EU AI Act: What UK Law Firms with EU Clients Must Know

The EU AI Act is not UK law. But for a significant number of UK law firms, it applies anyway. The Digital Omnibus of July 2026 changed the timetable — postponing the high-risk regime while leaving the transparency and AI literacy duties untouched — and a great many firms have misread what that means for them. Understanding which firms are in scope, which obligations apply to them, and how this interacts with the SRA and UK GDPR obligations that apply to every UK firm is now a matter of commercial and regulatory urgency.

Which UK Law Firms Are in Scope of the EU AI Act?

The EU AI Act applies on a market-based rather than location-based principle — similar to GDPR before it. A UK firm is in scope if it meets any of the following conditions:

• The firm places AI systems on the EU market — meaning it makes AI tools available to clients, staff, or third parties located in the EU
• The firm uses AI systems that produce outputs affecting individuals located in EU member states — including EU-based clients receiving AI-assisted legal advice
• The firm has offices, branches, or affiliated entities operating within EU member states
• The firm is a provider or deployer of AI systems used in connection with legal proceedings, enforcement, or the administration of justice affecting EU residents

In practice this means: any UK law firm with EU clients, EU offices, or EU-facing transactional, litigation, or advisory work should treat the EU AI Act as applicable to that portion of its business.

What the EU AI Act Requires — For Deployers

Law firms using AI tools in their practice are classified as deployers under the EU AI Act — not providers. Deployer obligations are less extensive than provider obligations but remain significant. For high-risk AI systems — which may include AI used in legal research, document analysis, or decision-support in legal proceedings — deployers must:

• Check whether a fundamental rights impact assessment applies. Article 27 does not bind every deployer of every high-risk system — it reaches bodies governed by public law, private entities providing public services, and deployers of specified Annex III systems. Establish whether your firm is in that category before assuming the obligation, or assuming it away
• Implement appropriate human oversight measures — ensuring qualified legal professionals review and take responsibility for AI-assisted outputs
• Ensure staff have adequate AI literacy — Article 4 requires deployers to ensure personnel using AI have sufficient knowledge of its capabilities, limitations, and risks
• Maintain logs of high-risk AI system use — where the system generates logs, these must be maintained for at least six months
• Report serious incidents to the relevant national authority — including malfunctions that cause or risk causing harm to EU residents
• Cooperate with market surveillance authorities on request

Is Legal AI High-Risk Under the EU AI Act?

Most firms assume the answer is yes and it usually is not. Annex III lists eight categories, and matching a category is necessary but not sufficient — the system must also perform the specific function the category text describes. Two categories are worth a firm checking properly:

• Administration of justice (Annex III, point 8(a)): the text is narrower than most summaries suggest. It catches AI "intended to be used by a judicial authority or on their behalf to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution." A firm's own research or drafting tool, used for its own client work, does not fall here. A tool deployed on behalf of a court or tribunal, or in an equivalent ADR role, does.
• Employment and workers management (Annex III, point 4): this is the one that actually catches most firms. AI used in recruitment, selection, performance evaluation, or task allocation for your own staff is in scope regardless of what your client-facing tools do.

The Deadlines — What Actually Applies, and When

The timeline changed materially in July 2026. The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since 27 July 2026 — postponed the heaviest part of the regime while leaving the obligations most firms actually feel exactly where they were.

Already in force:

• Article 4 — AI literacy. Applied since 2 February 2025. Every provider and deployer must ensure staff operating AI systems have a sufficient level of AI literacy. Not postponed.
• Article 5 — prohibited practices. Enforceable since 2 February 2025.
• Article 50 — transparency. Deployer-facing obligations applied from 2 August 2026. Not postponed.

Still ahead:

• 2 December 2026 — Article 50(2) content-marking obligations extend to systems already on the market at 2 August 2026, and the new Article 5 prohibitions take effect.
• 2 December 2027 — high-risk obligations for stand-alone Annex III systems. Moved from 2 August 2026, a sixteen-month extension.
• 2 August 2028 — high-risk obligations for AI embedded in regulated Annex I products.

For an EU-facing UK law firm, the practical reading is this. Your Article 4 and Article 50 obligations are live now and you should already be able to evidence them. Your Annex III high-risk work has until December 2027 — but the hard part of that work is finding every AI system in the firm and classifying it, and that does not get easier by waiting. Use the runway; do not shelve the programme.

What should be in place today:

• AI system inventory covering all tools used in EU-facing work
• AI literacy training delivered and documented for all staff using AI systems — Article 4, live since February 2025
• Article 50 transparency measures where AI interacts with clients or generates client-facing output
• Risk classification of each system against Annex III categories — ahead of December 2027, not after it
• Provider due diligence — EU AI Act compliance documentation from each AI tool vendor
• Human oversight protocols documented and implemented
• Incident reporting pathway established

How This Interacts with SRA and UK GDPR

UK GDPR and SRA obligations apply to every UK law firm regardless of EU exposure. The EU AI Act does not replace these — it adds to them for in-scope firms. The practical implication is that EU-facing firms must satisfy three regulatory regimes simultaneously:

• SRA Code of Conduct — competence, confidentiality, supervision. Applies now. No deadline.
• UK GDPR / ICO — data protection in AI deployments. Applies now. Actively enforced.
• EU AI Act — AI system governance for EU-facing work. Article 4 and Article 50 obligations live now; Annex III high-risk obligations from 2 December 2027.

A well-structured AI governance programme addresses all three simultaneously. Firms that build governance frameworks solely around one regime — typically the EU AI Act because it has a visible deadline — while ignoring SRA and UK GDPR are solving the wrong problem first.

Five Actions for EU-Facing UK Law Firms — Now

• Map all AI tools currently in use across your EU-facing practice areas
• Commission a risk classification assessment against EU AI Act Annex III — ahead of the 2 December 2027 deadline, not after it
• Engage your AI tool vendors to obtain EU AI Act compliance documentation — technical documentation (Article 11) and declarations of conformity (Article 47) where applicable
• Implement AI literacy training for all fee earners using AI in EU-facing work — Article 4 obligation
• Appoint an AI Governance Lead with responsibility for both EU AI Act and UK regulatory compliance