EU AI Act readiness for UK firms selling into the EU

• A sweep of engineering repositories, cloud accounts, the procurement register and supplier contracts finds candidate AI systems, and the assistant drafts an inventory entry for each, with its sources linked.
• For each system, the assistant drafts a role (provider or deployer), whether it reaches the EU, and a possible classification, citing the article, annex point or guideline passage it relied on, and stating plainly what it doesn't know.
• A named legal or compliance owner decides every role and every classification, records the reasoning, and sends borderline cases to EU counsel. The draft is never the decision.
• For the systems the group provides as high-risk, the assistant drafts technical documentation in the structure of Annex IV from engineering sources, marking each gap rather than filling it.
• When a system changes, such as a new model, a new use or a new EU customer, the change raises an event and its classification goes back to its owner for review.
• What it doesn't do: no final legal opinion, no conformity decision, no registration in the EU database and nothing sent to customers or authorities without a person.

• European CommissionEU AI Act scope (Article 2)
  →

  The Act applies to providers placing AI systems on the EU market, whether they are established in the EU or not, and to providers and deployers outside the EU where the system's output is used in the EU. So each inventory entry records who built it, who sells or uses it, and where its output lands. Where the servers are doesn't decide it.

• European CommissionHigh-risk classification (Article 6, Annexes I and III) and the Digital Omnibus
  →

  Annex III high-risk duties apply from 2 December 2027 and Annex I from 2 August 2028. The Commission published draft guidelines on high-risk classification on 19 May 2026 and consulted on them; the final version had not been published when we checked. A provider relying on the Article 6(3) exception must document its assessment before placing the system on the market, and the system must still be registered, though the Omnibus simplified the information required. A named person makes that call, not the assistant.

• European CommissionProvider duties: technical documentation, quality management and an EU authorised representative
  →

  Providers of high-risk systems need technical documentation (Annex IV), a quality management system, logging, human oversight and conformity assessment. A provider outside the EU must appoint an authorised representative in the EU, by written mandate, before making a high-risk system available there (Article 22). The first harmonised standard, EN 18286 on quality management, was cited in the Official Journal in October 2026; others are still being written by CEN and CENELEC. The Omnibus extended simplified documentation from SMEs to small mid-cap companies.

• European CommissionDeployer duties, transparency and AI literacy
  →

  Where the group only uses a high-risk system, deployer duties apply: use it as instructed, assign human oversight, keep logs and monitor it. Deployers using credit scoring or life and health insurance pricing also owe a fundamental rights impact assessment. Transparency duties for chatbots and AI-generated content have applied since 2 August 2026. The AI literacy duty has applied since February 2025; the Omnibus changed it to taking measures to support staff AI literacy.

• European Commission AI OfficeGeneral-purpose AI models
  →

  Model provider duties have applied since 2 August 2025, and the Commission's enforcement powers since 2 August 2026. The voluntary code of practice was published in July 2025. Calling a model through a cloud API usually leaves those duties with the model's provider, but significantly modifying a model can make you its provider. Record which models each system uses, and how.

• European CommissionPenalties (Article 99)
  →

  Up to €35 million or 7% of worldwide turnover for prohibited practices, €15 million or 3% for most other breaches, and €7.5 million or 1% for misleading information to authorities, whichever is higher. For SMEs it is whichever is lower. The new prohibitions on AI that generates non-consensual intimate images or child sexual abuse material apply from 2 December 2026.

• UK governmentNo UK equivalent yet
  →

  The King's Speech of 13 May 2026 included no dedicated AI bill. It announced sandboxing powers for testing new products, including AI, in a Regulating for Growth Bill. In the UK, AI stays under existing law and sector regulators, so the inventory serves both: the same record answers an EU classification question and a UK regulator's question.

