Most UK Businesses Are Hiding Behind Brexit to Ignore AI Regulation

I've sat in boardrooms where the legal team has confidently declared that the EU AI Act is 'not our problem.' They're wrong, and it's the kind of wrong that gets expensive.

The EU AI Act works like GDPR: it applies based on where the impact is felt, not where the company is registered. If your AI system makes decisions about EU citizens — customers, employees, users — you're in scope. Any UK SaaS platform accessible in the EU. Any employer using AI in recruitment for EU-based staff. Any financial services firm with EU clients.

The organisations treating Brexit as an AI regulation exemption are the same ones that scrambled to comply with GDPR after pretending it didn't apply to them either. We've seen this film before. The ending is fines and rushed remediation.

The UK government chose sector-specific regulation over a single horizontal framework. On paper, this sounds flexible and proportionate. In practice, it's a compliance nightmare.

You've got the ICO looking at data protection implications, the FCA building AI guidance for financial services, the CMA examining competition effects, the Equality and Human Rights Commission watching for discrimination, and the AI Safety Institute doing frontier model evaluations. None of them are coordinating. None of them have the same definitions. None of them have the same enforcement timelines.

So congratulations: instead of one framework to comply with, you've got five. Instead of one regulator to satisfy, you've got a committee that doesn't talk to itself. The EU approach may be heavy-handed, but at least you know what the rules are. The UK approach is ambiguity dressed up as innovation.

I'm tired of the consulting line that 'compliance is a competitive advantage.' It isn't. Nobody ever won a deal because their AI governance documentation was better.

But non-compliance is absolutely competitive suicide. When the first major AI liability case hits — and it will — the court won't care about your innovation credentials. It will care whether you did a risk assessment, whether you documented your decision-making, whether you had human oversight on high-risk systems. If the answer is 'no, we were waiting for the regulations to be clearer,' that's not a defence. That's an admission.

The organisations that will survive the first wave of AI enforcement aren't the ones with the best compliance programmes. They're the ones that can demonstrate they thought about risk before they were forced to. The bar is lower than you think — but you still have to clear it.

The standard consultancy advice is: run an AI inventory, classify your systems, build a governance framework, appoint a responsible AI lead. It's all correct. It's also all obvious, and most of it won't get done because it's boring and nobody's accountable for it.

Here's what actually works. Pick your three highest-risk AI use cases — the ones where someone could get hurt, lose money, or get discriminated against. For those three, do a proper risk assessment. Document it. Put human oversight in place. Test the outputs for bias. That's it. Don't try to boil the ocean. Don't build a framework. Don't hire a Head of Responsible AI. Just fix the three things that could actually blow up.

Once those are handled, you'll have enough institutional knowledge to expand the programme. But the organisations that start with the framework and never get to the risk are the ones that end up in the newspaper.