EU AI Act and UK data reform: what applies now

A company incorporated and staffed entirely in England can still owe obligations under the EU AI Act.  The Regulation follows the market rather than the map: it reaches providers placing AI systems on the Union market wherever established, and providers and deployers outside the Union whose system produces output used inside it.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, postponed a good deal of the AI Act in July.  It retained Article 50’s general application date, subject to a limited transition for providers’ machine-readable marking obligations, and it left the United Kingdom’s own reforms alone.

What applies, and from when

• Applying from 2 August 2026.  The Article 50 transparency obligations, subject to the marking transition below.
• In force since 5 February 2026.  The core data protection changes in the Data (Use and Access) Act 2025.
• In force since 19 June 2026.  The data protection complaints provisions in that Act.
• 2 December 2026.  Machine-readable marking under Article 50(2), for providers whose generative systems were on the EU market before 2 August 2026.
• 2 December 2027.  High-risk obligations for stand-alone systems under Article 6(2) and Annex III, postponed from 2 August 2026.
• 2 August 2028.  Product-related high-risk systems under Article 6(1) and Annex I, postponed from 2 August 2027.

Two roles, and three duties that do different work

Article 50 sorts its obligations by role.  A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trade mark.  A deployer uses a system under its own authority, unless the use is personal and non-professional.  A company is often both, and the two sets of obligations run independently.

The three duties do different work.  Marking under Article 50(2) is machine-readable: a signal letting software recognise output as artificially generated, which the reader may never see.  Informing users under Article 50(1) is owed to the person at the keyboard, who must be told, in terms they will notice, that their interlocutor is a machine.  Disclosure under Article 50(4) attaches to publishing certain AI-generated material and is owed to whoever reads it.

A company that is both

Take a hypothetical English software company supplying its own branded customer-support assistant to businesses in Germany and the Netherlands.  The assistant sits on those customers’ websites and writes replies to members of the public.  The company also publishes commentary on its own site, written with a generative model and read chiefly by customers in those countries.

The assistant it sells.  The company had it built and sells it under its own name, so it is the provider and its customers are the deployers.  It must design the assistant so that those using it are told they are dealing with an AI system.  That duty falls away where the position is obvious, but the Commission reads the exception narrowly, by reference to a reasonably well-informed, observant and circumspect person.  A chat window will not do the work on its own, a good many being staffed by people.

Marking.  The assistant composes replies rather than tidying text someone else has written, so its output is synthetic and must carry a machine-readable signal saying so.  The exception for an assistive function for standard editing runs to spellchecking and grammatical correction; it does not reach a system that writes the answer.

The commentary it publishes.  Here the company is a deployer.  Where AI-generated text is published to inform the public on a matter of public interest, the deployer must disclose that it was artificially generated, and the company is reached because its output is used within the Union.  The exemption is narrower than it looks, requiring both human review or editorial control and a natural or legal person holding editorial responsibility for publication.  Review without anyone answerable for publication will not satisfy it, and nor will the reverse.

The marking date.  Article 111(4), inserted by the Omnibus, gives providers whose generative systems were placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2).  A system placed on the market on or after 2 August 2026 is within the obligation from the outset.

The other Omnibus

Two instruments share the name.  Regulation (EU) 2026/1744, in force since 27 July 2026, is the one that is law: it amends the AI Act, with the civil aviation and machinery regulations, and leaves the EU GDPR untouched.  The other, a Commission proposal to reopen the EU GDPR and the ePrivacy Directive, has not been adopted; whatever it eventually does, it will do to the EU GDPR, and not to the UK GDPR.

The AI Omnibus also introduces Article 4a, extending the exceptional permission to process special category personal data for bias detection and correction beyond providers of high-risk systems.  The extension concerns specified harmful biases and remains subject to strict necessity and the full statutory conditions and safeguards.

The reforms at home

The recognised legitimate interest basis adds five conditions to Annex 1 to the UK GDPR on which a controller need not carry out a balancing test.  That is a real relaxation, and it does not go far.  The conditions are public-interest purposes such as safeguarding, emergencies and the detection of crime, necessity must still be shown, and a commercial organisation can rely on the basis only where one of them is engaged.  Read as a general easing of the rules for commercial processing, it would be an expensive misunderstanding.

The complaints duty is the broader change.  Since 19 June 2026 every controller subject to the UK GDPR, or to Part 3 of the Data Protection Act 2018, has had to facilitate data protection complaints, acknowledge receipt within 30 days and respond without undue delay.  There is no exemption for small organisations and none by sector.

We set out the checks that follow, and where the regulator’s guidance has yet to catch up with the statute, in DUAA data protection provisions in force, ICO guidance in transit: what to check now.

On transfers, the Commission renewed the United Kingdom’s adequacy decisions, which allow personal data to move from the EEA to the United Kingdom without additional transfer safeguards, on 19 December 2025.  They run to 27 December 2031, with a review after four years.  Renewal is not permanence: the Commission monitors conditions in third countries continuously and may repeal, amend or suspend a decision where the protection has fallen away.

What to do

• First, separate the systems the business provides from those it merely uses, and establish for each whether it is placed on the Union market or produces output used there.
• Second, for anything provided, establish what the system does, composing and editing being treated differently, then check whether it was on the market before 2 August 2026.
• Third, make sure a data protection complaint reaches somebody answerable for it and is acknowledged within 30 days.

If you would like help with any of this, please contact Robert Humphreys or a member of the HLaw team.

All the thoughts and commentary that HLaw publishes on this website, including those set out above, are subject to the terms and conditions of use of this website.  None of the above constitutes legal advice and is not to be relied upon.  Much of the above will no doubt fall out of date and conflict with future law and practice one day.  None of the above should be relied upon.  Always seek your own independent professional advice.

Humphreys Law