Something quiet but significant happened on 2 August 2026. The EU AI Act stopped being a future deadline and became live law. Not the scary, headline version of it that most coverage focused on. The part that landed is the transparency layer: chatbots must tell people they are talking to AI, AI-generated content must be marked so machines can detect it, and the European Commission’s AI Office can now investigate and fine providers of general-purpose AI models up to 3% of global turnover.
If your business is UK-based and sells only to UK customers, you can breathe out. The Act does not reach you. But if you sell into Europe, or you would like to, or your customers sell into Europe and pass their requirements down to you, this is now a commercial issue, not just a legal one.
The good news is that the version everyone feared got delayed. In June 2026 the European Parliament approved amendments pushing the heavy high-risk obligations out to December 2027 and August 2028. The AI Act will not audit your hiring algorithm this quarter. What will happen this quarter is more mundane and, for most SMEs, more urgent: EU procurement teams are already adding AI Act questions to their security questionnaires, and suppliers who cannot answer them are watching deals stall.
What Actually Became Law on 2 August 2026
Article 50 of the EU AI Act sets out transparency obligations, and they now apply directly. In practical terms, four things matter:
Chatbots must identify themselves. If you run a customer-facing chatbot or virtual assistant, it must clearly tell users they are interacting with an AI system. Not buried in the terms and conditions. Up front, where the interaction happens.
AI-generated content must be marked. Providers of generative AI systems must mark synthetic images, video and text in machine-readable form. If you publish AI-generated content that could be mistaken for real, there is now a legal expectation that it is labelled. Systems that were already on the market before August have a grace period to 2 December 2026 to catch up.
Deepfakes must be labelled. If your marketing uses AI-generated video or imagery of real people or events, it must be disclosed.
The Commission got teeth. The AI Office can now demand documentation, run its own evaluations, and fine general-purpose AI providers up to 3% of global annual turnover or €15 million. You are probably not a GPAI provider, but your vendors are, and their compliance is becoming part of your supply chain story.
What the UK Cannot Shield You From
Post-Brexit, the UK is a third country, and the EU AI Act is extraterritorial by design. It applies in three situations: you place an AI system on the EU market, you have an EU establishment that uses AI, or the output of your AI system is used in the EU. That last one catches people out. A UK company serving an AI-powered feature to a customer in Dublin is in scope without ever opening an EU office.
The practical reality for most UK SMEs is less dramatic but still real. Even when the Act does not legally bind you, your EU customers are obligated to understand the AI in their supply chain, and they discharge that obligation through questionnaires. If you cannot answer “what AI systems do you use, are you compliant with Article 50 transparency obligations, and who is accountable?” with evidence, you are the supplier who slows the deal down.
What High-Risk Actually Means (And Why You Probably Are Not)
The AI Act sorts AI systems into risk tiers. The prohibited tier (social scoring, emotion recognition in workplaces, some biometric categorisation) is already enforceable. The high-risk tier, which covers things like AI used in recruitment screening, credit decisions, and critical infrastructure, carries the heavy obligations: conformity assessments, technical documentation, EU-based authorised representatives. That tier has been pushed to December 2027 for standalone systems and August 2028 for AI embedded in regulated products.
Most SME AI use is what the Act calls limited risk, which triggers transparency duties only. Your chatbot discloses. Your content is marked. That is genuinely most of it, provided you are not making decisions about people with AI, which is the line that moves you into high-risk territory.
The Questionnaire Is Where This Gets Real
Ask a room of UK business owners about the EU AI Act and you will hear about fines and Brussels bureaucracy. Ask a sales director trying to close a deal with a German customer and you will hear something different: the security questionnaire arrived with eleven new AI questions in it, and procurement is waiting.
This is how the Act actually touches most UK SMEs. Not through a regulator knocking on the door, but through the supply chain. EU companies are legally required to understand the AI in their operations, and that includes the AI embedded in what they buy. Their vehicle for understanding it is the questionnaire, the due diligence call, and the contract clause. A deal that used to need a signature now needs an answer to: “describe your AI systems, confirm your transparency obligations under Article 50, and identify who is accountable.”
The companies that answer in a day look like safe suppliers. The companies that ask for three weeks to “check with legal” look like the risk the questionnaire was designed to catch.
The Mistakes We Keep Seeing
Three patterns come up repeatedly when UK SMEs get their first EU AI question:
Confusing the delay with an exemption. Teams read “EU delays AI Act” headlines and conclude there is nothing to do until 2027. The delay applies to the high-risk tier only. The transparency duties have been live law since August 2026, and the content-marking grace period closes on 2 December 2026.
Assuming UK-only means out of scope. It does, legally, until the first EU customer appears. But the questionnaire arrives before the contract, and by then the assessment needs to exist. Scoping yourself out takes an hour; rebuilding a stalled deal takes months.
Treating vendor AI as somebody else’s problem. Your chatbot platform may handle its own marking duties, but your disclosure duty as the deployer is yours. “The vendor said they are compliant” is a good input to your evidence file, not a substitute for one.
What To Do This Quarter
The work divides into three buckets, and none of it is expensive if you do it deliberately:
Inventory. Write down every AI tool your business uses, including the free tools staff adopted without asking. For each one: who owns it, what data goes in, where the output lands, and whether any of it touches EU customers.
Transparency. Check every customer-facing AI touchpoint against Article 50. Does your chatbot disclose? Is AI-generated content marked? If you use chatbots or generative AI features from vendors, confirm they are handling the marking, and get their compliance position in writing.
Evidence. Prepare a one-page AI Act summary before an EU buyer asks for it: what you use AI for, what you have done about disclosure, who is accountable. This turns a deal-blocking questionnaire into an hour of admin.
If you want a quick read on where you stand, we built a free EU AI Act Readiness Checker. Ten questions, two minutes, no email required, and you get a prioritised action plan at the end. It is aimed at UK businesses with EU exposure, but plenty of EU-based companies have used it too.
The Upside Nobody Mentions
Here is the part most compliance coverage misses. Every one of your competitors faces the same rules. The UK SME market has not internalised this yet, which means the businesses that get their AI house in order now will be the ones answering procurement questionnaires in a day while their competitors ask for extensions. Compliance, done early, is a sales asset.
We work with UK SMEs on exactly this: practical AI governance that satisfies EU buyers without enterprise pricing or consultant theatre. If the checker flags gaps you want help closing, book a free discovery call and we will talk it through. And if you want the dry, factual version of the rules without the sales voice, our EU AI Act guide for UK businesses covers the same ground in plain English.