EU AI Act Changes for 2027

TITLE: EU AI Act Changes for 2027

SLUG: eu-ai-act-changes-2027

META: Understand the EU AI Act's impact on UK businesses in 2027. Learn about compliance deadlines, practical steps, and key dates.

EXCERPT: The EU AI Act's deadline for standalone high-risk systems is now 2 December 2027, affecting UK businesses with EU ties.

What is Changing in 2027

The EU AI Act's deadline for standalone high-risk AI systems has been moved from 2 August 2026 to 2 December 2027 ^[1]. This delay aims to strengthen enforcement infrastructure, but the Act's core requirements remain unchanged ^[4].

What is Changing in 2027

The EU AI Act's deadline for standalone high-risk AI systems has been moved from 2 August 2026 to 2 December 2027 ^[1]. This delay aims to strengthen enforcement infrastructure, but the Act's core requirements remain unchanged ^[4].

What it Means for Your Business

The EU AI Act applies to UK businesses if they provide services to EU clients, employ staff based in the EU, or use AI systems that affect EU individuals ^[2]. If your firm adapted its data handling practices for GDPR due to EU clients or personal data, the EU AI Act will similarly apply ^[2]. The Act's "effects-based" approach means that the location of the company is irrelevant; the focus is on where the effects of AI systems are felt ^[2]. For example, a staffing firm in the UK that places candidates at EU-based subsidiaries and uses AI to screen CVs would be in scope for those placements ^[2].

Practical Examples

• Staffing Firms: If your firm places candidates in EU-based subsidiaries and uses AI for CV screening, you need to comply with the EU AI Act.
• Consulting Firms: If you provide AI-driven consulting services to EU clients, you must ensure your AI systems meet the Act's requirements.
• Tech Companies: If your AI systems process EU personal data, you must implement transparency obligations as of 2 August 2026 ^[3].

The EU AI Act introduces several key obligations for businesses:

• Transparency: Chatbots and other interactive AI systems must inform users they are dealing with AI, not a human ^[2].
• Labelling: Deepfakes must be labelled, and AI-generated or altered content must carry machine-readable marks ^[2].
• Documentation: Providers of general-purpose AI (GPAI) models must document certain information and provide it to competent authorities or downstream providers ^[2].
• Copyright Policy: Providers must put in place a copyright policy and publish a sufficiently detailed summary of the content used to train their models ^[2].
• Prohibited Practices: The Act bans particularly harmful systems, including those that manipulate people, exploit vulnerabilities, or unfairly score individuals ^[2].

What to Do Now

1. Assess Your AI Systems: Identify which of your AI systems fall under the EU AI Act's scope. Focus on high-risk systems that could impact EU individuals.

• Step-by-Step Guide: Begin by mapping out all AI systems used in your business. Determine which systems interact with EU clients or process EU personal data. Classify these systems based on their risk level and the potential impact on EU individuals.

1. Update Your Policies: Review and update your data handling and transparency policies to align with the EU AI Act's requirements.

• Example: If your firm uses AI for customer service chatbots, ensure that these systems are transparent about their use of AI and provide clear information to users about data handling practices.

1. Train Your Staff: Ensure your team understands the new regulations and can implement them effectively.

• Training Sessions: Organise regular training sessions for your staff to familiarise them with the EU AI Act. Focus on key areas such as data protection, transparency, and risk management.

1. Conduct Risk Assessments: Evaluate the risks associated with your AI systems and develop mitigation strategies.

• Risk Assessment Tools: Use risk assessment tools to identify potential risks and develop strategies to mitigate them. Document these assessments and keep them up to date as new risks emerge.

1. Engage with Regulators: Stay informed about updates and changes from regulatory bodies and participate in consultations.

• Regulatory Updates: Subscribe to regulatory updates from the EU and local authorities to stay informed about changes to the EU AI Act and other relevant regulations.

1. Document Compliance: Keep detailed records of your compliance efforts and risk assessments to demonstrate adherence to the Act.

• Compliance Documentation: Maintain comprehensive records of all compliance activities, including risk assessments, training sessions, and policy updates. This documentation will be crucial for demonstrating compliance to regulators and auditors.

Key Dates

• 2 August 2026: Transparency obligations under Article 50 apply ^[3].
• 2 December 2027: Deadline for standalone high-risk systems under Annex III ^[1].

Total Group helps businesses adopt AI safely, starting with an AI Readiness Assessment. Talk to us on 01727 881 224.

How Total Group can help

Total Group helps businesses adopt AI safely, starting with an AI Readiness Assessment. Talk to us on 01727 881 224.

• AI for business
• Private AI on hardware you own
• Free AI Readiness Review

Talk to us about what 2027 means for your business or call 01727 881 224.

Sources

1. Changes to EU AI Act implementation deadlines welcomed … (itpro.com)
2. Commission starts enforcing AI Act rules and new … – Futurium (futurium.ec.europa.eu)
3. EU AI Act Deadline Shifts to 2027, Compliance Remains Key (google.com)
4. EU AI Act August 2026 Deadline: What Applies Now – Fontvera (fontvera.eu)
5. EU Moves to Delay High-Risk AI Act Compliance to December … (idtechwire.com)

Frequently asked questions

What is the new deadline for standalone high-risk AI systems under the EU AI Act?

The deadline for standalone high-risk AI systems under the EU AI Act has been moved from 2 August 2026 to 2 December 2027 [1].

How does the EU AI Act apply to UK businesses?

The EU AI Act applies to UK businesses if they provide services to EU clients, employ staff based in the EU, or use AI systems that affect EU individuals [2].

What are the key obligations under the EU AI Act for businesses?

Key obligations include transparency requirements, labelling of deepfakes, documentation of general-purpose AI models, and adherence to prohibited practices [2].

What steps should businesses take to prepare for the EU AI Act?

Businesses should assess their AI systems, update policies, train staff, conduct risk assessments, engage with regulators, and document compliance efforts [2].