The EU AI Act doesn’t stop at the UK border. If your AI-assisted work ends up in front of an EU client, customer, or audience, the Act may already apply to you. Here’s what actually triggers it.

Most UK businesses have filed the EU AI Act under “not my problem.” Understandable: it’s an EU regulation, you’re not in the EU, and Brexit was supposed to mean fewer Brussels rules landing on your desk, not more.

Here’s the part that gets missed. The Act was written with exactly this assumption in mind, and it closes the door on it directly. Article 2 doesn’t just cover companies based in the EU. It covers providers and deployers “located in a third country, where the output produced by the AI system is used in the Union.” Third country, in EU law, means anywhere outside the EU. That includes the UK.

The three ways this reaches you

Strip out the legal phrasing and there are really three situations where a UK business ends up inside the Act’s scope:

  1. You sell or supply an AI system into the EU market. If you build or resell AI software and an EU customer is using it, you’re a provider under the Act, full stop, regardless of where your office is.
  2. You use AI in the UK, but the output lands in the EU. This is the one that catches people off guard. You don’t have to sell anything into the EU. If your own AI-assisted output, a report, a set of recommendations, a piece of marketing, ends up used by someone in the EU, you can be a “deployer” under the Act for that use.
  3. General-purpose AI models placed on the EU market, which mostly concerns the handful of companies building foundation models rather than the businesses using them, so most readers here can set this one aside.

It’s the second one that matters most for a typical UK small or mid-sized business, because it doesn’t require you to be selling into Europe at all. It just requires an EU person or organisation to end up using what your AI helped produce.

Two ordinary ways this actually happens

Neither of these involves anyone setting out to “sell into the EU”:

  • A UK accountancy or advisory firm uses AI to help draft a report, forecast, or set of recommendations for a client, and that client has EU operations or an EU-based decision-maker. The output crosses the border even though the engagement didn’t start as an EU one.
  • A UK business uses AI to generate marketing copy, ad variants, or product listings, and some of that output reaches EU audiences, through paid ads, an e-commerce listing, or a distributor. Nobody framed it as “expanding into Europe.” It happened as a byproduct of normal marketing.

The gap almost nobody talks about

Here’s the detail that actually makes this worth reading past the headline. Recital 22, the explanatory text that accompanies the Act, says the rule is meant to apply when output is “intended to be used in the Union.” Intended. That sounds like it only catches businesses deliberately targeting EU customers.

But recitals aren’t the operative law. The actual binding text of Article 2 doesn’t say “intended.” It says the output “is used” in the Union. No intent requirement anywhere in it.

That’s a real, unresolved gap between what the explanatory notes suggest and what the enforceable text actually says, and it means a business whose AI output reaches the EU by accident, not by design, may not be able to rely on “we weren’t trying to sell there” as a defence. Nobody has fully tested this in practice yet. That’s exactly why it’s worth knowing about now rather than finding out the hard way.

What this doesn’t mean

This isn’t a “panic, you’re all breaking the law” post. Most obligations under the Act are proportionate to risk: a UK firm using AI for internal drafting or general marketing sits nowhere near the same bar as someone deploying AI in hiring, credit, or biometric identification, the genuinely high-risk categories. The Act’s own transparency requirements (Article 50, covering things like AI-generated content disclosure) only become enforceable from 2 August 2026, with a grace period to 2 December 2026, and the toughest, high-risk rules have themselves been pushed further out, to December 2027 and August 2028 depending on the category. There’s runway here. The point isn’t urgency for its own sake. It’s that “we’re a UK company, this doesn’t apply to us” is not a safe assumption to build on.

What’s actually worth doing

Three things, roughly in order of effort:

  1. Map where your AI-assisted output actually goes. Not where your office is, where the output ends up. Client reports, marketing, product content, anything AI touches that leaves the building.
  2. Flag anything that reaches EU clients, customers, or audiences, even occasionally, and check which risk tier it would fall into if it were being assessed today.
  3. Get a second opinion before you assume you’re in the clear. This is a genuinely unsettled area of law (see the intent gap above), and “we checked once” isn’t the same as “we checked properly.”

We run this kind of assessment for UK and Irish businesses as a matter of course, not as an add-on. Check your EU AI Act exposure or book a free 30-minute review if you want a straight answer on where you actually stand.

Dates and article references reflect the Act’s official text and the European Commission’s published timeline as of September 2026