What does EU AI Act compliance actually cost a UK business?

Two numbers get repeated about the EU AI Act: a large penalty figure, and a deadline that has already moved once. Neither tells a UK business what to actually budget for, or whether the Act reaches it at all.

Does it apply to you

The Act's reach is not about where a company is registered. It applies based on where an AI system is placed on the EU market, or where its output is used, the same extraterritorial logic that made GDPR apply well beyond the EU's own borders. A UK business with an AI feature sold into the EU, or an AI system that processes EU residents' data, can find itself inside scope with no EU office and no EU staff. A UK business trading only with UK customers, on UK infrastructure, is the case most likely to sit outside it, but that conclusion is worth reaching deliberately, with an actual review of where the business's customers, data and AI outputs actually go, not assumed because the letterhead says London.

The deadline that moved, twice

The Act's high-risk system obligations were originally due to take full effect on 2 August 2026. That date has been superseded. The EU's Digital Omnibus on AI deferred the high-risk timeline: standalone high-risk systems under Annex III are now due 2 December 2027, and high-risk AI embedded in regulated products under Annex I is due 2 August 2028. The process ran through a provisional political agreement on 7 May 2026, European Parliament endorsement on 16 June 2026, and Council's final green light on 29 June 2026.

Not everything moved. Article 50's transparency obligations, disclosing that content is AI-generated or that a person is interacting with an AI system rather than a human, largely kept their original schedule. Treating the whole Act as pushed back is a common and costly misreading of what actually happened.

The deferral changed when the obligations start, not what they cost once they apply, and not the transparency rules that were never deferred.

What the penalties actually are

Article 99 of the Act sets three tiers, and in each case the fine is whichever figure is higher, the flat amount or the percentage of global turnover:

These figures were fixed when the Act was adopted and the Digital Omnibus deferral did not change them. What changed is the date the obligations that carry the 15 million euro or 3% tier actually start applying.

The cost that is not a fine

The penalty tiers get the attention, but for most businesses in scope, the real budget line is not a hypothetical fine, it is the cost of building the compliance work itself: a technical documentation package that actually describes what the system does and how, a risk management process that runs across the system's life rather than once at launch, human oversight that is a real function with the authority to intervene rather than a named person on an org chart, and record-keeping that can reconstruct a consequential decision after the fact rather than a log file nobody has read. None of that is free, and none of it is optional once a system is classified as high-risk. Building it once, correctly, before a deadline is not the same cost as building it in a rush after one has already passed.

What this means in practice

A UK business genuinely outside the Act's scope has no obligation to build any of this. A business inside scope has real time before the high-risk obligations bind, December 2027 for standalone systems, August 2028 for systems embedded in regulated products, but the transparency obligations that were not deferred may already apply now. The honest budgeting exercise has three steps: establish scope properly rather than assuming it, separate the transparency obligations that are live from the high-risk obligations that are not yet due, and treat the deferred window as time to build the documentation and oversight processes correctly rather than a reason to postpone the decision entirely.