EU AI Act: what it means for UK accountancy firms

The EU AI Act can apply to a UK accountancy firm with no office in the EU. It covers providers and deployers based outside the EU where the output of their AI system is used in the EU, so a UK practice using AI on work for EU clients should assume it may be in scope. The AI literacy duty has applied since 2 February 2025, and enforcement of it starts on 2 August 2026.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

What is the EU AI Act?

The AI Act is Regulation (EU) 2024/1689 of 13 June 2024, the EU law laying down harmonised rules on artificial intelligence. It entered into force on 1 August 2024 and applies in stages, with full roll out by 2 August 2028. The Act has since been amended by the Digital Omnibus on AI, which the European Commission says entered into force on 27 July 2026. The consolidated text is dated 27 July 2026, so older commentary may give dates that have since moved.

The Act sorts AI uses by risk. A small number of practices are banned outright. Some uses are classed as high risk and carry heavy obligations. Some carry only transparency duties, such as chatbots and deep fakes. The European Commission says most AI systems fall into the minimal risk group and can be used under existing law without extra obligations.

When does the Act reach a UK accountancy firm?

Article 2 sets the scope. It applies to providers placing AI systems on the EU market whether they are based in the EU or elsewhere, to deployers established or located in the EU, and, under Article 2(1)(c), to providers and deployers in a third country where the output produced by the AI system is used in the EU. A UK practice is a business in a third country for these purposes.

A deployer is a person or body using an AI system under its authority, except for personal non professional use. A provider is one that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Most firms that buy a tool and use it on client work will be deployers. A firm that builds its own tool and offers it to clients under its brand could become a provider, which carries far more obligations.

In practice the question for a UK firm is whether the output of its AI use ends up being used in the EU. Examples include AI drafted management accounts for a client in Ireland or a client facing chatbot used by customers in Spain. A firm with an office or subsidiary in an EU state is a deployer located in the EU for that office’s use.

For the wider professional duties that apply whatever the EU position, see ethics of AI use in practice and using AI in an accountancy practice.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

What are the risk categories and where do accountants fit?

Prohibited practices include social scoring for public and private purposes. High risk uses are listed in Annex III. Two of them are close to accountancy work. Point 4 covers AI used for recruitment or selection, including to analyse and filter job applications and to evaluate candidates, and AI used to make decisions on promotion or termination or to monitor and evaluate the performance and behaviour of workers. Point 5(b) covers AI used to evaluate the creditworthiness of natural persons or establish their credit score, with an exception for AI used to detect financial fraud.

A firm using AI to screen job applicants, score staff or assess an individual client’s credit is near the high risk end. Drafting letters, summarising documents or coding transactions is not in Annex III.

Date	What applies
1 August 2024	Act enters into force
2 February 2025	Definitions, AI literacy duty and prohibitions apply
2 August 2025	General purpose AI model rules and governance apply
2 August 2026	Article 50 transparency rules apply and enforcement starts, including for AI literacy
2 December 2027	High risk rules for Annex III systems apply (originally 2 August 2026)
2 August 2028	High risk rules for AI embedded in products under Annex I apply

What is the AI literacy duty?

Article 4 requires providers and deployers to take measures to support the AI literacy of their staff and other people dealing with AI systems on their behalf, which the Commission says can include contractors, service providers and clients. The measures should reflect staff knowledge, experience, training and the context in which the systems are used. The duty has applied since 2 February 2025, with supervision and enforcement from 2 August 2026.

The Commission’s guidance says the duty does not require a firm to guarantee any particular level of literacy, does not require certificates and does not require staff knowledge to be tested. Internal records of training are enough. It also says staff using ChatGPT for tasks such as drafting or translation fall within the duty and should be told about specific risks such as hallucination. Enforcement is by national market surveillance authorities, and any sanction must be proportionate.

For an accountancy firm this fits naturally into an AI policy and training log. See AI policy for an accountancy practice.

What do the transparency rules require?

Article 50 applies from 2 August 2026. Providers must design systems that interact with people so those people know they are dealing with AI, unless that is obvious. Deployers of AI that creates deep fake images, audio or video must disclose that the content is artificially generated or manipulated. Deployers of AI that generates text published to inform the public on topics of public interest must also disclose this, unless the text has been through human review or editorial control and someone holds editorial responsibility for it.

What if a firm does use a high risk system?

Article 26 sets deployer duties for high risk systems. They include using the system in line with the provider’s instructions, assigning human oversight to people with the competence, training and authority to do it, checking that input data under the firm’s control is relevant, monitoring the system and suspending use if it presents a risk, and keeping automatically generated logs for at least six months. An employer must inform workers’ representatives and affected workers before using a high risk system in the workplace, and deployers of Annex III systems that make or assist decisions about individuals must tell those individuals. For Annex III systems these duties apply from 2 December 2027.

A high risk use will usually involve personal data too, so the firm’s existing work on data protection and AI tools and client data is the starting point.

What are the penalties?

The Commission gives maximum fines of up to €35 million or 7% of worldwide annual turnover for prohibited practices or breaches of data requirements, up to €15 million or 3% for other obligations, and up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information. The higher figure applies, except for SMEs, where the lower figure applies. The Commission says the AI Act does not create criminal offences or a right to compensation; private damages claims depend on national law. Each Member State must adopt its own penalty laws.

What should a UK firm with EU clients do now?

List the AI tools in use and note which client work, if any, ends up being used in the EU.
Record AI literacy training for staff and contractors, including the risk of hallucination.
Check whether any use touches recruitment, staff monitoring or individual credit scoring.
Label website chatbots as AI and review any AI generated video or voice in marketing.
Explain AI use in engagement letters for EU clients.

Errors in AI assisted client work are a professional indemnity question as well as a regulatory one. See AI insurance for accountants.

Illustration only. A four partner firm in Bristol prepares monthly management accounts for a Dublin based client, using an AI tool to draft the commentary. The output is used in Ireland, so the firm is a third country deployer under Article 2(1)(c). The use is not in Annex III and is not public facing, so the main duty is AI literacy: the firm records a short training session for the two staff who use the tool, covering checking figures and spotting invented content.

Rules and dates under the Act have changed once already. Check the current position with an adviser qualified in the relevant EU state before relying on it.

Frequently asked questions

Does the EU AI Act apply to a UK firm with no EU clients?

If no output of its AI use is used in the EU and it has no EU establishment, Article 2 does not bring a UK firm within scope. UK duties on confidentiality and data protection still apply.

Do our staff need an AI certificate?

No. The Commission says Article 4 does not require certificates or testing. Keeping internal records of training and guidance is enough to show what the firm has done.

Is using ChatGPT to draft a client email high risk?

Not under Annex III. Drafting and summarising are not listed high risk uses. The AI literacy duty still applies to staff who use the tool on work whose output is used in the EU.

Have the high risk dates changed?

Yes. The Commission says the Digital Omnibus moved the Annex III high risk date from 2 August 2026 to 2 December 2027, and rules for AI in regulated products apply from 2 August 2028.

Using AI in your practice? Solar AI Cover brings professional indemnity, cyber and liability cover together for firms that use or build AI, and Solar Protect runs fee protection schemes for accountancy practices. See AI insurance for accountants or ask about a practice scheme.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 6 November 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.