The EU AI Act for professional services firms.
The EU AI Act applies to a UK professional services firm whenever the output of an AI system it uses or builds is used in the EU, so a firm with EU clients should treat itself as in scope for that work. For most consultancies, accountants, law firms and surveyors the duties today are light: AI literacy for staff, transparency where AI content reaches the public, and staying clear of the prohibited practices. The heavier high-risk duties, which catch AI used in recruitment, managing staff and credit or insurance decisions, now apply from 2 December 2027 after the Digital Omnibus delayed them.
- Risk tiers in the Act
- 4
- Months added to the high-risk deadline
- 16
- Top fine for a prohibited practice
- €35m
- Of worldwide turnover, if higher
- 7%
Firms we have built with
Does the EU AI Act apply to a UK professional services firm?
Often, yes. The AI Act (Regulation (EU) 2024/1689) is not limited to firms based in the EU. Article 2(1)(c) brings in providers and deployers established outside the EU "where the output produced by the AI system is used in the Union". A UK consultancy that drafts a report for a client in Dublin with the help of an AI tool, or an accountancy that builds a client portal with an AI assistant used by clients in Paris, has an output used in the Union. Brexit does not change that.
The Act gives most firms one of two roles. A deployer is a firm that uses an AI system under its own authority in the course of its work: a firm that rolls out ChatGPT Enterprise or Claude to its teams is a deployer. A provider is one that develops an AI system, or has one developed, and puts it on the market or into service under its own name. The difference matters for consultancies, because a firm that builds an AI tool and offers it to clients under its own brand has moved from deployer to provider for that tool, and providers carry most of the Act's obligations. Under Article 25, a deployer can also become a provider by putting its name on a high-risk system, substantially modifying one, or changing a system's intended purpose so that it becomes high-risk.
The UK has no equivalent law. As of October 2026 there is no comprehensive UK AI Act; the government regulates AI through existing regulators and existing law, such as UK GDPR. For a UK firm with EU clients, the EU AI Act is the most specific AI law it is likely to meet, alongside the rules of its own professional body.
- AI-assisted work sent to EU clients
- AI tools you build for clients
- Offices or subsidiaries in the EU
- UK clients who pass your work to the EU
How does the EU AI Act sort AI by risk?
The Act regulates uses of AI, not the technology itself, and sorts them into four tiers. Most of what a professional services firm does with AI sits in the bottom tier. Separate rules apply to the companies that build general-purpose AI models, such as OpenAI and Anthropic; a firm that only uses those models does not take on those duties.
Prohibited practices
Banned outright under Article 5. They include manipulative or deceptive techniques that distort behaviour, social scoring, untargeted scraping of facial images, and emotion recognition in the workplace or in education, except for medical or safety reasons. That last one is the most relevant to firms: a tool that infers how employees feel from their voice or face on calls is prohibited. A ninth prohibition, on AI that generates non-consensual intimate imagery or child sexual abuse material, applies from 2 December 2026.
High-risk AI
Uses listed in Annex III, or AI built into products covered by EU safety law under Annex I. These carry the full set of duties: risk management, data governance, technical documentation, logging, human oversight and registration. Annex III covers areas such as employment, credit and insurance, education, essential services and the administration of justice.
Transparency duties
Under Article 50, people must know when they are talking to an AI system, synthetic content must be marked as AI-generated, and deepfakes must be disclosed. These duties apply from 2 August 2026, whatever the risk tier.
Minimal risk
Everything else: drafting, research, summarising, analysis, proposals and internal automation. No specific obligations beyond AI literacy, though your clients, your contracts, UK GDPR and your professional body still set rules of their own.
When do the EU AI Act obligations apply after the Digital Omnibus?
The Act entered into force on 1 August 2024 and applies in stages. On 19 November 2025 the European Commission proposed the Digital Omnibus on AI to delay and simplify parts of it. A political agreement followed on 7 May 2026, and the final text was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744. It entered into force on 27 July 2026. The dates that matter now are these.
- 2 February 2025: the prohibited practices and the AI literacy duty in Article 4 apply.
- 2 August 2025: the rules for providers of general-purpose AI models, the governance structure and the penalty regime apply.
- 2 August 2026: most of the remaining Act applies, including the Article 50 transparency duties, and the AI Office and national authorities are responsible for enforcement.
- 2 December 2026: the new prohibition on AI that generates non-consensual intimate imagery or child sexual abuse material applies, and the grace period ends for generative AI systems placed on the market before 2 August 2026 to mark their output as AI-generated in a machine-readable way.
- 2 December 2027: the high-risk duties for Annex III uses, including employment, credit and insurance, apply. This was 2 August 2026 before the Omnibus.
