The EU AI Act: What It Means for Your Business and Your Tech

AI is finding its way into pretty much every part of running a business. It’s helping teams build products, support customers and get through the jobs that used to take an entire afternoon.

But alongside the possibilities come some pretty big questions. What are we responsible for? What should we be asking our suppliers? And how do we know the technology is doing what we think it’s doing?

The EU AI Act brings those questions into sharper focus. Getting to grips with the rules matters, but so does making sure your technology and the people using it can put them into practice.

Founders Law has been Brightbox's external legal counsel for the past few years. Today, we’re bringing together our two perspectives: the legal framework businesses need to understand, and the practical technology, skills and delivery considerations involved in putting AI to work. For growing businesses, those things increasingly need to be considered together.

1. Why should growing businesses care about the EU AI Act?

You might assume AI regulation is mainly something for the companies building the biggest models to worry about. But the EU AI Act can also affect businesses adding AI to their products or using it day to day.

Being based in the UK doesn’t automatically put you outside its reach. The Act can apply where you place AI systems on the EU market, have EU operations that use AI and to providers or deployers outside the EU where a system’s output is used in the EU. Your role and the circumstances matter.

The framework takes a risk-based approach. Certain practices are prohibited, some systems face specific transparency obligations, and high-risk systems are subject to more extensive requirements. General-purpose AI models have their own rules too.

Your starting point is to work out which requirements apply to your business, and when. The rules come into effect in stages, some are already in force, so timing needs to be part of that conversation.

As Anatol Poyer-Sleeman, Principal Counsel at Founders Law, explains:

"Parts of the AI Act are already live. Certain practices, such as using AI to infer people's emotions in the workplace, are already banned, and businesses need to think about whether their people understand the AI tools they use. But for most growing businesses the bigger risk is building or buying something that doesn't fit the rules.

"If product and engineering teams don't know where the legal lines are, you can spend months on a feature that then has to be reworked. Bringing legal input into decisions about building, buying and using AI at the start is far cheaper than retrofitting compliance later."

The stakes are real. The most serious breaches can attract fines of up to €35 million or 7% of worldwide annual turnover, and most other breaches up to €15 million or 3%. For SMEs and start-ups, the cap is the lower of the two figures. The AI Act also sits alongside existing law: in the UK, data protection law continues to regulate significant decisions about people made solely by automated means, including decisions made using AI.” To navigate those legal issues, you’ll need a clear picture of the technology. “AI-powered” might look good on a product page, but it doesn’t tell you much about what a system does, how it works or where the risks sit.

2. First, find out where you’re actually using AI

Before you can assess your responsibilities, you need to know what you’re working with.

That means looking beyond the AI features in your product. Think about third-party platforms, internal tools and anything your team has started using to make their working day a little easier.

A useful first step is to put together an inventory covering:

• What each system does and who uses it
• Who provides it and who owns it internally
• What data goes into it and where that data goes
• How its outputs influence actions or decisions
• Where it is deployed and where its outputs are used

From a legal perspective, there’s an important distinction between developing or providing a system and using one supplied by someone else. Changes to a system, its intended purpose or its branding can affect your responsibilities.

On the technical side, map the full setup: models, integrations, hosting and data flows. Giving your legal and technical teams the same picture makes it much easier to spot gaps and decide what needs attention.

3. Look at what the AI does before deciding how risky it is

Not every AI tool attracts the same obligations. The intended purpose of a system matters, as does how it is used.

Certain uses in recruitment, creditworthiness assessment of individuals and other sensitive areas can fall within the high-risk framework. Some AI used in regulated products can also qualify. Classification requires looking at the detailed criteria and any relevant exceptions.

Your legal team needs to assess the actual use case against the Act. A sector label alone won’t give you the answer, and buying from a well-known supplier doesn’t settle the question either.

Your technical team needs to understand how the system influences decisions, what happens when it gets something wrong, and whether people can spot and challenge those errors.

This is where testing matters. A polished demo can show what’s possible, but you also need to understand how the system performs with your users, your data and your actual workflows.

4. Turn the requirements into something that works in practice

Once you know which requirements are relevant, you can get into the practical detail: what needs to happen, who will do it, and how will you show it’s been done?

For high-risk systems, the framework includes requirements around matters such as risk management, documentation, record-keeping, human oversight, accuracy, robustness and cybersecurity. The allocation of obligations depends on your role.

Specific transparency rules also apply to certain AI interactions and generated content. These need their own assessment, even where a system is not high-risk.

The legal work is to identify your responsibilities and the evidence you’ll need.

The technical work is to build the controls that support them. Depending on the system, those might include version records, testing procedures, appropriate logs, user disclosures, monitoring and ways to escalate or intervene.

