The EU AI Act in 2026: what a Scottish business needs to know

For most small Scottish businesses using AI tools for their own UK work, the EU AI Act doesn’t apply directly. It does matter if you sell AI systems into the EU, or if what your AI produces is used there. And 2026 moved the dates: the strict high-risk rules now start in December 2027 and August 2028, while most of the transparency rules began on 2 August 2026.

Does it apply to you?

Article 2 sets out who’s covered. Three parts matter most for a UK business:

• Providers that put AI systems on the EU market, wherever they’re based. A provider is whoever develops an AI system, or has one developed, and puts it out under its own name.
• Deployers (organisations using an AI system in their work) that are established or located in the EU. An office in Dublin counts.
• Providers and deployers outside the EU, where the output produced by the AI system is used in the EU.

For example, an Edinburgh software company selling a booking app with an AI assistant to hotels in Spain is a provider on the EU market. A Glasgow recruitment agency using AI to shortlist candidates for jobs in Germany is using AI whose output is used in the EU. A Perth accountancy practice using an AI assistant to draft letters to UK clients isn’t caught.

Nor does it cover purely personal use, or research and development before a system goes on the market. The UK has no equivalent law: the King’s Speech on 13 May 2026 included no AI bill, and AI here is regulated through existing law such as UK GDPR. Our UK GDPR checklist for AI tools covers that side.

Four levels of risk

The European Commission sorts AI into four tiers:

• Unacceptable risk: banned.
• High risk: strict obligations, for uses such as recruitment and credit scoring.
• Transparency risk: people must be told, as with chatbots and deepfakes.
• Minimal or no risk: no specific rules. Most everyday office uses, such as drafting emails or summarising documents, sit here.

What’s banned

The prohibitions in Article 5 have applied since 2 February 2025. They cover AI that:

• uses manipulative or deceptive techniques to distort behaviour and cause significant harm
• exploits vulnerabilities linked to age, disability or social or economic situation
• scores people on social behaviour or personal characteristics, leading to unfair treatment
• predicts crime based solely on profiling or personality traits
• builds facial recognition databases by untargeted scraping of images from the internet or CCTV
• infers people’s emotions at work or in education, except for medical or safety reasons
• uses biometric data to deduce traits such as race, political opinions or sexual orientation
• does real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.

Regulation (EU) 2026/1744 added two more from 27 July 2026: AI that generates or manipulates intimate images, video or audio of identifiable people without their consent, and AI that generates child sexual abuse material.

Most of this is far from small-business life. The one to watch is emotion recognition: software that claims to read staff mood from voice or video is banned in workplaces the Act covers.

Transparency: what applies now

Most of the Article 50 duties have applied since 2 August 2026:

• Chatbots. AI systems that talk to people must be designed so people know they’re dealing with AI, unless it’s obvious. This sits with the provider, which can be you if you built the chatbot, even on top of someone else’s model.
• Generated content. Providers of systems that generate audio, images, video or text must mark the output, in a machine-readable way, as AI-generated. Systems already on the market before 2 August 2026 have until 2 December 2026.
• Deepfakes. Deployers must disclose that images, audio or video have been artificially generated or manipulated.
• Public-interest text. AI-generated text published to inform the public on matters of public interest must be disclosed, unless it has had human review and someone holds editorial responsibility.
• Emotion recognition and biometric categorisation. Deployers must tell people these systems are being used on them.

High-risk rules: what moved

The high-risk rules are the heaviest part of the Act, covering risk management, documentation, human oversight and more. They were due to start in 2026 and 2027. Regulation (EU) 2026/1744, often called the “Digital Omnibus”, came into force on 27 July 2026 and moved them to fixed later dates:

• 2 December 2027 for the uses listed in Annex III. These include recruitment and managing workers, credit scoring, life and health insurance pricing, education, and access to essential public services.
• 2 August 2028 for AI that’s a safety component of products already covered by EU product law (Annex I), such as toys, lifts and medical devices.

If you use AI to shortlist candidates or assess credit for people in the EU, use the extra time: ask your supplier how they’ll comply, and check what a person actually reviews.

The dates at a glance

Date	What applies
1 August 2024	The AI Act enters into force
2 February 2025	Banned practices and the AI literacy duty
2 August 2025	Rules for providers of general-purpose AI models (the big model makers)
27 July 2026	Regulation (EU) 2026/1744 in force: two new bans and a softer AI literacy duty
2 August 2026	Most Article 50 transparency duties
2 December 2026	AI-content marking for generative systems already on the market before 2 August 2026
2 December 2027	High-risk rules for Annex III uses
2 August 2028	High-risk rules for AI in Annex I products

What most small firms need to do

1. Map where AI touches the EU. List your AI tools and ask of each: do we sell it, or does its output reach people in the EU? If the answer is no, the Act probably isn’t your problem, though UK GDPR still is.
2. Check nothing you do is banned. For most firms, that means no emotion recognition on staff.
3. Label AI where people would want to know. Tell EU users when they’re talking to a chatbot, and disclose deepfakes you publish. It’s good manners in the UK too.
4. Support your team’s AI literacy. Since 27 July 2026, Article 4 says providers and deployers must “take measures to support the development of AI literacy” of their staff, rather than ensure a sufficient level of it. Short, practical training is the obvious measure.
5. Ask your suppliers. If a vendor’s AI is part of what you sell into the EU, ask how they meet the Act, and get the answer in writing.
6. Diary the high-risk dates if you use AI in hiring, credit, insurance or education decisions affecting people in the EU.

Not sure which side of the line you’re on? The note on the AI deadline that moved has the current dates, and ranking job applicants is the high-risk use most small firms already run.