
<p>Company Nr: 15894546</p>
<p>ICO Registration Nr:  ZB842887</p>
<p>VAT Registration Nr: <span data-teams="true">484 5226 73</span></p>
<p>Linnear Legal is an unregulated legal services provider, meaning the firm itself is not regulated by the Solicitors Regulation Authority (SRA). However, the solicitors employed by the firm are individually regulated by the SRA. Please see our Terms and Conditions for further information on our regulatory status, complaints procedure and insurance arrangements.</p>


Terms & Conditions

Cookie Policy

Privacy Policy

Services

Insights

About

We are driven by doing things differently, from every angle. 

Taking our Carbon Neutral Certified  status seriously.  

Putting equity and inclusion at the heart of everything we do.

Supporting sustainable employment and gender equality with WONDER. 

WONDER foundation

Contact us

<p>Artificial intelligence has been a leading disruptive technology in recent years, and it’s no surprise businesses are using it in increasingly novel ways. While developments in AI represent huge opportunities for businesses, they also represent risks, including to individuals’ rights and potential threats to privacy and security.</p>
<p>Recognising the potential threat that AI can pose to customers, from deepfake and voice-cloning technology to accelerating the spread of disinformation, the European Union has introduced the world’s first comprehensive AI legislation: <a href="https://artificialintelligenceact.eu/">the Artificial Intelligence Act (the AI Act)</a>.</p>
<h3>When was the EU AI Act passed?</h3>
<p>The AI Act came into force on 1 August 2024, with staggered implementation dates depending on the level of risk posed by AI systems. Although it’s an EU Act, thanks to its extraterritorial reach, UK businesses still need to be aware of how this Act might apply to them.</p>
<p>In this article, we explain what this means for businesses operating in the EU or hoping to access the European market, as well as why it is important and how to prepare for its impact.</p>
<h3>Who does the EU AI Act apply to?</h3>
<p>The EU AI Act affects providers, users, importers and distributors of AI systems. It also applies to service providers that integrate or customise AI systems for specific applications. Broadly, if an organisation uses AI in a professional capacity, it will be affected. For the most part, however, obligations will fall on providers (developers) of high-risk AI systems.</p>
<p>Although the Act is EU legislation, the Act will affect all organisations outside the EU if the relevant AI systems affect EU citizens.</p>
<h3>What is considered to be ‘high risk’ in the EU AI Act?</h3>
<p>The Act classifies AI into four types of risk category:</p>
<ul>
<li><strong>Unacceptable risk</strong> (prohibited)</li>
<li><strong>High-risk</strong> (regulated)</li>
<li><strong>Limited risk</strong> (subject to lighter transparency obligations, e.g. chatbots and deepfakes)</li>
<li><strong>Minimal risk</strong> (unregulated, e.g. AI art, filters and video games)</li>
</ul>
<p>The EU has noted that this fourth category may be affected by developments in generative AI.</p>
<p>AI is considered to be high risk if it concerns the following:</p>
<ul>
<li>Biometrics</li>
<li>Critical infrastructure</li>
<li>Education</li>
<li>Employment</li>
<li>Access to essential services – both public and private</li>
<li>Law enforcement</li>
<li>Immigration</li>
<li>Administration of justice and democratic processes</li>
</ul>
<p>This list is not exhaustive, and as AI is evolving rapidly, we recommend businesses using AI speak to a legal professional for comprehensive advice on whether and how the Act will apply to their business.</p>
<h3>Does the EU AI Act apply to UK businesses?</h3>
<p>As the UK is no longer a Member State of the EU, it does not need to comply directly with the Act.</p>
<ul>
<li>See also: <a href="https://linnearcms.wpenginepowered.com/resources/terms-and-conditions-for-smes/">Terms and conditions for SMEs</a></li>
<li>See also: <a href="https://linnearcms.wpenginepowered.com/resources/what-data-privacy-notice-why-important/">What is a data privacy notice and why is it important?</a></li>
<li>See also: <a href="https://linnearcms.wpenginepowered.com/resources/how-to-issue-shares-in-your-company/">How to issue shares in your company</a></li>
</ul>
<p>However, the AI Act has extraterritorial reach. This means that if an organisation wants to operate in the EU or sell AI-related products or services in the EU, it will need to ensure its business is compliant with the Act.</p>
<p>This is similar to how companies in the UK must comply with the GDPR if they process the personal data of EU citizens.<em> </em></p>
<h3>How might your business be affected?</h3>
