Skip to content
SafeLegalAI

72 on the record · +1 this week

explainerEU AI Act

Does the EU AI Act apply to UK law firms?

The EU AI Act can reach a UK firm when its AI output is used in the EU. What the extraterritorial scope, the AI-literacy duty, and the deferred deadlines mean.

Daman Kaur

A UK firm is outside the European Union, but the EU AI Act does not stop at the EU’s borders. It can reach a UK law firm where the output of an AI system the firm uses is used in the Union. Whether it applies is a fact-specific question about where a firm’s AI-assisted work lands, not simply about where the firm sits. This explains the test as the Regulation frames it; it is description, not advice, and each firm must map its own exposure.

The extraterritorial test

The AI Act (Regulation (EU) 2024/1689) applies to providers placing AI systems on the EU market regardless of where they are established, and — the part that matters for UK firms — to providers and deployers established in a third country “to the extent the output produced by those systems is intended to be used in the Union” (recital 22; and see Article 2). A law firm using an AI system in its practice is, in the Act’s terms, a “deployer”: a person using an AI system under its authority in the course of a professional activity.

So the question for a UK firm is not “are we in the EU?” but “is the output of our AI use used in the Union?” A firm advising an EU-based client, working on an EU matter, or producing material that feeds into proceedings or transactions in a member state can fall within scope on that basis. A firm acting only on UK matters for UK clients is more likely outside it.

What attaches if it applies

Two obligations are already live, having applied from 2 February 2025: the prohibition on the Article 5 “prohibited practices,” and the AI-literacy duty (Article 4), which requires providers and deployers to take measures to ensure a sufficient level of AI literacy among staff operating AI systems. Most legal-practice uses of general AI tools are not “high-risk” systems under the Act, so the heavier high-risk obligations will rarely bite — but where they do, they were set to apply from 2 August 2026.

That date now carries a caveat. The Digital Omnibus package, adopted by the EU co-legislators in mid-2026, would defer the high-risk dates, but as of 15 July 2026 it had not yet been published in the Official Journal and so was not in force. The milestone timeline tracks that sequence.

What a firm should actually check

The practical questions are about the firm’s own footprint: where does our AI-assisted output get used, do we have EU clients or EU-facing matters, and have we met the AI-literacy duty for the staff using these tools? Those answers, not the firm’s postcode, decide whether the Act reaches it. The scope test is genuinely fact-specific, and a firm with meaningful EU-facing work should assess it deliberately rather than assume Brexit put it out of reach.

Sources