• ICOUK GDPR for the readiness work itself
  →

  System documents, test data and logs often hold personal data. Index only what the work needs, process it in UK regions, keep a retention period, and make sure no provider trains its models on your documents. Systems that make decisions about people also need the UK's own automated decision rules, covered in a separate playbook.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A named owner for the inventory, and a named decision-maker in legal or compliance for each business area, with EU counsel on call for borderline cases.
• A classification method agreed before the pilot: the questions, in order, from scope to role to annex to exception, so drafts and decisions follow the same path.
• A weekly sample of drafts checked against their citations, with any wrong or stretched citation fed back and the prompt fixed under change control.
• Product and procurement processes changed so that no AI feature ships, and no AI supplier is signed, without an inventory entry.
• A plan for the authorised representative and EU database registration for any high-risk system the group provides, owned by legal.
• AI literacy measures for product, sales and support staff, recorded in the same place as the inventory.

1. 3 weeks

   Discovery

   Agree the classification method with legal, list the sources of truth (repositories, cloud accounts, procurement, contracts), load the source library, and pick one product line.

2. Gate · must be true to passMethod signed off by legal, decision-makers named, data access confirmed, DPIA screening done.

3. 6–8 weeks

   Pilot

   Sweep the pilot product line, draft entries and classifications, and have owners decide them. Compare with a hand-built inventory for the same line.

4. Gate · must be true to passNo system missed that the hand-built list found, every sampled citation accurate, and owners say drafts save them time.

5. 4–6 weeks

   Production

   Extend the sweep to the whole group, connect change events, and start technical documentation drafts for systems the group provides as high-risk.

6. Gate · must be true to passEvery entry decided by a named owner, change events live, and documentation gaps tracked to owners and dates.

7. Ongoing

   Scale

   Keep the inventory current, re-check decisions when guidance or standards change, and reuse it for UK regulators' questions and customer due diligence.

8. Gate · must be true to passQuarterly sample audit of entries passes, and no change goes live without re-review.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The draft classification reads like an opinion, so it is treated as one.

   How the design avoids it

   Drafts are labelled as drafts, a guardrail blocks 'compliant' and similar wording, and only a named owner can mark an entry decided.

2. 2

   Goes wrong

   The assistant cites the right article for the wrong point, and nobody checks.

   How the design avoids it

   Every claim is cited to a dated passage, and a weekly sample is checked by a person against the source.

3. 3

   Goes wrong

   The inventory only covers what engineering built, and misses AI inside bought software.

   How the design avoids it

   Sweep the procurement register and supplier terms too, and add an AI question to every new supplier contract.

4. 4

   Goes wrong

   Everyone assumes the system is out of scope because the servers are in London.

   How the design avoids it

   Scope is decided on who places it on the market and where the output is used, recorded for each entry.

5. 5

   Goes wrong

   The inventory is built once for a deadline and is stale a quarter later.

   How the design avoids it

   Change events from releases, suppliers and sales reopen entries, and decided entries are re-checked when guidance changes.

1. 2 December 2026
   New prohibitions on AI that generates non-consensual intimate images or child sexual abuse material apply, and machine-readable marking becomes due for AI content tools placed on the market before 2 August 2026.

   Check every generative feature that EU users can reach: what it can produce, what stops misuse, and how its output is marked.

2. Awaited
   The Commission's final guidelines on high-risk classification. The draft was published on 19 May 2026 and consulted on.

   Classify against the draft now, record which version each decision relied on, and re-check when the final text arrives.

3. In progress
   More harmonised standards from CEN and CENELEC's joint AI committee. EN 18286 on quality management was cited in October 2026; others, such as risk management, are still being written.

   Build your quality management and documentation so they map to the standards as they are cited, rather than waiting for all of them.

4. 2 December 2027
   Annex III high-risk duties begin, including credit scoring, recruitment, and life and health insurance pricing.

   For each system the group provides, have the technical documentation, quality management, logging, human oversight and authorised representative in place before this date.

5. 2 August 2028
   Annex I high-risk duties begin for AI that is, or is a safety component of, a product under the EU product laws listed in Annex I.

   If you sell machinery or devices into the EU, fold AI into the conformity assessment you already do for those products.