<p>There are a number of ways businesses might be affected by the EU AI Act, and it’s not always apparent what role businesses might be playing in relation to AI. Some businesses might be using AI in complicated ways, where it is not immediately clear whether they should be classed as providers or deployers. We set out the key differences – and similarities – below.</p>
<h4>Compliance obligations under the EU AI Act</h4>
<h5>Providers of AI</h5>
<p>The AI Act places emphasis on compliance, particularly for providers of high-risk AI systems. Providers will need to conduct risk assessments and ensure proper data governance. They must also maintain detailed technical documentation, ensure human oversight of AI systems, and undergo conformity assessments before their systems can enter the market.</p>
<p>For high-risk systems, providers must establish a risk-management system that operates throughout the AI system&#8217;s lifecycle. These systems must also be transparent enough for users to understand how they function, make necessary corrections, and ensure they are not solely relying on AI for critical decisions. Additionally, businesses need to implement cybersecurity measures to protect AI systems from malicious interference.</p>
<h5>Deployers of AI</h5>
<p>Deployers have fewer obligations but are still responsible for ensuring their AI systems are used in accordance with the law. This means implementing technical and organisational measures to prevent misuse, maintain human oversight, and comply with monitoring and record-keeping requirements.</p>
<h5>AI literacy</h5>
<p>EU ‘AI literacy’ requirements oblige employers to ensure workers are aware of potential risks, harms, and benefits of AI systems and how to use AI effectively. Training will be needed to get employees up to speed in high-risk sectors like finance, healthcare or recruitment.</p>
<p>Internal policies will also need to be adjusted to align with new requirements. With AI literacy requirements taking effect as of February 2025, we recommend getting your business AI literate as soon as possible.</p>
<h4>EU AI Act fines: potential penalties for not complying</h4>
<p>The penalties for non-compliance are severe. Companies that violate the Act could face fines of up to €35 million or 7% of global annual turnover – whichever is higher – for breaches involving prohibited AI systems. The high cost of non-compliance underscores businesses’ need to prioritise AI regulation.</p>
<p>Fines are tiered based on the severity of the breach:</p>
<ul>
<li><strong>€35 million or 7% of turnover</strong> for prohibited AI systems</li>
<li><strong>€15 million or 3% of turnover</strong> for other significant violations</li>
<li><strong>€7.5 million or 1% of turnover</strong> for misleading or incomplete information</li>
<li>Small and medium-sized enterprises (SMEs) and startups will be considered under a proportionate penalty system. The financial impact of these fines could still be devastating for unprepared businesses.</li>
</ul>
<h4>Steps to ensure compliance with the EU AI Act</h4>
<p>To comply with the AI Act, many businesses will need to overhaul their operational and technical processes. For high-risk AI systems, providers and deployers must implement systems for:</p>
<ul>
<li>Record keeping</li>
<li>Monitoring incidents and</li>
<li>Ensuring data transparency</li>
</ul>
<p>Businesses may also need to invest in new infrastructure to maintain logs for AI systems and document compliance over long periods. Some records may need retaining for up to 10 years.</p>
<p>Plus, companies based outside the EU that operate in the EU market will need to appoint an authorised representative within the EU to manage compliance on their behalf.</p>
<h3>Get your business AI-ready</h3>
<p>The AI Act represents a landmark moment for AI regulation, and is likely only the beginning of what’s set to become a complex and expanding area of commercial law.</p>
<p>While these obligations may seem burdensome, in developing a regulated framework and seeking to foster greater transparency, the EU is setting a benchmark for AI technology going forward. This may dictate the rulebook for years to come.</p>
<p><a href="https://www.linnearlegal.co.uk/get-in-touch/">Speak to a lawyer at Linnear Legal</a> for further advice on getting your business AI-ready.</p>


What does the new EU AI Act mean for your business?

The EU AI Act may affect UK businesses operating in the EU. Learn how to comply, avoid fines and prepare for AI regulation.

What does the new EU AI Act mean for your business? | Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/02/shutterstock_604448168.jpg

Linnear Legal

https://linnearcms.wpenginepowered.com/wp-content/uploads/2025/01/Linnear-Legal-logo.png

https://secure.gravatar.com/avatar/557c7f891380b6950d58942a774782ca?s=96&d=mm&r=g