Human oversight deserves particular attention. If someone is expected to review an AI output, they need enough information, time and authority to question it. Simply asking them to click “approve” won’t make that review meaningful.

For high-risk systems, the data used to train, validate and test a system must be properly governed. It needs to be relevant to what the system is meant to do, sufficiently representative and, as far as possible, complete and free of errors. It also needs to be examined for biases that could lead to unfair outcomes. Most of these obligations sit with the provider. But if you're using a high-risk system and you control the data that goes into it, you need to make sure that data is relevant and sufficiently representative for how you're using it.

In practice, that means knowing where your datasets came from, how they were cleaned and labelled, and whether they reflect the people and situations the system will actually encounter. Much of this data will be personal data, so your data protection obligations still apply alongside the AI Act.

Stuart Houghton, CEO at Brightbox, explains:

“From our perspective, this isn’t just a technology or compliance challenge - it’s a people and capability challenge too. Businesses need to understand how AI is actually being used inside their organisation, make sure teams have the skills to use it responsibly, and build appropriate checks into the workflow from the outset.

"Testing, visibility and meaningful human oversight are particularly important. An AI system might perform well in a controlled demonstration, but what matters is how it behaves with your data, your users and your real business processes. The organisations that get this right will be the ones that treat AI governance as part of good technology delivery, rather than something added at the end.”

5. Ask your AI suppliers a few more questions

When you buy an AI tool, you’re relying on someone else’s technology. You still need to understand what you’re buying and what your business is responsible for.

Before you commit, ask:

• What is the system intended to do, and what are its known limitations?
• What documentation and instructions are available?
• How is our data processed, retained and protected?
• Is our data used to train or improve models?
• How are material changes communicated?
• What support is available for monitoring, incidents and compliance?

Your contract should make responsibilities clear, including access to information, change notifications and cooperation. Data protection and confidentiality need attention too: the AI Act doesn’t replace those obligations.

Then check that the technology can deliver what you need. If you’re relying on access controls, logs or the ability to switch off a feature, make sure those capabilities are actually available before you build your processes around them.

From a technology delivery perspective, supplier due diligence should also go beyond the product demonstration. Businesses should understand how the system will integrate with their existing technology, what skills will be needed to support it, how easily it can be monitored or changed, and what happens if the supplier, model or underlying technology changes. Those questions can have just as much impact on the success of an AI implementation as the features available on day one.

The same thinking applies to the people you bring in to build and run your AI systems. If you use contractors or a staff augmentation partner, ask:

• Where will the engineers be based, and does that fit where your data is allowed to go?
• How will your data be accessed and protected while they work with it?
• Who owns the IP they create?
• How are they vetted, and will they work under your AI policies and controls?
• How quickly can the team change as your AI plans do?

Many businesses use a blend: onshore people close to the business and its clients, with nearshore engineers in the EU on similar working hours. At Brightbox, this starts at scoping: understanding what a client is building and where their data needs to stay, then shaping the locations, skills and resourcing model around it, alongside their legal advisers.

6. Put a process in place that can keep up with you

As your business grows, your AI use will probably change. New tools, new features, new markets and new questions to work through.

Clear ownership makes that much easier. Bring together the people responsible for legal, product, engineering, security and the teams using AI, so everyone knows their part.

Give staff practical guidance on which tools they can use, what data they can put into them and when they need to check an output.

There is a workforce dimension to this too. AI policies are only effective if the people using the technology understand why the controls exist and have the skills to work with AI appropriately. For many businesses, that means thinking about AI capability across the organisation, not just within specialist data or engineering teams.

Brightbox is already seeing the skills organisations need begin to change. Increasingly, the question is not simply whether someone has the right technical experience, but whether they understand how to work effectively alongside AI, validate its outputs and know when human judgement needs to take over.

Review your assessment when you introduce a new use case, change a model, add an integration or enter a new market. These changes may affect both the risk profile and the legal analysis.

Build proportionate checks into the way you buy and develop technology. Keeping useful records as you go will save a lot of detective work further down the line.

Where to start

You don’t need to answer every AI governance question this week. Start by getting a clear picture of what you use and what needs attention.

You can then map your AI use, work out your role, assess the relevant requirements and timing, ask your suppliers the right questions, and give someone responsibility for closing the gaps.

Most of all, bring your legal, technology and people teams into the conversation together. Successful AI adoption will depend not only on understanding the rules, but on having the right technology, controls, skills and people in place to operate within them.

Wondering what the EU AI Act means for your business? Talk to Founders Law.

Wondering whether your approach to technology resourcing is ready to support your responsibilities? Talk to Brightbox.