- 2 August 2028: the high-risk duties for AI built into products under Annex I apply. This was 2 August 2027.
Two common misreadings are worth avoiding. The Omnibus delayed the high-risk duties; it did not delay the prohibitions, AI literacy or, apart from that short marking grace period, the transparency duties, which already apply. And much of the guidance still ranking for this subject was written before July 2026, so it gives 2 August 2026 as the high-risk deadline. Check the date on anything you rely on.
Fines are set by Article 99: up to €35 million or 7% of worldwide annual turnover, whichever is higher, for a prohibited practice; up to €15 million or 3% for most other breaches; and up to €7.5 million or 1% for supplying incorrect information to authorities. For SMEs the lower of the two figures applies.
Which uses of AI in a professional services firm could be high-risk?
For most firms the honest answer is very few, but the ones that are high-risk are easy to stumble into, because they sit in the back office rather than in client work.
The first is your own hiring. Annex III lists AI used to place targeted job adverts, filter applications and evaluate candidates. A firm that uses an AI tool to screen CVs or rank candidates for roles that EU applicants apply to is deploying a high-risk system. The second is managing your people: AI that informs decisions about promotion or termination, allocates work based on individual behaviour or personal traits, or monitors and evaluates performance. Recruitment and HR consultancies that use or supply such tools sit squarely in this area.
The third is financial: AI that assesses the creditworthiness of individuals, other than for detecting fraud, or that assesses risk and sets prices for life and health insurance. That matters for financial advisers, brokers and the consultancies that build tools for them. The fourth is legal: AI intended to help a judicial authority, or an alternative dispute resolution process, to research and interpret facts and law and apply the law to the facts.
Article 6(3) gives a way out for some systems in these areas. A system is not high-risk if it does not pose a significant risk of harm and only performs a narrow procedural task, improves the result of work a person has already completed, detects patterns in decisions without replacing human assessment, or performs a preparatory task. Two cautions apply. A system that profiles individuals is always high-risk. And a provider relying on the exception must document its assessment and still register the system in the EU database, through a simplified procedure that the Omnibus kept rather than removed.
- Screening CVs and ranking candidates
- Promotion, task allocation and performance monitoring
- Credit, and life or health insurance pricing
- Supporting courts or arbitration
What does the EU AI Act require of a firm that uses AI?
As a deployer, these are the duties that apply to most professional services firms now.
- AI literacy (Article 4). Since 2 February 2025, providers and deployers must take measures to support the development of AI literacy among their staff and anyone using AI systems on their behalf, suited to their knowledge, experience and the context of use. The Omnibus softened the wording from ensuring "a sufficient level" of literacy and gave the Commission and member states a duty to help, but the obligation remains. Role-based training, with a record of who was trained on what, is the practical answer.
- Transparency (Article 50). If you publish AI-generated text to inform the public on matters of public interest, you must disclose it, unless a person has reviewed it and someone holds editorial responsibility for it. Thought leadership that a named partner reviews and signs off is the safe pattern. AI-generated or manipulated images, audio or video of real people, places or events must be disclosed as such. A chatbot on your website must make clear that people are talking to an AI; that duty falls on the provider, so check your supplier, and if you built the chatbot yourself, it falls on you.
- The prohibitions (Article 5). Check that nothing you use, or have built, infers employees' emotions at work or manipulates the people it interacts with.
If you deploy a high-risk system, the duties in Article 26 apply from 2 December 2027. They include using the system in line with the provider's instructions, assigning human oversight to people with the competence, training and authority to exercise it, making sure the input data you control is relevant, monitoring the system and reporting serious incidents, keeping its logs for at least six months, telling workers and their representatives before an AI system is used in the workplace, and telling individuals when a high-risk system is used to make or assist decisions about them.
What should a consultancy do about the EU AI Act now?
Most of what the Act asks of a professional services firm is good governance you would want anyway, and the delay to the high-risk duties gives you time to do it properly. Work through it in this order.
- Map where your AI output goes. List every AI tool your people use, including the consumer tools nobody signed off, and note which clients, and which countries, receive work they touch. That tells you whether the Act reaches you.
- Classify each use. Mark anything in recruitment, staff management, credit, insurance or legal decision-making for a closer look, and confirm nothing you use falls into a prohibited practice.
- Record your AI literacy training. Train by role, and keep a dated record. This duty already applies.
- Write the policies. An internal policy that sets out what may be used, with what data and with what review, and an external policy that tells clients how you use AI on their work.
- Assess each tool before it is used. An impact assessment for each AI tool, with risks rated before and after mitigation, and a register of approved tools.
- Set up the audit trail. A risk register and an incident log, so that you can show a client, an auditor or a regulator what you decided and why.
- Fix the transparency points. Decide who holds editorial responsibility for AI-assisted content you publish, and check your website chatbot and any synthetic media.
This is the work our AI governance implementation does. It gives you internal AI policies for your teams, external AI policies for clients and partners, impact assessments so you understand the implications of what you deploy, and audit trails including a risk register and an incident log, tailored to your data, your clients and the bodies you answer to. It typically takes two to four weeks and starts from £3,000. For Hillbreak, a specialist ESG and sustainability advisory firm for the real estate sector, we assessed its AI policy against the RICS standard and prepared the nine documents that closed the gaps, then ran an impact assessment workshop so the team can assess new tools themselves.
For the literacy duty, AI team training gives your people practical training built around their roles and the tools they actually use. If you want a policy to start from, our free AI policy template covers the AI Act alongside UK GDPR, and the governance template we use with clients is free on our resources page. And if you would like to see where your firm stands first, the free AI maturity assessment is nine questions and about two minutes. This guide explains the Act; it is not legal advice, so where a specific use sits close to a high-risk line, take legal advice on it.
Describe the defined business use case for this tool. What problem does it solve, and what outputs will it produce?
| Non-AI alternatives considered | |
|---|---|
| Why AI is more appropriate than alternatives | |
| Is this use of AI proportionate to the task? |
Governance pack · TemplateAI Tool Impact Assessment
Complete one per AI tool. Retain as a governance record.
| Tool name | |
|---|---|
| Vendor or provider | |
| Version or model | |
| Date of assessment | |
| Assessor | |
| Business owner | |
| Date of first use | |
| Next review date |
- A register of every AI tool and use
- Role-based AI literacy training
- Internal and external AI policies
- A risk register and an incident log
Sources for this guide
Checked on 21 October 2026. Article numbers refer to the AI Act as amended by the Digital Omnibus on AI.
- Regulation (EU) 2024/1689, the Artificial Intelligence Act, EUR-Lex.
- Regulation (EU) 2026/1744, the Digital Omnibus on AI, EUR-Lex, published 24 July 2026.
- AI Act: regulatory framework and application timeline, European Commission.
- Digital AI Omnibus delays key deadlines, introduces new rules, Cooley, 3 August 2026.
- EU AI Act omnibus agreement: postponed high-risk deadlines and other key changes, Gibson Dunn, 27 May 2026.
- AI Act Explorer: Article 2, Article 4, Article 50 and Annex III, Future of Life Institute.
- AI judgment day on the horizon while UK lawmakers play catch up, Lewis Silkin, 14 September 2026.
Questions
Does the EU AI Act apply to UK firms after Brexit?
It can. Article 2 reaches providers and deployers outside the EU where the output of their AI system is used in the EU. A UK firm that sends AI-assisted work to EU clients, or builds an AI tool that EU clients use, should assume it is in scope for that work.
Is using ChatGPT or Claude in a consultancy high-risk under the EU AI Act?
Not on its own. Research, drafting, summarising and proposal writing are not on the high-risk list. A use becomes high-risk when it falls into one of the Annex III areas, the most common in professional services being recruitment, decisions about staff such as promotion, task allocation and performance monitoring, and credit or life and health insurance decisions about individuals.
When do the EU AI Act high-risk rules apply now?
After the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, the high-risk duties for Annex III uses such as employment and credit apply from 2 December 2027 instead of 2 August 2026. High-risk AI built into regulated products under Annex I applies from 2 August 2028. The prohibitions, AI literacy and the transparency duties were not delayed, apart from a grace period to 2 December 2026 for marking the output of generative AI systems already on the market.
What does the AI literacy requirement mean for a professional services firm?
Article 4 has applied since 2 February 2025. As amended by the Digital Omnibus, it requires providers and deployers to take measures to support the development of AI literacy among their staff and others who use AI systems on their behalf, suited to their knowledge, experience and the context of use. In practice that means role-based training and a written record of what people were taught and when.
Does the UK have its own AI Act?
No. As of October 2026 the UK has no comprehensive AI law; AI is regulated through existing regulators and existing law, such as UK GDPR. Professional bodies are setting their own rules, such as the RICS professional standard on the responsible use of AI in surveying practice, in effect since 9 March 2026.
Can AssumeAI help us prepare for the EU AI Act?
Yes. AI governance implementation, from £3,000 and typically two to four weeks, gives you internal and external AI policies, impact assessments for the tools you use, and audit trails including a risk register and an incident log, tailored to your clients, your data and the bodies you answer to. Where a specific use sits close to a high-risk line, take legal advice on that use as well.